1802 files changed, 34021 insertions, 13433 deletions

diff --git a/.mailmap b/.mailmap
index 67dc22ffc9a8..1d6f4e7280dc 100644
--- a/.mailmap
+++ b/.mailmap
@@ -99,6 +99,8 @@ Linas Vepstas <linas@austin.ibm.com>
 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@web.de>
 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@ascom.ch>
 Mark Brown <broonie@sirena.org.uk>
+Martin Kepplinger <martink@posteo.de> <martin.kepplinger@theobroma-systems.com>
+Martin Kepplinger <martink@posteo.de> <martin.kepplinger@ginzinger.com>
 Matthieu CASTET <castet.matthieu@free.fr>
 Mauro Carvalho Chehab <mchehab@kernel.org> <mchehab@brturbo.com.br>
 Mauro Carvalho Chehab <mchehab@kernel.org> <maurochehab@gmail.com>
@@ -171,6 +173,7 @@ Vlad Dogaru <ddvlad@gmail.com> <vlad.dogaru@intel.com>
 Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@virtuozzo.com>
 Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@parallels.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
+Yakir Yang <kuankuan.y@gmail.com> <ykk@rock-chips.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
 Gustavo Padovan <padovan@profusion.mobi>
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 986e44387dad..facc20a3f962 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -653,6 +653,9 @@
         cpuidle.off=1   [CPU_IDLE]
                         disable the cpuidle sub-system
 
+        cpufreq.off=1   [CPU_FREQ]
+                        disable the cpufreq sub-system
+
         cpu_init_udelay=N
                         [X86] Delay for N microsec between assert and de-assert
                         of APIC INIT to start processors.  This delay occurs
@@ -1183,6 +1186,12 @@
                         functions that can be changed at run time by the
                         set_graph_notrace file in the debugfs tracing directory.
 
+        ftrace_graph_max_depth=<uint>
+                        [FTRACE] Used with the function graph tracer. This is
+                        the max depth it will trace into a function. This value
+                        can be changed at run time by the max_graph_depth file
+                        in the tracefs tracing directory. default: 0 (no limit)
+
         gamecon.map[2|3]=
                         [HW,JOY] Multisystem joystick and NES/SNES/PSX pad
                         support via parallel port (up to 5 devices per port)
@@ -1716,6 +1725,12 @@
                         kernel and module base offset ASLR (Address Space
                         Layout Randomization).
 
+        kasan_multi_shot
+                        [KNL] Enforce KASAN (Kernel Address Sanitizer) to print
+                        report on every invalid memory access. Without this
+                        parameter KASAN will print report only for the first
+                        invalid access.
+
         keepinitrd      [HW,ARM]
 
         kernelcore=     [KNL,X86,IA-64,PPC]
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index a71b8095dbd8..2f66683500b8 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -68,3 +68,4 @@ stable kernels.
 |                |                 |                 |                             |
 | Qualcomm Tech. | Falkor v1       | E1003           | QCOM_FALKOR_ERRATUM_1003    |
 | Qualcomm Tech. | Falkor v1       | E1009           | QCOM_FALKOR_ERRATUM_1009    |
+| Qualcomm Tech. | QDF2400 ITS     | E0065           | QCOM_QDF2400_ERRATUM_0065   |
diff --git a/Documentation/cgroup-v2.txt b/Documentation/cgroup-v2.txt
index 3b8449f8ac7e..49d7c997fa1e 100644
--- a/Documentation/cgroup-v2.txt
+++ b/Documentation/cgroup-v2.txt
@@ -1142,16 +1142,17 @@ used by the kernel.
 
   pids.max
 
- A read-write single value file which exists on non-root cgroups.  The
- default is "max".
+        A read-write single value file which exists on non-root
+        cgroups.  The default is "max".
 
- Hard limit of number of processes.
+        Hard limit of number of processes.
 
   pids.current
 
- A read-only single value file which exists on all cgroups.
+        A read-only single value file which exists on all cgroups.
 
- The number of processes currently in the cgroup and its descendants.
+        The number of processes currently in the cgroup and its
+        descendants.
 
 Organisational operations are not blocked by cgroup policies, so it is
 possible to have pids.current > pids.max.  This can be done by either
diff --git a/Documentation/dev-tools/kcov.rst b/Documentation/dev-tools/kcov.rst
index 2c41b713841f..44886c91e112 100644
--- a/Documentation/dev-tools/kcov.rst
+++ b/Documentation/dev-tools/kcov.rst
@@ -10,7 +10,7 @@ Note that kcov does not aim to collect as much coverage as possible. It aims
 to collect more or less stable coverage that is function of syscall inputs.
 To achieve this goal it does not collect coverage in soft/hard interrupts
 and instrumentation of some inherently non-deterministic parts of kernel is
-disbled (e.g. scheduler, locking).
+disabled (e.g. scheduler, locking).
 
 Usage
 -----
diff --git a/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt b/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
index 30c546900b60..07dbb358182c 100644
--- a/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
+++ b/Documentation/devicetree/bindings/arm/marvell/cp110-system-controller0.txt
@@ -45,7 +45,7 @@ The following clocks are available:
    - 1 15       SATA
    - 1 16       SATA USB
    - 1 17       Main
-   - 1 18       SD/MMC
+   - 1 18       SD/MMC/GOP
    - 1 21       Slow IO (SPI, NOR, BootROM, I2C, UART)
    - 1 22       USB3H0
    - 1 23       USB3H1
@@ -65,7 +65,7 @@ Required properties:
         "cpm-audio", "cpm-communit", "cpm-nand", "cpm-ppv2", "cpm-sdio",
         "cpm-mg-domain", "cpm-mg-core", "cpm-xor1", "cpm-xor0", "cpm-gop-dp", "none",
         "cpm-pcie_x10", "cpm-pcie_x11", "cpm-pcie_x4", "cpm-pcie-xor", "cpm-sata",
-        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc", "none", "none", "cpm-slow-io",
+        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc-gop", "none", "none", "cpm-slow-io",
         "cpm-usb3h0", "cpm-usb3h1", "cpm-usb3dev", "cpm-eip150", "cpm-eip197";
 
 Example:
@@ -78,6 +78,6 @@ Example:
                 gate-clock-output-names = "cpm-audio", "cpm-communit", "cpm-nand", "cpm-ppv2", "cpm-sdio",
                         "cpm-mg-domain", "cpm-mg-core", "cpm-xor1", "cpm-xor0", "cpm-gop-dp", "none",
                         "cpm-pcie_x10", "cpm-pcie_x11", "cpm-pcie_x4", "cpm-pcie-xor", "cpm-sata",
-                        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc", "none", "none", "cpm-slow-io",
+                        "cpm-sata-usb", "cpm-main", "cpm-sd-mmc-gop", "none", "none", "cpm-slow-io",
                         "cpm-usb3h0", "cpm-usb3h1", "cpm-usb3dev", "cpm-eip150", "cpm-eip197";
         };
diff --git a/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt b/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
index a78265993665..ca5204b3bc21 100644
--- a/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
+++ b/Documentation/devicetree/bindings/display/exynos/exynos_dsim.txt
@@ -4,7 +4,6 @@ Required properties:
   - compatible: value should be one of the following
                 "samsung,exynos3250-mipi-dsi" /* for Exynos3250/3472 SoCs */
                 "samsung,exynos4210-mipi-dsi" /* for Exynos4 SoCs */
-                "samsung,exynos4415-mipi-dsi" /* for Exynos4415 SoC */
                 "samsung,exynos5410-mipi-dsi" /* for Exynos5410/5420/5440 SoCs */
                 "samsung,exynos5422-mipi-dsi" /* for Exynos5422/5800 SoCs */
                 "samsung,exynos5433-mipi-dsi" /* for Exynos5433 SoCs */
diff --git a/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt b/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
index 18645e0228b0..5837402c3ade 100644
--- a/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
+++ b/Documentation/devicetree/bindings/display/exynos/samsung-fimd.txt
@@ -11,7 +11,6 @@ Required properties:
                 "samsung,s5pv210-fimd"; /* for S5PV210 SoC */
                 "samsung,exynos3250-fimd"; /* for Exynos3250/3472 SoCs */
                 "samsung,exynos4210-fimd"; /* for Exynos4 SoCs */
-                "samsung,exynos4415-fimd"; /* for Exynos4415 SoC */
                 "samsung,exynos5250-fimd"; /* for Exynos5250 SoCs */
                 "samsung,exynos5420-fimd"; /* for Exynos5420/5422/5800 SoCs */
 
diff --git a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
index ea9c1c9607f6..520d61dad6dd 100644
--- a/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
+++ b/Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.txt
@@ -13,7 +13,7 @@ Required Properties:
         - "rockchip,rk2928-dw-mshc": for Rockchip RK2928 and following,
                                                         before RK3288
         - "rockchip,rk3288-dw-mshc": for Rockchip RK3288
-        - "rockchip,rk1108-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK1108
+        - "rockchip,rv1108-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RV1108
         - "rockchip,rk3036-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3036
         - "rockchip,rk3368-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3368
         - "rockchip,rk3399-dw-mshc", "rockchip,rk3288-dw-mshc": for Rockchip RK3399
diff --git a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
index b7fa3b97986d..a339dbb15493 100644
--- a/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
+++ b/Documentation/devicetree/bindings/pci/hisilicon-pcie.txt
@@ -44,13 +44,19 @@ Hip05 Example (note that Hip06 is the same except compatible):
         };
 
 HiSilicon Hip06/Hip07 PCIe host bridge DT (almost-ECAM) description.
+
+Some BIOSes place the host controller in a mode where it is ECAM
+compliant for all devices other than the root complex. In such cases,
+the host controller should be described as below.
+
 The properties and their meanings are identical to those described in
 host-generic-pci.txt except as listed below.
 
 Properties of the host controller node that differ from
 host-generic-pci.txt:
 
-- compatible     : Must be "hisilicon,pcie-almost-ecam"
+- compatible     : Must be "hisilicon,hip06-pcie-ecam", or
+                   "hisilicon,hip07-pcie-ecam"
 
 - reg            : Two entries: First the ECAM configuration space for any
                    other bus underneath the root bus. Second, the base
@@ -59,7 +65,7 @@ host-generic-pci.txt:
 
 Example:
         pcie0: pcie@a0090000 {
-                compatible = "hisilicon,pcie-almost-ecam";
+                compatible = "hisilicon,hip06-pcie-ecam";
                 reg = <0 0xb0000000 0 0x2000000>,  /*  ECAM configuration space */
                       <0 0xa0090000 0 0x10000>; /* host bridge registers */
                 bus-range = <0  31>;
diff --git a/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt b/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt
deleted file mode 100644
index e68ae5dec9c9..000000000000
--- a/Documentation/devicetree/bindings/phy/brcm,nsp-usb3-phy.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Broadcom USB3 phy binding for northstar plus SoC
-The USB3 phy is internal to the SoC and is accessed using mdio interface.
-
-Required mdio bus properties:
-- reg: Should be 0x0 for SoC internal USB3 phy
-- #address-cells: must be 1
-- #size-cells: must be 0
-
-Required USB3 PHY properties:
-- compatible: should be "brcm,nsp-usb3-phy"
-- reg: USB3 Phy address on SoC internal MDIO bus and it should be 0x10.
-- usb3-ctrl-syscon: handler of syscon node defining physical address
-  of usb3 control register.
-- #phy-cells: must be 0
-
-Required usb3 control properties:
-- compatible: should be "brcm,nsp-usb3-ctrl"
-- reg: offset and length of the control registers
-
-Example:
-
-        mdio@0 {
-                reg = <0x0>;
-                #address-cells = <1>;
-                #size-cells = <0>;
-
-                usb3_phy: usb-phy@10 {
-                        compatible = "brcm,nsp-usb3-phy";
-                        reg = <0x10>;
-                        usb3-ctrl-syscon = <&usb3_ctrl>;
-                        #phy-cells = <0>;
-                        status = "disabled";
-                };
-        };
-
-        usb3_ctrl: syscon@104408 {
-                compatible = "brcm,nsp-usb3-ctrl", "syscon";
-                reg = <0x104408 0x3fc>;
-        };
diff --git a/Documentation/devicetree/bindings/powerpc/4xx/emac.txt b/Documentation/devicetree/bindings/powerpc/4xx/emac.txt
index 712baf6c3e24..44b842b6ca15 100644
--- a/Documentation/devicetree/bindings/powerpc/4xx/emac.txt
+++ b/Documentation/devicetree/bindings/powerpc/4xx/emac.txt
@@ -71,6 +71,9 @@
                           For Axon it can be absent, though my current driver
                           doesn't handle phy-address yet so for now, keep
                           0x00ffffff in it.
+    - phy-handle        : Used to describe configurations where a external PHY
+                          is used. Please refer to:
+                          Documentation/devicetree/bindings/net/ethernet.txt
     - rx-fifo-size-gige : 1 cell, Rx fifo size in bytes for 1000 Mb/sec
                           operations (if absent the value is the same as
                           rx-fifo-size).  For Axon, either absent or 2048.
@@ -81,8 +84,22 @@
                           offload, phandle of the TAH device node.
     - tah-channel       : 1 cell, optional. If appropriate, channel used on the
                           TAH engine.
+    - fixed-link        : Fixed-link subnode describing a link to a non-MDIO
+                          managed entity. See
+                          Documentation/devicetree/bindings/net/fixed-link.txt
+                          for details.
+    - mdio subnode      : When the EMAC has a phy connected to its local
+                          mdio, which us supported by the kernel's network
+                          PHY library in drivers/net/phy, there must be device
+                          tree subnode with the following required properties:
+                                - #address-cells: Must be <1>.
+                                - #size-cells: Must be <0>.
 
-    Example:
+                          For PHY definitions: Please refer to
+                          Documentation/devicetree/bindings/net/phy.txt and
+                          Documentation/devicetree/bindings/net/ethernet.txt
+
+    Examples:
 
         EMAC0: ethernet@40000800 {
                 device_type = "network";
@@ -104,6 +121,48 @@
                 zmii-channel = <0>;
         };
 
+        EMAC1: ethernet@ef600c00 {
+                device_type = "network";
+                compatible = "ibm,emac-apm821xx", "ibm,emac4sync";
+                interrupt-parent = <&EMAC1>;
+                interrupts = <0 1>;
+                #interrupt-cells = <1>;
+                #address-cells = <0>;
+                #size-cells = <0>;
+                interrupt-map = <0 &UIC2 0x10 IRQ_TYPE_LEVEL_HIGH /* Status */
+                                 1 &UIC2 0x14 IRQ_TYPE_LEVEL_HIGH /* Wake */>;
+                reg = <0xef600c00 0x000000c4>;
+                local-mac-address = [000000000000]; /* Filled in by U-Boot */
+                mal-device = <&MAL0>;
+                mal-tx-channel = <0>;
+                mal-rx-channel = <0>;
+                cell-index = <0>;
+                max-frame-size = <9000>;
+                rx-fifo-size = <16384>;
+                tx-fifo-size = <2048>;
+                fifo-entry-size = <10>;
+                phy-mode = "rgmii";
+                phy-handle = <&phy0>;
+                phy-map = <0x00000000>;
+                rgmii-device = <&RGMII0>;
+                rgmii-channel = <0>;
+                tah-device = <&TAH0>;
+                tah-channel = <0>;
+                has-inverted-stacr-oc;
+                has-new-stacr-staopc;
+
+                mdio {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        phy0: ethernet-phy@0 {
+                                compatible = "ethernet-phy-ieee802.3-c22";
+                                reg = <0>;
+                        };
+                };
+        };
+
+
       ii) McMAL node
 
     Required properties:
@@ -145,4 +204,3 @@
     - revision           : as provided by the RGMII new version register if
                            available.
                            For Axon: 0x0000012a
-
diff --git a/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt b/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt
index c3f6546ebac7..6a23ad9ac53a 100644
--- a/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt
+++ b/Documentation/devicetree/bindings/regulator/ti-abb-regulator.txt
@@ -45,7 +45,7 @@ Required Properties:
 Optional Properties:
 - reg-names: In addition to the required properties, the following are optional
   - "efuse-address"     - Contains efuse base address used to pick up ABB info.
-  - "ldo-address"       - Contains address of ABB LDO overide register address.
+  - "ldo-address"       - Contains address of ABB LDO override register.
         "efuse-address" is required for this.
 - ti,ldovbb-vset-mask   - Required if ldo-address is set, mask for LDO override
         register to provide override vset value.
diff --git a/Documentation/devicetree/bindings/rng/omap_rng.txt b/Documentation/devicetree/bindings/rng/omap_rng.txt
index 471477299ece..9cf7876ab434 100644
--- a/Documentation/devicetree/bindings/rng/omap_rng.txt
+++ b/Documentation/devicetree/bindings/rng/omap_rng.txt
@@ -12,7 +12,8 @@ Required properties:
 - reg : Offset and length of the register set for the module
 - interrupts : the interrupt number for the RNG module.
                 Used for "ti,omap4-rng" and "inside-secure,safexcel-eip76"
-- clocks: the trng clock source
+- clocks: the trng clock source. Only mandatory for the
+  "inside-secure,safexcel-eip76" compatible.
 
 Example:
 /* AM335x */
diff --git a/Documentation/devicetree/bindings/sound/cs35l35.txt b/Documentation/devicetree/bindings/sound/cs35l35.txt
new file mode 100644
index 000000000000..016b768bc722
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/cs35l35.txt
@@ -0,0 +1,180 @@
+CS35L35 Boosted Speaker Amplifier
+
+Required properties:
+
+  - compatible : "cirrus,cs35l35"
+
+  - reg : the I2C address of the device for I2C
+
+  - VA-supply, VP-supply : power supplies for the device,
+    as covered in
+    Documentation/devicetree/bindings/regulator/regulator.txt.
+
+  - interrupt-parent : Specifies the phandle of the interrupt controller to
+    which the IRQs from CS35L35 are delivered to.
+  - interrupts : IRQ line info CS35L35.
+    (See Documentation/devicetree/bindings/interrupt-controller/interrupts.txt
+    for further information relating to interrupt properties)
+
+Optional properties:
+  - reset-gpios : gpio used to reset the amplifier
+
+  - cirrus,stereo-config : Boolean to determine if there are 2 AMPs for a
+  Stereo configuration
+
+  - cirrus,audio-channel : Set Location of Audio Signal on Serial Port
+  0 = Data Packet received on Left I2S Channel
+  1 = Data Packet received on Right I2S Channel
+
+  - cirrus,advisory-channel : Set Location of Advisory Signal on Serial Port
+  0 = Data Packet received on Left I2S Channel
+  1 = Data Packet received on Right I2S Channel
+
+  - cirrus,shared-boost : Boolean to enable ClassH tracking of Advisory Signal
+  if 2 Devices share Boost BST_CTL
+
+  - cirrus,external-boost : Boolean to specify the device is using an external
+  boost supply, note that sharing a boost from another cs35l35 would constitute
+  using an external supply for the slave device
+
+  - cirrus,sp-drv-strength : Value for setting the Serial Port drive strength
+  Table 3-10 of the datasheet lists drive-strength specifications
+  0 = 1x (Default)
+  1 = .5x
+  - cirrus,sp-drv-unused : Determines how unused slots should be driven on the
+  Serial Port.
+  0 - Hi-Z
+  2 - Drive 0's (Default)
+  3 - Drive 1's
+
+  - cirrus,bst-pdn-fet-on : Boolean to determine if the Boost PDN control
+  powers down with a rectification FET On or Off. If VSPK is supplied
+  externally then FET is off.
+
+  - cirrus,boost-ctl-millivolt : Boost Voltage Value.  Configures the boost
+    converter's output voltage in mV. The range is from 2600mV to 9000mV with
+    increments of 100mV.
+    (Default) VP
+
+  - cirrus,boost-peak-milliamp : Boost-converter peak current limit in mA.
+  Configures the peak current by monitoring the current through the boost FET.
+  Range starts at 1680mA and goes to a maximum of 4480mA with increments of
+  110mA.
+  (Default) 2.46 Amps
+
+  - cirrus,amp-gain-zc : Boolean to determine if to use Amplifier gain-change
+  zero-cross
+
+Optional H/G Algorithm sub-node:
+
+  The cs35l35 node can have a single "cirrus,classh-internal-algo" sub-node
+  that will disable automatic control of the internal H/G Algorithm.
+
+  It is strongly recommended that the Datasheet be referenced when adjusting
+  or using these Class H Algorithm controls over the internal Algorithm.
+  Serious damage can occur to the Device and surrounding components.
+
+  - cirrus,classh-internal-algo : Sub-node for the Internal Class H Algorithm
+  See Section 4.3 Internal Class H Algorithm in the Datasheet.
+  If not used, the device manages the ClassH Algorithm internally.
+
+Optional properties for the "cirrus,classh-internal-algo" Sub-node
+
+  Section 7.29 Class H Control
+  - cirrus,classh-bst-overide : Boolean
+  - cirrus,classh-bst-max-limit
+  - cirrus,classh-mem-depth
+
+  Section 7.30 Class H Headroom Control
+  - cirrus,classh-headroom
+
+  Section 7.31 Class H Release Rate
+  - cirrus,classh-release-rate
+
+  Section 7.32 Class H Weak FET Drive Control
+  - cirrus,classh-wk-fet-disable
+  - cirrus,classh-wk-fet-delay
+  - cirrus,classh-wk-fet-thld
+
+  Section 7.34 Class H VP Control
+  - cirrus,classh-vpch-auto
+  - cirrus,classh-vpch-rate
+  - cirrus,classh-vpch-man
+
+Optional Monitor Signal Format sub-node:
+
+  The cs35l35 node can have a single "cirrus,monitor-signal-format" sub-node
+  for adjusting the Depth, Location and Frame of the Monitoring Signals
+  for Algorithms.
+
+  See Sections 4.8.2 through 4.8.4 Serial-Port Control in the Datasheet
+
+  -cirrus,monitor-signal-format : Sub-node for the Monitor Signaling Formating
+  on the I2S Port. Each of the 3 8 bit values in the array contain the settings
+  for depth, location, and frame.
+
+  If not used, the defaults for the 6 monitor signals is used.
+
+  Sections 7.44 - 7.53 lists values for the depth, location, and frame
+  for each monitoring signal.
+
+  - cirrus,imon : 4 8 bit values to set the depth, location, frame and ADC
+  scale of the IMON monitor signal.
+
+  - cirrus,vmon : 3 8 bit values to set the depth, location, and frame
+  of the VMON monitor signal.
+
+  - cirrus,vpmon : 3 8 bit values to set the depth, location, and frame
+  of the VPMON monitor signal.
+
+  - cirrus,vbstmon : 3 8 bit values to set the depth, location, and frame
+  of the VBSTMON monitor signal
+
+  - cirrus,vpbrstat : 3 8 bit values to set the depth, location, and frame
+  of the VPBRSTAT monitor signal
+
+  - cirrus,zerofill : 3 8 bit values to set the depth, location, and frame\
+  of the ZEROFILL packet in the monitor signal
+
+Example:
+
+cs35l35: cs35l35@20 {
+        compatible = "cirrus,cs35l35";
+        reg = <0x20>;
+        VA-supply = <&dummy_vreg>;
+        VP-supply = <&dummy_vreg>;
+        reset-gpios = <&axi_gpio 54 0>;
+        interrupt-parent = <&gpio8>;
+        interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+        cirrus,boost-ctl-millivolt = <9000>;
+
+        cirrus,stereo-config;
+        cirrus,audio-channel = <0x00>;
+        cirrus,advisory-channel = <0x01>;
+        cirrus,shared-boost;
+
+        cirrus,classh-internal-algo {
+                cirrus,classh-bst-overide;
+                cirrus,classh-bst-max-limit = <0x01>;
+                cirrus,classh-mem-depth = <0x01>;
+                cirrus,classh-release-rate = <0x08>;
+                cirrus,classh-headroom-millivolt = <0x0B>;
+                cirrus,classh-wk-fet-disable = <0x01>;
+                cirrus,classh-wk-fet-delay = <0x04>;
+                cirrus,classh-wk-fet-thld = <0x01>;
+                cirrus,classh-vpch-auto = <0x01>;
+                cirrus,classh-vpch-rate = <0x02>;
+                cirrus,classh-vpch-man = <0x05>;
+        };
+
+        /* Depth, Location, Frame */
+        cirrus,monitor-signal-format {
+                cirrus,imon = /bits/ 8 <0x03 0x00 0x01>;
+                cirrus,vmon = /bits/ 8 <0x03 0x00 0x00>;
+                cirrus,vpmon = /bits/ 8 <0x03 0x04 0x00>;
+                cirrus,vbstmon = /bits/ 8 <0x03 0x04 0x01>;
+                cirrus,vpbrstat = /bits/ 8 <0x00 0x04 0x00>;
+                cirrus,zerofill = /bits/ 8 <0x00 0x00 0x00>;
+        };
+
+};
diff --git a/Documentation/devicetree/bindings/sound/dioo,dio2125.txt b/Documentation/devicetree/bindings/sound/dioo,dio2125.txt
new file mode 100644
index 000000000000..63dbfe0f11d0
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/dioo,dio2125.txt
@@ -0,0 +1,12 @@
+DIO2125 Audio Driver
+
+Required properties:
+- compatible : "dioo,dio2125"
+- enable-gpios : the gpio connected to the enable pin of the dio2125
+
+Example:
+
+amp: analog-amplifier {
+        compatible = "dioo,dio2125";
+        enable-gpios = <&gpio GPIOH_3 0>;
+};
diff --git a/Documentation/devicetree/bindings/sound/everest,es7134.txt b/Documentation/devicetree/bindings/sound/everest,es7134.txt
new file mode 100644
index 000000000000..5495a3cb8b7b
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/everest,es7134.txt
@@ -0,0 +1,10 @@
+ES7134 i2s DA converter
+
+Required properties:
+- compatible : "everest,es7134" or "everest,es7144"
+
+Example:
+
+i2s_codec: external-codec {
+        compatible = "everest,es7134";
+};
diff --git a/Documentation/devicetree/bindings/sound/fsl,ssi.txt b/Documentation/devicetree/bindings/sound/fsl,ssi.txt
index 5b76be45d18b..d415888e1316 100644
--- a/Documentation/devicetree/bindings/sound/fsl,ssi.txt
+++ b/Documentation/devicetree/bindings/sound/fsl,ssi.txt
@@ -20,24 +20,8 @@ Required properties:
                     have.
 - interrupt-parent: The phandle for the interrupt controller that
                     services interrupts for this device.
-- fsl,playback-dma: Phandle to a node for the DMA channel to use for
-                    playback of audio.  This is typically dictated by SOC
-                    design.  See the notes below.
-- fsl,capture-dma:  Phandle to a node for the DMA channel to use for
-                    capture (recording) of audio.  This is typically dictated
-                    by SOC design.  See the notes below.
 - fsl,fifo-depth:   The number of elements in the transmit and receive FIFOs.
                     This number is the maximum allowed value for SFCSR[TFWM0].
-- fsl,ssi-asynchronous:
-                    If specified, the SSI is to be programmed in asynchronous
-                    mode.  In this mode, pins SRCK, STCK, SRFS, and STFS must
-                    all be connected to valid signals.  In synchronous mode,
-                    SRCK and SRFS are ignored.  Asynchronous mode allows
-                    playback and capture to use different sample sizes and
-                    sample rates.  Some drivers may require that SRCK and STCK
-                    be connected together, and SRFS and STFS be connected
-                    together.  This would still allow different sample sizes,
-                    but not different sample rates.
  - clocks:          "ipg" - Required clock for the SSI unit
                     "baud" - Required clock for SSI master mode. Otherwise this
                       clock is not used
@@ -61,6 +45,24 @@ Optional properties:
 - fsl,mode:         The operating mode for the AC97 interface only.
                     "ac97-slave" - AC97 mode, SSI is clock slave
                     "ac97-master" - AC97 mode, SSI is clock master
+- fsl,ssi-asynchronous:
+                    If specified, the SSI is to be programmed in asynchronous
+                    mode.  In this mode, pins SRCK, STCK, SRFS, and STFS must
+                    all be connected to valid signals.  In synchronous mode,
+                    SRCK and SRFS are ignored.  Asynchronous mode allows
+                    playback and capture to use different sample sizes and
+                    sample rates.  Some drivers may require that SRCK and STCK
+                    be connected together, and SRFS and STFS be connected
+                    together.  This would still allow different sample sizes,
+                    but not different sample rates.
+- fsl,playback-dma: Phandle to a node for the DMA channel to use for
+                    playback of audio.  This is typically dictated by SOC
+                    design.  See the notes below.
+                    Only used on Power Architecture.
+- fsl,capture-dma:  Phandle to a node for the DMA channel to use for
+                    capture (recording) of audio.  This is typically dictated
+                    by SOC design.  See the notes below.
+                    Only used on Power Architecture.
 
 Child 'codec' node required properties:
 - compatible:       Compatible list, contains the name of the codec
diff --git a/Documentation/devicetree/bindings/sound/hisilicon,hi6210-i2s.txt b/Documentation/devicetree/bindings/sound/hisilicon,hi6210-i2s.txt
new file mode 100644
index 000000000000..7a296784eb37
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/hisilicon,hi6210-i2s.txt
@@ -0,0 +1,42 @@
+* Hisilicon 6210 i2s controller
+
+Required properties:
+
+- compatible: should be one of the following:
+   - "hisilicon,hi6210-i2s"
+- reg: physical base address of the i2s controller unit and length of
+   memory mapped region.
+- interrupts: should contain the i2s interrupt.
+- clocks: a list of phandle + clock-specifier pairs, one for each entry
+  in clock-names.
+- clock-names: should contain following:
+   - "dacodec"
+   - "i2s-base"
+- dmas: DMA specifiers for tx dma. See the DMA client binding,
+  Documentation/devicetree/bindings/dma/dma.txt
+- dma-names: should be "tx" and "rx"
+- hisilicon,sysctrl-syscon: phandle to sysctrl syscon
+- #sound-dai-cells: Should be set to 1 (for multi-dai)
+   - The dai cell indexes reference the following interfaces:
+       0: S2 interface
+       (Currently that is the only one available, but more may be
+        supported in the future)
+
+Example for the hi6210 i2s controller:
+
+i2s0: i2s@f7118000{
+        compatible = "hisilicon,hi6210-i2s";
+        reg = <0x0 0xf7118000 0x0 0x8000>; /* i2s unit */
+        interrupts = <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>; /* 155 "DigACodec_intr"-32 */
+        clocks = <&sys_ctrl HI6220_DACODEC_PCLK>,
+                 <&sys_ctrl HI6220_BBPPLL0_DIV>;
+        clock-names = "dacodec", "i2s-base";
+        dmas = <&dma0 15 &dma0 14>;
+        dma-names = "rx", "tx";
+        hisilicon,sysctrl-syscon = <&sys_ctrl>;
+        #sound-dai-cells = <1>;
+};
+
+Then when referencing the i2s controller:
+        sound-dai = <&i2s0 0>; /* index 0 => S2 interface */
+
diff --git a/Documentation/devicetree/bindings/sound/max98925.txt b/Documentation/devicetree/bindings/sound/max98925.txt
deleted file mode 100644
index 27be63e2aa0d..000000000000
--- a/Documentation/devicetree/bindings/sound/max98925.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-max98925 audio CODEC
-
-This device supports I2C.
-
-Required properties:
-
-  - compatible : "maxim,max98925"
-
-  - vmon-slot-no : slot number used to send voltage information
-
-  - imon-slot-no : slot number used to send current information
-
-  - reg : the I2C address of the device for I2C
-
-Example:
-
-codec: max98925@1a {
-        compatible = "maxim,max98925";
-        vmon-slot-no = <0>;
-        imon-slot-no = <2>;
-        reg = <0x1a>;
-};
diff --git a/Documentation/devicetree/bindings/sound/max98926.txt b/Documentation/devicetree/bindings/sound/max98926.txt
deleted file mode 100644
index 0b7f4e4d5f9a..000000000000
--- a/Documentation/devicetree/bindings/sound/max98926.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-max98926 audio CODEC
-
-This device supports I2C.
-
-Required properties:
-
-  - compatible : "maxim,max98926"
-
-  - vmon-slot-no : slot number used to send voltage information
-                   or in inteleave mode this will be used as
-                   interleave slot.
-
-  - imon-slot-no : slot number used to send current information
-
-  - interleave-mode : When using two MAX98926 in a system it is
-                      possible to create ADC data that that will
-                      overflow the frame size. Digital Audio Interleave
-                      mode provides a means to output VMON and IMON data
-                      from two devices on a single DOUT line when running
-                      smaller frames sizes such as 32 BCLKS per LRCLK or
-                      48 BCLKS per LRCLK.
-
-  - reg : the I2C address of the device for I2C
-
-Example:
-
-codec: max98926@1a {
-   compatible = "maxim,max98926";
-   vmon-slot-no = <0>;
-   imon-slot-no = <2>;
-   reg = <0x1a>;
-};
diff --git a/Documentation/devicetree/bindings/sound/max9892x.txt b/Documentation/devicetree/bindings/sound/max9892x.txt
new file mode 100644
index 000000000000..f6171591ddc6
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/max9892x.txt
@@ -0,0 +1,41 @@
+Maxim Integrated MAX98925/MAX98926/MAX98927 Speaker Amplifier
+
+This device supports I2C.
+
+Required properties:
+
+  - compatible : should be one of the following
+    - "maxim,max98925"
+    - "maxim,max98926"
+    - "maxim,max98927"
+
+  - vmon-slot-no : slot number used to send voltage information
+                   or in inteleave mode this will be used as
+                   interleave slot.
+                   MAX98925/MAX98926 slot range : 0 ~ 30,  Default : 0
+                   MAX98927 slot range : 0 ~ 15,  Default : 0
+
+  - imon-slot-no : slot number used to send current information
+                   MAX98925/MAX98926 slot range : 0 ~ 30,  Default : 0
+                   MAX98927 slot range : 0 ~ 15,  Default : 0
+
+  - interleave-mode : When using two MAX9892X in a system it is
+                   possible to create ADC data that that will
+                   overflow the frame size. Digital Audio Interleave
+                   mode provides a means to output VMON and IMON data
+                   from two devices on a single DOUT line when running
+                   smaller frames sizes such as 32 BCLKS per LRCLK or
+                   48 BCLKS per LRCLK.
+                   Range : 0 (off), 1 (on),  Default : 0
+
+  - reg : the I2C address of the device for I2C
+
+Example:
+
+codec: max98927@3a {
+   compatible = "maxim,max98927";
+   vmon-slot-no = <0>;
+   imon-slot-no = <1>;
+   interleave-mode = <0>;
+   reg = <0x3a>;
+};
diff --git a/Documentation/devicetree/bindings/sound/mt2701-wm8960.txt b/Documentation/devicetree/bindings/sound/mt2701-wm8960.txt
new file mode 100644
index 000000000000..809b609ea9d0
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/mt2701-wm8960.txt
@@ -0,0 +1,24 @@
+MT2701 with WM8960 CODEC
+
+Required properties:
+- compatible: "mediatek,mt2701-wm8960-machine"
+- mediatek,platform: the phandle of MT2701 ASoC platform
+- audio-routing: a list of the connections between audio
+- mediatek,audio-codec: the phandles of wm8960 codec
+- pinctrl-names: Should contain only one value - "default"
+- pinctrl-0: Should specify pin control groups used for this controller.
+
+Example:
+
+        sound:sound {
+                compatible = "mediatek,mt2701-wm8960-machine";
+                mediatek,platform = <&afe>;
+                audio-routing =
+                        "Headphone", "HP_L",
+                        "Headphone", "HP_R",
+                        "LINPUT1", "AMIC",
+                        "RINPUT1", "AMIC";
+                mediatek,audio-codec = <&wm8960>;
+                pinctrl-names = "default";
+                pinctrl-0 = <&aud_pins_default>;
+        };
diff --git a/Documentation/devicetree/bindings/sound/nau8824.txt b/Documentation/devicetree/bindings/sound/nau8824.txt
new file mode 100644
index 000000000000..e0058b97e49a
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/nau8824.txt
@@ -0,0 +1,88 @@
+Nuvoton NAU8824 audio codec
+
+This device supports I2C only.
+
+Required properties:
+  - compatible : Must be "nuvoton,nau8824"
+
+  - reg : the I2C address of the device. This is either 0x1a (CSB=0) or 0x1b (CSB=1).
+
+Optional properties:
+  - nuvoton,jkdet-polarity: JKDET pin polarity. 0 - active high, 1 - active low.
+
+  - nuvoton,vref-impedance: VREF Impedance selection
+      0 - Open
+      1 - 25 kOhm
+      2 - 125 kOhm
+      3 - 2.5 kOhm
+
+  - nuvoton,micbias-voltage: Micbias voltage level.
+      0 - VDDA
+      1 - VDDA
+      2 - VDDA * 1.1
+      3 - VDDA * 1.2
+      4 - VDDA * 1.3
+      5 - VDDA * 1.4
+      6 - VDDA * 1.53
+      7 - VDDA * 1.53
+
+  - nuvoton,sar-threshold-num: Number of buttons supported
+  - nuvoton,sar-threshold: Impedance threshold for each button. Array that contains up to 8 buttons configuration. SAR value is calculated as
+    SAR = 255 * MICBIAS / SAR_VOLTAGE * R / (2000 + R)
+    where MICBIAS is configured by 'nuvoton,micbias-voltage', SAR_VOLTAGE is configured by 'nuvoton,sar-voltage', R - button impedance.
+    Refer datasheet section 10.2 for more information about threshold calculation.
+
+  - nuvoton,sar-hysteresis: Button impedance measurement hysteresis.
+
+  - nuvoton,sar-voltage: Reference voltage for button impedance measurement.
+      0 - VDDA
+      1 - VDDA
+      2 - VDDA * 1.1
+      3 - VDDA * 1.2
+      4 - VDDA * 1.3
+      5 - VDDA * 1.4
+      6 - VDDA * 1.53
+      7 - VDDA * 1.53
+
+  - nuvoton,sar-compare-time: SAR compare time
+      0 - 500 ns
+      1 - 1 us
+      2 - 2 us
+      3 - 4 us
+
+  - nuvoton,sar-sampling-time: SAR sampling time
+      0 - 2 us
+      1 - 4 us
+      2 - 8 us
+      3 - 16 us
+
+  - nuvoton,short-key-debounce: Button short key press debounce time.
+      0 - 30 ms
+      1 - 50 ms
+      2 - 100 ms
+
+  - nuvoton,jack-eject-debounce: Jack ejection debounce time.
+      0 - 0 ms
+      1 - 1 ms
+      2 - 10 ms
+
+
+Example:
+
+  headset: nau8824@1a {
+      compatible = "nuvoton,nau8824";
+      reg = <0x1a>;
+      interrupt-parent = <&gpio>;
+      interrupts = <TEGRA_GPIO(E, 6) IRQ_TYPE_LEVEL_LOW>;
+      nuvoton,vref-impedance = <2>;
+      nuvoton,micbias-voltage = <6>;
+      // Setup 4 buttons impedance according to Android specification
+      nuvoton,sar-threshold-num = <4>;
+      nuvoton,sar-threshold = <0xc 0x1e 0x38 0x60>;
+      nuvoton,sar-hysteresis = <0>;
+      nuvoton,sar-voltage = <6>;
+      nuvoton,sar-compare-time = <1>;
+      nuvoton,sar-sampling-time = <1>;
+      nuvoton,short-key-debounce = <0>;
+      nuvoton,jack-eject-debounce = <1>;
+  };
diff --git a/Documentation/devicetree/bindings/usb/usb251xb.txt b/Documentation/devicetree/bindings/usb/usb251xb.txt
index 0c065f77658f..3957d4edaa74 100644
--- a/Documentation/devicetree/bindings/usb/usb251xb.txt
+++ b/Documentation/devicetree/bindings/usb/usb251xb.txt
@@ -7,18 +7,18 @@ Required properties :
  - compatible : Should be "microchip,usb251xb" or one of the specific types:
         "microchip,usb2512b", "microchip,usb2512bi", "microchip,usb2513b",
         "microchip,usb2513bi", "microchip,usb2514b", "microchip,usb2514bi"
- - hub-reset-gpios : Should specify the gpio for hub reset
+ - reset-gpios : Should specify the gpio for hub reset
+ - reg : I2C address on the selected bus (default is <0x2C>)
 
 Optional properties :
- - reg : I2C address on the selected bus (default is <0x2C>)
  - skip-config : Skip Hub configuration, but only send the USB-Attach command
- - vendor-id : USB Vendor ID of the hub (16 bit, default is 0x0424)
- - product-id : USB Product ID of the hub (16 bit, default depends on type)
- - device-id : USB Device ID of the hub (16 bit, default is 0x0bb3)
- - language-id : USB Language ID (16 bit, default is 0x0000)
- - manufacturer : USB Manufacturer string (max 31 characters long)
- - product : USB Product string (max 31 characters long)
- - serial : USB Serial string (max 31 characters long)
+ - vendor-id : Set USB Vendor ID of the hub (16 bit, default is 0x0424)
+ - product-id : Set USB Product ID of the hub (16 bit, default depends on type)
+ - device-id : Set USB Device ID of the hub (16 bit, default is 0x0bb3)
+ - language-id : Set USB Language ID (16 bit, default is 0x0000)
+ - manufacturer : Set USB Manufacturer string (max 31 characters long)
+ - product : Set USB Product string (max 31 characters long)
+ - serial : Set USB Serial string (max 31 characters long)
  - {bus,self}-powered : selects between self- and bus-powered operation (default
         is self-powered)
  - disable-hi-speed : disable USB Hi-Speed support
@@ -31,8 +31,10 @@ Optional properties :
         (default is individual)
  - dynamic-power-switching : enable auto-switching from self- to bus-powered
         operation if the local power source is removed or unavailable
- - oc-delay-{100us,4ms,8ms,16ms} : set over current timer delay (default is 8ms)
- - compound-device : indicated the hub is part of a compound device
+ - oc-delay-us : Delay time (in microseconds) for filtering the over-current
+        sense inputs. Valid values are 100, 4000, 8000 (default) and 16000. If
+        an invalid value is given, the default is used instead.
+ - compound-device : indicate the hub is part of a compound device
  - port-mapping-mode : enable port mapping mode
  - string-support : enable string descriptor support (required for manufacturer,
         product and serial string configuration)
@@ -40,34 +42,15 @@ Optional properties :
         device connected.
  - sp-disabled-ports : Specifies the ports which will be self-power disabled
  - bp-disabled-ports : Specifies the ports which will be bus-power disabled
- - max-sp-power : Specifies the maximum current the hub consumes from an
-        upstream port when operating as self-powered hub including the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 2).
- - max-bp-power : Specifies the maximum current the hub consumes from an
-        upstream port when operating as bus-powered hub including the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 100).
- - max-sp-current : Specifies the maximum current the hub consumes from an
-        upstream port when operating as self-powered hub EXCLUDING the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 2).
- - max-bp-current : Specifies the maximum current the hub consumes from an
-        upstream port when operating as bus-powered hub EXCLUDING the power
-        consumption of a permanently attached peripheral if the hub is
-        configured as a compound device. The value is given in mA in a 0 - 500
-        range (default is 100).
- - power-on-time : Specifies the time it takes from the time the host initiates
-        the power-on sequence to a port until the port has adequate power. The
-        value is given in ms in a 0 - 510 range (default is 100ms).
+ - power-on-time-ms : Specifies the time it takes from the time the host
+        initiates the power-on sequence to a port until the port has adequate
+        power. The value is given in ms in a 0 - 510 range (default is 100ms).
 
 Examples:
         usb2512b@2c {
                 compatible = "microchip,usb2512b";
-                hub-reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+                reg = <0x2c>;
+                reset-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
         };
 
         usb2514b@2c {
diff --git a/Documentation/extcon/intel-int3496.txt b/Documentation/extcon/intel-int3496.txt
index af0b366c25b7..8155dbc7fad3 100644
--- a/Documentation/extcon/intel-int3496.txt
+++ b/Documentation/extcon/intel-int3496.txt
@@ -20,3 +20,8 @@ Index 1: The output gpio for enabling Vbus output from the device to the otg
 Index 2: The output gpio for muxing of the data pins between the USB host and
          the USB peripheral controller, write 1 to mux to the peripheral
          controller
+
+There is a mapping between indices and GPIO connection IDs as follows
+        id      index 0
+        vbus    index 1
+        mux     index 2
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index fdcfdd79682a..fe25787ff6d4 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -58,8 +58,7 @@ prototypes:
         int (*permission) (struct inode *, int, unsigned int);
         int (*get_acl)(struct inode *, int);
         int (*setattr) (struct dentry *, struct iattr *);
-        int (*getattr) (const struct path *, struct dentry *, struct kstat *,
-                        u32, unsigned int);
+        int (*getattr) (const struct path *, struct kstat *, u32, unsigned int);
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         int (*fiemap)(struct inode *, struct fiemap_extent_info *, u64 start, u64 len);
         void (*update_time)(struct inode *, struct timespec *, int);
diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting
index 95280079c0b3..5fb17f49f7a2 100644
--- a/Documentation/filesystems/porting
+++ b/Documentation/filesystems/porting
@@ -600,3 +600,9 @@ in your dentry operations instead.
 [recommended]
         ->readlink is optional for symlinks.  Don't set, unless filesystem needs
         to fake something for readlink(2).
+--
+[mandatory]
+        ->getattr() is now passed a struct path rather than a vfsmount and
+        dentry separately, and it now has request_mask and query_flags arguments
+        to specify the fields and sync type requested by statx.  Filesystems not
+        supporting any statx-specific features may ignore the new arguments.
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index 569211703721..94dd27ef4a76 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -382,8 +382,7 @@ struct inode_operations {
         int (*permission) (struct inode *, int);
         int (*get_acl)(struct inode *, int);
         int (*setattr) (struct dentry *, struct iattr *);
-        int (*getattr) (const struct path *, struct dentry *, struct kstat *,
-                        u32, unsigned int);
+        int (*getattr) (const struct path *, struct kstat *, u32, unsigned int);
         ssize_t (*listxattr) (struct dentry *, char *, size_t);
         void (*update_time)(struct inode *, struct timespec *, int);
         int (*atomic_open)(struct inode *, struct dentry *, struct file *,
diff --git a/Documentation/gcc-plugins.txt b/Documentation/gcc-plugins.txt
index 891c69464434..433eaefb4aa1 100644
--- a/Documentation/gcc-plugins.txt
+++ b/Documentation/gcc-plugins.txt
@@ -18,8 +18,8 @@ because gcc versions 4.5 and 4.6 are compiled by a C compiler,
 gcc-4.7 can be compiled by a C or a C++ compiler,
 and versions 4.8+ can only be compiled by a C++ compiler.
 
-Currently the GCC plugin infrastructure supports only the x86, arm and arm64
-architectures.
+Currently the GCC plugin infrastructure supports only the x86, arm, arm64 and
+powerpc architectures.
 
 This infrastructure was ported from grsecurity [6] and PaX [7].
 
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index fc73eeb7b3b8..ab0230461377 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1006,7 +1006,8 @@ accept_redirects - BOOLEAN
                 FALSE (router)
 
 forwarding - BOOLEAN
-        Enable IP forwarding on this interface.
+        Enable IP forwarding on this interface.  This controls whether packets
+        received _on_ this interface can be forwarded.
 
 mc_forwarding - BOOLEAN
         Do multicast routing. The kernel needs to be compiled with CONFIG_MROUTE
diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
index 54bd5faa8782..f2af35f6d6b2 100644
--- a/Documentation/pinctrl.txt
+++ b/Documentation/pinctrl.txt
@@ -77,9 +77,15 @@ static struct pinctrl_desc foo_desc = {
 
 int __init foo_probe(void)
 {
+        int error;
+
         struct pinctrl_dev *pctl;
 
-        return pinctrl_register_and_init(&foo_desc, <PARENT>, NULL, &pctl);
+        error = pinctrl_register_and_init(&foo_desc, <PARENT>, NULL, &pctl);
+        if (error)
+                return error;
+
+        return pinctrl_enable(pctl);
 }
 
 To enable the pinctrl subsystem and the subgroups for PINMUX and PINCONF and
diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst
index 11ec2d93a5e0..61e9c78bd6d1 100644
--- a/Documentation/process/stable-kernel-rules.rst
+++ b/Documentation/process/stable-kernel-rules.rst
@@ -124,7 +124,7 @@ specified in the following format in the sign-off area:
 
 .. code-block:: none
 
-     Cc: <stable@vger.kernel.org> # 3.3.x-
+     Cc: <stable@vger.kernel.org> # 3.3.x
 
 The tag has the meaning of:
 
diff --git a/Documentation/trace/kprobetrace.txt b/Documentation/trace/kprobetrace.txt
index e4991fb1eedc..41ef9d8efe95 100644
--- a/Documentation/trace/kprobetrace.txt
+++ b/Documentation/trace/kprobetrace.txt
@@ -12,7 +12,7 @@ kprobes can probe (this means, all functions body except for __kprobes
 functions). Unlike the Tracepoint based event, this can be added and removed
 dynamically, on the fly.
 
-To enable this feature, build your kernel with CONFIG_KPROBE_EVENT=y.
+To enable this feature, build your kernel with CONFIG_KPROBE_EVENTS=y.
 
 Similar to the events tracer, this doesn't need to be activated via
 current_tracer. Instead of that, add probe points via
diff --git a/Documentation/trace/uprobetracer.txt b/Documentation/trace/uprobetracer.txt
index fa7b680ee8a0..bf526a7c5559 100644
--- a/Documentation/trace/uprobetracer.txt
+++ b/Documentation/trace/uprobetracer.txt
@@ -7,7 +7,7 @@
 Overview
 --------
 Uprobe based trace events are similar to kprobe based trace events.
-To enable this feature, build your kernel with CONFIG_UPROBE_EVENT=y.
+To enable this feature, build your kernel with CONFIG_UPROBE_EVENTS=y.
 
 Similar to the kprobe-event tracer, this doesn't need to be activated via
 current_tracer. Instead of that, add probe points via
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 069450938b79..fd106899afd1 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -951,6 +951,10 @@ This ioctl allows the user to create or modify a guest physical memory
 slot.  When changing an existing slot, it may be moved in the guest
 physical memory space, or its flags may be modified.  It may not be
 resized.  Slots may not overlap in guest physical address space.
+Bits 0-15 of "slot" specifies the slot id and this value should be
+less than the maximum number of user memory slots supported per VM.
+The maximum allowed slots can be queried using KVM_CAP_NR_MEMSLOTS,
+if this capability is supported by the architecture.
 
 If KVM_CAP_MULTI_ADDRESS_SPACE is available, bits 16-31 of "slot"
 specifies the address space which is being modified.  They must be
@@ -3373,6 +3377,69 @@ struct kvm_ppc_resize_hpt {
         __u32 pad;
 };
 
+4.104 KVM_X86_GET_MCE_CAP_SUPPORTED
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: system ioctl
+Parameters: u64 mce_cap (out)
+Returns: 0 on success, -1 on error
+
+Returns supported MCE capabilities. The u64 mce_cap parameter
+has the same format as the MSR_IA32_MCG_CAP register. Supported
+capabilities will have the corresponding bits set.
+
+4.105 KVM_X86_SETUP_MCE
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: vcpu ioctl
+Parameters: u64 mcg_cap (in)
+Returns: 0 on success,
+         -EFAULT if u64 mcg_cap cannot be read,
+         -EINVAL if the requested number of banks is invalid,
+         -EINVAL if requested MCE capability is not supported.
+
+Initializes MCE support for use. The u64 mcg_cap parameter
+has the same format as the MSR_IA32_MCG_CAP register and
+specifies which capabilities should be enabled. The maximum
+supported number of error-reporting banks can be retrieved when
+checking for KVM_CAP_MCE. The supported capabilities can be
+retrieved with KVM_X86_GET_MCE_CAP_SUPPORTED.
+
+4.106 KVM_X86_SET_MCE
+
+Capability: KVM_CAP_MCE
+Architectures: x86
+Type: vcpu ioctl
+Parameters: struct kvm_x86_mce (in)
+Returns: 0 on success,
+         -EFAULT if struct kvm_x86_mce cannot be read,
+         -EINVAL if the bank number is invalid,
+         -EINVAL if VAL bit is not set in status field.
+
+Inject a machine check error (MCE) into the guest. The input
+parameter is:
+
+struct kvm_x86_mce {
+        __u64 status;
+        __u64 addr;
+        __u64 misc;
+        __u64 mcg_status;
+        __u8 bank;
+        __u8 pad1[7];
+        __u64 pad2[3];
+};
+
+If the MCE being reported is an uncorrected error, KVM will
+inject it as an MCE exception into the guest. If the guest
+MCG_STATUS register reports that an MCE is in progress, KVM
+causes an KVM_EXIT_SHUTDOWN vmexit.
+
+Otherwise, if the MCE is a corrected error, KVM will just
+store it in the corresponding bank (provided this bank is
+not holding a previously reported uncorrected error).
+
 5. The kvm_run structure
 ------------------------
 
diff --git a/Documentation/virtual/kvm/devices/arm-vgic.txt b/Documentation/virtual/kvm/devices/arm-vgic.txt
index 76e61c883347..b2f60ca8b60c 100644
--- a/Documentation/virtual/kvm/devices/arm-vgic.txt
+++ b/Documentation/virtual/kvm/devices/arm-vgic.txt
@@ -83,6 +83,12 @@ Groups:
 
     Bits for undefined preemption levels are RAZ/WI.
 
+    For historical reasons and to provide ABI compatibility with userspace we
+    export the GICC_PMR register in the format of the GICH_VMCR.VMPriMask
+    field in the lower 5 bits of a word, meaning that userspace must always
+    use the lower 5 bits to communicate with the KVM device and must shift the
+    value left by 3 places to obtain the actual priority mask level.
+
   Limitations:
     - Priorities are not implemented, and registers are RAZ/WI
     - Currently only implemented for KVM_DEV_TYPE_ARM_VGIC_V2.
diff --git a/Documentation/vm/userfaultfd.txt b/Documentation/vm/userfaultfd.txt
index 0e5543a920e5..bb2f945f87ab 100644
--- a/Documentation/vm/userfaultfd.txt
+++ b/Documentation/vm/userfaultfd.txt
@@ -172,10 +172,6 @@ the same read(2) protocol as for the page fault notifications. The
 manager has to explicitly enable these events by setting appropriate
 bits in uffdio_api.features passed to UFFDIO_API ioctl:
 
-UFFD_FEATURE_EVENT_EXIT - enable notification about exit() of the
-non-cooperative process. When the monitored process exits, the uffd
-manager will get UFFD_EVENT_EXIT.
-
 UFFD_FEATURE_EVENT_FORK - enable userfaultfd hooks for fork(). When
 this feature is enabled, the userfaultfd context of the parent process
 is duplicated into the newly created process. The manager receives
diff --git a/MAINTAINERS b/MAINTAINERS
index c265a5fe4848..38d3e4ed7208 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2585,12 +2585,26 @@ F:	include/uapi/linux/if_bonding.h
 
 BPF (Safe dynamic programs and tools)
 M:      Alexei Starovoitov <ast@kernel.org>
+M:      Daniel Borkmann <daniel@iogearbox.net>
 L:      netdev@vger.kernel.org
 L:      linux-kernel@vger.kernel.org
 S:      Supported
+F:      arch/x86/net/bpf_jit*
+F:      Documentation/networking/filter.txt
+F:      include/linux/bpf*
+F:      include/linux/filter.h
+F:      include/uapi/linux/bpf*
+F:      include/uapi/linux/filter.h
 F:      kernel/bpf/
-F:      tools/testing/selftests/bpf/
+F:      kernel/trace/bpf_trace.c
 F:      lib/test_bpf.c
+F:      net/bpf/
+F:      net/core/filter.c
+F:      net/sched/act_bpf.c
+F:      net/sched/cls_bpf.c
+F:      samples/bpf/
+F:      tools/net/bpf*
+F:      tools/testing/selftests/bpf/
 
 BROADCOM B44 10/100 ETHERNET DRIVER
 M:      Michael Chan <michael.chan@broadcom.com>
@@ -3216,7 +3230,6 @@ F:	drivers/platform/chrome/
 
 CISCO VIC ETHERNET NIC DRIVER
 M:      Christian Benvenuti <benve@cisco.com>
-M:      Sujith Sankar <ssujith@cisco.com>
 M:      Govindarajulu Varadarajan <_govind@gmx.com>
 M:      Neel Patel <neepatel@cisco.com>
 S:      Supported
@@ -4118,14 +4131,13 @@ F:	drivers/block/drbd/
 F:      lib/lru_cache.c
 F:      Documentation/blockdev/drbd/
 
-DRIVER CORE, KOBJECTS, DEBUGFS, KERNFS AND SYSFS
+DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
 S:      Supported
 F:      Documentation/kobject.txt
 F:      drivers/base/
 F:      fs/debugfs/
-F:      fs/kernfs/
 F:      fs/sysfs/
 F:      include/linux/debugfs.h
 F:      include/linux/kobj*
@@ -4776,6 +4788,12 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/mpc85xx_edac.[ch]
 
+EDAC-PND2
+M:      Tony Luck <tony.luck@intel.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/pnd2_edac.[ch]
+
 EDAC-PASEMI
 M:      Egor Martovetsky <egor@pasemi.com>
 L:      linux-edac@vger.kernel.org
@@ -4923,6 +4941,7 @@ F:	include/linux/netfilter_bridge/
 F:      net/bridge/
 
 ETHERNET PHY LIBRARY
+M:      Andrew Lunn <andrew@lunn.ch>
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
@@ -7084,9 +7103,9 @@ S:	Maintained
 F:      fs/autofs4/
 
 KERNEL BUILD + files below scripts/ (unless maintained elsewhere)
+M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 M:      Michal Marek <mmarek@suse.com>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git for-next
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git rc-fixes
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git
 L:      linux-kbuild@vger.kernel.org
 S:      Maintained
 F:      Documentation/kbuild/
@@ -7203,6 +7222,14 @@ F:	arch/mips/include/uapi/asm/kvm*
 F:      arch/mips/include/asm/kvm*
 F:      arch/mips/kvm/
 
+KERNFS
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+M:      Tejun Heo <tj@kernel.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core.git
+S:      Supported
+F:      include/linux/kernfs.h
+F:      fs/kernfs/
+
 KEXEC
 M:      Eric Biederman <ebiederm@xmission.com>
 W:      http://kernel.org/pub/linux/utils/kernel/kexec/
@@ -7774,13 +7801,6 @@ F:	include/net/mac80211.h
 F:      net/mac80211/
 F:      drivers/net/wireless/mac80211_hwsim.[ch]
 
-MACVLAN DRIVER
-M:      Patrick McHardy <kaber@trash.net>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/macvlan.c
-F:      include/linux/if_macvlan.h
-
 MAILBOX API
 M:      Jassi Brar <jassisinghbrar@gmail.com>
 L:      linux-kernel@vger.kernel.org
@@ -7853,6 +7873,8 @@ F:	drivers/net/ethernet/marvell/mvneta.*
 MARVELL MWIFIEX WIRELESS DRIVER
 M:      Amitkumar Karwar <akarwar@marvell.com>
 M:      Nishant Sarmukadam <nishants@marvell.com>
+M:      Ganapathi Bhat <gbhat@marvell.com>
+M:      Xinming Hu <huxm@marvell.com>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/marvell/mwifiex/
@@ -8307,7 +8329,6 @@ M:	Richard Leitner <richard.leitner@skidata.com>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/misc/usb251xb.c
-F:      include/linux/platform_data/usb251xb.h
 F:      Documentation/devicetree/bindings/usb/usb251xb.txt
 
 MICROSOFT SURFACE PRO 3 BUTTON DRIVER
@@ -8754,6 +8775,7 @@ W:	http://www.linuxfoundation.org/en/Net
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+B:      mailto:netdev@vger.kernel.org
 S:      Maintained
 F:      net/
 F:      include/net/
@@ -10815,6 +10837,7 @@ F:	drivers/s390/block/dasd*
 F:      block/partitions/ibm.c
 
 S390 NETWORK DRIVERS
+M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
 M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
 L:      linux-s390@vger.kernel.org
 W:      http://www.ibm.com/developerworks/linux/linux390/
@@ -10845,6 +10868,7 @@ S:	Supported
 F:      drivers/s390/scsi/zfcp_*
 
 S390 IUCV NETWORK LAYER
+M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
 M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
 L:      linux-s390@vger.kernel.org
 W:      http://www.ibm.com/developerworks/linux/linux390/
@@ -12455,7 +12479,6 @@ F:	drivers/clk/ti/
 F:      include/linux/clk/ti.h
 
 TI ETHERNET SWITCH DRIVER (CPSW)
-M:      Mugunthan V N <mugunthanvnm@ti.com>
 R:      Grygorii Strashko <grygorii.strashko@ti.com>
 L:      linux-omap@vger.kernel.org
 L:      netdev@vger.kernel.org
@@ -13296,7 +13319,7 @@ F:	drivers/virtio/
 F:      tools/virtio/
 F:      drivers/net/virtio_net.c
 F:      drivers/block/virtio_blk.c
-F:      include/linux/virtio_*.h
+F:      include/linux/virtio*.h
 F:      include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
 
@@ -13384,14 +13407,6 @@ W:	https://linuxtv.org
 S:      Maintained
 F:      drivers/media/platform/vivid/*
 
-VLAN (802.1Q)
-M:      Patrick McHardy <kaber@trash.net>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/macvlan.c
-F:      include/linux/if_*vlan.h
-F:      net/8021q/
-
 VLYNQ BUS
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
diff --git a/Makefile b/Makefile
index 165cf9783a5d..779302695453 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 11
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc8
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -372,7 +372,7 @@ LDFLAGS_MODULE  =
 CFLAGS_KERNEL   =
 AFLAGS_KERNEL   =
 LDFLAGS_vmlinux =
-CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized
+CFLAGS_GCOV     := -fprofile-arcs -ftest-coverage -fno-tree-loop-im $(call cc-disable-warning,maybe-uninitialized,)
 CFLAGS_KCOV     := $(call cc-option,-fsanitize-coverage=trace-pc,)
 
 
@@ -653,6 +653,12 @@ KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \
 # Tell gcc to never replace conditional load with a non-conditional one
 KBUILD_CFLAGS   += $(call cc-option,--param=allow-store-data-races=0)
 
+# check for 'asm goto'
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
+        KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
+        KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
+endif
+
 include scripts/Makefile.gcc-plugins
 
 ifdef CONFIG_READABLE_ASM
@@ -798,12 +804,6 @@ KBUILD_CFLAGS   += $(call cc-option,-Werror=incompatible-pointer-types)
 # use the deterministic mode of AR if available
 KBUILD_ARFLAGS := $(call ar-option,D)
 
-# check for 'asm goto'
-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
-        KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO
-        KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO
-endif
-
 include scripts/Makefile.kasan
 include scripts/Makefile.extrawarn
 include scripts/Makefile.ubsan
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 0b961093ca5c..6d76e528ab8f 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1290,7 +1290,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
         /* copy relevant bits of struct timex. */
         if (copy_from_user(&txc, txc_p, offsetof(struct timex32, time)) ||
             copy_from_user(&txc.tick, &txc_p->tick, sizeof(struct timex32) - 
-                           offsetof(struct timex32, time)))
+                           offsetof(struct timex32, tick)))
           return -EFAULT;
 
         ret = do_adjtimex(&txc);        
diff --git a/arch/arc/boot/dts/skeleton.dtsi b/arch/arc/boot/dts/skeleton.dtsi
index 65808fe0a290..2891cb266cf0 100644
--- a/arch/arc/boot/dts/skeleton.dtsi
+++ b/arch/arc/boot/dts/skeleton.dtsi
@@ -26,6 +26,7 @@
                         device_type = "cpu";
                         compatible = "snps,arc770d";
                         reg = <0>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/skeleton_hs.dtsi b/arch/arc/boot/dts/skeleton_hs.dtsi
index 2dfe8037dfbb..5e944d3e5b74 100644
--- a/arch/arc/boot/dts/skeleton_hs.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs.dtsi
@@ -21,6 +21,7 @@
                         device_type = "cpu";
                         compatible = "snps,archs38";
                         reg = <0>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/skeleton_hs_idu.dtsi b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
index 4c11079f3565..54b277d7dea0 100644
--- a/arch/arc/boot/dts/skeleton_hs_idu.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
@@ -19,8 +19,27 @@
 
                 cpu@0 {
                         device_type = "cpu";
-                        compatible = "snps,archs38xN";
+                        compatible = "snps,archs38";
                         reg = <0>;
+                        clocks = <&core_clk>;
+                };
+                cpu@1 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <1>;
+                        clocks = <&core_clk>;
+                };
+                cpu@2 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <2>;
+                        clocks = <&core_clk>;
+                };
+                cpu@3 {
+                        device_type = "cpu";
+                        compatible = "snps,archs38";
+                        reg = <3>;
+                        clocks = <&core_clk>;
                 };
         };
 
diff --git a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
index f0df59b23e21..459fc656b759 100644
--- a/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
+++ b/arch/arc/boot/dts/vdk_axs10x_mb.dtsi
@@ -112,13 +112,19 @@
                         interrupts = <7>;
                         bus-width = <4>;
                 };
+        };
 
-                /* Embedded Vision subsystem UIO mappings; only relevant for EV VDK */
-                uio_ev: uio@0xD0000000 {
-                        compatible = "generic-uio";
-                        reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
-                        reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
-                        interrupts = <23>;
-                };
+        /*
+         * Embedded Vision subsystem UIO mappings; only relevant for EV VDK
+         *
+         * This node is intentionally put outside of MB above becase
+         * it maps areas outside of MB's 0xEz-0xFz.
+         */
+        uio_ev: uio@0xD0000000 {
+                compatible = "generic-uio";
+                reg = <0xD0000000 0x2000 0xD1000000 0x2000 0x90000000 0x10000000 0xC0000000 0x10000000>;
+                reg-names = "ev_gsa", "ev_ctrl", "ev_shared_mem", "ev_code_mem";
+                interrupt-parent = <&mb_intc>;
+                interrupts = <23>;
         };
 };
diff --git a/arch/arc/include/asm/hugepage.h b/arch/arc/include/asm/hugepage.h
index 317ff773e1ca..b18fcb606908 100644
--- a/arch/arc/include/asm/hugepage.h
+++ b/arch/arc/include/asm/hugepage.h
@@ -11,6 +11,7 @@
 #define _ASM_ARC_HUGEPAGE_H
 
 #include <linux/types.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 static inline pte_t pmd_pte(pmd_t pmd)
diff --git a/arch/arc/include/asm/kprobes.h b/arch/arc/include/asm/kprobes.h
index 00bdbe167615..2e52d18e6bc7 100644
--- a/arch/arc/include/asm/kprobes.h
+++ b/arch/arc/include/asm/kprobes.h
@@ -54,9 +54,7 @@ int kprobe_fault_handler(struct pt_regs *regs, unsigned long cause);
 void kretprobe_trampoline(void);
 void trap_is_kprobe(unsigned long address, struct pt_regs *regs);
 #else
-static void trap_is_kprobe(unsigned long address, struct pt_regs *regs)
-{
-}
+#define trap_is_kprobe(address, regs)
 #endif /* CONFIG_KPROBES */
 
 #endif /* _ARC_KPROBES_H */
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index e94ca72b974e..ee22d40afef4 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -37,6 +37,7 @@
 
 #include <asm/page.h>
 #include <asm/mmu.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #include <linux/const.h>
 
diff --git a/arch/arc/kernel/entry-arcv2.S b/arch/arc/kernel/entry-arcv2.S
index 2585632eaa68..cc558a25b8fa 100644
--- a/arch/arc/kernel/entry-arcv2.S
+++ b/arch/arc/kernel/entry-arcv2.S
@@ -100,15 +100,21 @@ END(handle_interrupt)
 ;################### Non TLB Exception Handling #############################
 
 ENTRY(EV_SWI)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_SWI)
 
 ENTRY(EV_DivZero)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_DivZero)
 
 ENTRY(EV_DCError)
-        flag 1
+        ; TODO: implement this
+        EXCEPTION_PROLOGUE
+        b   ret_from_exception
 END(EV_DCError)
 
 ; ---------------------------------------------
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index 3093fa898a23..fa62404ba58f 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/delay.h>
 #include <linux/root_dev.h>
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/clocksource.h>
 #include <linux/console.h>
@@ -488,8 +489,9 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 {
         char *str;
         int cpu_id = ptr_to_cpu(v);
-        struct device_node *core_clk = of_find_node_by_name(NULL, "core_clk");
-        u32 freq = 0;
+        struct device *cpu_dev = get_cpu_device(cpu_id);
+        struct clk *cpu_clk;
+        unsigned long freq = 0;
 
         if (!cpu_online(cpu_id)) {
                 seq_printf(m, "processor [%d]\t: Offline\n", cpu_id);
@@ -502,9 +504,15 @@ static int show_cpuinfo(struct seq_file *m, void *v)
 
         seq_printf(m, arc_cpu_mumbojumbo(cpu_id, str, PAGE_SIZE));
 
-        of_property_read_u32(core_clk, "clock-frequency", &freq);
+        cpu_clk = clk_get(cpu_dev, NULL);
+        if (IS_ERR(cpu_clk)) {
+                seq_printf(m, "CPU speed \t: Cannot get clock for processor [%d]\n",
+                           cpu_id);
+        } else {
+                freq = clk_get_rate(cpu_clk);
+        }
         if (freq)
-                seq_printf(m, "CPU speed\t: %u.%02u Mhz\n",
+                seq_printf(m, "CPU speed\t: %lu.%02lu Mhz\n",
                            freq / 1000000, (freq / 10000) % 100);
 
         seq_printf(m, "Bogo MIPS\t: %lu.%02lu\n",
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index d408fa21a07c..928562967f3c 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -633,6 +633,9 @@ noinline static void slc_entire_op(const int op)
 
         write_aux_reg(ARC_REG_SLC_INVALIDATE, 1);
 
+        /* Make sure "busy" bit reports correct stataus, see STAR 9001165532 */
+        read_aux_reg(r);
+
         /* Important to wait for flush to complete */
         while (read_aux_reg(r) & SLC_CTRL_BUSY);
 }
diff --git a/arch/arm/boot/dts/am335x-baltos.dtsi b/arch/arm/boot/dts/am335x-baltos.dtsi
index efb5eae290a8..d42b98f15e8b 100644
--- a/arch/arm/boot/dts/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/am335x-baltos.dtsi
@@ -371,6 +371,8 @@
 
         phy1: ethernet-phy@1 {
                 reg = <7>;
+                eee-broken-100tx;
+                eee-broken-1000t;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts
index 9e43c443738a..9ba4b18c0cb2 100644
--- a/arch/arm/boot/dts/am335x-evmsk.dts
+++ b/arch/arm/boot/dts/am335x-evmsk.dts
@@ -672,6 +672,7 @@
         ti,non-removable;
         bus-width = <4>;
         cap-power-off-card;
+        keep-power-in-suspend;
         pinctrl-names = "default";
         pinctrl-0 = <&mmc2_pins>;
 
diff --git a/arch/arm/boot/dts/am335x-pcm-953.dtsi b/arch/arm/boot/dts/am335x-pcm-953.dtsi
index 02981eae96b9..1ec8e0d80191 100644
--- a/arch/arm/boot/dts/am335x-pcm-953.dtsi
+++ b/arch/arm/boot/dts/am335x-pcm-953.dtsi
@@ -63,14 +63,14 @@
                         label = "home";
                         linux,code = <KEY_HOME>;
                         gpios = <&gpio3 7 GPIO_ACTIVE_HIGH>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
                 button@1 {
                         label = "menu";
                         linux,code = <KEY_MENU>;
                         gpios = <&gpio3 8 GPIO_ACTIVE_HIGH>;
-                        gpio-key,wakeup;
+                        wakeup-source;
                 };
 
         };
diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi
index 0d341c545b01..e5ac1d81d15c 100644
--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
+++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
@@ -315,6 +315,13 @@
                         /* ID & VBUS GPIOs provided in board dts */
                 };
         };
+
+        tpic2810: tpic2810@60 {
+                compatible = "ti,tpic2810";
+                reg = <0x60>;
+                gpio-controller;
+                #gpio-cells = <2>;
+        };
 };
 
 &mcspi3 {
@@ -330,13 +337,6 @@
                 spi-max-frequency = <1000000>;
                 spi-cpol;
         };
-
-        tpic2810: tpic2810@60 {
-                compatible = "ti,tpic2810";
-                reg = <0x60>;
-                gpio-controller;
-                #gpio-cells = <2>;
-        };
 };
 
 &uart3 {
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 4fbb089cf5ad..00de62dc0042 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -66,14 +66,14 @@
                 timer@20200 {
                         compatible = "arm,cortex-a9-global-timer";
                         reg = <0x20200 0x100>;
-                        interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
                 local-timer@20600 {
                         compatible = "arm,cortex-a9-twd-timer";
                         reg = <0x20600 0x100>;
-                        interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>;
+                        interrupts = <GIC_PPI 13 IRQ_TYPE_EDGE_RISING>;
                         clocks = <&periph_clk>;
                 };
 
diff --git a/arch/arm/boot/dts/bcm953012k.dts b/arch/arm/boot/dts/bcm953012k.dts
index bfd923096a8c..ae31a5826e91 100644
--- a/arch/arm/boot/dts/bcm953012k.dts
+++ b/arch/arm/boot/dts/bcm953012k.dts
@@ -48,15 +48,14 @@
         };
 
         memory {
-                reg = <0x00000000 0x10000000>;
+                reg = <0x80000000 0x10000000>;
         };
 };
 
 &uart0 {
-        clock-frequency = <62499840>;
+        status = "okay";
 };
 
 &uart1 {
-        clock-frequency = <62499840>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/bcm958522er.dts b/arch/arm/boot/dts/bcm958522er.dts
index 3f04a40eb90c..df05e7f568af 100644
--- a/arch/arm/boot/dts/bcm958522er.dts
+++ b/arch/arm/boot/dts/bcm958522er.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958525er.dts b/arch/arm/boot/dts/bcm958525er.dts
index 9fd542200d3d..4a3ab19c6281 100644
--- a/arch/arm/boot/dts/bcm958525er.dts
+++ b/arch/arm/boot/dts/bcm958525er.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958525xmc.dts b/arch/arm/boot/dts/bcm958525xmc.dts
index 41e7fd350fcd..81f78435d8c7 100644
--- a/arch/arm/boot/dts/bcm958525xmc.dts
+++ b/arch/arm/boot/dts/bcm958525xmc.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 31 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958622hr.dts b/arch/arm/boot/dts/bcm958622hr.dts
index 477c4860db52..c88b8fefcb2f 100644
--- a/arch/arm/boot/dts/bcm958622hr.dts
+++ b/arch/arm/boot/dts/bcm958622hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958623hr.dts b/arch/arm/boot/dts/bcm958623hr.dts
index c0a499d5ba44..d503fa0dde31 100644
--- a/arch/arm/boot/dts/bcm958623hr.dts
+++ b/arch/arm/boot/dts/bcm958623hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
index f7eb5854a224..cc0363b843c1 100644
--- a/arch/arm/boot/dts/bcm958625hr.dts
+++ b/arch/arm/boot/dts/bcm958625hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/bcm988312hr.dts b/arch/arm/boot/dts/bcm988312hr.dts
index 16666324fda8..74e15a3cd9f8 100644
--- a/arch/arm/boot/dts/bcm988312hr.dts
+++ b/arch/arm/boot/dts/bcm988312hr.dts
@@ -55,6 +55,7 @@
         gpio-restart {
                 compatible = "gpio-restart";
                 gpios = <&gpioa 15 GPIO_ACTIVE_LOW>;
+                open-source;
                 priority = <200>;
         };
 };
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 2c9e56f4aac5..bbfb9d5a70a9 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -283,6 +283,7 @@
                                 device_type = "pci";
                                 ranges = <0x81000000 0 0          0x03000 0 0x00010000
                                           0x82000000 0 0x20013000 0x13000 0 0xffed000>;
+                                bus-range = <0x00 0xff>;
                                 #interrupt-cells = <1>;
                                 num-lanes = <1>;
                                 linux,pci-domain = <0>;
@@ -319,6 +320,7 @@
                                 device_type = "pci";
                                 ranges = <0x81000000 0 0          0x03000 0 0x00010000
                                           0x82000000 0 0x30013000 0x13000 0 0xffed000>;
+                                bus-range = <0x00 0xff>;
                                 #interrupt-cells = <1>;
                                 num-lanes = <1>;
                                 linux,pci-domain = <1>;
diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
index 49f466fe0b1d..dcfc97591433 100644
--- a/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
+++ b/arch/arm/boot/dts/imx6sx-udoo-neo.dtsi
@@ -121,11 +121,6 @@
         };
 };
 
-&cpu0 {
-        arm-supply = <&sw1a_reg>;
-        soc-supply = <&sw1c_reg>;
-};
-
 &fec1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_enet1>;
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 8f9a69ca818c..efe53998c961 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -121,7 +121,7 @@
 &i2c3 {
         clock-frequency = <400000>;
         at24@50 {
-                compatible = "at24,24c02";
+                compatible = "atmel,24c64";
                 readonly;
                 reg = <0x50>;
         };
diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 22332be72140..528b4e9c6d3d 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -266,7 +266,7 @@
                 };
 
                 usb1: ohci@00400000 {
-                        compatible = "atmel,sama5d2-ohci", "usb-ohci";
+                        compatible = "atmel,at91rm9200-ohci", "usb-ohci";
                         reg = <0x00400000 0x100000>;
                         interrupts = <41 IRQ_TYPE_LEVEL_HIGH 2>;
                         clocks = <&uhphs_clk>, <&uhphs_clk>, <&uhpck>;
diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
index 82d8c4771293..162e1eb5373d 100644
--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
@@ -14,6 +14,7 @@
 #include <dt-bindings/mfd/dbx500-prcmu.h>
 #include <dt-bindings/arm/ux500_pm_domains.h>
 #include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/clock/ste-ab8500.h>
 #include "skeleton.dtsi"
 
 / {
@@ -603,6 +604,11 @@
                                 interrupt-controller;
                                 #interrupt-cells = <2>;
 
+                                ab8500_clock: clock-controller {
+                                        compatible = "stericsson,ab8500-clk";
+                                        #clock-cells = <1>;
+                                };
+
                                 ab8500_gpio: ab8500-gpio {
                                         compatible = "stericsson,ab8500-gpio";
                                         gpio-controller;
@@ -686,6 +692,8 @@
 
                                 ab8500-pwm {
                                         compatible = "stericsson,ab8500-pwm";
+                                        clocks = <&ab8500_clock AB8500_SYSCLK_INT>;
+                                        clock-names = "intclk";
                                 };
 
                                 ab8500-debugfs {
@@ -700,6 +708,9 @@
                                         V-AMIC2-supply = <&ab8500_ldo_anamic2_reg>;
                                         V-DMIC-supply = <&ab8500_ldo_dmic_reg>;
 
+                                        clocks = <&ab8500_clock AB8500_SYSCLK_AUDIO>;
+                                        clock-names = "audioclk";
+
                                         stericsson,earpeice-cmv = <950>; /* Units in mV. */
                                 };
 
@@ -1095,6 +1106,14 @@
                         status = "disabled";
                 };
 
+                sound {
+                        compatible = "stericsson,snd-soc-mop500";
+                        stericsson,cpu-dai = <&msp1 &msp3>;
+                        stericsson,audio-codec = <&codec>;
+                        clocks = <&prcmu_clk PRCMU_SYSCLK>, <&ab8500_clock AB8500_SYSCLK_ULP>, <&ab8500_clock AB8500_SYSCLK_INT>;
+                        clock-names = "sysclk", "ulpclk", "intclk";
+                };
+
                 msp0: msp@80123000 {
                         compatible = "stericsson,ux500-msp-i2s";
                         reg = <0x80123000 0x1000>;
diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
index f37f9e10713c..9e359e4f342e 100644
--- a/arch/arm/boot/dts/ste-href.dtsi
+++ b/arch/arm/boot/dts/ste-href.dtsi
@@ -186,15 +186,6 @@
                         status = "okay";
                 };
 
-                sound {
-                        compatible = "stericsson,snd-soc-mop500";
-
-                        stericsson,cpu-dai = <&msp1 &msp3>;
-                        stericsson,audio-codec = <&codec>;
-                        clocks = <&prcmu_clk PRCMU_SYSCLK>;
-                        clock-names = "sysclk";
-                };
-
                 msp0: msp@80123000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp0_default_mode>;
diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
index dd5514def604..ade1d0d4e5f4 100644
--- a/arch/arm/boot/dts/ste-snowball.dts
+++ b/arch/arm/boot/dts/ste-snowball.dts
@@ -159,15 +159,6 @@
                                      "", "", "", "", "", "", "", "";
                 };
 
-                sound {
-                        compatible = "stericsson,snd-soc-mop500";
-
-                        stericsson,cpu-dai = <&msp1 &msp3>;
-                        stericsson,audio-codec = <&codec>;
-                        clocks = <&prcmu_clk PRCMU_SYSCLK>;
-                        clock-names = "sysclk";
-                };
-
                 msp0: msp@80123000 {
                         pinctrl-names = "default";
                         pinctrl-0 = <&msp0_default_mode>;
diff --git a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
index 72ec0d5ae052..bbf1c8cbaac6 100644
--- a/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
+++ b/arch/arm/boot/dts/sun7i-a20-lamobo-r1.dts
@@ -167,7 +167,7 @@
                                         reg = <8>;
                                         label = "cpu";
                                         ethernet = <&gmac>;
-                                        phy-mode = "rgmii";
+                                        phy-mode = "rgmii-txid";
                                         fixed-link {
                                                 speed = <1000>;
                                                 full-duplex;
diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
index a952cc0703cc..8a3ed21cb7bc 100644
--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
@@ -495,7 +495,7 @@
                         resets = <&ccu RST_BUS_GPU>;
 
                         assigned-clocks = <&ccu CLK_GPU>;
-                        assigned-clock-rates = <408000000>;
+                        assigned-clock-rates = <384000000>;
                 };
 
                 gic: interrupt-controller@01c81000 {
diff --git a/arch/arm/boot/dts/sun8i-a33.dtsi b/arch/arm/boot/dts/sun8i-a33.dtsi
index 18c174fef84f..306af6cadf26 100644
--- a/arch/arm/boot/dts/sun8i-a33.dtsi
+++ b/arch/arm/boot/dts/sun8i-a33.dtsi
@@ -66,12 +66,6 @@
                         opp-microvolt = <1200000>;
                         clock-latency-ns = <244144>; /* 8 32k periods */
                 };
-
-                opp@1200000000 {
-                        opp-hz = /bits/ 64 <1200000000>;
-                        opp-microvolt = <1320000>;
-                        clock-latency-ns = <244144>; /* 8 32k periods */
-                };
         };
 
         cpus {
@@ -81,16 +75,22 @@
                         operating-points-v2 = <&cpu0_opp_table>;
                 };
 
+                cpu@1 {
+                        operating-points-v2 = <&cpu0_opp_table>;
+                };
+
                 cpu@2 {
                         compatible = "arm,cortex-a7";
                         device_type = "cpu";
                         reg = <2>;
+                        operating-points-v2 = <&cpu0_opp_table>;
                 };
 
                 cpu@3 {
                         compatible = "arm,cortex-a7";
                         device_type = "cpu";
                         reg = <3>;
+                        operating-points-v2 = <&cpu0_opp_table>;
                 };
         };
 
@@ -113,8 +113,8 @@
                 simple-audio-card,mclk-fs = <512>;
                 simple-audio-card,aux-devs = <&codec_analog>;
                 simple-audio-card,routing =
-                        "Left DAC", "Digital Left DAC",
-                        "Right DAC", "Digital Right DAC";
+                        "Left DAC", "AIF1 Slot 0 Left",
+                        "Right DAC", "AIF1 Slot 0 Right";
                 status = "disabled";
 
                 simple-audio-card,cpu {
diff --git a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
index 7097c18ff487..d6bd15898db6 100644
--- a/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
+++ b/arch/arm/boot/dts/sun8i-reference-design-tablet.dtsi
@@ -50,8 +50,6 @@
 
         backlight: backlight {
                 compatible = "pwm-backlight";
-                pinctrl-names = "default";
-                pinctrl-0 = <&bl_en_pin>;
                 pwms = <&pwm 0 50000 PWM_POLARITY_INVERTED>;
                 brightness-levels = <0 10 20 30 40 50 60 70 80 90 100>;
                 default-brightness-level = <8>;
@@ -93,11 +91,6 @@
 };
 
 &pio {
-        bl_en_pin: bl_en_pin@0 {
-                pins = "PH6";
-                function = "gpio_in";
-        };
-
         mmc0_cd_pin: mmc0_cd_pin@0 {
                 pins = "PB4";
                 function = "gpio_in";
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index f2462a6bdba6..decd388d613d 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -188,6 +188,7 @@ CONFIG_WL12XX=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SPI=m
 CONFIG_WLCORE_SDIO=m
+CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_JOYDEV=m
 CONFIG_INPUT_EVDEV=m
 CONFIG_KEYBOARD_ATKBD=m
diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h
index e22089fb44dc..a3f0b3d50089 100644
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -209,6 +209,7 @@
 #define HSR_EC_IABT_HYP (0x21)
 #define HSR_EC_DABT     (0x24)
 #define HSR_EC_DABT_HYP (0x25)
+#define HSR_EC_MAX      (0x3f)
 
 #define HSR_WFI_IS_WFE          (_AC(1, UL) << 0)
 
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index cc495d799c67..31ee468ce667 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -30,7 +30,6 @@
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
 
 #define KVM_USER_MEM_SLOTS 32
-#define KVM_PRIVATE_MEM_SLOTS 4
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #define KVM_HAVE_ONE_REG
 #define KVM_HALT_POLL_NS_DEFAULT 500000
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index a8d656d9aec7..1c462381c225 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -20,6 +20,7 @@
 
 #else
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 #include <asm/memory.h>
 #include <asm/pgtable-hwdef.h>
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index c9a2103faeb9..314eb6abe1ff 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -221,6 +221,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
         case KVM_CAP_MAX_VCPUS:
                 r = KVM_MAX_VCPUS;
                 break;
+        case KVM_CAP_NR_MEMSLOTS:
+                r = KVM_USER_MEM_SLOTS;
+                break;
         case KVM_CAP_MSI_DEVID:
                 if (!kvm)
                         r = -EINVAL;
@@ -1121,6 +1124,9 @@ static void cpu_hyp_reinit(void)
                 if (__hyp_get_vectors() == hyp_default_vectors)
                         cpu_init_hyp_mode(NULL);
         }
+
+        if (vgic_present)
+                kvm_vgic_init_cpu_hardware();
 }
 
 static void cpu_hyp_reset(void)
diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c
index 4e40d1955e35..96af65a30d78 100644
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -79,7 +79,19 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return 1;
 }
 
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+        kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n",
+                      hsr);
+
+        kvm_inject_undefined(vcpu);
+        return 1;
+}
+
 static exit_handle_fn arm_exit_handlers[] = {
+        [0 ... HSR_EC_MAX]      = kvm_handle_unknown_ec,
         [HSR_EC_WFI]            = kvm_handle_wfx,
         [HSR_EC_CP15_32]        = kvm_handle_cp15_32,
         [HSR_EC_CP15_64]        = kvm_handle_cp15_64,
@@ -98,13 +110,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu)
 {
         u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu);
 
-        if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
-            !arm_exit_handlers[hsr_ec]) {
-                kvm_err("Unknown exception class: hsr: %#08x\n",
-                        (unsigned int)kvm_vcpu_get_hsr(vcpu));
-                BUG();
-        }
-
         return arm_exit_handlers[hsr_ec];
 }
 
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 962616fd4ddd..582a972371cf 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -292,11 +292,18 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
         phys_addr_t addr = start, end = start + size;
         phys_addr_t next;
 
+        assert_spin_locked(&kvm->mmu_lock);
         pgd = kvm->arch.pgd + stage2_pgd_index(addr);
         do {
                 next = stage2_pgd_addr_end(addr, end);
                 if (!stage2_pgd_none(*pgd))
                         unmap_stage2_puds(kvm, pgd, addr, next);
+                /*
+                 * If the range is too large, release the kvm->mmu_lock
+                 * to prevent starvation and lockup detector warnings.
+                 */
+                if (next != end)
+                        cond_resched_lock(&kvm->mmu_lock);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -803,6 +810,7 @@ void stage2_unmap_vm(struct kvm *kvm)
         int idx;
 
         idx = srcu_read_lock(&kvm->srcu);
+        down_read(&current->mm->mmap_sem);
         spin_lock(&kvm->mmu_lock);
 
         slots = kvm_memslots(kvm);
@@ -810,6 +818,7 @@ void stage2_unmap_vm(struct kvm *kvm)
                 stage2_unmap_memslot(kvm, memslot);
 
         spin_unlock(&kvm->mmu_lock);
+        up_read(&current->mm->mmap_sem);
         srcu_read_unlock(&kvm->srcu, idx);
 }
 
@@ -829,7 +838,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
         if (kvm->arch.pgd == NULL)
                 return;
 
+        spin_lock(&kvm->mmu_lock);
         unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+        spin_unlock(&kvm->mmu_lock);
+
         /* Free the HW pgd, one page at a time */
         free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE);
         kvm->arch.pgd = NULL;
@@ -1801,6 +1813,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
             (KVM_PHYS_SIZE >> PAGE_SHIFT))
                 return -EFAULT;
 
+        down_read(&current->mm->mmap_sem);
         /*
          * A memory region could potentially cover multiple VMAs, and any holes
          * between them, so iterate over all of them to find out if we can map
@@ -1844,8 +1857,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
                         pa += vm_start - vma->vm_start;
 
                         /* IO region dirty page logging not allowed */
-                        if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES)
-                                return -EINVAL;
+                        if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
 
                         ret = kvm_phys_addr_ioremap(kvm, gpa, pa,
                                                     vm_end - vm_start,
@@ -1857,7 +1872,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         } while (hva < reg_end);
 
         if (change == KVM_MR_FLAGS_ONLY)
-                return ret;
+                goto out;
 
         spin_lock(&kvm->mmu_lock);
         if (ret)
@@ -1865,6 +1880,8 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         else
                 stage2_flush_memslot(kvm, memslot);
         spin_unlock(&kvm->mmu_lock);
+out:
+        up_read(&current->mm->mmap_sem);
         return ret;
 }
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 3d89b7905bd9..a277981f414d 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -289,6 +289,22 @@ static void at91_ddr_standby(void)
                 at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1);
 }
 
+static void sama5d3_ddr_standby(void)
+{
+        u32 lpr0;
+        u32 saved_lpr0;
+
+        saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR);
+        lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB;
+        lpr0 |= AT91_DDRSDRC_LPCB_POWER_DOWN;
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0);
+
+        cpu_do_idle();
+
+        at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0);
+}
+
 /* We manage both DDRAM/SDRAM controllers, we need more than one value to
  * remember.
  */
@@ -323,7 +339,7 @@ static const struct of_device_id const ramc_ids[] __initconst = {
         { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
         { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
         { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
-        { .compatible = "atmel,sama5d3-ddramc", .data = at91_ddr_standby },
+        { .compatible = "atmel,sama5d3-ddramc", .data = sama5d3_ddr_standby },
         { /*sentinel*/ }
 };
 
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 093458b62c8d..c89757abb0ae 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -241,6 +241,3 @@ obj-$(CONFIG_MACH_OMAP2_TUSB6010)	+= usb-tusb6010.o
 
 onenand-$(CONFIG_MTD_ONENAND_OMAP2)     := gpmc-onenand.o
 obj-y                                   += $(onenand-m) $(onenand-y)
-
-nand-$(CONFIG_MTD_NAND_OMAP2)           := gpmc-nand.o
-obj-y                                   += $(nand-m) $(nand-y)
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index c4f2ace91ea2..3089d3bfa19b 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -270,6 +270,7 @@ extern const struct smp_operations omap4_smp_ops;
 extern int omap4_mpuss_init(void);
 extern int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state);
 extern int omap4_hotplug_cpu(unsigned int cpu, unsigned int power_state);
+extern u32 omap4_get_cpu1_ns_pa_addr(void);
 #else
 static inline int omap4_enter_lowpower(unsigned int cpu,
                                         unsigned int power_state)
diff --git a/arch/arm/mach-omap2/gpmc-nand.c b/arch/arm/mach-omap2/gpmc-nand.c
deleted file mode 100644
index f6ac027f3c3b..000000000000
--- a/arch/arm/mach-omap2/gpmc-nand.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * gpmc-nand.c
- *
- * Copyright (C) 2009 Texas Instruments
- * Vimal Singh <vimalsingh@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/kernel.h>
-#include <linux/platform_device.h>
-#include <linux/io.h>
-#include <linux/omap-gpmc.h>
-#include <linux/mtd/nand.h>
-#include <linux/platform_data/mtd-nand-omap2.h>
-
-#include <asm/mach/flash.h>
-
-#include "soc.h"
-
-/* minimum size for IO mapping */
-#define NAND_IO_SIZE    4
-
-static bool gpmc_hwecc_bch_capable(enum omap_ecc ecc_opt)
-{
-        /* platforms which support all ECC schemes */
-        if (soc_is_am33xx() || soc_is_am43xx() || cpu_is_omap44xx() ||
-                 soc_is_omap54xx() || soc_is_dra7xx())
-                return 1;
-
-        if (ecc_opt == OMAP_ECC_BCH4_CODE_HW_DETECTION_SW ||
-                 ecc_opt == OMAP_ECC_BCH8_CODE_HW_DETECTION_SW) {
-                if (cpu_is_omap24xx())
-                        return 0;
-                else if (cpu_is_omap3630() && (GET_OMAP_REVISION() == 0))
-                        return 0;
-                else
-                        return 1;
-        }
-
-        /* OMAP3xxx do not have ELM engine, so cannot support ECC schemes
-         * which require H/W based ECC error detection */
-        if ((cpu_is_omap34xx() || cpu_is_omap3630()) &&
-            ((ecc_opt == OMAP_ECC_BCH4_CODE_HW) ||
-                 (ecc_opt == OMAP_ECC_BCH8_CODE_HW)))
-                return 0;
-
-        /* legacy platforms support only HAM1 (1-bit Hamming) ECC scheme */
-        if (ecc_opt == OMAP_ECC_HAM1_CODE_HW ||
-            ecc_opt == OMAP_ECC_HAM1_CODE_SW)
-                return 1;
-        else
-                return 0;
-}
-
-/* This function will go away once the device-tree convertion is complete */
-static void gpmc_set_legacy(struct omap_nand_platform_data *gpmc_nand_data,
-                            struct gpmc_settings *s)
-{
-        /* Enable RD PIN Monitoring Reg */
-        if (gpmc_nand_data->dev_ready) {
-                s->wait_on_read = true;
-                s->wait_on_write = true;
-        }
-
-        if (gpmc_nand_data->devsize == NAND_BUSWIDTH_16)
-                s->device_width = GPMC_DEVWIDTH_16BIT;
-        else
-                s->device_width = GPMC_DEVWIDTH_8BIT;
-}
-
-int gpmc_nand_init(struct omap_nand_platform_data *gpmc_nand_data,
-                   struct gpmc_timings *gpmc_t)
-{
-        int err = 0;
-        struct gpmc_settings s;
-        struct platform_device *pdev;
-        struct resource gpmc_nand_res[] = {
-                { .flags = IORESOURCE_MEM, },
-                { .flags = IORESOURCE_IRQ, },
-                { .flags = IORESOURCE_IRQ, },
-        };
-
-        BUG_ON(gpmc_nand_data->cs >= GPMC_CS_NUM);
-
-        err = gpmc_cs_request(gpmc_nand_data->cs, NAND_IO_SIZE,
-                              (unsigned long *)&gpmc_nand_res[0].start);
-        if (err < 0) {
-                pr_err("omap2-gpmc: Cannot request GPMC CS %d, error %d\n",
-                       gpmc_nand_data->cs, err);
-                return err;
-        }
-        gpmc_nand_res[0].end = gpmc_nand_res[0].start + NAND_IO_SIZE - 1;
-        gpmc_nand_res[1].start = gpmc_get_client_irq(GPMC_IRQ_FIFOEVENTENABLE);
-        gpmc_nand_res[2].start = gpmc_get_client_irq(GPMC_IRQ_COUNT_EVENT);
-
-        memset(&s, 0, sizeof(struct gpmc_settings));
-        gpmc_set_legacy(gpmc_nand_data, &s);
-
-        s.device_nand = true;
-
-        if (gpmc_t) {
-                err = gpmc_cs_set_timings(gpmc_nand_data->cs, gpmc_t, &s);
-                if (err < 0) {
-                        pr_err("omap2-gpmc: Unable to set gpmc timings: %d\n",
-                               err);
-                        return err;
-                }
-        }
-
-        err = gpmc_cs_program_settings(gpmc_nand_data->cs, &s);
-        if (err < 0)
-                goto out_free_cs;
-
-        err = gpmc_configure(GPMC_CONFIG_WP, 0);
-        if (err < 0)
-                goto out_free_cs;
-
-        if (!gpmc_hwecc_bch_capable(gpmc_nand_data->ecc_opt)) {
-                pr_err("omap2-nand: Unsupported NAND ECC scheme selected\n");
-                err = -EINVAL;
-                goto out_free_cs;
-        }
-
-
-        pdev = platform_device_alloc("omap2-nand", gpmc_nand_data->cs);
-        if (pdev) {
-                err = platform_device_add_resources(pdev, gpmc_nand_res,
-                                                    ARRAY_SIZE(gpmc_nand_res));
-                if (!err)
-                        pdev->dev.platform_data = gpmc_nand_data;
-        } else {
-                err = -ENOMEM;
-        }
-        if (err)
-                goto out_free_pdev;
-
-        err = platform_device_add(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "Unable to register NAND device\n");
-                goto out_free_pdev;
-        }
-
-        return 0;
-
-out_free_pdev:
-        platform_device_put(pdev);
-out_free_cs:
-        gpmc_cs_free(gpmc_nand_data->cs);
-
-        return err;
-}
diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c
index 8633c703546a..2944af820558 100644
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr)
         return ret;
 }
 
-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
+int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
 {
         int err;
         struct device *dev = &gpmc_onenand_device.dev;
@@ -393,15 +393,17 @@ void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
         if (err < 0) {
                 dev_err(dev, "Cannot request GPMC CS %d, error %d\n",
                         gpmc_onenand_data->cs, err);
-                return;
+                return err;
         }
 
         gpmc_onenand_resource.end = gpmc_onenand_resource.start +
                                                         ONENAND_IO_SIZE - 1;
 
-        if (platform_device_register(&gpmc_onenand_device) < 0) {
+        err = platform_device_register(&gpmc_onenand_device);
+        if (err) {
                 dev_err(dev, "Unable to register OneNAND device\n");
                 gpmc_cs_free(gpmc_onenand_data->cs);
-                return;
         }
+
+        return err;
 }
diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
index fe36ce2734d4..4c6f14cf92a8 100644
--- a/arch/arm/mach-omap2/omap-headsmp.S
+++ b/arch/arm/mach-omap2/omap-headsmp.S
@@ -17,6 +17,7 @@
 
 #include <linux/linkage.h>
 #include <linux/init.h>
+#include <asm/assembler.h>
 
 #include "omap44xx.h"
 
@@ -66,7 +67,7 @@ wait_2:	ldr	r2, =AUX_CORE_BOOT0_PA	@ read from AuxCoreBoot0
         cmp     r0, r4
         bne     wait_2
         ldr     r12, =API_HYP_ENTRY
-        adr     r0, hyp_boot
+        badr    r0, hyp_boot
         smc     #0
 hyp_boot:
         b       omap_secondary_startup
diff --git a/arch/arm/mach-omap2/omap-hotplug.c b/arch/arm/mach-omap2/omap-hotplug.c
index d3fb5661bb5d..433db6d0b073 100644
--- a/arch/arm/mach-omap2/omap-hotplug.c
+++ b/arch/arm/mach-omap2/omap-hotplug.c
@@ -50,7 +50,7 @@ void omap4_cpu_die(unsigned int cpu)
                 omap4_hotplug_cpu(cpu, PWRDM_POWER_OFF);
 
                 if (omap_secure_apis_support())
-                        boot_cpu = omap_read_auxcoreboot0();
+                        boot_cpu = omap_read_auxcoreboot0() >> 9;
                 else
                         boot_cpu =
                                 readl_relaxed(base + OMAP_AUX_CORE_BOOT_0) >> 5;
diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
index 113ab2dd2ee9..03ec6d307c82 100644
--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
@@ -64,6 +64,7 @@
 #include "prm-regbits-44xx.h"
 
 static void __iomem *sar_base;
+static u32 old_cpu1_ns_pa_addr;
 
 #if defined(CONFIG_PM) && defined(CONFIG_SMP)
 
@@ -212,6 +213,11 @@ static void __init save_l2x0_context(void)
 {}
 #endif
 
+u32 omap4_get_cpu1_ns_pa_addr(void)
+{
+        return old_cpu1_ns_pa_addr;
+}
+
 /**
  * omap4_enter_lowpower: OMAP4 MPUSS Low Power Entry Function
  * The purpose of this function is to manage low power programming
@@ -460,22 +466,30 @@ int __init omap4_mpuss_init(void)
 void __init omap4_mpuss_early_init(void)
 {
         unsigned long startup_pa;
+        void __iomem *ns_pa_addr;
 
-        if (!(cpu_is_omap44xx() || soc_is_omap54xx()))
+        if (!(soc_is_omap44xx() || soc_is_omap54xx()))
                 return;
 
         sar_base = omap4_get_sar_ram_base();
 
-        if (cpu_is_omap443x())
+        /* Save old NS_PA_ADDR for validity checks later on */
+        if (soc_is_omap44xx())
+                ns_pa_addr = sar_base + CPU1_WAKEUP_NS_PA_ADDR_OFFSET;
+        else
+                ns_pa_addr = sar_base + OMAP5_CPU1_WAKEUP_NS_PA_ADDR_OFFSET;
+        old_cpu1_ns_pa_addr = readl_relaxed(ns_pa_addr);
+
+        if (soc_is_omap443x())
                 startup_pa = __pa_symbol(omap4_secondary_startup);
-        else if (cpu_is_omap446x())
+        else if (soc_is_omap446x())
                 startup_pa = __pa_symbol(omap4460_secondary_startup);
         else if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
                 startup_pa = __pa_symbol(omap5_secondary_hyp_startup);
         else
                 startup_pa = __pa_symbol(omap5_secondary_startup);
 
-        if (cpu_is_omap44xx())
+        if (soc_is_omap44xx())
                 writel_relaxed(startup_pa, sar_base +
                                CPU1_WAKEUP_NS_PA_ADDR_OFFSET);
         else
diff --git a/arch/arm/mach-omap2/omap-smc.S b/arch/arm/mach-omap2/omap-smc.S
index fd90125bffc7..72506e6cf9e7 100644
--- a/arch/arm/mach-omap2/omap-smc.S
+++ b/arch/arm/mach-omap2/omap-smc.S
@@ -94,6 +94,5 @@ ENTRY(omap_read_auxcoreboot0)
         ldr     r12, =0x103
         dsb
         smc     #0
-        mov     r0, r0, lsr #9
         ldmfd   sp!, {r2-r12, pc}
 ENDPROC(omap_read_auxcoreboot0)
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 003353b0b794..3faf454ba487 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -21,6 +21,7 @@
 #include <linux/io.h>
 #include <linux/irqchip/arm-gic.h>
 
+#include <asm/sections.h>
 #include <asm/smp_scu.h>
 #include <asm/virt.h>
 
@@ -40,10 +41,14 @@
 
 #define OMAP5_CORE_COUNT        0x2
 
+#define AUX_CORE_BOOT0_GP_RELEASE       0x020
+#define AUX_CORE_BOOT0_HS_RELEASE       0x200
+
 struct omap_smp_config {
         unsigned long cpu1_rstctrl_pa;
         void __iomem *cpu1_rstctrl_va;
         void __iomem *scu_base;
+        void __iomem *wakeupgen_base;
         void *startup_addr;
 };
 
@@ -140,7 +145,6 @@ static int omap4_boot_secondary(unsigned int cpu, struct task_struct *idle)
         static struct clockdomain *cpu1_clkdm;
         static bool booted;
         static struct powerdomain *cpu1_pwrdm;
-        void __iomem *base = omap_get_wakeupgen_base();
 
         /*
          * Set synchronisation state between this boot processor
@@ -155,9 +159,11 @@ static int omap4_boot_secondary(unsigned int cpu, struct task_struct *idle)
          * A barrier is added to ensure that write buffer is drained
          */
         if (omap_secure_apis_support())
-                omap_modify_auxcoreboot0(0x200, 0xfffffdff);
+                omap_modify_auxcoreboot0(AUX_CORE_BOOT0_HS_RELEASE,
+                                         0xfffffdff);
         else
-                writel_relaxed(0x20, base + OMAP_AUX_CORE_BOOT_0);
+                writel_relaxed(AUX_CORE_BOOT0_GP_RELEASE,
+                               cfg.wakeupgen_base + OMAP_AUX_CORE_BOOT_0);
 
         if (!cpu1_clkdm && !cpu1_pwrdm) {
                 cpu1_clkdm = clkdm_lookup("mpu1_clkdm");
@@ -261,9 +267,72 @@ static void __init omap4_smp_init_cpus(void)
                 set_cpu_possible(i, true);
 }
 
+/*
+ * For now, just make sure the start-up address is not within the booting
+ * kernel space as that means we just overwrote whatever secondary_startup()
+ * code there was.
+ */
+static bool __init omap4_smp_cpu1_startup_valid(unsigned long addr)
+{
+        if ((addr >= __pa(PAGE_OFFSET)) && (addr <= __pa(__bss_start)))
+                return false;
+
+        return true;
+}
+
+/*
+ * We may need to reset CPU1 before configuring, otherwise kexec boot can end
+ * up trying to use old kernel startup address or suspend-resume will
+ * occasionally fail to bring up CPU1 on 4430 if CPU1 fails to enter deeper
+ * idle states.
+ */
+static void __init omap4_smp_maybe_reset_cpu1(struct omap_smp_config *c)
+{
+        unsigned long cpu1_startup_pa, cpu1_ns_pa_addr;
+        bool needs_reset = false;
+        u32 released;
+
+        if (omap_secure_apis_support())
+                released = omap_read_auxcoreboot0() & AUX_CORE_BOOT0_HS_RELEASE;
+        else
+                released = readl_relaxed(cfg.wakeupgen_base +
+                                         OMAP_AUX_CORE_BOOT_0) &
+                                                AUX_CORE_BOOT0_GP_RELEASE;
+        if (released) {
+                pr_warn("smp: CPU1 not parked?\n");
+
+                return;
+        }
+
+        cpu1_startup_pa = readl_relaxed(cfg.wakeupgen_base +
+                                        OMAP_AUX_CORE_BOOT_1);
+        cpu1_ns_pa_addr = omap4_get_cpu1_ns_pa_addr();
+
+        /* Did the configured secondary_startup() get overwritten? */
+        if (!omap4_smp_cpu1_startup_valid(cpu1_startup_pa))
+                needs_reset = true;
+
+        /*
+         * If omap4 or 5 has NS_PA_ADDR configured, CPU1 may be in a
+         * deeper idle state in WFI and will wake to an invalid address.
+         */
+        if ((soc_is_omap44xx() || soc_is_omap54xx()) &&
+            !omap4_smp_cpu1_startup_valid(cpu1_ns_pa_addr))
+                needs_reset = true;
+
+        if (!needs_reset || !c->cpu1_rstctrl_va)
+                return;
+
+        pr_info("smp: CPU1 parked within kernel, needs reset (0x%lx 0x%lx)\n",
+                cpu1_startup_pa, cpu1_ns_pa_addr);
+
+        writel_relaxed(1, c->cpu1_rstctrl_va);
+        readl_relaxed(c->cpu1_rstctrl_va);
+        writel_relaxed(0, c->cpu1_rstctrl_va);
+}
+
 static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
 {
-        void __iomem *base = omap_get_wakeupgen_base();
         const struct omap_smp_config *c = NULL;
 
         if (soc_is_omap443x())
@@ -281,6 +350,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
         /* Must preserve cfg.scu_base set earlier */
         cfg.cpu1_rstctrl_pa = c->cpu1_rstctrl_pa;
         cfg.startup_addr = c->startup_addr;
+        cfg.wakeupgen_base = omap_get_wakeupgen_base();
 
         if (soc_is_dra74x() || soc_is_omap54xx()) {
                 if ((__boot_cpu_mode & MODE_MASK) == HYP_MODE)
@@ -299,15 +369,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
         if (cfg.scu_base)
                 scu_enable(cfg.scu_base);
 
-        /*
-         * Reset CPU1 before configuring, otherwise kexec will
-         * end up trying to use old kernel startup address.
-         */
-        if (cfg.cpu1_rstctrl_va) {
-                writel_relaxed(1, cfg.cpu1_rstctrl_va);
-                readl_relaxed(cfg.cpu1_rstctrl_va);
-                writel_relaxed(0, cfg.cpu1_rstctrl_va);
-        }
+        omap4_smp_maybe_reset_cpu1(&cfg);
 
         /*
          * Write the address of secondary startup routine into the
@@ -319,7 +381,7 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
                 omap_auxcoreboot_addr(__pa_symbol(cfg.startup_addr));
         else
                 writel_relaxed(__pa_symbol(cfg.startup_addr),
-                               base + OMAP_AUX_CORE_BOOT_1);
+                               cfg.wakeupgen_base + OMAP_AUX_CORE_BOOT_1);
 }
 
 const struct smp_operations omap4_smp_ops __initconst = {
diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
index e920dd83e443..f989145480c8 100644
--- a/arch/arm/mach-omap2/omap_device.c
+++ b/arch/arm/mach-omap2/omap_device.c
@@ -222,6 +222,14 @@ static int _omap_device_notifier_call(struct notifier_block *nb,
                                 dev_err(dev, "failed to idle\n");
                 }
                 break;
+        case BUS_NOTIFY_BIND_DRIVER:
+                od = to_omap_device(pdev);
+                if (od && (od->_state == OMAP_DEVICE_STATE_ENABLED) &&
+                    pm_runtime_status_suspended(dev)) {
+                        od->_driver_status = BUS_NOTIFY_BIND_DRIVER;
+                        pm_runtime_set_active(dev);
+                }
+                break;
         case BUS_NOTIFY_ADD_DEVICE:
                 if (pdev->dev.of_node)
                         omap_device_build_from_dt(pdev);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index 56f917ec8621..1435fee39a89 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2112,11 +2112,20 @@ static struct omap_hwmod_ocp_if omap3_l4_core__i2c3 = {
 };
 
 /* L4 CORE -> SR1 interface */
+static struct omap_hwmod_addr_space omap3_sr1_addr_space[] = {
+        {
+                .pa_start       = OMAP34XX_SR1_BASE,
+                .pa_end         = OMAP34XX_SR1_BASE + SZ_1K - 1,
+                .flags          = ADDR_TYPE_RT,
+        },
+        { },
+};
 
 static struct omap_hwmod_ocp_if omap34xx_l4_core__sr1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap34xx_sr1_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr1_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -2124,15 +2133,25 @@ static struct omap_hwmod_ocp_if omap36xx_l4_core__sr1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap36xx_sr1_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr1_addr_space,
         .user           = OCP_USER_MPU,
 };
 
 /* L4 CORE -> SR1 interface */
+static struct omap_hwmod_addr_space omap3_sr2_addr_space[] = {
+        {
+                .pa_start       = OMAP34XX_SR2_BASE,
+                .pa_end         = OMAP34XX_SR2_BASE + SZ_1K - 1,
+                .flags          = ADDR_TYPE_RT,
+        },
+        { },
+};
 
 static struct omap_hwmod_ocp_if omap34xx_l4_core__sr2 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap34xx_sr2_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr2_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -2140,6 +2159,7 @@ static struct omap_hwmod_ocp_if omap36xx_l4_core__sr2 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap36xx_sr2_hwmod,
         .clk            = "sr_l4_ick",
+        .addr           = omap3_sr2_addr_space,
         .user           = OCP_USER_MPU,
 };
 
@@ -3111,16 +3131,20 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_hwmod_ocp_ifs[] __initdata = {
  * Return: 0 if device named @dev_name is not likely to be accessible,
  * or 1 if it is likely to be accessible.
  */
-static int __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
-                                                       const char *dev_name)
+static bool __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
+                                                        const char *dev_name)
 {
+        struct device_node *node;
+        bool available;
+
         if (!bus)
-                return (omap_type() == OMAP2_DEVICE_TYPE_GP) ? 1 : 0;
+                return omap_type() == OMAP2_DEVICE_TYPE_GP;
 
-        if (of_device_is_available(of_find_node_by_name(bus, dev_name)))
-                return 1;
+        node = of_get_child_by_name(bus, dev_name);
+        available = of_device_is_available(node);
+        of_node_put(node);
 
-        return 0;
+        return available;
 }
 
 int __init omap3xxx_hwmod_init(void)
@@ -3189,15 +3213,20 @@ int __init omap3xxx_hwmod_init(void)
 
         if (h_sham && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "sham")) {
                 r = omap_hwmod_register_links(h_sham);
-                if (r < 0)
+                if (r < 0) {
+                        of_node_put(bus);
                         return r;
+                }
         }
 
         if (h_aes && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "aes")) {
                 r = omap_hwmod_register_links(h_aes);
-                if (r < 0)
+                if (r < 0) {
+                        of_node_put(bus);
                         return r;
+                }
         }
+        of_node_put(bus);
 
         /*
          * Register hwmod links specific to certain ES levels of a
diff --git a/arch/arm/mach-orion5x/Kconfig b/arch/arm/mach-orion5x/Kconfig
index 633442ad4e4c..2a7bb6ccdcb7 100644
--- a/arch/arm/mach-orion5x/Kconfig
+++ b/arch/arm/mach-orion5x/Kconfig
@@ -6,6 +6,7 @@ menuconfig ARCH_ORION5X
         select GPIOLIB
         select MVEBU_MBUS
         select PCI
+        select PHYLIB if NETDEVICES
         select PLAT_ORION_LEGACY
         help
           Support for the following Marvell Orion 5x series SoCs:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 63eabb06f9f1..475811f5383a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -935,13 +935,31 @@ static void arm_coherent_dma_free(struct device *dev, size_t size, void *cpu_add
         __arm_dma_free(dev, size, cpu_addr, handle, attrs, true);
 }
 
+/*
+ * The whole dma_get_sgtable() idea is fundamentally unsafe - it seems
+ * that the intention is to allow exporting memory allocated via the
+ * coherent DMA APIs through the dma_buf API, which only accepts a
+ * scattertable.  This presents a couple of problems:
+ * 1. Not all memory allocated via the coherent DMA APIs is backed by
+ *    a struct page
+ * 2. Passing coherent DMA memory into the streaming APIs is not allowed
+ *    as we will try to flush the memory through a different alias to that
+ *    actually being used (and the flushes are redundant.)
+ */
 int arm_dma_get_sgtable(struct device *dev, struct sg_table *sgt,
                  void *cpu_addr, dma_addr_t handle, size_t size,
                  unsigned long attrs)
 {
-        struct page *page = pfn_to_page(dma_to_pfn(dev, handle));
+        unsigned long pfn = dma_to_pfn(dev, handle);
+        struct page *page;
         int ret;
 
+        /* If the PFN is not valid, we do not have a struct page */
+        if (!pfn_valid(pfn))
+                return -ENXIO;
+
+        page = pfn_to_page(pfn);
+
         ret = sg_alloc_table(sgt, 1, GFP_KERNEL);
         if (unlikely(ret))
                 return ret;
diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
index 3b5c7aaf9c76..33a45bd96860 100644
--- a/arch/arm/mm/nommu.c
+++ b/arch/arm/mm/nommu.c
@@ -303,7 +303,10 @@ static inline void set_vbar(unsigned long val)
  */
 static inline bool security_extensions_enabled(void)
 {
-        return !!cpuid_feature_extract(CPUID_EXT_PFR1, 4);
+        /* Check CPUID Identification Scheme before ID_PFR1 read */
+        if ((read_cpuid_id() & 0x000f0000) == 0x000f0000)
+                return !!cpuid_feature_extract(CPUID_EXT_PFR1, 4);
+        return 0;
 }
 
 static unsigned long __init setup_vectors_base(void)
diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c
index 9255b6d67ba5..aff6994950ba 100644
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -468,6 +468,7 @@ void __init orion_ge11_init(struct mv643xx_eth_platform_data *eth_data,
                     eth_data, &orion_ge11);
 }
 
+#ifdef CONFIG_ARCH_ORION5X
 /*****************************************************************************
  * Ethernet switch
  ****************************************************************************/
@@ -480,6 +481,9 @@ void __init orion_ge00_switch_init(struct dsa_chip_data *d)
         struct mdio_board_info *bd;
         unsigned int i;
 
+        if (!IS_BUILTIN(CONFIG_PHYLIB))
+                return;
+
         for (i = 0; i < ARRAY_SIZE(d->port_names); i++)
                 if (!strcmp(d->port_names[i], "cpu"))
                         break;
@@ -493,6 +497,7 @@ void __init orion_ge00_switch_init(struct dsa_chip_data *d)
 
         mdiobus_register_board_info(&orion_ge00_switch_board_info, 1);
 }
+#endif
 
 /*****************************************************************************
  * I2C
diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
index b6dc9d838a9a..ad1f4e6a9e33 100644
--- a/arch/arm/probes/kprobes/core.c
+++ b/arch/arm/probes/kprobes/core.c
@@ -266,11 +266,20 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
 #endif
 
         if (p) {
-                if (cur) {
+                if (!p->ainsn.insn_check_cc(regs->ARM_cpsr)) {
+                        /*
+                         * Probe hit but conditional execution check failed,
+                         * so just skip the instruction and continue as if
+                         * nothing had happened.
+                         * In this case, we can skip recursing check too.
+                         */
+                        singlestep_skip(p, regs);
+                } else if (cur) {
                         /* Kprobe is pending, so we're recursing. */
                         switch (kcb->kprobe_status) {
                         case KPROBE_HIT_ACTIVE:
                         case KPROBE_HIT_SSDONE:
+                        case KPROBE_HIT_SS:
                                 /* A pre- or post-handler probe got us here. */
                                 kprobes_inc_nmissed_count(p);
                                 save_previous_kprobe(kcb);
@@ -279,11 +288,16 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
                                 singlestep(p, regs, kcb);
                                 restore_previous_kprobe(kcb);
                                 break;
+                        case KPROBE_REENTER:
+                                /* A nested probe was hit in FIQ, it is a BUG */
+                                pr_warn("Unrecoverable kprobe detected at %p.\n",
+                                        p->addr);
+                                /* fall through */
                         default:
                                 /* impossible cases */
                                 BUG();
                         }
-                } else if (p->ainsn.insn_check_cc(regs->ARM_cpsr)) {
+                } else {
                         /* Probe hit and conditional execution check ok. */
                         set_current_kprobe(p);
                         kcb->kprobe_status = KPROBE_HIT_ACTIVE;
@@ -304,13 +318,6 @@ void __kprobes kprobe_handler(struct pt_regs *regs)
                                 }
                                 reset_current_kprobe();
                         }
-                } else {
-                        /*
-                         * Probe hit but conditional execution check failed,
-                         * so just skip the instruction and continue as if
-                         * nothing had happened.
-                         */
-                        singlestep_skip(p, regs);
                 }
         } else if (cur) {
                 /* We probably hit a jprobe.  Call its break handler. */
@@ -434,6 +441,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
         struct hlist_node *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
+        kprobe_opcode_t *correct_ret_addr = NULL;
 
         INIT_HLIST_HEAD(&empty_rp);
         kretprobe_hash_lock(current, &head, &flags);
@@ -456,14 +464,34 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
                         /* another task is sharing our hash bucket */
                         continue;
 
+                orig_ret_address = (unsigned long)ri->ret_addr;
+
+                if (orig_ret_address != trampoline_address)
+                        /*
+                         * This is the real return address. Any other
+                         * instances associated with this task are for
+                         * other calls deeper on the call stack
+                         */
+                        break;
+        }
+
+        kretprobe_assert(ri, orig_ret_address, trampoline_address);
+
+        correct_ret_addr = ri->ret_addr;
+        hlist_for_each_entry_safe(ri, tmp, head, hlist) {
+                if (ri->task != current)
+                        /* another task is sharing our hash bucket */
+                        continue;
+
+                orig_ret_address = (unsigned long)ri->ret_addr;
                 if (ri->rp && ri->rp->handler) {
                         __this_cpu_write(current_kprobe, &ri->rp->kp);
                         get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
+                        ri->ret_addr = correct_ret_addr;
                         ri->rp->handler(ri, regs);
                         __this_cpu_write(current_kprobe, NULL);
                 }
 
-                orig_ret_address = (unsigned long)ri->ret_addr;
                 recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
@@ -475,7 +503,6 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs)
                         break;
         }
 
-        kretprobe_assert(ri, orig_ret_address, trampoline_address);
         kretprobe_hash_unlock(current, &flags);
 
         hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {
diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c
index c893726aa52d..1c98a87786ca 100644
--- a/arch/arm/probes/kprobes/test-core.c
+++ b/arch/arm/probes/kprobes/test-core.c
@@ -977,7 +977,10 @@ static void coverage_end(void)
 void __naked __kprobes_test_case_start(void)
 {
         __asm__ __volatile__ (
-                "stmdb  sp!, {r4-r11}                           \n\t"
+                "mov    r2, sp                                  \n\t"
+                "bic    r3, r2, #7                              \n\t"
+                "mov    sp, r3                                  \n\t"
+                "stmdb  sp!, {r2-r11}                           \n\t"
                 "sub    sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
                 "bic    r0, lr, #1  @ r0 = inline data          \n\t"
                 "mov    r1, sp                                  \n\t"
@@ -997,7 +1000,8 @@ void __naked __kprobes_test_case_end_32(void)
                 "movne  pc, r0                                  \n\t"
                 "mov    r0, r4                                  \n\t"
                 "add    sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
-                "ldmia  sp!, {r4-r11}                           \n\t"
+                "ldmia  sp!, {r2-r11}                           \n\t"
+                "mov    sp, r2                                  \n\t"
                 "mov    pc, r0                                  \n\t"
         );
 }
@@ -1013,7 +1017,8 @@ void __naked __kprobes_test_case_end_16(void)
                 "bxne   r0                                      \n\t"
                 "mov    r0, r4                                  \n\t"
                 "add    sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t"
-                "ldmia  sp!, {r4-r11}                           \n\t"
+                "ldmia  sp!, {r2-r11}                           \n\t"
+                "mov    sp, r2                                  \n\t"
                 "bx     r0                                      \n\t"
         );
 }
diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl
index 3c2cb5d5adfa..0bb0e9c6376c 100644
--- a/arch/arm/tools/syscall.tbl
+++ b/arch/arm/tools/syscall.tbl
@@ -411,3 +411,4 @@
 394     common  pkey_mprotect           sys_pkey_mprotect
 395     common  pkey_alloc              sys_pkey_alloc
 396     common  pkey_free               sys_pkey_free
+397     common  statx                   sys_statx
diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c
index ce18c91b50a1..f0325d96b97a 100644
--- a/arch/arm/xen/mm.c
+++ b/arch/arm/xen/mm.c
@@ -198,6 +198,8 @@ static const struct dma_map_ops xen_swiotlb_dma_ops = {
         .unmap_page = xen_swiotlb_unmap_page,
         .dma_supported = xen_swiotlb_dma_supported,
         .set_dma_mask = xen_swiotlb_set_dma_mask,
+        .mmap = xen_swiotlb_dma_mmap,
+        .get_sgtable = xen_swiotlb_get_sgtable,
 };
 
 int __init xen_mm_init(void)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a39029b5414e..3741859765cf 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -508,6 +508,16 @@ config QCOM_FALKOR_ERRATUM_1009
 
           If unsure, say Y.
 
+config QCOM_QDF2400_ERRATUM_0065
+        bool "QDF2400 E0065: Incorrect GITS_TYPER.ITT_Entry_size"
+        default y
+        help
+          On Qualcomm Datacenter Technologies QDF2400 SoC, ITS hardware reports
+          ITE size incorrectly. The GITS_TYPER.ITT_Entry_size field should have
+          been indicated as 16Bytes (0xf), not 8Bytes (0x7).
+
+          If unsure, say Y.
+
 endmenu
 
 
@@ -1063,6 +1073,10 @@ config SYSVIPC_COMPAT
         def_bool y
         depends on COMPAT && SYSVIPC
 
+config KEYS_COMPAT
+        def_bool y
+        depends on COMPAT && KEYS
+
 endmenu
 
 menu "Power management options"
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
index 1c64ea2d23f9..0565779e66fa 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
@@ -179,8 +179,10 @@
                 usbphy: phy@01c19400 {
                         compatible = "allwinner,sun50i-a64-usb-phy";
                         reg = <0x01c19400 0x14>,
+                              <0x01c1a800 0x4>,
                               <0x01c1b800 0x4>;
                         reg-names = "phy_ctrl",
+                                    "pmu0",
                                     "pmu1";
                         clocks = <&ccu CLK_USB_PHY0>,
                                  <&ccu CLK_USB_PHY1>;
diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
index 9f9e203c09c5..bcb03fc32665 100644
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -114,6 +114,7 @@
         pcie0: pcie@20020000 {
                 compatible = "brcm,iproc-pcie";
                 reg = <0 0x20020000 0 0x1000>;
+                dma-coherent;
 
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
@@ -144,6 +145,7 @@
         pcie4: pcie@50020000 {
                 compatible = "brcm,iproc-pcie";
                 reg = <0 0x50020000 0 0x1000>;
+                dma-coherent;
 
                 #interrupt-cells = <1>;
                 interrupt-map-mask = <0 0 0 0>;
@@ -174,6 +176,7 @@
         pcie8: pcie@60c00000 {
                 compatible = "brcm,iproc-pcie-paxc";
                 reg = <0 0x60c00000 0 0x1000>;
+                dma-coherent;
                 linux,pci-domain = <8>;
 
                 bus-range = <0x0 0x1>;
@@ -203,6 +206,7 @@
                               <0x61030000 0x100>;
                         reg-names = "amac_base", "idm_base", "nicpm_base";
                         interrupts = <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         phy-handle = <&gphy0>;
                         phy-mode = "rgmii";
                         status = "disabled";
@@ -213,6 +217,7 @@
                         reg = <0x612c0000 0x445>;  /* PDC FS0 regs */
                         interrupts = <GIC_SPI 187 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -222,6 +227,7 @@
                         reg = <0x612e0000 0x445>;  /* PDC FS1 regs */
                         interrupts = <GIC_SPI 189 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -231,6 +237,7 @@
                         reg = <0x61300000 0x445>;  /* PDC FS2 regs */
                         interrupts = <GIC_SPI 191 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -240,6 +247,7 @@
                         reg = <0x61320000 0x445>;  /* PDC FS3 regs */
                         interrupts = <GIC_SPI 193 IRQ_TYPE_LEVEL_HIGH>;
                         #mbox-cells = <1>;
+                        dma-coherent;
                         brcm,rx-status-len = <32>;
                         brcm,use-bcm-hdr;
                 };
@@ -644,6 +652,7 @@
                 sata: ahci@663f2000 {
                         compatible = "brcm,iproc-ahci", "generic-ahci";
                         reg = <0x663f2000 0x1000>;
+                        dma-coherent;
                         reg-names = "ahci";
                         interrupts = <GIC_SPI 438 IRQ_TYPE_LEVEL_HIGH>;
                         #address-cells = <1>;
@@ -667,6 +676,7 @@
                         compatible = "brcm,sdhci-iproc-cygnus";
                         reg = <0x66420000 0x100>;
                         interrupts = <GIC_SPI 421 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         bus-width = <8>;
                         clocks = <&genpll_sw BCM_NS2_GENPLL_SW_SDIO_CLK>;
                         status = "disabled";
@@ -676,6 +686,7 @@
                         compatible = "brcm,sdhci-iproc-cygnus";
                         reg = <0x66430000 0x100>;
                         interrupts = <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>;
+                        dma-coherent;
                         bus-width = <8>;
                         clocks = <&genpll_sw BCM_NS2_GENPLL_SW_SDIO_CLK>;
                         status = "disabled";
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 05310ad8c5ab..f31c48d0cd68 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -251,7 +251,7 @@ static inline bool system_supports_fpsimd(void)
 static inline bool system_uses_ttbr0_pan(void)
 {
         return IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN) &&
-                !cpus_have_cap(ARM64_HAS_PAN);
+                !cpus_have_const_cap(ARM64_HAS_PAN);
 }
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/arm64/include/asm/current.h b/arch/arm64/include/asm/current.h
index 86c404171305..f6580d4afb0e 100644
--- a/arch/arm64/include/asm/current.h
+++ b/arch/arm64/include/asm/current.h
@@ -3,8 +3,6 @@
 
 #include <linux/compiler.h>
 
-#include <asm/sysreg.h>
-
 #ifndef __ASSEMBLY__
 
 struct task_struct;
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index f21fd3894370..e7705e7bb07b 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -30,8 +30,7 @@
 
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
 
-#define KVM_USER_MEM_SLOTS 32
-#define KVM_PRIVATE_MEM_SLOTS 4
+#define KVM_USER_MEM_SLOTS 512
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #define KVM_HALT_POLL_NS_DEFAULT 500000
 
diff --git a/arch/arm64/include/asm/pgtable-types.h b/arch/arm64/include/asm/pgtable-types.h
index 69b2fd41503c..345a072b5856 100644
--- a/arch/arm64/include/asm/pgtable-types.h
+++ b/arch/arm64/include/asm/pgtable-types.h
@@ -55,9 +55,13 @@ typedef struct { pteval_t pgprot; } pgprot_t;
 #define __pgprot(x)     ((pgprot_t) { (x) } )
 
 #if CONFIG_PGTABLE_LEVELS == 2
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #elif CONFIG_PGTABLE_LEVELS == 3
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
+#elif CONFIG_PGTABLE_LEVELS == 4
+#include <asm-generic/5level-fixup.h>
 #endif
 
 #endif  /* __ASM_PGTABLE_TYPES_H */
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index e78ac26324bd..bdbeb06dc11e 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -44,7 +44,7 @@
 #define __ARM_NR_compat_cacheflush      (__ARM_NR_COMPAT_BASE+2)
 #define __ARM_NR_compat_set_tls         (__ARM_NR_COMPAT_BASE+5)
 
-#define __NR_compat_syscalls            394
+#define __NR_compat_syscalls            398
 #endif
 
 #define __ARCH_WANT_SYS_CLONE
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index b7e8ef16ff0d..c66b51aab195 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -809,6 +809,14 @@ __SYSCALL(__NR_copy_file_range, sys_copy_file_range)
 __SYSCALL(__NR_preadv2, compat_sys_preadv2)
 #define __NR_pwritev2 393
 __SYSCALL(__NR_pwritev2, compat_sys_pwritev2)
+#define __NR_pkey_mprotect 394
+__SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
+#define __NR_pkey_alloc 395
+__SYSCALL(__NR_pkey_alloc, sys_pkey_alloc)
+#define __NR_pkey_free 396
+__SYSCALL(__NR_pkey_free, sys_pkey_free)
+#define __NR_statx 397
+__SYSCALL(__NR_statx, sys_statx)
 
 /*
  * Please add new compat syscalls above this comment and update
diff --git a/arch/arm64/kernel/cpuidle.c b/arch/arm64/kernel/cpuidle.c
index 75a0f8acef66..fd691087dc9a 100644
--- a/arch/arm64/kernel/cpuidle.c
+++ b/arch/arm64/kernel/cpuidle.c
@@ -30,7 +30,7 @@ int arm_cpuidle_init(unsigned int cpu)
 }
 
 /**
- * cpu_suspend() - function to enter a low-power idle state
+ * arm_cpuidle_suspend() - function to enter a low-power idle state
  * @arg: argument to pass to CPU suspend operations
  *
  * Return: 0 on success, -EOPNOTSUPP if CPU suspend hook not initialized, CPU
diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
index 769f24ef628c..d7e90d97f5c4 100644
--- a/arch/arm64/kernel/kaslr.c
+++ b/arch/arm64/kernel/kaslr.c
@@ -131,11 +131,15 @@ u64 __init kaslr_early_init(u64 dt_phys, u64 modulo_offset)
         /*
          * The kernel Image should not extend across a 1GB/32MB/512MB alignment
          * boundary (for 4KB/16KB/64KB granule kernels, respectively). If this
-         * happens, increase the KASLR offset by the size of the kernel image.
+         * happens, increase the KASLR offset by the size of the kernel image
+         * rounded up by SWAPPER_BLOCK_SIZE.
          */
         if ((((u64)_text + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT) !=
-            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT))
-                offset = (offset + (u64)(_end - _text)) & mask;
+            (((u64)_end + offset + modulo_offset) >> SWAPPER_TABLE_SHIFT)) {
+                u64 kimg_sz = _end - _text;
+                offset = (offset + round_up(kimg_sz, SWAPPER_BLOCK_SIZE))
+                                & mask;
+        }
 
         if (IS_ENABLED(CONFIG_KASAN))
                 /*
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 2a07aae5b8a2..c5c45942fb6e 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -372,12 +372,6 @@ int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
         return 0;
 }
 
-int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
-                                       unsigned long val, void *data)
-{
-        return NOTIFY_DONE;
-}
-
 static void __kprobes kprobe_handler(struct pt_regs *regs)
 {
         struct kprobe *p, *cur_kprobe;
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index ef1caae02110..9b1036570586 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -944,7 +944,7 @@ static bool have_cpu_die(void)
 #ifdef CONFIG_HOTPLUG_CPU
         int any_cpu = raw_smp_processor_id();
 
-        if (cpu_ops[any_cpu]->cpu_die)
+        if (cpu_ops[any_cpu] && cpu_ops[any_cpu]->cpu_die)
                 return true;
 #endif
         return false;
diff --git a/arch/arm64/kernel/vdso/.gitignore b/arch/arm64/kernel/vdso/.gitignore
index b8cc94e9698b..f8b69d84238e 100644
--- a/arch/arm64/kernel/vdso/.gitignore
+++ b/arch/arm64/kernel/vdso/.gitignore
@@ -1,2 +1 @@
 vdso.lds
-vdso-offsets.h
diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
index 1bfe30dfbfe7..fa1b18e364fc 100644
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -135,7 +135,19 @@ static int kvm_handle_guest_debug(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return ret;
 }
 
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+        kvm_pr_unimpl("Unknown exception class: hsr: %#08x -- %s\n",
+                      hsr, esr_get_class_string(hsr));
+
+        kvm_inject_undefined(vcpu);
+        return 1;
+}
+
 static exit_handle_fn arm_exit_handlers[] = {
+        [0 ... ESR_ELx_EC_MAX]  = kvm_handle_unknown_ec,
         [ESR_ELx_EC_WFx]        = kvm_handle_wfx,
         [ESR_ELx_EC_CP15_32]    = kvm_handle_cp15_32,
         [ESR_ELx_EC_CP15_64]    = kvm_handle_cp15_64,
@@ -162,13 +174,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu)
         u32 hsr = kvm_vcpu_get_hsr(vcpu);
         u8 hsr_ec = ESR_ELx_EC(hsr);
 
-        if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
-            !arm_exit_handlers[hsr_ec]) {
-                kvm_err("Unknown exception class: hsr: %#08x -- %s\n",
-                        hsr, esr_get_class_string(hsr));
-                BUG();
-        }
-
         return arm_exit_handlers[hsr_ec];
 }
 
diff --git a/arch/arm64/kvm/hyp/tlb.c b/arch/arm64/kvm/hyp/tlb.c
index e8e7ba2bc11f..9e1d2b75eecd 100644
--- a/arch/arm64/kvm/hyp/tlb.c
+++ b/arch/arm64/kvm/hyp/tlb.c
@@ -18,14 +18,62 @@
 #include <asm/kvm_hyp.h>
 #include <asm/tlbflush.h>
 
+static void __hyp_text __tlb_switch_to_guest_vhe(struct kvm *kvm)
+{
+        u64 val;
+
+        /*
+         * With VHE enabled, we have HCR_EL2.{E2H,TGE} = {1,1}, and
+         * most TLB operations target EL2/EL0. In order to affect the
+         * guest TLBs (EL1/EL0), we need to change one of these two
+         * bits. Changing E2H is impossible (goodbye TTBR1_EL2), so
+         * let's flip TGE before executing the TLB operation.
+         */
+        write_sysreg(kvm->arch.vttbr, vttbr_el2);
+        val = read_sysreg(hcr_el2);
+        val &= ~HCR_TGE;
+        write_sysreg(val, hcr_el2);
+        isb();
+}
+
+static void __hyp_text __tlb_switch_to_guest_nvhe(struct kvm *kvm)
+{
+        write_sysreg(kvm->arch.vttbr, vttbr_el2);
+        isb();
+}
+
+static hyp_alternate_select(__tlb_switch_to_guest,
+                            __tlb_switch_to_guest_nvhe,
+                            __tlb_switch_to_guest_vhe,
+                            ARM64_HAS_VIRT_HOST_EXTN);
+
+static void __hyp_text __tlb_switch_to_host_vhe(struct kvm *kvm)
+{
+        /*
+         * We're done with the TLB operation, let's restore the host's
+         * view of HCR_EL2.
+         */
+        write_sysreg(0, vttbr_el2);
+        write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
+}
+
+static void __hyp_text __tlb_switch_to_host_nvhe(struct kvm *kvm)
+{
+        write_sysreg(0, vttbr_el2);
+}
+
+static hyp_alternate_select(__tlb_switch_to_host,
+                            __tlb_switch_to_host_nvhe,
+                            __tlb_switch_to_host_vhe,
+                            ARM64_HAS_VIRT_HOST_EXTN);
+
 void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
 {
         dsb(ishst);
 
         /* Switch to requested VMID */
         kvm = kern_hyp_va(kvm);
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
-        isb();
+        __tlb_switch_to_guest()(kvm);
 
         /*
          * We could do so much better if we had the VA as well.
@@ -46,7 +94,7 @@ void __hyp_text __kvm_tlb_flush_vmid_ipa(struct kvm *kvm, phys_addr_t ipa)
         dsb(ish);
         isb();
 
-        write_sysreg(0, vttbr_el2);
+        __tlb_switch_to_host()(kvm);
 }
 
 void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
@@ -55,14 +103,13 @@ void __hyp_text __kvm_tlb_flush_vmid(struct kvm *kvm)
 
         /* Switch to requested VMID */
         kvm = kern_hyp_va(kvm);
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
-        isb();
+        __tlb_switch_to_guest()(kvm);
 
         __tlbi(vmalls12e1is);
         dsb(ish);
         isb();
 
-        write_sysreg(0, vttbr_el2);
+        __tlb_switch_to_host()(kvm);
 }
 
 void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
@@ -70,14 +117,13 @@ void __hyp_text __kvm_tlb_flush_local_vmid(struct kvm_vcpu *vcpu)
         struct kvm *kvm = kern_hyp_va(kern_hyp_va(vcpu)->kvm);
 
         /* Switch to requested VMID */
-        write_sysreg(kvm->arch.vttbr, vttbr_el2);
-        isb();
+        __tlb_switch_to_guest()(kvm);
 
         __tlbi(vmalle1);
         dsb(nsh);
         isb();
 
-        write_sysreg(0, vttbr_el2);
+        __tlb_switch_to_host()(kvm);
 }
 
 void __hyp_text __kvm_flush_vm_context(void)
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 4bf899fb451b..1b35b8bddbfb 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -42,7 +42,20 @@
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 
-static const char *fault_name(unsigned int esr);
+struct fault_info {
+        int     (*fn)(unsigned long addr, unsigned int esr,
+                      struct pt_regs *regs);
+        int     sig;
+        int     code;
+        const char *name;
+};
+
+static const struct fault_info fault_info[];
+
+static inline const struct fault_info *esr_to_fault_info(unsigned int esr)
+{
+        return fault_info + (esr & 63);
+}
 
 #ifdef CONFIG_KPROBES
 static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
@@ -197,10 +210,12 @@ static void __do_user_fault(struct task_struct *tsk, unsigned long addr,
                             struct pt_regs *regs)
 {
         struct siginfo si;
+        const struct fault_info *inf;
 
         if (unhandled_signal(tsk, sig) && show_unhandled_signals_ratelimited()) {
+                inf = esr_to_fault_info(esr);
                 pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
-                        tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
+                        tsk->comm, task_pid_nr(tsk), inf->name, sig,
                         addr, esr);
                 show_pte(tsk->mm, addr);
                 show_regs(regs);
@@ -219,14 +234,16 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re
 {
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->active_mm;
+        const struct fault_info *inf;
 
         /*
          * If we are in kernel mode at this point, we have no context to
          * handle this fault with.
          */
-        if (user_mode(regs))
-                __do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
-        else
+        if (user_mode(regs)) {
+                inf = esr_to_fault_info(esr);
+                __do_user_fault(tsk, addr, esr, inf->sig, inf->code, regs);
+        } else
                 __do_kernel_fault(mm, addr, esr, regs);
 }
 
@@ -488,12 +505,7 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
         return 1;
 }
 
-static const struct fault_info {
-        int     (*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-        int     sig;
-        int     code;
-        const char *name;
-} fault_info[] = {
+static const struct fault_info fault_info[] = {
         { do_bad,               SIGBUS,  0,             "ttbr address size fault"       },
         { do_bad,               SIGBUS,  0,             "level 1 address size fault"    },
         { do_bad,               SIGBUS,  0,             "level 2 address size fault"    },
@@ -560,19 +572,13 @@ static const struct fault_info {
         { do_bad,               SIGBUS,  0,             "unknown 63"                    },
 };
 
-static const char *fault_name(unsigned int esr)
-{
-        const struct fault_info *inf = fault_info + (esr & 63);
-        return inf->name;
-}
-
 /*
  * Dispatch a data abort to the relevant handler.
  */
 asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
                                          struct pt_regs *regs)
 {
-        const struct fault_info *inf = fault_info + (esr & 63);
+        const struct fault_info *inf = esr_to_fault_info(esr);
         struct siginfo info;
 
         if (!inf->fn(addr, esr, regs))
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index e25584d72396..7514a000e361 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -294,10 +294,6 @@ static __init int setup_hugepagesz(char *opt)
                 hugetlb_add_hstate(PMD_SHIFT - PAGE_SHIFT);
         } else if (ps == PUD_SIZE) {
                 hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
-        } else if (ps == (PAGE_SIZE * CONT_PTES)) {
-                hugetlb_add_hstate(CONT_PTE_SHIFT);
-        } else if (ps == (PMD_SIZE * CONT_PMDS)) {
-                hugetlb_add_hstate((PMD_SHIFT + CONT_PMD_SHIFT) - PAGE_SHIFT);
         } else {
                 hugetlb_bad_size();
                 pr_err("hugepagesz: Unsupported page size %lu K\n", ps >> 10);
@@ -306,13 +302,3 @@ static __init int setup_hugepagesz(char *opt)
         return 1;
 }
 __setup("hugepagesz=", setup_hugepagesz);
-
-#ifdef CONFIG_ARM64_64K_PAGES
-static __init int add_default_hugepagesz(void)
-{
-        if (size_to_hstate(CONT_PTES * PAGE_SIZE) == NULL)
-                hugetlb_add_hstate(CONT_PTE_SHIFT);
-        return 0;
-}
-arch_initcall(add_default_hugepagesz);
-#endif
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index 55d1e9205543..687a358a3733 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -162,7 +162,7 @@ void __init kasan_init(void)
         clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
 
         vmemmap_populate(kimg_shadow_start, kimg_shadow_end,
-                         pfn_to_nid(virt_to_pfn(_text)));
+                         pfn_to_nid(virt_to_pfn(lm_alias(_text))));
 
         /*
          * vmemmap_populate() has populated the shadow region that covers the
diff --git a/arch/avr32/include/asm/pgtable-2level.h b/arch/avr32/include/asm/pgtable-2level.h
index 425dd567b5b9..d5b1c63993ec 100644
--- a/arch/avr32/include/asm/pgtable-2level.h
+++ b/arch/avr32/include/asm/pgtable-2level.h
@@ -8,6 +8,7 @@
 #ifndef __ASM_AVR32_PGTABLE_2LEVEL_H
 #define __ASM_AVR32_PGTABLE_2LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /*
diff --git a/arch/avr32/oprofile/backtrace.c b/arch/avr32/oprofile/backtrace.c
index 75d9ad6f99cf..29cf2f191bfd 100644
--- a/arch/avr32/oprofile/backtrace.c
+++ b/arch/avr32/oprofile/backtrace.c
@@ -14,7 +14,7 @@
  */
 
 #include <linux/oprofile.h>
-#include <linux/sched.h>
+#include <linux/ptrace.h>
 #include <linux/uaccess.h>
 
 /* The first two words of each frame on the stack look like this if we have
diff --git a/arch/c6x/kernel/ptrace.c b/arch/c6x/kernel/ptrace.c
index a27e1f02ce18..8801dc98fd44 100644
--- a/arch/c6x/kernel/ptrace.c
+++ b/arch/c6x/kernel/ptrace.c
@@ -70,46 +70,6 @@ static int gpr_get(struct task_struct *target,
                                    0, sizeof(*regs));
 }
 
-static int gpr_set(struct task_struct *target,
-                   const struct user_regset *regset,
-                   unsigned int pos, unsigned int count,
-                   const void *kbuf, const void __user *ubuf)
-{
-        int ret;
-        struct pt_regs *regs = task_pt_regs(target);
-
-        /* Don't copyin TSR or CSR */
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 0, PT_TSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_TSR * sizeof(long),
-                                        (PT_TSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_TSR + 1) * sizeof(long),
-                                 PT_CSR * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
-                                        PT_CSR * sizeof(long),
-                                        (PT_CSR + 1) * sizeof(long));
-        if (ret)
-                return ret;
-
-        ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                 &regs,
-                                 (PT_CSR + 1) * sizeof(long), -1);
-        return ret;
-}
-
 enum c6x_regset {
         REGSET_GPR,
 };
@@ -121,7 +81,6 @@ static const struct user_regset c6x_regsets[] = {
                 .size = sizeof(u32),
                 .align = sizeof(u32),
                 .get = gpr_get,
-                .set = gpr_set
         },
 };
 
diff --git a/arch/cris/arch-v32/drivers/cryptocop.c b/arch/cris/arch-v32/drivers/cryptocop.c
index ae6903d7fdbe..14970f11bbf2 100644
--- a/arch/cris/arch-v32/drivers/cryptocop.c
+++ b/arch/cris/arch-v32/drivers/cryptocop.c
@@ -2086,7 +2086,7 @@ static void cryptocop_job_queue_close(void)
                 dma_in_cfg.en = regk_dma_no;
                 REG_WR(dma, IN_DMA_INST, rw_cfg, dma_in_cfg);
 
-                /* Disble the cryptocop. */
+                /* Disable the cryptocop. */
                 rw_cfg = REG_RD(strcop, regi_strcop, rw_cfg);
                 rw_cfg.en = 0;
                 REG_WR(strcop, regi_strcop, rw_cfg, rw_cfg);
diff --git a/arch/cris/include/asm/pgtable.h b/arch/cris/include/asm/pgtable.h
index 2a3210ba4c72..fa3a73004cc5 100644
--- a/arch/cris/include/asm/pgtable.h
+++ b/arch/cris/include/asm/pgtable.h
@@ -6,6 +6,7 @@
 #define _CRIS_PGTABLE_H
 
 #include <asm/page.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/frv/include/asm/pgtable.h b/arch/frv/include/asm/pgtable.h
index a0513d463a1f..ab6e7e961b54 100644
--- a/arch/frv/include/asm/pgtable.h
+++ b/arch/frv/include/asm/pgtable.h
@@ -16,6 +16,7 @@
 #ifndef _ASM_PGTABLE_H
 #define _ASM_PGTABLE_H
 
+#include <asm-generic/5level-fixup.h>
 #include <asm/mem-layout.h>
 #include <asm/setup.h>
 #include <asm/processor.h>
diff --git a/arch/h8300/include/asm/pgtable.h b/arch/h8300/include/asm/pgtable.h
index 8341db67821d..7d265d28ba5e 100644
--- a/arch/h8300/include/asm/pgtable.h
+++ b/arch/h8300/include/asm/pgtable.h
@@ -1,5 +1,6 @@
 #ifndef _H8300_PGTABLE_H
 #define _H8300_PGTABLE_H
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 #include <asm-generic/pgtable.h>
 #define pgtable_cache_init()   do { } while (0)
diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c
index 92075544a19a..0dc1c8f622bc 100644
--- a/arch/h8300/kernel/ptrace.c
+++ b/arch/h8300/kernel/ptrace.c
@@ -95,7 +95,8 @@ static int regs_get(struct task_struct *target,
         long *reg = (long *)&regs;
 
         /* build user regs in buffer */
-        for (r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
@@ -113,7 +114,8 @@ static int regs_set(struct task_struct *target,
         long *reg;
 
         /* build user regs in buffer */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0);
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 *reg++ = h8300_get_reg(target, r);
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
@@ -122,7 +124,7 @@ static int regs_set(struct task_struct *target,
                 return ret;
 
         /* write back to pt_regs */
-        for (reg = (long *)&regs, r = 0; r < ARRAY_SIZE(register_offset); r++)
+        for (reg = (long *)&regs, r = 0; r < sizeof(regs) / sizeof(long); r++)
                 h8300_put_reg(target, r, *reg++);
         return 0;
 }
diff --git a/arch/h8300/kernel/ptrace_h.c b/arch/h8300/kernel/ptrace_h.c
index fe3b5673baba..f5ff3b794c85 100644
--- a/arch/h8300/kernel/ptrace_h.c
+++ b/arch/h8300/kernel/ptrace_h.c
@@ -9,7 +9,7 @@
  */
 
 #include <linux/linkage.h>
-#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <asm/ptrace.h>
 
 #define BREAKINST 0x5730 /* trapa #3 */
diff --git a/arch/hexagon/include/asm/pgtable.h b/arch/hexagon/include/asm/pgtable.h
index 49eab8136ec3..24a9177fb897 100644
--- a/arch/hexagon/include/asm/pgtable.h
+++ b/arch/hexagon/include/asm/pgtable.h
@@ -26,6 +26,7 @@
  */
 #include <linux/swap.h>
 #include <asm/page.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /* A handy thing to have if one has the RAM. Declared in head.S */
diff --git a/arch/ia64/include/asm/asm-prototypes.h b/arch/ia64/include/asm/asm-prototypes.h
new file mode 100644
index 000000000000..a2c139808cfe
--- /dev/null
+++ b/arch/ia64/include/asm/asm-prototypes.h
@@ -0,0 +1,29 @@
+#ifndef _ASM_IA64_ASM_PROTOTYPES_H
+#define _ASM_IA64_ASM_PROTOTYPES_H
+
+#include <asm/cacheflush.h>
+#include <asm/checksum.h>
+#include <asm/esi.h>
+#include <asm/ftrace.h>
+#include <asm/page.h>
+#include <asm/pal.h>
+#include <asm/string.h>
+#include <asm/uaccess.h>
+#include <asm/unwind.h>
+#include <asm/xor.h>
+
+extern const char ia64_ivt[];
+
+signed int __divsi3(signed int, unsigned int);
+signed int __modsi3(signed int, unsigned int);
+
+signed long long __divdi3(signed long long, unsigned long long);
+signed long long __moddi3(signed long long, unsigned long long);
+
+unsigned int __udivsi3(unsigned int, unsigned int);
+unsigned int __umodsi3(unsigned int, unsigned int);
+
+unsigned long long __udivdi3(unsigned long long, unsigned long long);
+unsigned long long __umoddi3(unsigned long long, unsigned long long);
+
+#endif /* _ASM_IA64_ASM_PROTOTYPES_H */
diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
index 384794e665fc..6cc22c8d8923 100644
--- a/arch/ia64/include/asm/pgtable.h
+++ b/arch/ia64/include/asm/pgtable.h
@@ -587,8 +587,10 @@ extern struct page *zero_page_memmap_ptr;
 
 
 #if CONFIG_PGTABLE_LEVELS == 3
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 #endif
+#include <asm-generic/5level-fixup.h>
 #include <asm-generic/pgtable.h>
 
 #endif /* _ASM_IA64_PGTABLE_H */
diff --git a/arch/ia64/lib/Makefile b/arch/ia64/lib/Makefile
index 1f3d3877618f..0a40b14407b1 100644
--- a/arch/ia64/lib/Makefile
+++ b/arch/ia64/lib/Makefile
@@ -24,25 +24,25 @@ AFLAGS___modsi3.o	=	     -DMODULO
 AFLAGS___umodsi3.o      = -DUNSIGNED -DMODULO
 
 $(obj)/__divdi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__udivdi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__moddi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__umoddi3.o: $(src)/idiv64.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__divsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__udivsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__modsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
 
 $(obj)/__umodsi3.o: $(src)/idiv32.S FORCE
-        $(call if_changed_dep,as_o_S)
+        $(call if_changed_rule,as_o_S)
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 048bf076f7df..531cb9eb3319 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -60,6 +61,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -71,6 +73,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -101,6 +104,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -298,6 +302,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -371,6 +377,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -383,6 +390,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_A2065=y
 CONFIG_ARIADNE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -404,7 +412,6 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -564,6 +571,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -594,6 +603,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -605,6 +615,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -629,4 +640,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index d4de24963f5f..ca91d39555da 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -353,6 +359,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -362,6 +369,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -378,7 +386,6 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -523,6 +530,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -553,6 +562,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -564,6 +574,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -588,4 +599,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index fc0fd3f871f3..23a3d8a691e2 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -362,6 +368,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -372,6 +379,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_ATARILANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -389,7 +397,6 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -544,6 +551,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -574,6 +583,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -585,6 +595,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -609,4 +620,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 52e984a0aa69..95deb95140fe 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -352,6 +358,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index aaeed4422cc9..afae6958db2d 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -58,6 +59,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -69,6 +71,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -99,6 +102,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -296,6 +300,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -353,6 +359,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -363,6 +370,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_HPLANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -379,7 +387,6 @@ CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -525,6 +532,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -555,6 +564,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -566,6 +576,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -590,4 +601,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 3bbc9b2f0dac..b010734729a7 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -25,6 +25,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -57,6 +58,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -68,6 +70,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -98,6 +101,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -298,6 +302,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -369,6 +375,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -379,6 +386,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -398,7 +406,6 @@ CONFIG_MAC8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -547,6 +554,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -577,6 +586,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -588,6 +598,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -612,4 +623,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 8f2c0decb2f8..0e414549b235 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -21,6 +21,7 @@ CONFIG_SOLARIS_X86_PARTITION=y
 CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68020=y
@@ -67,6 +68,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -78,6 +80,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -108,6 +111,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -308,6 +312,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -402,6 +408,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -419,6 +426,7 @@ CONFIG_HPLANCE=y
 CONFIG_MVME147_NET=y
 CONFIG_SUN3LANCE=y
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -444,7 +452,6 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 CONFIG_SMC91X=y
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
@@ -627,6 +634,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -657,6 +666,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -668,6 +678,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -692,4 +703,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index c743dd22e96f..b2e687a0ec3d 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68030=y
@@ -55,6 +56,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -66,6 +68,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -96,6 +99,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -293,6 +297,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -351,6 +357,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_MVME147_NET=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 2ccaca858f05..cbd8ee24d1bc 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -352,6 +358,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -361,6 +368,7 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -377,7 +385,6 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -515,6 +522,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -545,6 +554,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -556,6 +566,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -580,4 +591,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 5599f3fd5fcd..1e82cc944339 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -26,6 +26,7 @@ CONFIG_SUN_PARTITION=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_M68040=y
@@ -56,6 +57,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -67,6 +69,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -97,6 +100,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -294,6 +298,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -358,6 +364,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -369,6 +376,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 # CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -388,7 +396,6 @@ CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
@@ -538,6 +545,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -568,6 +577,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -579,6 +589,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -603,4 +614,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 313bf0a562ad..f9e77f57a972 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_SUN3=y
@@ -53,6 +54,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -64,6 +66,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -94,6 +97,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -291,6 +295,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -349,6 +355,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -359,6 +366,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_EZCHIP is not set
@@ -375,7 +383,6 @@ CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -517,6 +524,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -546,6 +555,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -557,6 +567,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -581,4 +592,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 38b61365f769..3c394fcfb368 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -25,6 +25,7 @@ CONFIG_UNIXWARE_DISKLABEL=y
 # CONFIG_EFI_PARTITION is not set
 CONFIG_SYSV68_PARTITION=y
 CONFIG_IOSCHED_DEADLINE=m
+CONFIG_MQ_IOSCHED_DEADLINE=m
 CONFIG_KEXEC=y
 CONFIG_BOOTINFO_PROC=y
 CONFIG_SUN3X=y
@@ -53,6 +54,7 @@ CONFIG_NET_IPVTI=m
 CONFIG_NET_FOU_IP_TUNNELS=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
+CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
@@ -64,6 +66,7 @@ CONFIG_IPV6=m
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
+CONFIG_INET6_ESP_OFFLOAD=m
 CONFIG_INET6_IPCOMP=m
 CONFIG_IPV6_ILA=m
 CONFIG_IPV6_VTI=m
@@ -94,6 +97,7 @@ CONFIG_NFT_NUMGEN=m
 CONFIG_NFT_CT=m
 CONFIG_NFT_SET_RBTREE=m
 CONFIG_NFT_SET_HASH=m
+CONFIG_NFT_SET_BITMAP=m
 CONFIG_NFT_COUNTER=m
 CONFIG_NFT_LOG=m
 CONFIG_NFT_LIMIT=m
@@ -291,6 +295,8 @@ CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
+CONFIG_PSAMPLE=m
+CONFIG_NET_IFE=m
 CONFIG_NET_DEVLINK=m
 # CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
@@ -349,6 +355,7 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
 CONFIG_VXLAN=m
 CONFIG_GENEVE=m
 CONFIG_GTP=m
@@ -359,6 +366,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_AMAZON is not set
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
@@ -375,7 +383,6 @@ CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
@@ -517,6 +524,8 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_WW_MUTEX_SELFTEST=m
+CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
@@ -547,6 +556,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
@@ -558,6 +568,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -582,4 +593,5 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 # CONFIG_CRYPTO_HW is not set
+CONFIG_CRC32_SELFTEST=m
 CONFIG_XZ_DEC_TEST=m
diff --git a/arch/m68k/include/asm/bitops.h b/arch/m68k/include/asm/bitops.h
index b4a9b0d5928d..dda58cfe8c22 100644
--- a/arch/m68k/include/asm/bitops.h
+++ b/arch/m68k/include/asm/bitops.h
@@ -148,7 +148,7 @@ static inline void bfchg_mem_change_bit(int nr, volatile unsigned long *vaddr)
 #define __change_bit(nr, vaddr) change_bit(nr, vaddr)
 
 
-static inline int test_bit(int nr, const unsigned long *vaddr)
+static inline int test_bit(int nr, const volatile unsigned long *vaddr)
 {
         return (vaddr[nr >> 5] & (1UL << (nr & 31))) != 0;
 }
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index a857d82ec509..aab1edd0d4ba 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             379
+#define NR_syscalls             380
 
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 9fe674bf911f..25589f5b8669 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -384,5 +384,6 @@
 #define __NR_copy_file_range    376
 #define __NR_preadv2            377
 #define __NR_pwritev2           378
+#define __NR_statx              379
 
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index d6fd6d9ced24..8c9fcfafe0dd 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -399,3 +399,4 @@ ENTRY(sys_call_table)
         .long sys_copy_file_range
         .long sys_preadv2
         .long sys_pwritev2
+        .long sys_statx
diff --git a/arch/metag/include/asm/pgtable.h b/arch/metag/include/asm/pgtable.h
index ffa3a3a2ecad..0c151e5af079 100644
--- a/arch/metag/include/asm/pgtable.h
+++ b/arch/metag/include/asm/pgtable.h
@@ -6,6 +6,7 @@
 #define _METAG_PGTABLE_H
 
 #include <asm/pgtable-bits.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /* Invalid regions on Meta: 0x00000000-0x001FFFFF and 0xFFFF0000-0xFFFFFFFF */
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 273e61225c27..07238b39638c 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -197,20 +197,21 @@ extern long __must_check strnlen_user(const char __user *src, long count);
 
 #define strlen_user(str) strnlen_user(str, 32767)
 
-extern unsigned long __must_check __copy_user_zeroing(void *to,
-                                                      const void __user *from,
-                                                      unsigned long n);
+extern unsigned long raw_copy_from_user(void *to, const void __user *from,
+                                        unsigned long n);
 
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+        unsigned long res = n;
         if (likely(access_ok(VERIFY_READ, from, n)))
-                return __copy_user_zeroing(to, from, n);
-        memset(to, 0, n);
-        return n;
+                res = raw_copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
-#define __copy_from_user(to, from, n) __copy_user_zeroing(to, from, n)
+#define __copy_from_user(to, from, n) raw_copy_from_user(to, from, n)
 #define __copy_from_user_inatomic __copy_from_user
 
 extern unsigned long __must_check __copy_user(void __user *to,
diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c
index 5fd16ee5280c..e615603a4b0a 100644
--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -26,6 +26,16 @@
  * user_regset definitions.
  */
 
+static unsigned long user_txstatus(const struct pt_regs *regs)
+{
+        unsigned long data = (unsigned long)regs->ctx.Flags;
+
+        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
+                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+
+        return data;
+}
+
 int metag_gp_regs_copyout(const struct pt_regs *regs,
                           unsigned int pos, unsigned int count,
                           void *kbuf, void __user *ubuf)
@@ -64,9 +74,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
-        data = (unsigned long)regs->ctx.Flags;
-        if (regs->ctx.SaveMask & TBICTX_CBUF_BIT)
-                data |= USER_GP_REGS_STATUS_CATCH_BIT;
+        data = user_txstatus(regs);
         ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                   &data, 4*25, 4*26);
         if (ret)
@@ -121,6 +129,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs,
         if (ret)
                 goto out;
         /* TXSTATUS */
+        data = user_txstatus(regs);
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &data, 4*25, 4*26);
         if (ret)
@@ -246,6 +255,8 @@ int metag_rp_state_copyin(struct pt_regs *regs,
         unsigned long long *ptr;
         int ret, i;
 
+        if (count < 4*13)
+                return -EINVAL;
         /* Read the entire pipeline before making any changes */
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                  &rp, 0, 4*13);
@@ -305,7 +316,7 @@ static int metag_tls_set(struct task_struct *target,
                         const void *kbuf, const void __user *ubuf)
 {
         int ret;
-        void __user *tls;
+        void __user *tls = target->thread.tls_ptr;
 
         ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
         if (ret)
diff --git a/arch/metag/lib/usercopy.c b/arch/metag/lib/usercopy.c
index b3ebfe9c8e88..2792fc621088 100644
--- a/arch/metag/lib/usercopy.c
+++ b/arch/metag/lib/usercopy.c
@@ -29,7 +29,6 @@
                 COPY                                             \
                 "1:\n"                                           \
                 "       .section .fixup,\"ax\"\n"                \
-                "       MOV D1Ar1,#0\n"                          \
                 FIXUP                                            \
                 "       MOVT    D1Ar1,#HI(1b)\n"                 \
                 "       JUMP    D1Ar1,#LO(1b)\n"                 \
@@ -260,27 +259,31 @@
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "22:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
-                "SUB    %3, %3, #32\n"                                  \
                 "23:\n"                                                 \
-                "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "SUB    %3, %3, #32\n"                                  \
                 "24:\n"                                                 \
+                "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "25:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "26:\n"                                                 \
                 "SUB    %3, %3, #32\n"                                  \
                 "DCACHE [%1+#-64], D0Ar6\n"                             \
                 "BR     $Lloop"id"\n"                                   \
                                                                         \
                 "MOV    RAPF, %1\n"                                     \
-                "25:\n"                                                 \
+                "27:\n"                                                 \
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "26:\n"                                                 \
+                "28:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "29:\n"                                                 \
                 "SUB    %3, %3, #32\n"                                  \
-                "27:\n"                                                 \
+                "30:\n"                                                 \
                 "MGETL  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "28:\n"                                                 \
+                "31:\n"                                                 \
                 "MSETL  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "32:\n"                                                 \
                 "SUB    %0, %0, #8\n"                                   \
-                "29:\n"                                                 \
+                "33:\n"                                                 \
                 "SETL   [%0++], D0.7, D1.7\n"                           \
                 "SUB    %3, %3, #32\n"                                  \
                 "1:"                                                    \
@@ -312,11 +315,15 @@
                 "       .long 26b,3b\n"                                 \
                 "       .long 27b,3b\n"                                 \
                 "       .long 28b,3b\n"                                 \
-                "       .long 29b,4b\n"                                 \
+                "       .long 29b,3b\n"                                 \
+                "       .long 30b,3b\n"                                 \
+                "       .long 31b,3b\n"                                 \
+                "       .long 32b,3b\n"                                 \
+                "       .long 33b,4b\n"                                 \
                 "       .previous\n"                                    \
                 : "=r" (to), "=r" (from), "=r" (ret), "=d" (n)          \
                 : "0" (to), "1" (from), "2" (ret), "3" (n)              \
-                : "D1Ar1", "D0Ar2", "memory")
+                : "D1Ar1", "D0Ar2", "cc", "memory")
 
 /*      rewind 'to' and 'from'  pointers when a fault occurs
  *
@@ -342,7 +349,7 @@
 #define __asm_copy_to_user_64bit_rapf_loop(to,  from, ret, n, id)\
         __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,           \
                 "LSR    D0Ar2, D0Ar2, #8\n"                             \
-                "AND    D0Ar2, D0Ar2, #0x7\n"                           \
+                "ANDS   D0Ar2, D0Ar2, #0x7\n"                           \
                 "ADDZ   D0Ar2, D0Ar2, #4\n"                             \
                 "SUB    D0Ar2, D0Ar2, #1\n"                             \
                 "MOV    D1Ar1, #4\n"                                    \
@@ -403,47 +410,55 @@
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "22:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
-                "SUB    %3, %3, #16\n"                                  \
                 "23:\n"                                                 \
-                "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "24:\n"                                                 \
-                "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
                 "SUB    %3, %3, #16\n"                                  \
-                "25:\n"                                                 \
+                "24:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "26:\n"                                                 \
+                "25:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "26:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "27:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
                 "28:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "29:\n"                                                 \
+                "SUB    %3, %3, #16\n"                                  \
+                "30:\n"                                                 \
+                "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
+                "31:\n"                                                 \
+                "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "32:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "DCACHE [%1+#-64], D0Ar6\n"                             \
                 "BR     $Lloop"id"\n"                                   \
                                                                         \
                 "MOV    RAPF, %1\n"                                     \
-                "29:\n"                                                 \
+                "33:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "30:\n"                                                 \
+                "34:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "35:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "31:\n"                                                 \
+                "36:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "32:\n"                                                 \
+                "37:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "38:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "33:\n"                                                 \
+                "39:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "34:\n"                                                 \
+                "40:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "41:\n"                                                 \
                 "SUB    %3, %3, #16\n"                                  \
-                "35:\n"                                                 \
+                "42:\n"                                                 \
                 "MGETD  D0FrT, D0.5, D0.6, D0.7, [%1++]\n"              \
-                "36:\n"                                                 \
+                "43:\n"                                                 \
                 "MSETD  [%0++], D0FrT, D0.5, D0.6, D0.7\n"              \
+                "44:\n"                                                 \
                 "SUB    %0, %0, #4\n"                                   \
-                "37:\n"                                                 \
+                "45:\n"                                                 \
                 "SETD   [%0++], D0.7\n"                                 \
                 "SUB    %3, %3, #16\n"                                  \
                 "1:"                                                    \
@@ -483,11 +498,19 @@
                 "       .long 34b,3b\n"                                 \
                 "       .long 35b,3b\n"                                 \
                 "       .long 36b,3b\n"                                 \
-                "       .long 37b,4b\n"                                 \
+                "       .long 37b,3b\n"                                 \
+                "       .long 38b,3b\n"                                 \
+                "       .long 39b,3b\n"                                 \
+                "       .long 40b,3b\n"                                 \
+                "       .long 41b,3b\n"                                 \
+                "       .long 42b,3b\n"                                 \
+                "       .long 43b,3b\n"                                 \
+                "       .long 44b,3b\n"                                 \
+                "       .long 45b,4b\n"                                 \
                 "       .previous\n"                                    \
                 : "=r" (to), "=r" (from), "=r" (ret), "=d" (n)          \
                 : "0" (to), "1" (from), "2" (ret), "3" (n)              \
-                : "D1Ar1", "D0Ar2", "memory")
+                : "D1Ar1", "D0Ar2", "cc", "memory")
 
 /*      rewind 'to' and 'from'  pointers when a fault occurs
  *
@@ -513,7 +536,7 @@
 #define __asm_copy_to_user_32bit_rapf_loop(to, from, ret, n, id)\
         __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,           \
                 "LSR    D0Ar2, D0Ar2, #8\n"                             \
-                "AND    D0Ar2, D0Ar2, #0x7\n"                           \
+                "ANDS   D0Ar2, D0Ar2, #0x7\n"                           \
                 "ADDZ   D0Ar2, D0Ar2, #4\n"                             \
                 "SUB    D0Ar2, D0Ar2, #1\n"                             \
                 "MOV    D1Ar1, #4\n"                                    \
@@ -538,23 +561,31 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
         if ((unsigned long) src & 1) {
                 __asm_copy_to_user_1(dst, src, retn);
                 n--;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 1) {
                 /* Worst case - byte copy */
                 while (n > 0) {
                         __asm_copy_to_user_1(dst, src, retn);
                         n--;
+                        if (retn)
+                                return retn + n;
                 }
         }
         if (((unsigned long) src & 2) && n >= 2) {
                 __asm_copy_to_user_2(dst, src, retn);
                 n -= 2;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 2) {
                 /* Second worst case - word copy */
                 while (n >= 2) {
                         __asm_copy_to_user_2(dst, src, retn);
                         n -= 2;
+                        if (retn)
+                                return retn + n;
                 }
         }
 
@@ -569,6 +600,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 while (n >= 8) {
                         __asm_copy_to_user_8x64(dst, src, retn);
                         n -= 8;
+                        if (retn)
+                                return retn + n;
                 }
         }
         if (n >= RAPF_MIN_BUF_SIZE) {
@@ -581,6 +614,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 while (n >= 8) {
                         __asm_copy_to_user_8x64(dst, src, retn);
                         n -= 8;
+                        if (retn)
+                                return retn + n;
                 }
         }
 #endif
@@ -588,11 +623,15 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
         while (n >= 16) {
                 __asm_copy_to_user_16(dst, src, retn);
                 n -= 16;
+                if (retn)
+                        return retn + n;
         }
 
         while (n >= 4) {
                 __asm_copy_to_user_4(dst, src, retn);
                 n -= 4;
+                if (retn)
+                        return retn + n;
         }
 
         switch (n) {
@@ -609,6 +648,10 @@ unsigned long __copy_user(void __user *pdst, const void *psrc,
                 break;
         }
 
+        /*
+         * If we get here, retn correctly reflects the number of failing
+         * bytes.
+         */
         return retn;
 }
 EXPORT_SYMBOL(__copy_user);
@@ -617,16 +660,14 @@ EXPORT_SYMBOL(__copy_user);
         __asm_copy_user_cont(to, from, ret,     \
                 "       GETB D1Ar1,[%1++]\n"    \
                 "2:     SETB [%0++],D1Ar1\n",   \
-                "3:     ADD  %2,%2,#1\n"        \
-                "       SETB [%0++],D1Ar1\n",   \
+                "3:     ADD  %2,%2,#1\n",       \
                 "       .long 2b,3b\n")
 
 #define __asm_copy_from_user_2x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
         __asm_copy_user_cont(to, from, ret,             \
                 "       GETW D1Ar1,[%1++]\n"            \
                 "2:     SETW [%0++],D1Ar1\n" COPY,      \
-                "3:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
+                "3:     ADD  %2,%2,#2\n" FIXUP,         \
                 "       .long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_2(to, from, ret) \
@@ -636,145 +677,26 @@ EXPORT_SYMBOL(__copy_user);
         __asm_copy_from_user_2x_cont(to, from, ret,     \
                 "       GETB D1Ar1,[%1++]\n"            \
                 "4:     SETB [%0++],D1Ar1\n",           \
-                "5:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
+                "5:     ADD  %2,%2,#1\n",               \
                 "       .long 4b,5b\n")
 
 #define __asm_copy_from_user_4x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
         __asm_copy_user_cont(to, from, ret,             \
                 "       GETD D1Ar1,[%1++]\n"            \
                 "2:     SETD [%0++],D1Ar1\n" COPY,      \
-                "3:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
+                "3:     ADD  %2,%2,#4\n" FIXUP,         \
                 "       .long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_4(to, from, ret) \
         __asm_copy_from_user_4x_cont(to, from, ret, "", "", "")
 
-#define __asm_copy_from_user_5(to, from, ret) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "4:     SETB [%0++],D1Ar1\n",           \
-                "5:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 4b,5b\n")
-
-#define __asm_copy_from_user_6x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "4:     SETW [%0++],D1Ar1\n" COPY,      \
-                "5:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 4b,5b\n" TENTRY)
-
-#define __asm_copy_from_user_6(to, from, ret) \
-        __asm_copy_from_user_6x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_7(to, from, ret) \
-        __asm_copy_from_user_6x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "6:     SETB [%0++],D1Ar1\n",           \
-                "7:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 6b,7b\n")
-
-#define __asm_copy_from_user_8x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_4x_cont(to, from, ret,     \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "4:     SETD [%0++],D1Ar1\n" COPY,      \
-                "5:     ADD  %2,%2,#4\n"                        \
-                "       SETD [%0++],D1Ar1\n" FIXUP,             \
-                "       .long 4b,5b\n" TENTRY)
-
-#define __asm_copy_from_user_8(to, from, ret) \
-        __asm_copy_from_user_8x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_9(to, from, ret) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "6:     SETB [%0++],D1Ar1\n",           \
-                "7:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 6b,7b\n")
-
-#define __asm_copy_from_user_10x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "6:     SETW [%0++],D1Ar1\n" COPY,      \
-                "7:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 6b,7b\n" TENTRY)
-
-#define __asm_copy_from_user_10(to, from, ret) \
-        __asm_copy_from_user_10x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_11(to, from, ret)          \
-        __asm_copy_from_user_10x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "8:     SETB [%0++],D1Ar1\n",           \
-                "9:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 8b,9b\n")
-
-#define __asm_copy_from_user_12x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_8x_cont(to, from, ret,     \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "6:     SETD [%0++],D1Ar1\n" COPY,      \
-                "7:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 6b,7b\n" TENTRY)
-
-#define __asm_copy_from_user_12(to, from, ret) \
-        __asm_copy_from_user_12x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_13(to, from, ret) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "8:     SETB [%0++],D1Ar1\n",           \
-                "9:     ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 8b,9b\n")
-
-#define __asm_copy_from_user_14x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETW D1Ar1,[%1++]\n"            \
-                "8:     SETW [%0++],D1Ar1\n" COPY,      \
-                "9:     ADD  %2,%2,#2\n"                \
-                "       SETW [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 8b,9b\n" TENTRY)
-
-#define __asm_copy_from_user_14(to, from, ret) \
-        __asm_copy_from_user_14x_cont(to, from, ret, "", "", "")
-
-#define __asm_copy_from_user_15(to, from, ret) \
-        __asm_copy_from_user_14x_cont(to, from, ret,    \
-                "       GETB D1Ar1,[%1++]\n"            \
-                "10:    SETB [%0++],D1Ar1\n",           \
-                "11:    ADD  %2,%2,#1\n"                \
-                "       SETB [%0++],D1Ar1\n",           \
-                "       .long 10b,11b\n")
-
-#define __asm_copy_from_user_16x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
-        __asm_copy_from_user_12x_cont(to, from, ret,    \
-                "       GETD D1Ar1,[%1++]\n"            \
-                "8:     SETD [%0++],D1Ar1\n" COPY,      \
-                "9:     ADD  %2,%2,#4\n"                \
-                "       SETD [%0++],D1Ar1\n" FIXUP,     \
-                "       .long 8b,9b\n" TENTRY)
-
-#define __asm_copy_from_user_16(to, from, ret) \
-        __asm_copy_from_user_16x_cont(to, from, ret, "", "", "")
-
 #define __asm_copy_from_user_8x64(to, from, ret) \
         asm volatile (                          \
                 "       GETL D0Ar2,D1Ar1,[%1++]\n"      \
                 "2:     SETL [%0++],D0Ar2,D1Ar1\n"      \
                 "1:\n"                                  \
                 "       .section .fixup,\"ax\"\n"       \
-                "       MOV D1Ar1,#0\n"                 \
-                "       MOV D0Ar2,#0\n"                 \
                 "3:     ADD  %2,%2,#8\n"                \
-                "       SETL [%0++],D0Ar2,D1Ar1\n"      \
                 "       MOVT    D0Ar2,#HI(1b)\n"        \
                 "       JUMP    D0Ar2,#LO(1b)\n"        \
                 "       .previous\n"                    \
@@ -789,36 +711,57 @@ EXPORT_SYMBOL(__copy_user);
  *
  *      Rationale:
  *              A fault occurs while reading from user buffer, which is the
- *              source. Since the fault is at a single address, we only
- *              need to rewind by 8 bytes.
+ *              source.
  *              Since we don't write to kernel buffer until we read first,
  *              the kernel buffer is at the right state and needn't be
- *              corrected.
+ *              corrected, but the source must be rewound to the beginning of
+ *              the block, which is LSM_STEP*8 bytes.
+ *              LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *              and stored in D0Ar2
+ *
+ *              NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *                      LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *                      a fault happens at the 4th write, LSM_STEP will be 0
+ *                      instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_64bit_rapf_loop(to, from, ret, n, id)      \
         __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id,           \
-                "SUB    %1, %1, #8\n")
+                "LSR    D0Ar2, D0Ar2, #5\n"                             \
+                "ANDS   D0Ar2, D0Ar2, #0x38\n"                          \
+                "ADDZ   D0Ar2, D0Ar2, #32\n"                            \
+                "SUB    %1, %1, D0Ar2\n")
 
 /*      rewind 'from' pointer when a fault occurs
  *
  *      Rationale:
  *              A fault occurs while reading from user buffer, which is the
- *              source. Since the fault is at a single address, we only
- *              need to rewind by 4 bytes.
+ *              source.
  *              Since we don't write to kernel buffer until we read first,
  *              the kernel buffer is at the right state and needn't be
- *              corrected.
+ *              corrected, but the source must be rewound to the beginning of
+ *              the block, which is LSM_STEP*4 bytes.
+ *              LSM_STEP is bits 10:8 in TXSTATUS which is already read
+ *              and stored in D0Ar2
+ *
+ *              NOTE: If a fault occurs at the last operation in M{G,S}ETL
+ *                      LSM_STEP will be 0. ie: we do 4 writes in our case, if
+ *                      a fault happens at the 4th write, LSM_STEP will be 0
+ *                      instead of 4. The code copes with that.
  */
 #define __asm_copy_from_user_32bit_rapf_loop(to, from, ret, n, id)      \
         __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id,           \
-                "SUB    %1, %1, #4\n")
+                "LSR    D0Ar2, D0Ar2, #6\n"                             \
+                "ANDS   D0Ar2, D0Ar2, #0x1c\n"                          \
+                "ADDZ   D0Ar2, D0Ar2, #16\n"                            \
+                "SUB    %1, %1, D0Ar2\n")
 
 
-/* Copy from user to kernel, zeroing the bytes that were inaccessible in
-   userland.  The return-value is the number of bytes that were
-   inaccessible.  */
-unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
-                                  unsigned long n)
+/*
+ * Copy from user to kernel. The return-value is the number of bytes that were
+ * inaccessible.
+ */
+unsigned long raw_copy_from_user(void *pdst, const void __user *psrc,
+                                 unsigned long n)
 {
         register char *dst asm ("A0.2") = pdst;
         register const char __user *src asm ("A1.2") = psrc;
@@ -830,6 +773,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
         if ((unsigned long) src & 1) {
                 __asm_copy_from_user_1(dst, src, retn);
                 n--;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 1) {
                 /* Worst case - byte copy */
@@ -837,12 +782,14 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_1(dst, src, retn);
                         n--;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
         if (((unsigned long) src & 2) && n >= 2) {
                 __asm_copy_from_user_2(dst, src, retn);
                 n -= 2;
+                if (retn)
+                        return retn + n;
         }
         if ((unsigned long) dst & 2) {
                 /* Second worst case - word copy */
@@ -850,16 +797,10 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_2(dst, src, retn);
                         n -= 2;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 
-        /* We only need one check after the unalignment-adjustments,
-           because if both adjustments were done, either both or
-           neither reference had an exception.  */
-        if (retn != 0)
-                goto copy_exception_bytes;
-
 #ifdef USE_RAPF
         /* 64 bit copy loop */
         if (!(((unsigned long) src | (unsigned long) dst) & 7)) {
@@ -872,7 +813,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_8x64(dst, src, retn);
                         n -= 8;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 
@@ -888,7 +829,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                         __asm_copy_from_user_8x64(dst, src, retn);
                         n -= 8;
                         if (retn)
-                                goto copy_exception_bytes;
+                                return retn + n;
                 }
         }
 #endif
@@ -898,7 +839,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
                 n -= 4;
 
                 if (retn)
-                        goto copy_exception_bytes;
+                        return retn + n;
         }
 
         /* If we get here, there were no memory read faults.  */
@@ -924,21 +865,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
         /* If we get here, retn correctly reflects the number of failing
            bytes.  */
         return retn;
-
- copy_exception_bytes:
-        /* We already have "retn" bytes cleared, and need to clear the
-           remaining "n" bytes.  A non-optimized simple byte-for-byte in-line
-           memset is preferred here, since this isn't speed-critical code and
-           we'd rather have this a leaf-function than calling memset.  */
-        {
-                char *endp;
-                for (endp = dst + n; dst < endp; dst++)
-                        *dst = 0;
-        }
-
-        return retn + n;
 }
-EXPORT_SYMBOL(__copy_user_zeroing);
+EXPORT_SYMBOL(raw_copy_from_user);
 
 #define __asm_clear_8x64(to, ret) \
         asm volatile (                                  \
diff --git a/arch/microblaze/include/asm/page.h b/arch/microblaze/include/asm/page.h
index fd850879854d..d506bb0893f9 100644
--- a/arch/microblaze/include/asm/page.h
+++ b/arch/microblaze/include/asm/page.h
@@ -95,7 +95,8 @@ typedef struct { unsigned long pgd; } pgd_t;
 #   else /* CONFIG_MMU */
 typedef struct { unsigned long  ste[64]; }      pmd_t;
 typedef struct { pmd_t          pue[1]; }       pud_t;
-typedef struct { pud_t          pge[1]; }       pgd_t;
+typedef struct { pud_t          p4e[1]; }       p4d_t;
+typedef struct { p4d_t          pge[1]; }       pgd_t;
 #   endif /* CONFIG_MMU */
 
 # define pte_val(x)     ((x).pte)
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index a008a9f03072..e0bb576410bb 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1531,7 +1531,7 @@ config CPU_MIPS64_R6
         select CPU_SUPPORTS_HIGHMEM
         select CPU_SUPPORTS_MSA
         select GENERIC_CSUM
-        select MIPS_O32_FP64_SUPPORT if MIPS32_O32
+        select MIPS_O32_FP64_SUPPORT if 32BIT || MIPS32_O32
         select HAVE_KVM
         help
           Choose this option to build a kernel for release 6 or later of the
diff --git a/arch/mips/cavium-octeon/cpu.c b/arch/mips/cavium-octeon/cpu.c
index a5b427909b5c..036d56cc4591 100644
--- a/arch/mips/cavium-octeon/cpu.c
+++ b/arch/mips/cavium-octeon/cpu.c
@@ -10,7 +10,9 @@
 #include <linux/irqflags.h>
 #include <linux/notifier.h>
 #include <linux/prefetch.h>
+#include <linux/ptrace.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 
 #include <asm/cop2.h>
 #include <asm/current.h>
diff --git a/arch/mips/cavium-octeon/crypto/octeon-crypto.c b/arch/mips/cavium-octeon/crypto/octeon-crypto.c
index 4d22365844af..cfb4a146cf17 100644
--- a/arch/mips/cavium-octeon/crypto/octeon-crypto.c
+++ b/arch/mips/cavium-octeon/crypto/octeon-crypto.c
@@ -9,6 +9,7 @@
 #include <asm/cop2.h>
 #include <linux/export.h>
 #include <linux/interrupt.h>
+#include <linux/sched/task_stack.h>
 
 #include "octeon-crypto.h"
 
diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
index 4b94b7fbafa3..3de786545ded 100644
--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -12,6 +12,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/sched.h>
 #include <linux/sched/hotplug.h>
+#include <linux/sched/task_stack.h>
 #include <linux/init.h>
 #include <linux/export.h>
 
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 321752bcbab6..a2813fe381cf 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -12,6 +12,7 @@
 
 #include <linux/sched.h>
 #include <linux/sched/task_stack.h>
+#include <linux/ptrace.h>
 #include <linux/thread_info.h>
 #include <linux/bitops.h>
 
@@ -20,6 +21,7 @@
 #include <asm/cpu-features.h>
 #include <asm/fpu_emulator.h>
 #include <asm/hazards.h>
+#include <asm/ptrace.h>
 #include <asm/processor.h>
 #include <asm/current.h>
 #include <asm/msa.h>
diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index 956db6e201d1..ddd1c918103b 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -18,9 +18,24 @@
 #include <irq.h>
 
 #define IRQ_STACK_SIZE                  THREAD_SIZE
+#define IRQ_STACK_START                 (IRQ_STACK_SIZE - sizeof(unsigned long))
 
 extern void *irq_stack[NR_CPUS];
 
+/*
+ * The highest address on the IRQ stack contains a dummy frame put down in
+ * genex.S (handle_int & except_vec_vi_handler) which is structured as follows:
+ *
+ *   top ------------
+ *       | task sp  | <- irq_stack[cpu] + IRQ_STACK_START
+ *       ------------
+ *       |          | <- First frame of IRQ context
+ *       ------------
+ *
+ * task sp holds a copy of the task stack pointer where the struct pt_regs
+ * from exception entry can be found.
+ */
+
 static inline bool on_irq_stack(int cpu, unsigned long sp)
 {
         unsigned long low = (unsigned long)irq_stack[cpu];
diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
index d21f3da7bdb6..6f94bed571c4 100644
--- a/arch/mips/include/asm/pgtable-32.h
+++ b/arch/mips/include/asm/pgtable-32.h
@@ -16,6 +16,7 @@
 #include <asm/cachectl.h>
 #include <asm/fixmap.h>
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 extern int temp_tlb_entry;
diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h
index 514cbc0a6a67..130a2a6c1531 100644
--- a/arch/mips/include/asm/pgtable-64.h
+++ b/arch/mips/include/asm/pgtable-64.h
@@ -17,6 +17,7 @@
 #include <asm/cachectl.h>
 #include <asm/fixmap.h>
 
+#define __ARCH_USE_5LEVEL_HACK
 #if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48)
 #include <asm-generic/pgtable-nopmd.h>
 #else
diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h
index f485afe51514..a8df44d60607 100644
--- a/arch/mips/include/asm/spinlock.h
+++ b/arch/mips/include/asm/spinlock.h
@@ -127,7 +127,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock)
                 "       andi    %[ticket], %[ticket], 0xffff            \n"
                 "       bne     %[ticket], %[my_ticket], 4f             \n"
                 "        subu   %[ticket], %[my_ticket], %[ticket]      \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "4:     andi    %[ticket], %[ticket], 0xffff            \n"
                 "       sll     %[ticket], 5                            \n"
@@ -202,7 +202,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock)
                 "       sc      %[ticket], %[ticket_ptr]                \n"
                 "       beqz    %[ticket], 1b                           \n"
                 "        li     %[ticket], 1                            \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 "       .subsection 2                                   \n"
                 "3:     b       2b                                      \n"
                 "        li     %[ticket], 0                            \n"
@@ -382,7 +382,7 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
                 "       .set    reorder                                 \n"
                 __WEAK_LLSC_MB
                 "       li      %2, 1                                   \n"
-                "2:                                                     \n"
+                "2:     .insn                                           \n"
                 : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret)
                 : GCC_OFF_SMALL_ASM() (rw->lock)
                 : "memory");
@@ -422,7 +422,7 @@ static inline int arch_write_trylock(arch_rwlock_t *rw)
                         "       lui     %1, 0x8000                      \n"
                         "       sc      %1, %0                          \n"
                         "       li      %2, 1                           \n"
-                        "2:                                             \n"
+                        "2:     .insn                                   \n"
                         : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp),
                           "=&r" (ret)
                         : GCC_OFF_SMALL_ASM() (rw->lock)
diff --git a/arch/mips/include/uapi/asm/unistd.h b/arch/mips/include/uapi/asm/unistd.h
index 3e940dbe0262..78faf4292e90 100644
--- a/arch/mips/include/uapi/asm/unistd.h
+++ b/arch/mips/include/uapi/asm/unistd.h
@@ -386,17 +386,18 @@
 #define __NR_pkey_mprotect              (__NR_Linux + 363)
 #define __NR_pkey_alloc                 (__NR_Linux + 364)
 #define __NR_pkey_free                  (__NR_Linux + 365)
+#define __NR_statx                      (__NR_Linux + 366)
 
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             365
+#define __NR_Linux_syscalls             366
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         365
+#define __NR_O32_Linux_syscalls         366
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -730,16 +731,17 @@
 #define __NR_pkey_mprotect              (__NR_Linux + 323)
 #define __NR_pkey_alloc                 (__NR_Linux + 324)
 #define __NR_pkey_free                  (__NR_Linux + 325)
+#define __NR_statx                      (__NR_Linux + 326)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             325
+#define __NR_Linux_syscalls             326
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          325
+#define __NR_64_Linux_syscalls          326
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -1077,15 +1079,16 @@
 #define __NR_pkey_mprotect              (__NR_Linux + 327)
 #define __NR_pkey_alloc                 (__NR_Linux + 328)
 #define __NR_pkey_free                  (__NR_Linux + 329)
+#define __NR_statx                      (__NR_Linux + 330)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             329
+#define __NR_Linux_syscalls             330
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         329
+#define __NR_N32_Linux_syscalls         330
 
 #endif /* _UAPI_ASM_UNISTD_H */
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index bb5c5d34ba81..a670c0c11875 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
         DEFINE(_THREAD_SIZE, THREAD_SIZE);
         DEFINE(_THREAD_MASK, THREAD_MASK);
         DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
+        DEFINE(_IRQ_STACK_START, IRQ_STACK_START);
         BLANK();
 }
 
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 59476a607add..a00e87b0256d 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -361,7 +361,7 @@ LEAF(mips_cps_get_bootcfg)
         END(mips_cps_get_bootcfg)
 
 LEAF(mips_cps_boot_vpes)
-        PTR_L   ta2, COREBOOTCFG_VPEMASK(a0)
+        lw      ta2, COREBOOTCFG_VPEMASK(a0)
         PTR_L   ta3, COREBOOTCFG_VPECONFIG(a0)
 
 #if defined(CONFIG_CPU_MIPSR6)
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 07718bb5fc9d..12422fd4af23 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -1824,7 +1824,7 @@ static inline void cpu_probe_loongson(struct cpuinfo_mips *c, unsigned int cpu)
                 }
 
                 decode_configs(c);
-                c->options |= MIPS_CPU_TLBINV | MIPS_CPU_LDPTE;
+                c->options |= MIPS_CPU_FTLB | MIPS_CPU_TLBINV | MIPS_CPU_LDPTE;
                 c->writecombine = _CACHE_UNCACHED_ACCELERATED;
                 break;
         default:
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index 7ec9612cb007..ae810da4d499 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -215,9 +215,11 @@ NESTED(handle_int, PT_SIZE, sp)
         beq     t0, t1, 2f
 
         /* Switch to IRQ stack */
-        li      t1, _IRQ_STACK_SIZE
+        li      t1, _IRQ_STACK_START
         PTR_ADD sp, t0, t1
 
+        /* Save task's sp on IRQ stack so that unwinding can follow it */
+        LONG_S  s1, 0(sp)
 2:
         jal     plat_irq_dispatch
 
@@ -325,9 +327,11 @@ NESTED(except_vec_vi_handler, 0, sp)
         beq     t0, t1, 2f
 
         /* Switch to IRQ stack */
-        li      t1, _IRQ_STACK_SIZE
+        li      t1, _IRQ_STACK_START
         PTR_ADD sp, t0, t1
 
+        /* Save task's sp on IRQ stack so that unwinding can follow it */
+        LONG_S  s1, 0(sp)
 2:
         jalr    v0
 
@@ -519,7 +523,7 @@ NESTED(nmi_handler, PT_SIZE, sp)
         BUILD_HANDLER reserved reserved sti verbose     /* others */
 
         .align  5
-        LEAF(handle_ri_rdhwr_vivt)
+        LEAF(handle_ri_rdhwr_tlbp)
         .set    push
         .set    noat
         .set    noreorder
@@ -538,7 +542,7 @@ NESTED(nmi_handler, PT_SIZE, sp)
         .set    pop
         bltz    k1, handle_ri   /* slow path */
         /* fall thru */
-        END(handle_ri_rdhwr_vivt)
+        END(handle_ri_rdhwr_tlbp)
 
         LEAF(handle_ri_rdhwr)
         .set    push
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index fb6b6b650719..b68e10fc453d 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -488,31 +488,52 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
                                               unsigned long pc,
                                               unsigned long *ra)
 {
+        unsigned long low, high, irq_stack_high;
         struct mips_frame_info info;
         unsigned long size, ofs;
+        struct pt_regs *regs;
         int leaf;
-        extern void ret_from_irq(void);
-        extern void ret_from_exception(void);
 
         if (!stack_page)
                 return 0;
 
         /*
-         * If we reached the bottom of interrupt context,
-         * return saved pc in pt_regs.
+         * IRQ stacks start at IRQ_STACK_START
+         * task stacks at THREAD_SIZE - 32
          */
-        if (pc == (unsigned long)ret_from_irq ||
-            pc == (unsigned long)ret_from_exception) {
-                struct pt_regs *regs;
-                if (*sp >= stack_page &&
-                    *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) {
-                        regs = (struct pt_regs *)*sp;
-                        pc = regs->cp0_epc;
-                        if (!user_mode(regs) && __kernel_text_address(pc)) {
-                                *sp = regs->regs[29];
-                                *ra = regs->regs[31];
-                                return pc;
-                        }
+        low = stack_page;
+        if (!preemptible() && on_irq_stack(raw_smp_processor_id(), *sp)) {
+                high = stack_page + IRQ_STACK_START;
+                irq_stack_high = high;
+        } else {
+                high = stack_page + THREAD_SIZE - 32;
+                irq_stack_high = 0;
+        }
+
+        /*
+         * If we reached the top of the interrupt stack, start unwinding
+         * the interrupted task stack.
+         */
+        if (unlikely(*sp == irq_stack_high)) {
+                unsigned long task_sp = *(unsigned long *)*sp;
+
+                /*
+                 * Check that the pointer saved in the IRQ stack head points to
+                 * something within the stack of the current task
+                 */
+                if (!object_is_on_stack((void *)task_sp))
+                        return 0;
+
+                /*
+                 * Follow pointer to tasks kernel stack frame where interrupted
+                 * state was saved.
+                 */
+                regs = (struct pt_regs *)task_sp;
+                pc = regs->cp0_epc;
+                if (!user_mode(regs) && __kernel_text_address(pc)) {
+                        *sp = regs->regs[29];
+                        *ra = regs->regs[31];
+                        return pc;
                 }
                 return 0;
         }
@@ -533,8 +554,7 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
         if (leaf < 0)
                 return 0;
 
-        if (*sp < stack_page ||
-            *sp + info.frame_size > stack_page + THREAD_SIZE - 32)
+        if (*sp < low || *sp + info.frame_size > high)
                 return 0;
 
         if (leaf)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 339601267265..6931fe722a0b 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -456,7 +456,8 @@ static int fpr_set(struct task_struct *target,
                                           &target->thread.fpu,
                                           0, sizeof(elf_fpregset_t));
 
-        for (i = 0; i < NUM_FPU_REGS; i++) {
+        BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t));
+        for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) {
                 err = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &fpr_val, i * sizeof(elf_fpreg_t),
                                          (i + 1) * sizeof(elf_fpreg_t));
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index c29d397eee86..80ed68b2c95e 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -600,3 +600,4 @@ EXPORT(sys_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free                   /* 4365 */
+        PTR     sys_statx
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 0687f96ee912..49765b44aa9b 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -438,4 +438,5 @@ EXPORT(sys_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free                   /* 5325 */
+        PTR     sys_statx
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 0331ba39a065..90bad2d1b2d3 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -433,4 +433,5 @@ EXPORT(sysn32_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free
+        PTR     sys_statx                       /* 6330 */
         .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 5a47042dd25f..2dd70bd104e1 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -588,4 +588,5 @@ EXPORT(sys32_call_table)
         PTR     sys_pkey_mprotect
         PTR     sys_pkey_alloc
         PTR     sys_pkey_free                   /* 4365 */
+        PTR     sys_statx
         .size   sys32_call_table,.-sys32_call_table
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 3daa2cae50b0..1b070a76fcdd 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -11,6 +11,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/sched/hotplug.h>
+#include <linux/sched/task_stack.h>
 #include <linux/mm.h>
 #include <linux/delay.h>
 #include <linux/smp.h>
diff --git a/arch/mips/kernel/smp-mt.c b/arch/mips/kernel/smp-mt.c
index e077ea3e11fb..e398cbc3d776 100644
--- a/arch/mips/kernel/smp-mt.c
+++ b/arch/mips/kernel/smp-mt.c
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/irqchip/mips-gic.h>
 #include <linux/compiler.h>
+#include <linux/sched/task_stack.h>
 #include <linux/smp.h>
 
 #include <linux/atomic.h>
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index c7d17cfb32f6..b49e7bf9f950 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -83,7 +83,7 @@ extern asmlinkage void handle_dbe(void);
 extern asmlinkage void handle_sys(void);
 extern asmlinkage void handle_bp(void);
 extern asmlinkage void handle_ri(void);
-extern asmlinkage void handle_ri_rdhwr_vivt(void);
+extern asmlinkage void handle_ri_rdhwr_tlbp(void);
 extern asmlinkage void handle_ri_rdhwr(void);
 extern asmlinkage void handle_cpu(void);
 extern asmlinkage void handle_ov(void);
@@ -2408,9 +2408,18 @@ void __init trap_init(void)
 
         set_except_vector(EXCCODE_SYS, handle_sys);
         set_except_vector(EXCCODE_BP, handle_bp);
-        set_except_vector(EXCCODE_RI, rdhwr_noopt ? handle_ri :
-                          (cpu_has_vtag_icache ?
-                           handle_ri_rdhwr_vivt : handle_ri_rdhwr));
+
+        if (rdhwr_noopt)
+                set_except_vector(EXCCODE_RI, handle_ri);
+        else {
+                if (cpu_has_vtag_icache)
+                        set_except_vector(EXCCODE_RI, handle_ri_rdhwr_tlbp);
+                else if (current_cpu_type() == CPU_LOONGSON3)
+                        set_except_vector(EXCCODE_RI, handle_ri_rdhwr_tlbp);
+                else
+                        set_except_vector(EXCCODE_RI, handle_ri_rdhwr);
+        }
+
         set_except_vector(EXCCODE_CPU, handle_cpu);
         set_except_vector(EXCCODE_OV, handle_ov);
         set_except_vector(EXCCODE_TR, handle_tr);
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index 3c3aa05891dd..95bec460b651 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -467,7 +467,7 @@ void __init ltq_soc_init(void)
 
                 if (!np_xbar)
                         panic("Failed to load xbar nodes from devicetree");
-                if (of_address_to_resource(np_pmu, 0, &res_xbar))
+                if (of_address_to_resource(np_xbar, 0, &res_xbar))
                         panic("Failed to get xbar resources");
                 if (!request_mem_region(res_xbar.start, resource_size(&res_xbar),
                         res_xbar.name))
diff --git a/arch/mips/loongson64/loongson-3/cop2-ex.c b/arch/mips/loongson64/loongson-3/cop2-ex.c
index ea13764d0a03..621d6af5f6eb 100644
--- a/arch/mips/loongson64/loongson-3/cop2-ex.c
+++ b/arch/mips/loongson64/loongson-3/cop2-ex.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/notifier.h>
+#include <linux/ptrace.h>
 
 #include <asm/fpu.h>
 #include <asm/cop2.h>
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index e7f798d55fbc..3fe99cb271a9 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1562,6 +1562,7 @@ static void probe_vcache(void)
         vcache_size = c->vcache.sets * c->vcache.ways * c->vcache.linesz;
 
         c->vcache.waybit = 0;
+        c->vcache.waysize = vcache_size / c->vcache.ways;
 
         pr_info("Unified victim cache %ldkB %s, linesize %d bytes.\n",
                 vcache_size >> 10, way_string[c->vcache.ways], c->vcache.linesz);
@@ -1664,6 +1665,7 @@ static void __init loongson3_sc_init(void)
         /* Loongson-3 has 4 cores, 1MB scache for each. scaches are shared */
         scache_size *= 4;
         c->scache.waybit = 0;
+        c->scache.waysize = scache_size / c->scache.ways;
         pr_info("Unified secondary cache %ldkB %s, linesize %d bytes.\n",
                scache_size >> 10, way_string[c->scache.ways], c->scache.linesz);
         if (scache_size)
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 9bfee8988eaf..4f642e07c2b1 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -760,7 +760,8 @@ static void build_huge_update_entries(u32 **p, unsigned int pte,
 static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
                                     struct uasm_label **l,
                                     unsigned int pte,
-                                    unsigned int ptr)
+                                    unsigned int ptr,
+                                    unsigned int flush)
 {
 #ifdef CONFIG_SMP
         UASM_i_SC(p, pte, 0, ptr);
@@ -769,6 +770,22 @@ static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
 #else
         UASM_i_SW(p, pte, 0, ptr);
 #endif
+        if (cpu_has_ftlb && flush) {
+                BUG_ON(!cpu_has_tlbinv);
+
+                UASM_i_MFC0(p, ptr, C0_ENTRYHI);
+                uasm_i_ori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
+                UASM_i_MTC0(p, ptr, C0_ENTRYHI);
+                build_tlb_write_entry(p, l, r, tlb_indexed);
+
+                uasm_i_xori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
+                UASM_i_MTC0(p, ptr, C0_ENTRYHI);
+                build_huge_update_entries(p, pte, ptr);
+                build_huge_tlb_write_entry(p, l, r, pte, tlb_random, 0);
+
+                return;
+        }
+
         build_huge_update_entries(p, pte, ptr);
         build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed, 0);
 }
@@ -2199,7 +2216,7 @@ static void build_r4000_tlb_load_handler(void)
                 uasm_l_tlbl_goaround2(&l, p);
         }
         uasm_i_ori(&p, wr.r1, wr.r1, (_PAGE_ACCESSED | _PAGE_VALID));
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
 #endif
 
         uasm_l_nopage_tlbl(&l, p);
@@ -2254,7 +2271,7 @@ static void build_r4000_tlb_store_handler(void)
         build_tlb_probe_entry(&p);
         uasm_i_ori(&p, wr.r1, wr.r1,
                    _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY);
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
 #endif
 
         uasm_l_nopage_tlbs(&l, p);
@@ -2310,7 +2327,7 @@ static void build_r4000_tlb_modify_handler(void)
         build_tlb_probe_entry(&p);
         uasm_i_ori(&p, wr.r1, wr.r1,
                    _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY);
-        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
+        build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 0);
 #endif
 
         uasm_l_nopage_tlbm(&l, p);
diff --git a/arch/mips/netlogic/common/smp.c b/arch/mips/netlogic/common/smp.c
index 10d86d54880a..bddf1ef553a4 100644
--- a/arch/mips/netlogic/common/smp.c
+++ b/arch/mips/netlogic/common/smp.c
@@ -35,6 +35,7 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/init.h>
+#include <linux/sched/task_stack.h>
 #include <linux/smp.h>
 #include <linux/irq.h>
 
diff --git a/arch/mips/netlogic/xlp/cop2-ex.c b/arch/mips/netlogic/xlp/cop2-ex.c
index 52bc5de42005..21e439b3db70 100644
--- a/arch/mips/netlogic/xlp/cop2-ex.c
+++ b/arch/mips/netlogic/xlp/cop2-ex.c
@@ -9,11 +9,14 @@
  * Copyright (C) 2009 Wind River Systems,
  *   written by Ralf Baechle <ralf@linux-mips.org>
  */
+#include <linux/capability.h>
 #include <linux/init.h>
 #include <linux/irqflags.h>
 #include <linux/notifier.h>
 #include <linux/prefetch.h>
+#include <linux/ptrace.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 
 #include <asm/cop2.h>
 #include <asm/current.h>
diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c
index c4ffd43d3996..48ce701557a4 100644
--- a/arch/mips/ralink/rt3883.c
+++ b/arch/mips/ralink/rt3883.c
@@ -35,7 +35,7 @@ static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) };
 static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
 static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
 static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) };
-static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna a", 0, 35, 3) };
+static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) };
 static struct rt2880_pmx_func pci_func[] = {
         FUNC("pci-dev", 0, 40, 32),
         FUNC("pci-host2", 1, 40, 32),
@@ -43,7 +43,7 @@ static struct rt2880_pmx_func pci_func[] = {
         FUNC("pci-fnc", 3, 40, 32)
 };
 static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) };
-static struct rt2880_pmx_func ge2_func[] = { FUNC("ge1", 0, 84, 12) };
+static struct rt2880_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) };
 
 static struct rt2880_pmx_group rt3883_pinmux_data[] = {
         GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C),
diff --git a/arch/mips/sgi-ip22/ip28-berr.c b/arch/mips/sgi-ip22/ip28-berr.c
index 1f2a5bc4779e..75460e1e106b 100644
--- a/arch/mips/sgi-ip22/ip28-berr.c
+++ b/arch/mips/sgi-ip22/ip28-berr.c
@@ -9,6 +9,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/signal.h>
 #include <linux/seq_file.h>
 
 #include <asm/addrspace.h>
diff --git a/arch/mips/sgi-ip27/ip27-berr.c b/arch/mips/sgi-ip27/ip27-berr.c
index d12879eb2b1f..83efe03d5c60 100644
--- a/arch/mips/sgi-ip27/ip27-berr.c
+++ b/arch/mips/sgi-ip27/ip27-berr.c
@@ -12,7 +12,9 @@
 #include <linux/signal.h>       /* for SIGBUS */
 #include <linux/sched.h>        /* schow_regs(), force_sig() */
 #include <linux/sched/debug.h>
+#include <linux/sched/signal.h>
 
+#include <asm/ptrace.h>
 #include <asm/sn/addrs.h>
 #include <asm/sn/arch.h>
 #include <asm/sn/sn0/hub.h>
diff --git a/arch/mips/sgi-ip27/ip27-smp.c b/arch/mips/sgi-ip27/ip27-smp.c
index f5ed45e8f442..4cd47d23d81a 100644
--- a/arch/mips/sgi-ip27/ip27-smp.c
+++ b/arch/mips/sgi-ip27/ip27-smp.c
@@ -8,10 +8,13 @@
  */
 #include <linux/init.h>
 #include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 #include <linux/topology.h>
 #include <linux/nodemask.h>
+
 #include <asm/page.h>
 #include <asm/processor.h>
+#include <asm/ptrace.h>
 #include <asm/sn/arch.h>
 #include <asm/sn/gda.h>
 #include <asm/sn/intr.h>
diff --git a/arch/mips/sgi-ip32/ip32-berr.c b/arch/mips/sgi-ip32/ip32-berr.c
index 57d8c7486fe6..c1f12a9cf305 100644
--- a/arch/mips/sgi-ip32/ip32-berr.c
+++ b/arch/mips/sgi-ip32/ip32-berr.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/signal.h>
 #include <asm/traps.h>
 #include <linux/uaccess.h>
 #include <asm/addrspace.h>
diff --git a/arch/mips/sgi-ip32/ip32-reset.c b/arch/mips/sgi-ip32/ip32-reset.c
index 8bd415c8729f..b3b442def423 100644
--- a/arch/mips/sgi-ip32/ip32-reset.c
+++ b/arch/mips/sgi-ip32/ip32-reset.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/notifier.h>
 #include <linux/delay.h>
 #include <linux/rtc/ds1685.h>
diff --git a/arch/mn10300/include/asm/page.h b/arch/mn10300/include/asm/page.h
index 3810a6f740fd..dfe730a5ede0 100644
--- a/arch/mn10300/include/asm/page.h
+++ b/arch/mn10300/include/asm/page.h
@@ -57,6 +57,7 @@ typedef struct page *pgtable_t;
 #define __pgd(x)        ((pgd_t) { (x) })
 #define __pgprot(x)     ((pgprot_t) { (x) })
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/nios2/include/asm/pgtable.h b/arch/nios2/include/asm/pgtable.h
index 298393c3cb42..db4f7d179220 100644
--- a/arch/nios2/include/asm/pgtable.h
+++ b/arch/nios2/include/asm/pgtable.h
@@ -22,6 +22,7 @@
 #include <asm/tlbflush.h>
 
 #include <asm/pgtable-bits.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #define FIRST_USER_ADDRESS      0UL
diff --git a/arch/nios2/kernel/prom.c b/arch/nios2/kernel/prom.c
index 367c5426157b..3901b80d4420 100644
--- a/arch/nios2/kernel/prom.c
+++ b/arch/nios2/kernel/prom.c
@@ -48,6 +48,13 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
         return alloc_bootmem_align(size, align);
 }
 
+int __init early_init_dt_reserve_memory_arch(phys_addr_t base, phys_addr_t size,
+                                             bool nomap)
+{
+        reserve_bootmem(base, size, BOOTMEM_DEFAULT);
+        return 0;
+}
+
 void __init early_init_devtree(void *params)
 {
         __be32 *dtb = (u32 *)__dtb_start;
diff --git a/arch/nios2/kernel/setup.c b/arch/nios2/kernel/setup.c
index 6e57ffa5db27..6044d9be28b4 100644
--- a/arch/nios2/kernel/setup.c
+++ b/arch/nios2/kernel/setup.c
@@ -201,6 +201,9 @@ void __init setup_arch(char **cmdline_p)
         }
 #endif /* CONFIG_BLK_DEV_INITRD */
 
+        early_init_fdt_reserve_self();
+        early_init_fdt_scan_reserved_mem();
+
         unflatten_and_copy_device_tree();
 
         setup_cpuinfo();
diff --git a/arch/openrisc/include/asm/cmpxchg.h b/arch/openrisc/include/asm/cmpxchg.h
index 5fcb9ac72693..f0a5d8b844d6 100644
--- a/arch/openrisc/include/asm/cmpxchg.h
+++ b/arch/openrisc/include/asm/cmpxchg.h
@@ -77,7 +77,11 @@ static inline unsigned long __xchg(unsigned long val, volatile void *ptr,
         return val;
 }
 
-#define xchg(ptr, with) \
-        ((typeof(*(ptr)))__xchg((unsigned long)(with), (ptr), sizeof(*(ptr))))
+#define xchg(ptr, with)                                                 \
+        ({                                                              \
+                (__typeof__(*(ptr))) __xchg((unsigned long)(with),      \
+                                            (ptr),                      \
+                                            sizeof(*(ptr)));            \
+        })
 
 #endif /* __ASM_OPENRISC_CMPXCHG_H */
diff --git a/arch/openrisc/include/asm/pgtable.h b/arch/openrisc/include/asm/pgtable.h
index 3567aa7be555..ff97374ca069 100644
--- a/arch/openrisc/include/asm/pgtable.h
+++ b/arch/openrisc/include/asm/pgtable.h
@@ -25,6 +25,7 @@
 #ifndef __ASM_OPENRISC_PGTABLE_H
 #define __ASM_OPENRISC_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
index 140faa16685a..1311e6b13991 100644
--- a/arch/openrisc/include/asm/uaccess.h
+++ b/arch/openrisc/include/asm/uaccess.h
@@ -211,7 +211,7 @@ do {									\
         case 1: __get_user_asm(x, ptr, retval, "l.lbz"); break;         \
         case 2: __get_user_asm(x, ptr, retval, "l.lhz"); break;         \
         case 4: __get_user_asm(x, ptr, retval, "l.lwz"); break;         \
-        case 8: __get_user_asm2(x, ptr, retval);                        \
+        case 8: __get_user_asm2(x, ptr, retval); break;                 \
         default: (x) = __get_user_bad();                                \
         }                                                               \
 } while (0)
diff --git a/arch/openrisc/kernel/or32_ksyms.c b/arch/openrisc/kernel/or32_ksyms.c
index 5c4695d13542..ee3e604959e1 100644
--- a/arch/openrisc/kernel/or32_ksyms.c
+++ b/arch/openrisc/kernel/or32_ksyms.c
@@ -30,6 +30,7 @@
 #include <asm/hardirq.h>
 #include <asm/delay.h>
 #include <asm/pgalloc.h>
+#include <asm/pgtable.h>
 
 #define DECLARE_EXPORT(name) extern void name(void); EXPORT_SYMBOL(name)
 
@@ -42,6 +43,9 @@ DECLARE_EXPORT(__muldi3);
 DECLARE_EXPORT(__ashrdi3);
 DECLARE_EXPORT(__ashldi3);
 DECLARE_EXPORT(__lshrdi3);
+DECLARE_EXPORT(__ucmpdi2);
 
+EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(__copy_tofrom_user);
+EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(memset);
diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index 828a29110459..f8da545854f9 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -90,6 +90,7 @@ void arch_cpu_idle(void)
 }
 
 void (*pm_power_off) (void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
 
 /*
  * When a process does an "exec", machine state like FPU and debug
diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
index 19c9c3c5f267..c7e15cc5c668 100644
--- a/arch/parisc/include/asm/cacheflush.h
+++ b/arch/parisc/include/asm/cacheflush.h
@@ -43,28 +43,9 @@ static inline void flush_kernel_dcache_page(struct page *page)
 
 #define flush_kernel_dcache_range(start,size) \
         flush_kernel_dcache_range_asm((start), (start)+(size));
-/* vmap range flushes and invalidates.  Architecturally, we don't need
- * the invalidate, because the CPU should refuse to speculate once an
- * area has been flushed, so invalidate is left empty */
-static inline void flush_kernel_vmap_range(void *vaddr, int size)
-{
-        unsigned long start = (unsigned long)vaddr;
-
-        flush_kernel_dcache_range_asm(start, start + size);
-}
-static inline void invalidate_kernel_vmap_range(void *vaddr, int size)
-{
-        unsigned long start = (unsigned long)vaddr;
-        void *cursor = vaddr;
 
-        for ( ; cursor < vaddr + size; cursor += PAGE_SIZE) {
-                struct page *page = vmalloc_to_page(cursor);
-
-                if (test_and_clear_bit(PG_dcache_dirty, &page->flags))
-                        flush_kernel_dcache_page(page);
-        }
-        flush_kernel_dcache_range_asm(start, start + size);
-}
+void flush_kernel_vmap_range(void *vaddr, int size);
+void invalidate_kernel_vmap_range(void *vaddr, int size);
 
 #define flush_cache_vmap(start, end)            flush_cache_all()
 #define flush_cache_vunmap(start, end)          flush_cache_all()
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index fb4382c28259..cbd4f4af8108 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -32,16 +32,17 @@
  * that put_user is the same as __put_user, etc.
  */
 
-#define access_ok(type, uaddr, size) (1)
+#define access_ok(type, uaddr, size)    \
+        ( (uaddr) == (uaddr) )
 
 #define put_user __put_user
 #define get_user __get_user
 
 #if !defined(CONFIG_64BIT)
-#define LDD_USER(ptr)           __get_user_asm64(ptr)
+#define LDD_USER(val, ptr)      __get_user_asm64(val, ptr)
 #define STD_USER(x, ptr)        __put_user_asm64(x, ptr)
 #else
-#define LDD_USER(ptr)           __get_user_asm("ldd", ptr)
+#define LDD_USER(val, ptr)      __get_user_asm(val, "ldd", ptr)
 #define STD_USER(x, ptr)        __put_user_asm("std", x, ptr)
 #endif
 
@@ -64,6 +65,15 @@ struct exception_table_entry {
         ".previous\n"
 
 /*
+ * ASM_EXCEPTIONTABLE_ENTRY_EFAULT() creates a special exception table entry
+ * (with lowest bit set) for which the fault handler in fixup_exception() will
+ * load -EFAULT into %r8 for a read or write fault, and zeroes the target
+ * register in case of a read fault in get_user().
+ */
+#define ASM_EXCEPTIONTABLE_ENTRY_EFAULT( fault_addr, except_addr )\
+        ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr + 1)
+
+/*
  * The page fault handler stores, in a per-cpu area, the following information
  * if a fixup routine is available.
  */
@@ -87,92 +97,116 @@ struct exception_data {
                 " mtsp %0,%%sr2\n\t"            \
                 : : "r"(get_fs()) : )
 
-#define __get_user(x, ptr)                               \
-({                                                       \
-        register long __gu_err __asm__ ("r8") = 0;       \
-        register long __gu_val __asm__ ("r9") = 0;       \
-                                                         \
-        load_sr2();                                      \
-        switch (sizeof(*(ptr))) {                        \
-            case 1: __get_user_asm("ldb", ptr); break;   \
-            case 2: __get_user_asm("ldh", ptr); break;   \
-            case 4: __get_user_asm("ldw", ptr); break;   \
-            case 8: LDD_USER(ptr);  break;               \
-            default: BUILD_BUG(); break;                 \
-        }                                                \
-                                                         \
-        (x) = (__force __typeof__(*(ptr))) __gu_val;     \
-        __gu_err;                                        \
+#define __get_user_internal(val, ptr)                   \
+({                                                      \
+        register long __gu_err __asm__ ("r8") = 0;      \
+                                                        \
+        switch (sizeof(*(ptr))) {                       \
+        case 1: __get_user_asm(val, "ldb", ptr); break; \
+        case 2: __get_user_asm(val, "ldh", ptr); break; \
+        case 4: __get_user_asm(val, "ldw", ptr); break; \
+        case 8: LDD_USER(val, ptr); break;              \
+        default: BUILD_BUG();                           \
+        }                                               \
+                                                        \
+        __gu_err;                                       \
 })
 
-#define __get_user_asm(ldx, ptr)                        \
-        __asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t"     \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
+#define __get_user(val, ptr)                            \
+({                                                      \
+        load_sr2();                                     \
+        __get_user_internal(val, ptr);                  \
+})
+
+#define __get_user_asm(val, ldx, ptr)                   \
+{                                                       \
+        register long __gu_val;                         \
+                                                        \
+        __asm__("1: " ldx " 0(%%sr2,%2),%0\n"           \
+                "9:\n"                                  \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
                 : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err)               \
-                : "r1");
+                : "r"(ptr), "1"(__gu_err));             \
+                                                        \
+        (val) = (__force __typeof__(*(ptr))) __gu_val;  \
+}
 
 #if !defined(CONFIG_64BIT)
 
-#define __get_user_asm64(ptr)                           \
-        __asm__("\n1:\tldw 0(%%sr2,%2),%0"              \
-                "\n2:\tldw 4(%%sr2,%2),%R0\n\t"         \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\
-                ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\
-                : "=r"(__gu_val), "=r"(__gu_err)        \
-                : "r"(ptr), "1"(__gu_err)               \
-                : "r1");
+#define __get_user_asm64(val, ptr)                      \
+{                                                       \
+        union {                                         \
+                unsigned long long      l;              \
+                __typeof__(*(ptr))      t;              \
+        } __gu_tmp;                                     \
+                                                        \
+        __asm__("   copy %%r0,%R0\n"                    \
+                "1: ldw 0(%%sr2,%2),%0\n"               \
+                "2: ldw 4(%%sr2,%2),%R0\n"              \
+                "9:\n"                                  \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b) \
+                : "=&r"(__gu_tmp.l), "=r"(__gu_err)     \
+                : "r"(ptr), "1"(__gu_err));             \
+                                                        \
+        (val) = __gu_tmp.t;                             \
+}
 
 #endif /* !defined(CONFIG_64BIT) */
 
 
-#define __put_user(x, ptr)                                      \
+#define __put_user_internal(x, ptr)                             \
 ({                                                              \
         register long __pu_err __asm__ ("r8") = 0;              \
         __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x);       \
                                                                 \
-        load_sr2();                                             \
         switch (sizeof(*(ptr))) {                               \
-            case 1: __put_user_asm("stb", __x, ptr); break;     \
-            case 2: __put_user_asm("sth", __x, ptr); break;     \
-            case 4: __put_user_asm("stw", __x, ptr); break;     \
-            case 8: STD_USER(__x, ptr); break;                  \
-            default: BUILD_BUG(); break;                        \
-        }                                                       \
+        case 1: __put_user_asm("stb", __x, ptr); break;         \
+        case 2: __put_user_asm("sth", __x, ptr); break;         \
+        case 4: __put_user_asm("stw", __x, ptr); break;         \
+        case 8: STD_USER(__x, ptr); break;                      \
+        default: BUILD_BUG();                                   \
+        }                                                       \
                                                                 \
         __pu_err;                                               \
 })
 
+#define __put_user(x, ptr)                                      \
+({                                                              \
+        load_sr2();                                             \
+        __put_user_internal(x, ptr);                            \
+})
+
+
 /*
  * The "__put_user/kernel_asm()" macros tell gcc they read from memory
  * instead of writing. This is because they do not write to any memory
  * gcc knows about, so there are no aliasing issues. These macros must
- * also be aware that "fixup_put_user_skip_[12]" are executed in the
- * context of the fault, and any registers used there must be listed
- * as clobbers. In this case only "r1" is used by the current routines.
- * r8/r9 are already listed as err/val.
+ * also be aware that fixups are executed in the context of the fault,
+ * and any registers used there must be listed as clobbers.
+ * r8 is already listed as err.
  */
 
 #define __put_user_asm(stx, x, ptr)                         \
         __asm__ __volatile__ (                              \
-                "\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t"         \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
+                "1: " stx " %2,0(%%sr2,%1)\n"               \
+                "9:\n"                                      \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)     \
                 : "=r"(__pu_err)                            \
-                : "r"(ptr), "r"(x), "0"(__pu_err)           \
-                : "r1")
+                : "r"(ptr), "r"(x), "0"(__pu_err))
 
 
 #if !defined(CONFIG_64BIT)
 
 #define __put_user_asm64(__val, ptr) do {                   \
         __asm__ __volatile__ (                              \
-                "\n1:\tstw %2,0(%%sr2,%1)"                  \
-                "\n2:\tstw %R2,4(%%sr2,%1)\n\t"             \
-                ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
-                ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
+                "1: stw %2,0(%%sr2,%1)\n"                   \
+                "2: stw %R2,4(%%sr2,%1)\n"                  \
+                "9:\n"                                      \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)     \
+                ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b)     \
                 : "=r"(__pu_err)                            \
-                : "r"(ptr), "r"(__val), "0"(__pu_err) \
-                : "r1");                                    \
+                : "r"(ptr), "r"(__val), "0"(__pu_err));     \
 } while (0)
 
 #endif /* !defined(CONFIG_64BIT) */
diff --git a/arch/parisc/include/uapi/asm/unistd.h b/arch/parisc/include/uapi/asm/unistd.h
index 6b0741e7a7ed..667c99421003 100644
--- a/arch/parisc/include/uapi/asm/unistd.h
+++ b/arch/parisc/include/uapi/asm/unistd.h
@@ -362,8 +362,9 @@
 #define __NR_copy_file_range    (__NR_Linux + 346)
 #define __NR_preadv2            (__NR_Linux + 347)
 #define __NR_pwritev2           (__NR_Linux + 348)
+#define __NR_statx              (__NR_Linux + 349)
 
-#define __NR_Linux_syscalls     (__NR_pwritev2 + 1)
+#define __NR_Linux_syscalls     (__NR_statx + 1)
 
 
 #define __IGNORE_select         /* newselect */
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 0dc72d5de861..c32a09095216 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -616,3 +616,25 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                 __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
         }
 }
+
+void flush_kernel_vmap_range(void *vaddr, int size)
+{
+        unsigned long start = (unsigned long)vaddr;
+
+        if ((unsigned long)size > parisc_cache_flush_threshold)
+                flush_data_cache();
+        else
+                flush_kernel_dcache_range_asm(start, start + size);
+}
+EXPORT_SYMBOL(flush_kernel_vmap_range);
+
+void invalidate_kernel_vmap_range(void *vaddr, int size)
+{
+        unsigned long start = (unsigned long)vaddr;
+
+        if ((unsigned long)size > parisc_cache_flush_threshold)
+                flush_data_cache();
+        else
+                flush_kernel_dcache_range_asm(start, start + size);
+}
+EXPORT_SYMBOL(invalidate_kernel_vmap_range);
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index a0ecdb4abcc8..c66c943d9322 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -620,6 +620,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                          */
                         *loc = fsel(val, addend); 
                         break;
+                case R_PARISC_SECREL32:
+                        /* 32-bit section relative address. */
+                        *loc = fsel(val, addend);
+                        break;
                 case R_PARISC_DPREL21L:
                         /* left 21 bit of relative address */
                         val = lrsel(val - dp, addend);
@@ -807,6 +811,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                          */
                         *loc = fsel(val, addend); 
                         break;
+                case R_PARISC_SECREL32:
+                        /* 32-bit section relative address. */
+                        *loc = fsel(val, addend);
+                        break;
                 case R_PARISC_FPTR64:
                         /* 64-bit function address */
                         if(in_local(me, (void *)(val + addend))) {
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 7484b3d11e0d..c6d6272a934f 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -47,16 +47,6 @@ EXPORT_SYMBOL(__cmpxchg_u64);
 EXPORT_SYMBOL(lclear_user);
 EXPORT_SYMBOL(lstrnlen_user);
 
-/* Global fixups - defined as int to avoid creation of function pointers */
-extern int fixup_get_user_skip_1;
-extern int fixup_get_user_skip_2;
-extern int fixup_put_user_skip_1;
-extern int fixup_put_user_skip_2;
-EXPORT_SYMBOL(fixup_get_user_skip_1);
-EXPORT_SYMBOL(fixup_get_user_skip_2);
-EXPORT_SYMBOL(fixup_put_user_skip_1);
-EXPORT_SYMBOL(fixup_put_user_skip_2);
-
 #ifndef CONFIG_64BIT
 /* Needed so insmod can set dp value */
 extern int $global$;
diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
index e282a5131d77..6017a5af2e6e 100644
--- a/arch/parisc/kernel/perf.c
+++ b/arch/parisc/kernel/perf.c
@@ -39,7 +39,7 @@
  *  the PDC INTRIGUE calls.  This is done to eliminate bugs introduced
  *  in various PDC revisions.  The code is much more maintainable
  *  and reliable this way vs having to debug on every version of PDC
- *  on every box. 
+ *  on every box.
  */
 
 #include <linux/capability.h>
@@ -195,8 +195,8 @@ static int perf_config(uint32_t *image_ptr);
 static int perf_release(struct inode *inode, struct file *file);
 static int perf_open(struct inode *inode, struct file *file);
 static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t *ppos);
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, 
-        loff_t *ppos);
+static ssize_t perf_write(struct file *file, const char __user *buf,
+        size_t count, loff_t *ppos);
 static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 static void perf_start_counters(void);
 static int perf_stop_counters(uint32_t *raddr);
@@ -222,7 +222,7 @@ extern void perf_intrigue_disable_perf_counters (void);
 /*
  * configure:
  *
- * Configure the cpu with a given data image.  First turn off the counters, 
+ * Configure the cpu with a given data image.  First turn off the counters,
  * then download the image, then turn the counters back on.
  */
 static int perf_config(uint32_t *image_ptr)
@@ -234,7 +234,7 @@ static int perf_config(uint32_t *image_ptr)
         error = perf_stop_counters(raddr);
         if (error != 0) {
                 printk("perf_config: perf_stop_counters = %ld\n", error);
-                return -EINVAL; 
+                return -EINVAL;
         }
 
 printk("Preparing to write image\n");
@@ -242,7 +242,7 @@ printk("Preparing to write image\n");
         error = perf_write_image((uint64_t *)image_ptr);
         if (error != 0) {
                 printk("perf_config: DOWNLOAD = %ld\n", error);
-                return -EINVAL; 
+                return -EINVAL;
         }
 
 printk("Preparing to start counters\n");
@@ -254,7 +254,7 @@ printk("Preparing to start counters\n");
 }
 
 /*
- * Open the device and initialize all of its memory.  The device is only 
+ * Open the device and initialize all of its memory.  The device is only
  * opened once, but can be "queried" by multiple processes that know its
  * file descriptor.
  */
@@ -298,19 +298,19 @@ static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t
  * called on the processor that the download should happen
  * on.
  */
-static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, 
-        loff_t *ppos)
+static ssize_t perf_write(struct file *file, const char __user *buf,
+        size_t count, loff_t *ppos)
 {
         size_t image_size;
         uint32_t image_type;
         uint32_t interface_type;
         uint32_t test;
 
-        if (perf_processor_interface == ONYX_INTF) 
+        if (perf_processor_interface == ONYX_INTF)
                 image_size = PCXU_IMAGE_SIZE;
-        else if (perf_processor_interface == CUDA_INTF) 
+        else if (perf_processor_interface == CUDA_INTF)
                 image_size = PCXW_IMAGE_SIZE;
-        else 
+        else
                 return -EFAULT;
 
         if (!capable(CAP_SYS_ADMIN))
@@ -330,22 +330,22 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
 
         /* First check the machine type is correct for
            the requested image */
-        if (((perf_processor_interface == CUDA_INTF) &&
-                       (interface_type != CUDA_INTF)) ||
-            ((perf_processor_interface == ONYX_INTF) &&
-                       (interface_type != ONYX_INTF))) 
+        if (((perf_processor_interface == CUDA_INTF) &&
+                        (interface_type != CUDA_INTF)) ||
+                ((perf_processor_interface == ONYX_INTF) &&
+                        (interface_type != ONYX_INTF)))
                 return -EINVAL;
 
         /* Next check to make sure the requested image
            is valid */
-        if (((interface_type == CUDA_INTF) && 
+        if (((interface_type == CUDA_INTF) &&
                        (test >= MAX_CUDA_IMAGES)) ||
-            ((interface_type == ONYX_INTF) && 
-                       (test >= MAX_ONYX_IMAGES))) 
+            ((interface_type == ONYX_INTF) &&
+                       (test >= MAX_ONYX_IMAGES)))
                 return -EINVAL;
 
         /* Copy the image into the processor */
-        if (interface_type == CUDA_INTF) 
+        if (interface_type == CUDA_INTF)
                 return perf_config(cuda_images[test]);
         else
                 return perf_config(onyx_images[test]);
@@ -359,7 +359,7 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
 static void perf_patch_images(void)
 {
 #if 0 /* FIXME!! */
-/* 
+/*
  * NOTE:  this routine is VERY specific to the current TLB image.
  * If the image is changed, this routine might also need to be changed.
  */
@@ -367,9 +367,9 @@ static void perf_patch_images(void)
         extern void $i_dtlb_miss_2_0();
         extern void PA2_0_iva();
 
-        /* 
+        /*
          * We can only use the lower 32-bits, the upper 32-bits should be 0
-         * anyway given this is in the kernel 
+         * anyway given this is in the kernel
          */
         uint32_t itlb_addr  = (uint32_t)&($i_itlb_miss_2_0);
         uint32_t dtlb_addr  = (uint32_t)&($i_dtlb_miss_2_0);
@@ -377,21 +377,21 @@ static void perf_patch_images(void)
 
         if (perf_processor_interface == ONYX_INTF) {
                 /* clear last 2 bytes */
-                onyx_images[TLBMISS][15] &= 0xffffff00;  
+                onyx_images[TLBMISS][15] &= 0xffffff00;
                 /* set 2 bytes */
                 onyx_images[TLBMISS][15] |= (0x000000ff&((dtlb_addr) >> 24));
                 onyx_images[TLBMISS][16] = (dtlb_addr << 8)&0xffffff00;
                 onyx_images[TLBMISS][17] = itlb_addr;
 
                 /* clear last 2 bytes */
-                onyx_images[TLBHANDMISS][15] &= 0xffffff00;  
+                onyx_images[TLBHANDMISS][15] &= 0xffffff00;
                 /* set 2 bytes */
                 onyx_images[TLBHANDMISS][15] |= (0x000000ff&((dtlb_addr) >> 24));
                 onyx_images[TLBHANDMISS][16] = (dtlb_addr << 8)&0xffffff00;
                 onyx_images[TLBHANDMISS][17] = itlb_addr;
 
                 /* clear last 2 bytes */
-                onyx_images[BIG_CPI][15] &= 0xffffff00;  
+                onyx_images[BIG_CPI][15] &= 0xffffff00;
                 /* set 2 bytes */
                 onyx_images[BIG_CPI][15] |= (0x000000ff&((dtlb_addr) >> 24));
                 onyx_images[BIG_CPI][16] = (dtlb_addr << 8)&0xffffff00;
@@ -404,24 +404,24 @@ static void perf_patch_images(void)
 
         } else if (perf_processor_interface == CUDA_INTF) {
                 /* Cuda interface */
-                cuda_images[TLBMISS][16] =  
+                cuda_images[TLBMISS][16] =
                         (cuda_images[TLBMISS][16]&0xffff0000) |
                         ((dtlb_addr >> 8)&0x0000ffff);
-                cuda_images[TLBMISS][17] = 
+                cuda_images[TLBMISS][17] =
                         ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
                 cuda_images[TLBMISS][18] = (itlb_addr << 16)&0xffff0000;
 
-                cuda_images[TLBHANDMISS][16] = 
+                cuda_images[TLBHANDMISS][16] =
                         (cuda_images[TLBHANDMISS][16]&0xffff0000) |
                         ((dtlb_addr >> 8)&0x0000ffff);
-                cuda_images[TLBHANDMISS][17] = 
+                cuda_images[TLBHANDMISS][17] =
                         ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
                 cuda_images[TLBHANDMISS][18] = (itlb_addr << 16)&0xffff0000;
 
-                cuda_images[BIG_CPI][16] = 
+                cuda_images[BIG_CPI][16] =
                         (cuda_images[BIG_CPI][16]&0xffff0000) |
                         ((dtlb_addr >> 8)&0x0000ffff);
-                cuda_images[BIG_CPI][17] = 
+                cuda_images[BIG_CPI][17] =
                         ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
                 cuda_images[BIG_CPI][18] = (itlb_addr << 16)&0xffff0000;
         } else {
@@ -433,7 +433,7 @@ static void perf_patch_images(void)
 
 /*
  * ioctl routine
- * All routines effect the processor that they are executed on.  Thus you 
+ * All routines effect the processor that they are executed on.  Thus you
  * must be running on the processor that you wish to change.
  */
 
@@ -459,7 +459,7 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         }
 
                         /* copy out the Counters */
-                        if (copy_to_user((void __user *)arg, raddr, 
+                        if (copy_to_user((void __user *)arg, raddr,
                                         sizeof (raddr)) != 0) {
                                 error =  -EFAULT;
                                 break;
@@ -487,7 +487,7 @@ static const struct file_operations perf_fops = {
         .open = perf_open,
         .release = perf_release
 };
-        
+
 static struct miscdevice perf_dev = {
         MISC_DYNAMIC_MINOR,
         PA_PERF_DEV,
@@ -595,7 +595,7 @@ static int perf_stop_counters(uint32_t *raddr)
                 /* OR sticky2 (bit 1496) to counter2 bit 32 */
                 tmp64 |= (userbuf[23] >> 8) & 0x0000000080000000;
                 raddr[2] = (uint32_t)tmp64;
-                
+
                 /* Counter3 is bits 1497 to 1528 */
                 tmp64 =  (userbuf[23] >> 7) & 0x00000000ffffffff;
                 /* OR sticky3 (bit 1529) to counter3 bit 32 */
@@ -617,7 +617,7 @@ static int perf_stop_counters(uint32_t *raddr)
                 userbuf[22] = 0;
                 userbuf[23] = 0;
 
-                /* 
+                /*
                  * Write back the zeroed bytes + the image given
                  * the read was destructive.
                  */
@@ -625,13 +625,13 @@ static int perf_stop_counters(uint32_t *raddr)
         } else {
 
                 /*
-                 * Read RDR-15 which contains the counters and sticky bits 
+                 * Read RDR-15 which contains the counters and sticky bits
                  */
                 if (!perf_rdr_read_ubuf(15, userbuf)) {
                         return -13;
                 }
 
-                /* 
+                /*
                  * Clear out the counters
                  */
                 perf_rdr_clear(15);
@@ -644,7 +644,7 @@ static int perf_stop_counters(uint32_t *raddr)
                 raddr[2] = (uint32_t)((userbuf[1] >> 32) & 0x00000000ffffffffUL);
                 raddr[3] = (uint32_t)(userbuf[1] & 0x00000000ffffffffUL);
         }
- 
+
         return 0;
 }
 
@@ -682,7 +682,7 @@ static int perf_rdr_read_ubuf(uint32_t	rdr_num, uint64_t *buffer)
         i = tentry->num_words;
         while (i--) {
                 buffer[i] = 0;
-        }       
+        }
 
         /* Check for bits an even number of 64 */
         if ((xbits = width & 0x03f) != 0) {
@@ -808,18 +808,22 @@ static int perf_write_image(uint64_t *memaddr)
         }
 
         runway = ioremap_nocache(cpu_device->hpa.start, 4096);
+        if (!runway) {
+                pr_err("perf_write_image: ioremap failed!\n");
+                return -ENOMEM;
+        }
 
         /* Merge intrigue bits into Runway STATUS 0 */
         tmp64 = __raw_readq(runway + RUNWAY_STATUS) & 0xffecfffffffffffful;
-        __raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul), 
+        __raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul),
                      runway + RUNWAY_STATUS);
-        
+
         /* Write RUNWAY DEBUG registers */
         for (i = 0; i < 8; i++) {
                 __raw_writeq(*memaddr++, runway + RUNWAY_DEBUG);
         }
 
-        return 0; 
+        return 0;
 }
 
 /*
@@ -843,7 +847,7 @@ printk("perf_rdr_write\n");
                         perf_rdr_shift_out_U(rdr_num, buffer[i]);
                 } else {
                         perf_rdr_shift_out_W(rdr_num, buffer[i]);
-                }       
+                }
         }
 printk("perf_rdr_write done\n");
 }
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index 06f7ca7fe70b..4516a5b53f38 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -142,6 +142,10 @@ void machine_power_off(void)
 
         printk(KERN_EMERG "System shut down completed.\n"
                "Please power this system off now.");
+
+        /* prevent soft lockup/stalled CPU messages for endless loop. */
+        rcu_sysrq_start();
+        for (;;);
 }
 
 void (*pm_power_off)(void) = machine_power_off;
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 3cfef1de8061..44aeaa9c039f 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -444,6 +444,7 @@
         ENTRY_SAME(copy_file_range)
         ENTRY_COMP(preadv2)
         ENTRY_COMP(pwritev2)
+        ENTRY_SAME(statx)
 
 
 .ifne (. - 90b) - (__NR_Linux_syscalls * (91b - 90b))
diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
index 8fa92b8d839a..f2dac4d73b1b 100644
--- a/arch/parisc/lib/Makefile
+++ b/arch/parisc/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for parisc-specific library files
 #
 
-lib-y   := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
+lib-y   := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \
            ucmpdi2.o delay.o
 
 obj-y   := iomap.o
diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
deleted file mode 100644
index a5b72f22c7a6..000000000000
--- a/arch/parisc/lib/fixup.S
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Linux/PA-RISC Project (http://www.parisc-linux.org/)
- *
- *  Copyright (C) 2004  Randolph Chung <tausq@debian.org>
- *
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2, or (at your option)
- *    any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- * 
- * Fixup routines for kernel exception handling.
- */
-#include <asm/asm-offsets.h>
-#include <asm/assembly.h>
-#include <asm/errno.h>
-#include <linux/linkage.h>
-
-#ifdef CONFIG_SMP
-        .macro  get_fault_ip t1 t2
-        loadgp
-        addil LT%__per_cpu_offset,%r27
-        LDREG RT%__per_cpu_offset(%r1),\t1
-        /* t2 = smp_processor_id() */
-        mfctl 30,\t2
-        ldw TI_CPU(\t2),\t2
-#ifdef CONFIG_64BIT
-        extrd,u \t2,63,32,\t2
-#endif
-        /* t2 = &__per_cpu_offset[smp_processor_id()]; */
-        LDREGX \t2(\t1),\t2 
-        addil LT%exception_data,%r27
-        LDREG RT%exception_data(%r1),\t1
-        /* t1 = this_cpu_ptr(&exception_data) */
-        add,l \t1,\t2,\t1
-        /* %r27 = t1->fault_gp - restore gp */
-        LDREG EXCDATA_GP(\t1), %r27
-        /* t1 = t1->fault_ip */
-        LDREG EXCDATA_IP(\t1), \t1
-        .endm
-#else
-        .macro  get_fault_ip t1 t2
-        loadgp
-        /* t1 = this_cpu_ptr(&exception_data) */
-        addil LT%exception_data,%r27
-        LDREG RT%exception_data(%r1),\t2
-        /* %r27 = t2->fault_gp - restore gp */
-        LDREG EXCDATA_GP(\t2), %r27
-        /* t1 = t2->fault_ip */
-        LDREG EXCDATA_IP(\t2), \t1
-        .endm
-#endif
-
-        .level LEVEL
-
-        .text
-        .section .fixup, "ax"
-
-        /* get_user() fixups, store -EFAULT in r8, and 0 in r9 */
-ENTRY_CFI(fixup_get_user_skip_1)
-        get_fault_ip %r1,%r8
-        ldo 4(%r1), %r1
-        ldi -EFAULT, %r8
-        bv %r0(%r1)
-        copy %r0, %r9
-ENDPROC_CFI(fixup_get_user_skip_1)
-
-ENTRY_CFI(fixup_get_user_skip_2)
-        get_fault_ip %r1,%r8
-        ldo 8(%r1), %r1
-        ldi -EFAULT, %r8
-        bv %r0(%r1)
-        copy %r0, %r9
-ENDPROC_CFI(fixup_get_user_skip_2)
-
-        /* put_user() fixups, store -EFAULT in r8 */
-ENTRY_CFI(fixup_put_user_skip_1)
-        get_fault_ip %r1,%r8
-        ldo 4(%r1), %r1
-        bv %r0(%r1)
-        ldi -EFAULT, %r8
-ENDPROC_CFI(fixup_put_user_skip_1)
-
-ENTRY_CFI(fixup_put_user_skip_2)
-        get_fault_ip %r1,%r8
-        ldo 8(%r1), %r1
-        bv %r0(%r1)
-        ldi -EFAULT, %r8
-ENDPROC_CFI(fixup_put_user_skip_2)
-
diff --git a/arch/parisc/lib/lusercopy.S b/arch/parisc/lib/lusercopy.S
index 56845de6b5df..85c28bb80fb7 100644
--- a/arch/parisc/lib/lusercopy.S
+++ b/arch/parisc/lib/lusercopy.S
@@ -5,6 +5,8 @@
  *    Copyright (C) 2000 Richard Hirst <rhirst with parisc-linux.org>
  *    Copyright (C) 2001 Matthieu Delahaye <delahaym at esiee.fr>
  *    Copyright (C) 2003 Randolph Chung <tausq with parisc-linux.org>
+ *    Copyright (C) 2017 Helge Deller <deller@gmx.de>
+ *    Copyright (C) 2017 John David Anglin <dave.anglin@bell.net>
  *
  *
  *    This program is free software; you can redistribute it and/or modify
@@ -132,4 +134,321 @@ ENDPROC_CFI(lstrnlen_user)
 
         .procend
 
+
+
+/*
+ * unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
+ *
+ * Inputs:
+ * - sr1 already contains space of source region
+ * - sr2 already contains space of destination region
+ *
+ * Returns:
+ * - number of bytes that could not be copied.
+ *   On success, this will be zero.
+ *
+ * This code is based on a C-implementation of a copy routine written by
+ * Randolph Chung, which in turn was derived from the glibc.
+ *
+ * Several strategies are tried to try to get the best performance for various
+ * conditions. In the optimal case, we copy by loops that copy 32- or 16-bytes
+ * at a time using general registers.  Unaligned copies are handled either by
+ * aligning the destination and then using shift-and-write method, or in a few
+ * cases by falling back to a byte-at-a-time copy.
+ *
+ * Testing with various alignments and buffer sizes shows that this code is
+ * often >10x faster than a simple byte-at-a-time copy, even for strangely
+ * aligned operands. It is interesting to note that the glibc version of memcpy
+ * (written in C) is actually quite fast already. This routine is able to beat
+ * it by 30-40% for aligned copies because of the loop unrolling, but in some
+ * cases the glibc version is still slightly faster. This lends more
+ * credibility that gcc can generate very good code as long as we are careful.
+ *
+ * Possible optimizations:
+ * - add cache prefetching
+ * - try not to use the post-increment address modifiers; they may create
+ *   additional interlocks. Assumption is that those were only efficient on old
+ *   machines (pre PA8000 processors)
+ */
+
+        dst = arg0
+        src = arg1
+        len = arg2
+        end = arg3
+        t1  = r19
+        t2  = r20
+        t3  = r21
+        t4  = r22
+        srcspc = sr1
+        dstspc = sr2
+
+        t0 = r1
+        a1 = t1
+        a2 = t2
+        a3 = t3
+        a0 = t4
+
+        save_src = ret0
+        save_dst = ret1
+        save_len = r31
+
+ENTRY_CFI(pa_memcpy)
+        .proc
+        .callinfo NO_CALLS
+        .entry
+
+        /* Last destination address */
+        add     dst,len,end
+
+        /* short copy with less than 16 bytes? */
+        cmpib,COND(>>=),n 15,len,.Lbyte_loop
+
+        /* same alignment? */
+        xor     src,dst,t0
+        extru   t0,31,2,t1
+        cmpib,<>,n  0,t1,.Lunaligned_copy
+
+#ifdef CONFIG_64BIT
+        /* only do 64-bit copies if we can get aligned. */
+        extru   t0,31,3,t1
+        cmpib,<>,n  0,t1,.Lalign_loop32
+
+        /* loop until we are 64-bit aligned */
+.Lalign_loop64:
+        extru   dst,31,3,t1
+        cmpib,=,n       0,t1,.Lcopy_loop_16_start
+20:     ldb,ma  1(srcspc,src),t1
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lalign_loop64
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_loop_16_start:
+        ldi     31,t0
+.Lcopy_loop_16:
+        cmpb,COND(>>=),n t0,len,.Lword_loop
+
+10:     ldd     0(srcspc,src),t1
+11:     ldd     8(srcspc,src),t2
+        ldo     16(src),src
+12:     std,ma  t1,8(dstspc,dst)
+13:     std,ma  t2,8(dstspc,dst)
+14:     ldd     0(srcspc,src),t1
+15:     ldd     8(srcspc,src),t2
+        ldo     16(src),src
+16:     std,ma  t1,8(dstspc,dst)
+17:     std,ma  t2,8(dstspc,dst)
+
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(11b,.Lcopy16_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(12b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(13b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(14b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(15b,.Lcopy16_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+
+        b       .Lcopy_loop_16
+        ldo     -32(len),len
+
+.Lword_loop:
+        cmpib,COND(>>=),n 3,len,.Lbyte_loop
+20:     ldw,ma  4(srcspc,src),t1
+21:     stw,ma  t1,4(dstspc,dst)
+        b       .Lword_loop
+        ldo     -4(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+#endif /* CONFIG_64BIT */
+
+        /* loop until we are 32-bit aligned */
+.Lalign_loop32:
+        extru   dst,31,2,t1
+        cmpib,=,n       0,t1,.Lcopy_loop_8
+20:     ldb,ma  1(srcspc,src),t1
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lalign_loop32
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+
+.Lcopy_loop_8:
+        cmpib,COND(>>=),n 15,len,.Lbyte_loop
+
+10:     ldw     0(srcspc,src),t1
+11:     ldw     4(srcspc,src),t2
+12:     stw,ma  t1,4(dstspc,dst)
+13:     stw,ma  t2,4(dstspc,dst)
+14:     ldw     8(srcspc,src),t1
+15:     ldw     12(srcspc,src),t2
+        ldo     16(src),src
+16:     stw,ma  t1,4(dstspc,dst)
+17:     stw,ma  t2,4(dstspc,dst)
+
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(11b,.Lcopy8_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(12b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(13b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(14b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(15b,.Lcopy8_fault)
+        ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+
+        b       .Lcopy_loop_8
+        ldo     -16(len),len
+
+.Lbyte_loop:
+        cmpclr,COND(<>) len,%r0,%r0
+        b,n     .Lcopy_done
+20:     ldb     0(srcspc,src),t1
+        ldo     1(src),src
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lbyte_loop
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_done:
+        bv      %r0(%r2)
+        sub     end,dst,ret0
+
+
+        /* src and dst are not aligned the same way. */
+        /* need to go the hard way */
+.Lunaligned_copy:
+        /* align until dst is 32bit-word-aligned */
+        extru   dst,31,2,t1
+        cmpib,=,n       0,t1,.Lcopy_dstaligned
+20:     ldb     0(srcspc,src),t1
+        ldo     1(src),src
+21:     stb,ma  t1,1(dstspc,dst)
+        b       .Lunaligned_copy
+        ldo     -1(len),len
+
+        ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+        ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+
+.Lcopy_dstaligned:
+
+        /* store src, dst and len in safe place */
+        copy    src,save_src
+        copy    dst,save_dst
+        copy    len,save_len
+
+        /* len now needs give number of words to copy */
+        SHRREG  len,2,len
+
+        /*
+         * Copy from a not-aligned src to an aligned dst using shifts.
+         * Handles 4 words per loop.
+         */
+
+        depw,z src,28,2,t0
+        subi 32,t0,t0
+        mtsar t0
+        extru len,31,2,t0
+        cmpib,= 2,t0,.Lcase2
+        /* Make src aligned by rounding it down.  */
+        depi 0,31,2,src
+
+        cmpiclr,<> 3,t0,%r0
+        b,n .Lcase3
+        cmpiclr,<> 1,t0,%r0
+        b,n .Lcase1
+.Lcase0:
+        cmpb,COND(=) %r0,len,.Lcda_finish
+        nop
+
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b,n .Ldo3
+.Lcase1:
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        ldo -1(len),len
+        cmpb,COND(=),n %r0,len,.Ldo0
+.Ldo4:
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a2, a3, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo3:
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a3, a0, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo2:
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a0, a1, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+.Ldo1:
+1:      ldw,ma 4(srcspc,src), a3
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        shrpw a1, a2, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+        ldo -4(len),len
+        cmpb,COND(<>) %r0,len,.Ldo4
+        nop
+.Ldo0:
+        shrpw a2, a3, %sar, t0
+1:      stw,ma t0, 4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+
+.Lcda_rdfault:
+.Lcda_finish:
+        /* calculate new src, dst and len and jump to byte-copy loop */
+        sub     dst,save_dst,t0
+        add     save_src,t0,src
+        b       .Lbyte_loop
+        sub     save_len,t0,len
+
+.Lcase3:
+1:      ldw,ma 4(srcspc,src), a0
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b .Ldo2
+        ldo 1(len),len
+.Lcase2:
+1:      ldw,ma 4(srcspc,src), a1
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+1:      ldw,ma 4(srcspc,src), a2
+        ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+        b .Ldo1
+        ldo 2(len),len
+
+
+        /* fault exception fixup handlers: */
+#ifdef CONFIG_64BIT
+.Lcopy16_fault:
+        b       .Lcopy_done
+10:     std,ma  t1,8(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+#endif
+
+.Lcopy8_fault:
+        b       .Lcopy_done
+10:     stw,ma  t1,4(dstspc,dst)
+        ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+
+        .exit
+ENDPROC_CFI(pa_memcpy)
+        .procend
+
         .end
diff --git a/arch/parisc/lib/memcpy.c b/arch/parisc/lib/memcpy.c
index f82ff10ed974..b3d47ec1d80a 100644
--- a/arch/parisc/lib/memcpy.c
+++ b/arch/parisc/lib/memcpy.c
@@ -2,7 +2,7 @@
  *    Optimized memory copy routines.
  *
  *    Copyright (C) 2004 Randolph Chung <tausq@debian.org>
- *    Copyright (C) 2013 Helge Deller <deller@gmx.de>
+ *    Copyright (C) 2013-2017 Helge Deller <deller@gmx.de>
  *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
@@ -21,474 +21,21 @@
  *    Portions derived from the GNU C Library
  *    Copyright (C) 1991, 1997, 2003 Free Software Foundation, Inc.
  *
- * Several strategies are tried to try to get the best performance for various
- * conditions. In the optimal case, we copy 64-bytes in an unrolled loop using 
- * fp regs. This is followed by loops that copy 32- or 16-bytes at a time using
- * general registers.  Unaligned copies are handled either by aligning the 
- * destination and then using shift-and-write method, or in a few cases by 
- * falling back to a byte-at-a-time copy.
- *
- * I chose to implement this in C because it is easier to maintain and debug,
- * and in my experiments it appears that the C code generated by gcc (3.3/3.4
- * at the time of writing) is fairly optimal. Unfortunately some of the 
- * semantics of the copy routine (exception handling) is difficult to express
- * in C, so we have to play some tricks to get it to work.
- *
- * All the loads and stores are done via explicit asm() code in order to use
- * the right space registers. 
- * 
- * Testing with various alignments and buffer sizes shows that this code is 
- * often >10x faster than a simple byte-at-a-time copy, even for strangely
- * aligned operands. It is interesting to note that the glibc version
- * of memcpy (written in C) is actually quite fast already. This routine is 
- * able to beat it by 30-40% for aligned copies because of the loop unrolling, 
- * but in some cases the glibc version is still slightly faster. This lends 
- * more credibility that gcc can generate very good code as long as we are 
- * careful.
- *
- * TODO:
- * - cache prefetching needs more experimentation to get optimal settings
- * - try not to use the post-increment address modifiers; they create additional
- *   interlocks
- * - replace byte-copy loops with stybs sequences
  */
 
-#ifdef __KERNEL__
 #include <linux/module.h>
 #include <linux/compiler.h>
 #include <linux/uaccess.h>
-#define s_space "%%sr1"
-#define d_space "%%sr2"
-#else
-#include "memcpy.h"
-#define s_space "%%sr0"
-#define d_space "%%sr0"
-#define pa_memcpy new2_copy
-#endif
 
 DECLARE_PER_CPU(struct exception_data, exception_data);
 
-#define preserve_branch(label)  do {                                    \
-        volatile int dummy = 0;                                         \
-        /* The following branch is never taken, it's just here to  */   \
-        /* prevent gcc from optimizing away our exception code. */      \
-        if (unlikely(dummy != dummy))                                   \
-                goto label;                                             \
-} while (0)
-
 #define get_user_space() (segment_eq(get_fs(), KERNEL_DS) ? 0 : mfsp(3))
 #define get_kernel_space() (0)
 
-#define MERGE(w0, sh_1, w1, sh_2)  ({                                   \
-        unsigned int _r;                                                \
-        asm volatile (                                                  \
-        "mtsar %3\n"                                                    \
-        "shrpw %1, %2, %%sar, %0\n"                                     \
-        : "=r"(_r)                                                      \
-        : "r"(w0), "r"(w1), "r"(sh_2)                                   \
-        );                                                              \
-        _r;                                                             \
-})
-#define THRESHOLD       16
-
-#ifdef DEBUG_MEMCPY
-#define DPRINTF(fmt, args...) do { printk(KERN_DEBUG "%s:%d:%s ", __FILE__, __LINE__, __func__ ); printk(KERN_DEBUG fmt, ##args ); } while (0)
-#else
-#define DPRINTF(fmt, args...)
-#endif
-
-#define def_load_ai_insn(_insn,_sz,_tt,_s,_a,_t,_e)     \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn ",ma " #_sz "(" _s ",%1), %0\n\t" \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : _tt(_t), "+r"(_a)                             \
-        :                                               \
-        : "r8")
-
-#define def_store_ai_insn(_insn,_sz,_tt,_s,_a,_t,_e)    \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn ",ma %1, " #_sz "(" _s ",%0)\n\t" \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : "+r"(_a)                                      \
-        : _tt(_t)                                       \
-        : "r8")
-
-#define ldbma(_s, _a, _t, _e) def_load_ai_insn(ldbs,1,"=r",_s,_a,_t,_e)
-#define stbma(_s, _t, _a, _e) def_store_ai_insn(stbs,1,"r",_s,_a,_t,_e)
-#define ldwma(_s, _a, _t, _e) def_load_ai_insn(ldw,4,"=r",_s,_a,_t,_e)
-#define stwma(_s, _t, _a, _e) def_store_ai_insn(stw,4,"r",_s,_a,_t,_e)
-#define flddma(_s, _a, _t, _e) def_load_ai_insn(fldd,8,"=f",_s,_a,_t,_e)
-#define fstdma(_s, _t, _a, _e) def_store_ai_insn(fstd,8,"f",_s,_a,_t,_e)
-
-#define def_load_insn(_insn,_tt,_s,_o,_a,_t,_e)         \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn " " #_o "(" _s ",%1), %0\n\t"     \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        : _tt(_t)                                       \
-        : "r"(_a)                                       \
-        : "r8")
-
-#define def_store_insn(_insn,_tt,_s,_t,_o,_a,_e)        \
-        __asm__ __volatile__ (                          \
-        "1:\t" #_insn " %0, " #_o "(" _s ",%1)\n\t"     \
-        ASM_EXCEPTIONTABLE_ENTRY(1b,_e)                 \
-        :                                               \
-        : _tt(_t), "r"(_a)                              \
-        : "r8")
-
-#define ldw(_s,_o,_a,_t,_e)     def_load_insn(ldw,"=r",_s,_o,_a,_t,_e)
-#define stw(_s,_t,_o,_a,_e)     def_store_insn(stw,"r",_s,_t,_o,_a,_e)
-
-#ifdef  CONFIG_PREFETCH
-static inline void prefetch_src(const void *addr)
-{
-        __asm__("ldw 0(" s_space ",%0), %%r0" : : "r" (addr));
-}
-
-static inline void prefetch_dst(const void *addr)
-{
-        __asm__("ldd 0(" d_space ",%0), %%r0" : : "r" (addr));
-}
-#else
-#define prefetch_src(addr) do { } while(0)
-#define prefetch_dst(addr) do { } while(0)
-#endif
-
-#define PA_MEMCPY_OK            0
-#define PA_MEMCPY_LOAD_ERROR    1
-#define PA_MEMCPY_STORE_ERROR   2
-
-/* Copy from a not-aligned src to an aligned dst, using shifts. Handles 4 words
- * per loop.  This code is derived from glibc. 
- */
-static noinline unsigned long copy_dstaligned(unsigned long dst,
-                                        unsigned long src, unsigned long len)
-{
-        /* gcc complains that a2 and a3 may be uninitialized, but actually
-         * they cannot be.  Initialize a2/a3 to shut gcc up.
-         */
-        register unsigned int a0, a1, a2 = 0, a3 = 0;
-        int sh_1, sh_2;
-
-        /* prefetch_src((const void *)src); */
-
-        /* Calculate how to shift a word read at the memory operation
-           aligned srcp to make it aligned for copy.  */
-        sh_1 = 8 * (src % sizeof(unsigned int));
-        sh_2 = 8 * sizeof(unsigned int) - sh_1;
-
-        /* Make src aligned by rounding it down.  */
-        src &= -sizeof(unsigned int);
-
-        switch (len % 4)
-        {
-                case 2:
-                        /* a1 = ((unsigned int *) src)[0];
-                           a2 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a1, cda_ldw_exc);
-                        ldw(s_space, 4, src, a2, cda_ldw_exc);
-                        src -= 1 * sizeof(unsigned int);
-                        dst -= 3 * sizeof(unsigned int);
-                        len += 2;
-                        goto do1;
-                case 3:
-                        /* a0 = ((unsigned int *) src)[0];
-                           a1 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a0, cda_ldw_exc);
-                        ldw(s_space, 4, src, a1, cda_ldw_exc);
-                        src -= 0 * sizeof(unsigned int);
-                        dst -= 2 * sizeof(unsigned int);
-                        len += 1;
-                        goto do2;
-                case 0:
-                        if (len == 0)
-                                return PA_MEMCPY_OK;
-                        /* a3 = ((unsigned int *) src)[0];
-                           a0 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a3, cda_ldw_exc);
-                        ldw(s_space, 4, src, a0, cda_ldw_exc);
-                        src -=-1 * sizeof(unsigned int);
-                        dst -= 1 * sizeof(unsigned int);
-                        len += 0;
-                        goto do3;
-                case 1:
-                        /* a2 = ((unsigned int *) src)[0];
-                           a3 = ((unsigned int *) src)[1]; */
-                        ldw(s_space, 0, src, a2, cda_ldw_exc);
-                        ldw(s_space, 4, src, a3, cda_ldw_exc);
-                        src -=-2 * sizeof(unsigned int);
-                        dst -= 0 * sizeof(unsigned int);
-                        len -= 1;
-                        if (len == 0)
-                                goto do0;
-                        goto do4;                       /* No-op.  */
-        }
-
-        do
-        {
-                /* prefetch_src((const void *)(src + 4 * sizeof(unsigned int))); */
-do4:
-                /* a0 = ((unsigned int *) src)[0]; */
-                ldw(s_space, 0, src, a0, cda_ldw_exc);
-                /* ((unsigned int *) dst)[0] = MERGE (a2, sh_1, a3, sh_2); */
-                stw(d_space, MERGE (a2, sh_1, a3, sh_2), 0, dst, cda_stw_exc);
-do3:
-                /* a1 = ((unsigned int *) src)[1]; */
-                ldw(s_space, 4, src, a1, cda_ldw_exc);
-                /* ((unsigned int *) dst)[1] = MERGE (a3, sh_1, a0, sh_2); */
-                stw(d_space, MERGE (a3, sh_1, a0, sh_2), 4, dst, cda_stw_exc);
-do2:
-                /* a2 = ((unsigned int *) src)[2]; */
-                ldw(s_space, 8, src, a2, cda_ldw_exc);
-                /* ((unsigned int *) dst)[2] = MERGE (a0, sh_1, a1, sh_2); */
-                stw(d_space, MERGE (a0, sh_1, a1, sh_2), 8, dst, cda_stw_exc);
-do1:
-                /* a3 = ((unsigned int *) src)[3]; */
-                ldw(s_space, 12, src, a3, cda_ldw_exc);
-                /* ((unsigned int *) dst)[3] = MERGE (a1, sh_1, a2, sh_2); */
-                stw(d_space, MERGE (a1, sh_1, a2, sh_2), 12, dst, cda_stw_exc);
-
-                src += 4 * sizeof(unsigned int);
-                dst += 4 * sizeof(unsigned int);
-                len -= 4;
-        }
-        while (len != 0);
-
-do0:
-        /* ((unsigned int *) dst)[0] = MERGE (a2, sh_1, a3, sh_2); */
-        stw(d_space, MERGE (a2, sh_1, a3, sh_2), 0, dst, cda_stw_exc);
-
-        preserve_branch(handle_load_error);
-        preserve_branch(handle_store_error);
-
-        return PA_MEMCPY_OK;
-
-handle_load_error:
-        __asm__ __volatile__ ("cda_ldw_exc:\n");
-        return PA_MEMCPY_LOAD_ERROR;
-
-handle_store_error:
-        __asm__ __volatile__ ("cda_stw_exc:\n");
-        return PA_MEMCPY_STORE_ERROR;
-}
-
-
-/* Returns PA_MEMCPY_OK, PA_MEMCPY_LOAD_ERROR or PA_MEMCPY_STORE_ERROR.
- * In case of an access fault the faulty address can be read from the per_cpu
- * exception data struct. */
-static noinline unsigned long pa_memcpy_internal(void *dstp, const void *srcp,
-                                        unsigned long len)
-{
-        register unsigned long src, dst, t1, t2, t3;
-        register unsigned char *pcs, *pcd;
-        register unsigned int *pws, *pwd;
-        register double *pds, *pdd;
-        unsigned long ret;
-
-        src = (unsigned long)srcp;
-        dst = (unsigned long)dstp;
-        pcs = (unsigned char *)srcp;
-        pcd = (unsigned char *)dstp;
-
-        /* prefetch_src((const void *)srcp); */
-
-        if (len < THRESHOLD)
-                goto byte_copy;
-
-        /* Check alignment */
-        t1 = (src ^ dst);
-        if (unlikely(t1 & (sizeof(double)-1)))
-                goto unaligned_copy;
-
-        /* src and dst have same alignment. */
-
-        /* Copy bytes till we are double-aligned. */
-        t2 = src & (sizeof(double) - 1);
-        if (unlikely(t2 != 0)) {
-                t2 = sizeof(double) - t2;
-                while (t2 && len) {
-                        /* *pcd++ = *pcs++; */
-                        ldbma(s_space, pcs, t3, pmc_load_exc);
-                        len--;
-                        stbma(d_space, t3, pcd, pmc_store_exc);
-                        t2--;
-                }
-        }
-
-        pds = (double *)pcs;
-        pdd = (double *)pcd;
-
-#if 0
-        /* Copy 8 doubles at a time */
-        while (len >= 8*sizeof(double)) {
-                register double r1, r2, r3, r4, r5, r6, r7, r8;
-                /* prefetch_src((char *)pds + L1_CACHE_BYTES); */
-                flddma(s_space, pds, r1, pmc_load_exc);
-                flddma(s_space, pds, r2, pmc_load_exc);
-                flddma(s_space, pds, r3, pmc_load_exc);
-                flddma(s_space, pds, r4, pmc_load_exc);
-                fstdma(d_space, r1, pdd, pmc_store_exc);
-                fstdma(d_space, r2, pdd, pmc_store_exc);
-                fstdma(d_space, r3, pdd, pmc_store_exc);
-                fstdma(d_space, r4, pdd, pmc_store_exc);
-
-#if 0
-                if (L1_CACHE_BYTES <= 32)
-                        prefetch_src((char *)pds + L1_CACHE_BYTES);
-#endif
-                flddma(s_space, pds, r5, pmc_load_exc);
-                flddma(s_space, pds, r6, pmc_load_exc);
-                flddma(s_space, pds, r7, pmc_load_exc);
-                flddma(s_space, pds, r8, pmc_load_exc);
-                fstdma(d_space, r5, pdd, pmc_store_exc);
-                fstdma(d_space, r6, pdd, pmc_store_exc);
-                fstdma(d_space, r7, pdd, pmc_store_exc);
-                fstdma(d_space, r8, pdd, pmc_store_exc);
-                len -= 8*sizeof(double);
-        }
-#endif
-
-        pws = (unsigned int *)pds;
-        pwd = (unsigned int *)pdd;
-
-word_copy:
-        while (len >= 8*sizeof(unsigned int)) {
-                register unsigned int r1,r2,r3,r4,r5,r6,r7,r8;
-                /* prefetch_src((char *)pws + L1_CACHE_BYTES); */
-                ldwma(s_space, pws, r1, pmc_load_exc);
-                ldwma(s_space, pws, r2, pmc_load_exc);
-                ldwma(s_space, pws, r3, pmc_load_exc);
-                ldwma(s_space, pws, r4, pmc_load_exc);
-                stwma(d_space, r1, pwd, pmc_store_exc);
-                stwma(d_space, r2, pwd, pmc_store_exc);
-                stwma(d_space, r3, pwd, pmc_store_exc);
-                stwma(d_space, r4, pwd, pmc_store_exc);
-
-                ldwma(s_space, pws, r5, pmc_load_exc);
-                ldwma(s_space, pws, r6, pmc_load_exc);
-                ldwma(s_space, pws, r7, pmc_load_exc);
-                ldwma(s_space, pws, r8, pmc_load_exc);
-                stwma(d_space, r5, pwd, pmc_store_exc);
-                stwma(d_space, r6, pwd, pmc_store_exc);
-                stwma(d_space, r7, pwd, pmc_store_exc);
-                stwma(d_space, r8, pwd, pmc_store_exc);
-                len -= 8*sizeof(unsigned int);
-        }
-
-        while (len >= 4*sizeof(unsigned int)) {
-                register unsigned int r1,r2,r3,r4;
-                ldwma(s_space, pws, r1, pmc_load_exc);
-                ldwma(s_space, pws, r2, pmc_load_exc);
-                ldwma(s_space, pws, r3, pmc_load_exc);
-                ldwma(s_space, pws, r4, pmc_load_exc);
-                stwma(d_space, r1, pwd, pmc_store_exc);
-                stwma(d_space, r2, pwd, pmc_store_exc);
-                stwma(d_space, r3, pwd, pmc_store_exc);
-                stwma(d_space, r4, pwd, pmc_store_exc);
-                len -= 4*sizeof(unsigned int);
-        }
-
-        pcs = (unsigned char *)pws;
-        pcd = (unsigned char *)pwd;
-
-byte_copy:
-        while (len) {
-                /* *pcd++ = *pcs++; */
-                ldbma(s_space, pcs, t3, pmc_load_exc);
-                stbma(d_space, t3, pcd, pmc_store_exc);
-                len--;
-        }
-
-        return PA_MEMCPY_OK;
-
-unaligned_copy:
-        /* possibly we are aligned on a word, but not on a double... */
-        if (likely((t1 & (sizeof(unsigned int)-1)) == 0)) {
-                t2 = src & (sizeof(unsigned int) - 1);
-
-                if (unlikely(t2 != 0)) {
-                        t2 = sizeof(unsigned int) - t2;
-                        while (t2) {
-                                /* *pcd++ = *pcs++; */
-                                ldbma(s_space, pcs, t3, pmc_load_exc);
-                                stbma(d_space, t3, pcd, pmc_store_exc);
-                                len--;
-                                t2--;
-                        }
-                }
-
-                pws = (unsigned int *)pcs;
-                pwd = (unsigned int *)pcd;
-                goto word_copy;
-        }
-
-        /* Align the destination.  */
-        if (unlikely((dst & (sizeof(unsigned int) - 1)) != 0)) {
-                t2 = sizeof(unsigned int) - (dst & (sizeof(unsigned int) - 1));
-                while (t2) {
-                        /* *pcd++ = *pcs++; */
-                        ldbma(s_space, pcs, t3, pmc_load_exc);
-                        stbma(d_space, t3, pcd, pmc_store_exc);
-                        len--;
-                        t2--;
-                }
-                dst = (unsigned long)pcd;
-                src = (unsigned long)pcs;
-        }
-
-        ret = copy_dstaligned(dst, src, len / sizeof(unsigned int));
-        if (ret)
-                return ret;
-
-        pcs += (len & -sizeof(unsigned int));
-        pcd += (len & -sizeof(unsigned int));
-        len %= sizeof(unsigned int);
-
-        preserve_branch(handle_load_error);
-        preserve_branch(handle_store_error);
-
-        goto byte_copy;
-
-handle_load_error:
-        __asm__ __volatile__ ("pmc_load_exc:\n");
-        return PA_MEMCPY_LOAD_ERROR;
-
-handle_store_error:
-        __asm__ __volatile__ ("pmc_store_exc:\n");
-        return PA_MEMCPY_STORE_ERROR;
-}
-
-
 /* Returns 0 for success, otherwise, returns number of bytes not transferred. */
-static unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
-{
-        unsigned long ret, fault_addr, reference;
-        struct exception_data *d;
-
-        ret = pa_memcpy_internal(dstp, srcp, len);
-        if (likely(ret == PA_MEMCPY_OK))
-                return 0;
-
-        /* if a load or store fault occured we can get the faulty addr */
-        d = this_cpu_ptr(&exception_data);
-        fault_addr = d->fault_addr;
-
-        /* error in load or store? */
-        if (ret == PA_MEMCPY_LOAD_ERROR)
-                reference = (unsigned long) srcp;
-        else
-                reference = (unsigned long) dstp;
+extern unsigned long pa_memcpy(void *dst, const void *src,
+                                unsigned long len);
 
-        DPRINTF("pa_memcpy: fault type = %lu, len=%lu fault_addr=%lu ref=%lu\n",
-                ret, len, fault_addr, reference);
-
-        if (fault_addr >= reference)
-                return len - (fault_addr - reference);
-        else
-                return len;
-}
-
-#ifdef __KERNEL__
 unsigned long __copy_to_user(void __user *dst, const void *src,
                              unsigned long len)
 {
@@ -537,5 +84,3 @@ long probe_kernel_read(void *dst, const void *src, size_t size)
 
         return __probe_kernel_read(dst, src, size);
 }
-
-#endif
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index deab89a8915a..32ec22146141 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -150,6 +150,23 @@ int fixup_exception(struct pt_regs *regs)
                 d->fault_space = regs->isr;
                 d->fault_addr = regs->ior;
 
+                /*
+                 * Fix up get_user() and put_user().
+                 * ASM_EXCEPTIONTABLE_ENTRY_EFAULT() sets the least-significant
+                 * bit in the relative address of the fixup routine to indicate
+                 * that %r8 should be loaded with -EFAULT to report a userspace
+                 * access error.
+                 */
+                if (fix->fixup & 1) {
+                        regs->gr[8] = -EFAULT;
+
+                        /* zero target register for get_user() */
+                        if (parisc_acctyp(0, regs->iir) == VM_READ) {
+                                int treg = regs->iir & 0x1f;
+                                regs->gr[treg] = 0;
+                        }
+                }
+
                 regs->iaoq[0] = (unsigned long)&fix->fixup + fix->fixup;
                 regs->iaoq[0] &= ~3;
                 /*
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 494091762bd7..97a8bc8a095c 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -80,93 +80,99 @@ config ARCH_HAS_DMA_SET_COHERENT_MASK
 config PPC
         bool
         default y
-        select BUILDTIME_EXTABLE_SORT
+        #
+        # Please keep this list sorted alphabetically.
+        #
+        select ARCH_HAS_DEVMEM_IS_ALLOWED
+        select ARCH_HAS_DMA_SET_COHERENT_MASK
+        select ARCH_HAS_ELF_RANDOMIZE
+        select ARCH_HAS_GCOV_PROFILE_ALL
+        select ARCH_HAS_SCALED_CPUTIME          if VIRT_CPU_ACCOUNTING_NATIVE
+        select ARCH_HAS_SG_CHAIN
+        select ARCH_HAS_TICK_BROADCAST          if GENERIC_CLOCKEVENTS_BROADCAST
+        select ARCH_HAS_UBSAN_SANITIZE_ALL
+        select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select ARCH_MIGHT_HAVE_PC_PARPORT
         select ARCH_MIGHT_HAVE_PC_SERIO
+        select ARCH_SUPPORTS_ATOMIC_RMW
+        select ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT
+        select ARCH_USE_BUILTIN_BSWAP
+        select ARCH_USE_CMPXCHG_LOCKREF         if PPC64
+        select ARCH_WANT_IPC_PARSE_VERSION
         select BINFMT_ELF
-        select ARCH_HAS_ELF_RANDOMIZE
-        select OF
-        select OF_EARLY_FLATTREE
-        select OF_RESERVED_MEM
-        select HAVE_FTRACE_MCOUNT_RECORD
+        select BUILDTIME_EXTABLE_SORT
+        select CLONE_BACKWARDS
+        select DCACHE_WORD_ACCESS               if PPC64 && CPU_LITTLE_ENDIAN
+        select EDAC_ATOMIC_SCRUB
+        select EDAC_SUPPORT
+        select GENERIC_ATOMIC64                 if PPC32
+        select GENERIC_CLOCKEVENTS
+        select GENERIC_CLOCKEVENTS_BROADCAST    if SMP
+        select GENERIC_CMOS_UPDATE
+        select GENERIC_CPU_AUTOPROBE
+        select GENERIC_IRQ_SHOW
+        select GENERIC_IRQ_SHOW_LEVEL
+        select GENERIC_SMP_IDLE_THREAD
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
+        select GENERIC_TIME_VSYSCALL_OLD
+        select HAVE_ARCH_AUDITSYSCALL
+        select HAVE_ARCH_HARDENED_USERCOPY
+        select HAVE_ARCH_JUMP_LABEL
+        select HAVE_ARCH_KGDB
+        select HAVE_ARCH_SECCOMP_FILTER
+        select HAVE_ARCH_TRACEHOOK
+        select HAVE_CBPF_JIT                    if !PPC64
+        select HAVE_CONTEXT_TRACKING            if PPC64
+        select HAVE_DEBUG_KMEMLEAK
+        select HAVE_DEBUG_STACKOVERFLOW
+        select HAVE_DMA_API_DEBUG
         select HAVE_DYNAMIC_FTRACE
-        select HAVE_DYNAMIC_FTRACE_WITH_REGS if MPROFILE_KERNEL
-        select HAVE_FUNCTION_TRACER
+        select HAVE_DYNAMIC_FTRACE_WITH_REGS    if MPROFILE_KERNEL
+        select HAVE_EBPF_JIT                    if PPC64
+        select HAVE_EFFICIENT_UNALIGNED_ACCESS  if !(CPU_LITTLE_ENDIAN && POWER7_CPU)
+        select HAVE_FTRACE_MCOUNT_RECORD
         select HAVE_FUNCTION_GRAPH_TRACER
+        select HAVE_FUNCTION_TRACER
         select HAVE_GCC_PLUGINS
-        select SYSCTL_EXCEPTION_TRACE
-        select VIRT_TO_BUS if !PPC64
+        select HAVE_GENERIC_RCU_GUP
+        select HAVE_HW_BREAKPOINT               if PERF_EVENTS && (PPC_BOOK3S || PPC_8xx)
         select HAVE_IDE
         select HAVE_IOREMAP_PROT
-        select HAVE_EFFICIENT_UNALIGNED_ACCESS if !(CPU_LITTLE_ENDIAN && POWER7_CPU)
+        select HAVE_IRQ_EXIT_ON_IRQ_STACK
+        select HAVE_KERNEL_GZIP
         select HAVE_KPROBES
-        select HAVE_OPTPROBES if PPC64
-        select HAVE_ARCH_KGDB
         select HAVE_KRETPROBES
-        select HAVE_ARCH_TRACEHOOK
+        select HAVE_LIVEPATCH                   if HAVE_DYNAMIC_FTRACE_WITH_REGS
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
-        select HAVE_DMA_API_DEBUG
+        select HAVE_MOD_ARCH_SPECIFIC
+        select HAVE_NMI                         if PERF_EVENTS
         select HAVE_OPROFILE
-        select HAVE_DEBUG_KMEMLEAK
-        select ARCH_HAS_SG_CHAIN
-        select GENERIC_ATOMIC64 if PPC32
+        select HAVE_OPTPROBES                   if PPC64
         select HAVE_PERF_EVENTS
+        select HAVE_PERF_EVENTS_NMI             if PPC64
         select HAVE_PERF_REGS
         select HAVE_PERF_USER_STACK_DUMP
+        select HAVE_RCU_TABLE_FREE              if SMP
         select HAVE_REGS_AND_STACK_ACCESS_API
-        select HAVE_HW_BREAKPOINT if PERF_EVENTS && (PPC_BOOK3S || PPC_8xx)
-        select ARCH_WANT_IPC_PARSE_VERSION
-        select SPARSE_IRQ
+        select HAVE_SYSCALL_TRACEPOINTS
+        select HAVE_VIRT_CPU_ACCOUNTING
         select IRQ_DOMAIN
-        select GENERIC_IRQ_SHOW
-        select GENERIC_IRQ_SHOW_LEVEL
         select IRQ_FORCED_THREADING
-        select HAVE_RCU_TABLE_FREE if SMP
-        select HAVE_SYSCALL_TRACEPOINTS
-        select HAVE_CBPF_JIT if !PPC64
-        select HAVE_EBPF_JIT if PPC64
-        select HAVE_ARCH_JUMP_LABEL
-        select ARCH_HAVE_NMI_SAFE_CMPXCHG
-        select ARCH_HAS_GCOV_PROFILE_ALL
-        select GENERIC_SMP_IDLE_THREAD
-        select GENERIC_CMOS_UPDATE
-        select GENERIC_TIME_VSYSCALL_OLD
-        select GENERIC_CLOCKEVENTS
-        select GENERIC_CLOCKEVENTS_BROADCAST if SMP
-        select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
-        select GENERIC_STRNCPY_FROM_USER
-        select GENERIC_STRNLEN_USER
-        select HAVE_MOD_ARCH_SPECIFIC
         select MODULES_USE_ELF_RELA
-        select CLONE_BACKWARDS
-        select ARCH_USE_BUILTIN_BSWAP
-        select OLD_SIGSUSPEND
-        select OLD_SIGACTION if PPC32
-        select HAVE_DEBUG_STACKOVERFLOW
-        select HAVE_IRQ_EXIT_ON_IRQ_STACK
-        select ARCH_USE_CMPXCHG_LOCKREF if PPC64
-        select HAVE_ARCH_AUDITSYSCALL
-        select ARCH_SUPPORTS_ATOMIC_RMW
-        select DCACHE_WORD_ACCESS if PPC64 && CPU_LITTLE_ENDIAN
         select NO_BOOTMEM
-        select HAVE_GENERIC_RCU_GUP
-        select HAVE_PERF_EVENTS_NMI if PPC64
-        select HAVE_NMI if PERF_EVENTS
-        select EDAC_SUPPORT
-        select EDAC_ATOMIC_SCRUB
-        select ARCH_HAS_DMA_SET_COHERENT_MASK
-        select ARCH_HAS_DEVMEM_IS_ALLOWED
-        select HAVE_ARCH_SECCOMP_FILTER
-        select ARCH_HAS_UBSAN_SANITIZE_ALL
-        select ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT
-        select HAVE_LIVEPATCH if HAVE_DYNAMIC_FTRACE_WITH_REGS
-        select GENERIC_CPU_AUTOPROBE
-        select HAVE_VIRT_CPU_ACCOUNTING
-        select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE
-        select HAVE_ARCH_HARDENED_USERCOPY
-        select HAVE_KERNEL_GZIP
-        select HAVE_CONTEXT_TRACKING if PPC64
+        select OF
+        select OF_EARLY_FLATTREE
+        select OF_RESERVED_MEM
+        select OLD_SIGACTION                    if PPC32
+        select OLD_SIGSUSPEND
+        select SPARSE_IRQ
+        select SYSCTL_EXCEPTION_TRACE
+        select VIRT_TO_BUS                      if !PPC64
+        #
+        # Please keep this list sorted alphabetically.
+        #
 
 config GENERIC_CSUM
         def_bool n
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 31286fa7873c..19b0d1a81959 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -72,8 +72,15 @@ GNUTARGET	:= powerpc
 MULTIPLEWORD    := -mmultiple
 endif
 
-cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mbig-endian)
+ifdef CONFIG_PPC64
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mabi=elfv1)
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mcall-aixdesc)
+aflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mabi=elfv1)
+aflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -mabi=elfv2
+endif
+
 cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -mlittle-endian
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mbig-endian)
 ifneq ($(cc-name),clang)
   cflags-$(CONFIG_CPU_LITTLE_ENDIAN)    += -mno-strict-align
 endif
@@ -113,7 +120,9 @@ ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv2,$(call cc-option,-mcall-aixdesc))
 AFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv2)
 else
+CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv1)
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mcall-aixdesc)
+AFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mabi=elfv1)
 endif
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
 CFLAGS-$(CONFIG_PPC64)  += $(call cc-option,-mno-pointers-to-nested-functions)
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 861e72109df2..f080abfc2f83 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -68,6 +68,7 @@ SECTIONS
   }
 
 #ifdef CONFIG_PPC64_BOOT_WRAPPER
+  . = ALIGN(256);
   .got :
   {
     __toc_start = .;
diff --git a/arch/powerpc/crypto/crc32c-vpmsum_glue.c b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
index 9fa046d56eba..f058e0c3e4d4 100644
--- a/arch/powerpc/crypto/crc32c-vpmsum_glue.c
+++ b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
@@ -33,10 +33,13 @@ static u32 crc32c_vpmsum(u32 crc, unsigned char const *p, size_t len)
         }
 
         if (len & ~VMX_ALIGN_MASK) {
+                preempt_disable();
                 pagefault_disable();
                 enable_kernel_altivec();
                 crc = __crc32c_vpmsum(crc, p, len & ~VMX_ALIGN_MASK);
+                disable_kernel_altivec();
                 pagefault_enable();
+                preempt_enable();
         }
 
         tail = len & VMX_ALIGN_MASK;
@@ -52,7 +55,7 @@ static int crc32c_vpmsum_cra_init(struct crypto_tfm *tfm)
 {
         u32 *key = crypto_tfm_ctx(tfm);
 
-        *key = 0;
+        *key = ~0;
 
         return 0;
 }
diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
index 73eb794d6163..bc5fdfd22788 100644
--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -51,6 +51,10 @@
 #define PPC_BIT(bit)            (1UL << PPC_BITLSHIFT(bit))
 #define PPC_BITMASK(bs, be)     ((PPC_BIT(bs) - PPC_BIT(be)) | PPC_BIT(bs))
 
+/* Put a PPC bit into a "normal" bit position */
+#define PPC_BITEXTRACT(bits, ppc_bit, dst_bit)                  \
+        ((((bits) >> PPC_BITLSHIFT(ppc_bit)) & 1) << (dst_bit))
+
 #include <asm/barrier.h>
 
 /* Macro for generating the ***_bits() functions */
diff --git a/arch/powerpc/include/asm/book3s/32/pgtable.h b/arch/powerpc/include/asm/book3s/32/pgtable.h
index 012223638815..26ed228d4dc6 100644
--- a/arch/powerpc/include/asm/book3s/32/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/32/pgtable.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_BOOK3S_32_PGTABLE_H
 #define _ASM_POWERPC_BOOK3S_32_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #include <asm/book3s/32/hash.h>
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 1eeeb72c7015..8f4d41936e5a 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -1,9 +1,12 @@
 #ifndef _ASM_POWERPC_BOOK3S_64_PGTABLE_H_
 #define _ASM_POWERPC_BOOK3S_64_PGTABLE_H_
 
+#include <asm-generic/5level-fixup.h>
+
 #ifndef __ASSEMBLY__
 #include <linux/mmdebug.h>
 #endif
+
 /*
  * Common bits between hash and Radix page table
  */
@@ -347,23 +350,58 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm,
         __r;                                                    \
 })
 
+static inline int __pte_write(pte_t pte)
+{
+        return !!(pte_raw(pte) & cpu_to_be64(_PAGE_WRITE));
+}
+
+#ifdef CONFIG_NUMA_BALANCING
+#define pte_savedwrite pte_savedwrite
+static inline bool pte_savedwrite(pte_t pte)
+{
+        /*
+         * Saved write ptes are prot none ptes that doesn't have
+         * privileged bit sit. We mark prot none as one which has
+         * present and pviliged bit set and RWX cleared. To mark
+         * protnone which used to have _PAGE_WRITE set we clear
+         * the privileged bit.
+         */
+        return !(pte_raw(pte) & cpu_to_be64(_PAGE_RWX | _PAGE_PRIVILEGED));
+}
+#else
+#define pte_savedwrite pte_savedwrite
+static inline bool pte_savedwrite(pte_t pte)
+{
+        return false;
+}
+#endif
+
+static inline int pte_write(pte_t pte)
+{
+        return __pte_write(pte) || pte_savedwrite(pte);
+}
+
 #define __HAVE_ARCH_PTEP_SET_WRPROTECT
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
                                       pte_t *ptep)
 {
-        if ((pte_raw(*ptep) & cpu_to_be64(_PAGE_WRITE)) == 0)
-                return;
-
-        pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 0);
+        if (__pte_write(*ptep))
+                pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 0);
+        else if (unlikely(pte_savedwrite(*ptep)))
+                pte_update(mm, addr, ptep, 0, _PAGE_PRIVILEGED, 0);
 }
 
 static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
                                            unsigned long addr, pte_t *ptep)
 {
-        if ((pte_raw(*ptep) & cpu_to_be64(_PAGE_WRITE)) == 0)
-                return;
-
-        pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 1);
+        /*
+         * We should not find protnone for hugetlb, but this complete the
+         * interface.
+         */
+        if (__pte_write(*ptep))
+                pte_update(mm, addr, ptep, _PAGE_WRITE, 0, 1);
+        else if (unlikely(pte_savedwrite(*ptep)))
+                pte_update(mm, addr, ptep, 0, _PAGE_PRIVILEGED, 1);
 }
 
 #define __HAVE_ARCH_PTEP_GET_AND_CLEAR
@@ -397,11 +435,6 @@ static inline void pte_clear(struct mm_struct *mm, unsigned long addr,
         pte_update(mm, addr, ptep, ~0UL, 0, 0);
 }
 
-static inline int pte_write(pte_t pte)
-{
-        return !!(pte_raw(pte) & cpu_to_be64(_PAGE_WRITE));
-}
-
 static inline int pte_dirty(pte_t pte)
 {
         return !!(pte_raw(pte) & cpu_to_be64(_PAGE_DIRTY));
@@ -465,19 +498,12 @@ static inline pte_t pte_clear_savedwrite(pte_t pte)
         VM_BUG_ON(!pte_protnone(pte));
         return __pte(pte_val(pte) | _PAGE_PRIVILEGED);
 }
-
-#define pte_savedwrite pte_savedwrite
-static inline bool pte_savedwrite(pte_t pte)
+#else
+#define pte_clear_savedwrite pte_clear_savedwrite
+static inline pte_t pte_clear_savedwrite(pte_t pte)
 {
-        /*
-         * Saved write ptes are prot none ptes that doesn't have
-         * privileged bit sit. We mark prot none as one which has
-         * present and pviliged bit set and RWX cleared. To mark
-         * protnone which used to have _PAGE_WRITE set we clear
-         * the privileged bit.
-         */
-        VM_BUG_ON(!pte_protnone(pte));
-        return !(pte_raw(pte) & cpu_to_be64(_PAGE_RWX | _PAGE_PRIVILEGED));
+        VM_WARN_ON(1);
+        return __pte(pte_val(pte) & ~_PAGE_WRITE);
 }
 #endif /* CONFIG_NUMA_BALANCING */
 
@@ -506,6 +532,8 @@ static inline unsigned long pte_pfn(pte_t pte)
 /* Generic modifiers for PTE bits */
 static inline pte_t pte_wrprotect(pte_t pte)
 {
+        if (unlikely(pte_savedwrite(pte)))
+                return pte_clear_savedwrite(pte);
         return __pte(pte_val(pte) & ~_PAGE_WRITE);
 }
 
@@ -926,6 +954,7 @@ static inline int pmd_protnone(pmd_t pmd)
 
 #define __HAVE_ARCH_PMD_WRITE
 #define pmd_write(pmd)          pte_write(pmd_pte(pmd))
+#define __pmd_write(pmd)        __pte_write(pmd_pte(pmd))
 #define pmd_savedwrite(pmd)     pte_savedwrite(pmd_pte(pmd))
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -982,11 +1011,10 @@ static inline int __pmdp_test_and_clear_young(struct mm_struct *mm,
 static inline void pmdp_set_wrprotect(struct mm_struct *mm, unsigned long addr,
                                       pmd_t *pmdp)
 {
-
-        if ((pmd_raw(*pmdp) & cpu_to_be64(_PAGE_WRITE)) == 0)
-                return;
-
-        pmd_hugepage_update(mm, addr, pmdp, _PAGE_WRITE, 0);
+        if (__pmd_write((*pmdp)))
+                pmd_hugepage_update(mm, addr, pmdp, _PAGE_WRITE, 0);
+        else if (unlikely(pmd_savedwrite(*pmdp)))
+                pmd_hugepage_update(mm, addr, pmdp, 0, _PAGE_PRIVILEGED);
 }
 
 static inline int pmd_trans_huge(pmd_t pmd)
diff --git a/arch/powerpc/include/asm/checksum.h b/arch/powerpc/include/asm/checksum.h
index 4e63787dc3be..842124b199b5 100644
--- a/arch/powerpc/include/asm/checksum.h
+++ b/arch/powerpc/include/asm/checksum.h
@@ -112,7 +112,7 @@ static inline __wsum csum_add(__wsum csum, __wsum addend)
 
 #ifdef __powerpc64__
         res += (__force u64)addend;
-        return (__force __wsum)((u32)res + (res >> 32));
+        return (__force __wsum) from64to32(res);
 #else
         asm("addc %0,%0,%1;"
             "addze %0,%0;"
diff --git a/arch/powerpc/include/asm/cpuidle.h b/arch/powerpc/include/asm/cpuidle.h
index fd321eb423cb..155731557c9b 100644
--- a/arch/powerpc/include/asm/cpuidle.h
+++ b/arch/powerpc/include/asm/cpuidle.h
@@ -70,8 +70,8 @@ static inline void report_invalid_psscr_val(u64 psscr_val, int err)
         std     r0,0(r1);                                       \
         ptesync;                                                \
         ld      r0,0(r1);                                       \
-1:      cmpd    cr0,r0,r0;                                      \
-        bne     1b;                                             \
+236:    cmpd    cr0,r0,r0;                                      \
+        bne     236b;                                           \
         IDLE_INST;                                              \
 
 #define IDLE_STATE_ENTER_SEQ_NORET(IDLE_INST)                   \
diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
index 93b9b84568e8..09bde6e34f5d 100644
--- a/arch/powerpc/include/asm/elf.h
+++ b/arch/powerpc/include/asm/elf.h
@@ -144,8 +144,8 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 #define ARCH_DLINFO_CACHE_GEOMETRY                                      \
         NEW_AUX_ENT(AT_L1I_CACHESIZE, ppc64_caches.l1i.size);           \
         NEW_AUX_ENT(AT_L1I_CACHEGEOMETRY, get_cache_geometry(l1i));     \
-        NEW_AUX_ENT(AT_L1D_CACHESIZE, ppc64_caches.l1i.size);           \
-        NEW_AUX_ENT(AT_L1D_CACHEGEOMETRY, get_cache_geometry(l1i));     \
+        NEW_AUX_ENT(AT_L1D_CACHESIZE, ppc64_caches.l1d.size);           \
+        NEW_AUX_ENT(AT_L1D_CACHEGEOMETRY, get_cache_geometry(l1d));     \
         NEW_AUX_ENT(AT_L2_CACHESIZE, ppc64_caches.l2.size);             \
         NEW_AUX_ENT(AT_L2_CACHEGEOMETRY, get_cache_geometry(l2));       \
         NEW_AUX_ENT(AT_L3_CACHESIZE, ppc64_caches.l3.size);             \
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 14752eee3d0c..ed3beadd2cc5 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -236,9 +236,9 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
         mtctr   reg;                                                    \
         bctr
 
-#define BRANCH_LINK_TO_FAR(reg, label)                                  \
-        __LOAD_FAR_HANDLER(reg, label);                                 \
-        mtctr   reg;                                                    \
+#define BRANCH_LINK_TO_FAR(label)                                       \
+        __LOAD_FAR_HANDLER(r12, label);                                 \
+        mtctr   r12;                                                    \
         bctrl
 
 /*
@@ -265,7 +265,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943)
 #define BRANCH_TO_COMMON(reg, label)                                    \
         b       label
 
-#define BRANCH_LINK_TO_FAR(reg, label)                                  \
+#define BRANCH_LINK_TO_FAR(label)                                       \
         bl      label
 
 #define BRANCH_TO_KVM(reg, label)                                       \
diff --git a/arch/powerpc/include/asm/mce.h b/arch/powerpc/include/asm/mce.h
index f97d8cb6bdf6..ed62efe01e49 100644
--- a/arch/powerpc/include/asm/mce.h
+++ b/arch/powerpc/include/asm/mce.h
@@ -66,6 +66,55 @@
 
 #define P8_DSISR_MC_SLB_ERRORS          (P7_DSISR_MC_SLB_ERRORS | \
                                          P8_DSISR_MC_ERAT_MULTIHIT_SEC)
+
+/*
+ * Machine Check bits on power9
+ */
+#define P9_SRR1_MC_LOADSTORE(srr1)      (((srr1) >> PPC_BITLSHIFT(42)) & 1)
+
+#define P9_SRR1_MC_IFETCH(srr1) (       \
+        PPC_BITEXTRACT(srr1, 45, 0) |   \
+        PPC_BITEXTRACT(srr1, 44, 1) |   \
+        PPC_BITEXTRACT(srr1, 43, 2) |   \
+        PPC_BITEXTRACT(srr1, 36, 3) )
+
+/* 0 is reserved */
+#define P9_SRR1_MC_IFETCH_UE                            1
+#define P9_SRR1_MC_IFETCH_SLB_PARITY                    2
+#define P9_SRR1_MC_IFETCH_SLB_MULTIHIT                  3
+#define P9_SRR1_MC_IFETCH_ERAT_MULTIHIT                 4
+#define P9_SRR1_MC_IFETCH_TLB_MULTIHIT                  5
+#define P9_SRR1_MC_IFETCH_UE_TLB_RELOAD                 6
+/* 7 is reserved */
+#define P9_SRR1_MC_IFETCH_LINK_TIMEOUT                  8
+#define P9_SRR1_MC_IFETCH_LINK_TABLEWALK_TIMEOUT        9
+/* 10 ? */
+#define P9_SRR1_MC_IFETCH_RA                    11
+#define P9_SRR1_MC_IFETCH_RA_TABLEWALK          12
+#define P9_SRR1_MC_IFETCH_RA_ASYNC_STORE                13
+#define P9_SRR1_MC_IFETCH_LINK_ASYNC_STORE_TIMEOUT      14
+#define P9_SRR1_MC_IFETCH_RA_TABLEWALK_FOREIGN  15
+
+/* DSISR bits for machine check (On Power9) */
+#define P9_DSISR_MC_UE                                  (PPC_BIT(48))
+#define P9_DSISR_MC_UE_TABLEWALK                        (PPC_BIT(49))
+#define P9_DSISR_MC_LINK_LOAD_TIMEOUT                   (PPC_BIT(50))
+#define P9_DSISR_MC_LINK_TABLEWALK_TIMEOUT              (PPC_BIT(51))
+#define P9_DSISR_MC_ERAT_MULTIHIT                       (PPC_BIT(52))
+#define P9_DSISR_MC_TLB_MULTIHIT_MFTLB                  (PPC_BIT(53))
+#define P9_DSISR_MC_USER_TLBIE                          (PPC_BIT(54))
+#define P9_DSISR_MC_SLB_PARITY_MFSLB                    (PPC_BIT(55))
+#define P9_DSISR_MC_SLB_MULTIHIT_MFSLB                  (PPC_BIT(56))
+#define P9_DSISR_MC_RA_LOAD                             (PPC_BIT(57))
+#define P9_DSISR_MC_RA_TABLEWALK                        (PPC_BIT(58))
+#define P9_DSISR_MC_RA_TABLEWALK_FOREIGN                (PPC_BIT(59))
+#define P9_DSISR_MC_RA_FOREIGN                          (PPC_BIT(60))
+
+/* SLB error bits */
+#define P9_DSISR_MC_SLB_ERRORS          (P9_DSISR_MC_ERAT_MULTIHIT | \
+                                         P9_DSISR_MC_SLB_PARITY_MFSLB | \
+                                         P9_DSISR_MC_SLB_MULTIHIT_MFSLB)
+
 enum MCE_Version {
         MCE_V1 = 1,
 };
@@ -93,6 +142,9 @@ enum MCE_ErrorType {
         MCE_ERROR_TYPE_SLB = 2,
         MCE_ERROR_TYPE_ERAT = 3,
         MCE_ERROR_TYPE_TLB = 4,
+        MCE_ERROR_TYPE_USER = 5,
+        MCE_ERROR_TYPE_RA = 6,
+        MCE_ERROR_TYPE_LINK = 7,
 };
 
 enum MCE_UeErrorType {
@@ -121,6 +173,32 @@ enum MCE_TlbErrorType {
         MCE_TLB_ERROR_MULTIHIT = 2,
 };
 
+enum MCE_UserErrorType {
+        MCE_USER_ERROR_INDETERMINATE = 0,
+        MCE_USER_ERROR_TLBIE = 1,
+};
+
+enum MCE_RaErrorType {
+        MCE_RA_ERROR_INDETERMINATE = 0,
+        MCE_RA_ERROR_IFETCH = 1,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH = 2,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH_FOREIGN = 3,
+        MCE_RA_ERROR_LOAD = 4,
+        MCE_RA_ERROR_STORE = 5,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE = 6,
+        MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE_FOREIGN = 7,
+        MCE_RA_ERROR_LOAD_STORE_FOREIGN = 8,
+};
+
+enum MCE_LinkErrorType {
+        MCE_LINK_ERROR_INDETERMINATE = 0,
+        MCE_LINK_ERROR_IFETCH_TIMEOUT = 1,
+        MCE_LINK_ERROR_PAGE_TABLE_WALK_IFETCH_TIMEOUT = 2,
+        MCE_LINK_ERROR_LOAD_TIMEOUT = 3,
+        MCE_LINK_ERROR_STORE_TIMEOUT = 4,
+        MCE_LINK_ERROR_PAGE_TABLE_WALK_LOAD_STORE_TIMEOUT = 5,
+};
+
 struct machine_check_event {
         enum MCE_Version        version:8;      /* 0x00 */
         uint8_t                 in_use;         /* 0x01 */
@@ -166,6 +244,30 @@ struct machine_check_event {
                         uint64_t        effective_address;
                         uint8_t         reserved_2[16];
                 } tlb_error;
+
+                struct {
+                        enum MCE_UserErrorType user_error_type:8;
+                        uint8_t         effective_address_provided;
+                        uint8_t         reserved_1[6];
+                        uint64_t        effective_address;
+                        uint8_t         reserved_2[16];
+                } user_error;
+
+                struct {
+                        enum MCE_RaErrorType ra_error_type:8;
+                        uint8_t         effective_address_provided;
+                        uint8_t         reserved_1[6];
+                        uint64_t        effective_address;
+                        uint8_t         reserved_2[16];
+                } ra_error;
+
+                struct {
+                        enum MCE_LinkErrorType link_error_type:8;
+                        uint8_t         effective_address_provided;
+                        uint8_t         reserved_1[6];
+                        uint64_t        effective_address;
+                        uint8_t         reserved_2[16];
+                } link_error;
         } u;
 };
 
@@ -176,8 +278,12 @@ struct mce_error_info {
                 enum MCE_SlbErrorType slb_error_type:8;
                 enum MCE_EratErrorType erat_error_type:8;
                 enum MCE_TlbErrorType tlb_error_type:8;
+                enum MCE_UserErrorType user_error_type:8;
+                enum MCE_RaErrorType ra_error_type:8;
+                enum MCE_LinkErrorType link_error_type:8;
         } u;
-        uint8_t         reserved[2];
+        enum MCE_Severity       severity:8;
+        enum MCE_Initiator      initiator:8;
 };
 
 #define MAX_MC_EVT      100
diff --git a/arch/powerpc/include/asm/nohash/32/pgtable.h b/arch/powerpc/include/asm/nohash/32/pgtable.h
index ba9921bf202e..5134ade2e850 100644
--- a/arch/powerpc/include/asm/nohash/32/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/32/pgtable.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_NOHASH_32_PGTABLE_H
 #define _ASM_POWERPC_NOHASH_32_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #ifndef __ASSEMBLY__
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable-4k.h b/arch/powerpc/include/asm/nohash/64/pgtable-4k.h
index d0db98793dd8..9f4de0a1035e 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable-4k.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable-4k.h
@@ -1,5 +1,8 @@
 #ifndef _ASM_POWERPC_NOHASH_64_PGTABLE_4K_H
 #define _ASM_POWERPC_NOHASH_64_PGTABLE_4K_H
+
+#include <asm-generic/5level-fixup.h>
+
 /*
  * Entries per page directory level.  The PTE level must use a 64b record
  * for each page table entry.  The PMD and PGD level use a 32b record for
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable-64k.h b/arch/powerpc/include/asm/nohash/64/pgtable-64k.h
index 55b28ef3409a..1facb584dd29 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable-64k.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable-64k.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_POWERPC_NOHASH_64_PGTABLE_64K_H
 #define _ASM_POWERPC_NOHASH_64_PGTABLE_64K_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 
diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
index 0cd8a3852763..e5805ad78e12 100644
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -230,7 +230,7 @@ static inline int hugepd_ok(hugepd_t hpd)
         return ((hpd_val(hpd) & 0x4) != 0);
 #else
         /* We clear the top bit to indicate hugepd */
-        return ((hpd_val(hpd) & PD_HUGE) ==  0);
+        return (hpd_val(hpd) && (hpd_val(hpd) & PD_HUGE) == 0);
 #endif
 }
 
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index d99bd442aacb..e7d6d86563ee 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -284,6 +284,13 @@
 #define PPC_INST_BRANCH_COND            0x40800000
 #define PPC_INST_LBZCIX                 0x7c0006aa
 #define PPC_INST_STBCIX                 0x7c0007aa
+#define PPC_INST_LWZX                   0x7c00002e
+#define PPC_INST_LFSX                   0x7c00042e
+#define PPC_INST_STFSX                  0x7c00052e
+#define PPC_INST_LFDX                   0x7c0004ae
+#define PPC_INST_STFDX                  0x7c0005ae
+#define PPC_INST_LVX                    0x7c0000ce
+#define PPC_INST_STVX                   0x7c0001ce
 
 /* macros to insert fields into opcodes */
 #define ___PPC_RA(a)    (((a) & 0x1f) << 16)
diff --git a/arch/powerpc/include/asm/prom.h b/arch/powerpc/include/asm/prom.h
index 4a90634e8322..35c00d7a0cf8 100644
--- a/arch/powerpc/include/asm/prom.h
+++ b/arch/powerpc/include/asm/prom.h
@@ -160,12 +160,18 @@ struct of_drconf_cell {
 #define OV5_PFO_HW_ENCR         0x1120  /* PFO Encryption Accelerator */
 #define OV5_SUB_PROCESSORS      0x1501  /* 1,2,or 4 Sub-Processors supported */
 #define OV5_XIVE_EXPLOIT        0x1701  /* XIVE exploitation supported */
-#define OV5_MMU_RADIX_300       0x1880  /* ISA v3.00 radix MMU supported */
-#define OV5_MMU_HASH_300        0x1840  /* ISA v3.00 hash MMU supported */
-#define OV5_MMU_SEGM_RADIX      0x1820  /* radix mode (no segmentation) */
-#define OV5_MMU_PROC_TBL        0x1810  /* hcall selects SLB or proc table */
-#define OV5_MMU_SLB             0x1800  /* always use SLB */
-#define OV5_MMU_GTSE            0x1808  /* Guest translation shootdown */
+/* MMU Base Architecture */
+#define OV5_MMU_SUPPORT         0x18C0  /* MMU Mode Support Mask */
+#define OV5_MMU_HASH            0x1800  /* Hash MMU Only */
+#define OV5_MMU_RADIX           0x1840  /* Radix MMU Only */
+#define OV5_MMU_EITHER          0x1880  /* Hash or Radix Supported */
+#define OV5_MMU_DYNAMIC         0x18C0  /* Hash or Radix Can Switch Later */
+#define OV5_NMMU                0x1820  /* Nest MMU Available */
+/* Hash Table Extensions */
+#define OV5_HASH_SEG_TBL        0x1980  /* In Memory Segment Tables Available */
+#define OV5_HASH_GTSE           0x1940  /* Guest Translation Shoot Down Avail */
+/* Radix Table Extensions */
+#define OV5_RADIX_GTSE          0x1A40  /* Guest Translation Shoot Down Avail */
 
 /* Option Vector 6: IBM PAPR hints */
 #define OV6_LINUX               0x02    /* Linux is our OS */
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 4b369d83fe9c..1c9470881c4a 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -387,3 +387,4 @@ SYSCALL(copy_file_range)
 COMPAT_SYS_SPU(preadv2)
 COMPAT_SYS_SPU(pwritev2)
 SYSCALL(kexec_file_load)
+SYSCALL(statx)
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index eb1acee91a20..9ba11dbcaca9 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls             383
+#define NR_syscalls             384
 
 #define __NR__exit __NR_exit
 
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 2f26335a3c42..b85f14228857 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -393,5 +393,6 @@
 #define __NR_preadv2            380
 #define __NR_pwritev2           381
 #define __NR_kexec_file_load    382
+#define __NR_statx              383
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index cbc7c42cdb74..ec7a8b099dd9 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -807,14 +807,25 @@ int fix_alignment(struct pt_regs *regs)
         nb = aligninfo[instr].len;
         flags = aligninfo[instr].flags;
 
-        /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
-        if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
-                nb = 8;
-                flags = LD+SW;
-        } else if (IS_XFORM(instruction) &&
-                   ((instruction >> 1) & 0x3ff) == 660) {
-                nb = 8;
-                flags = ST+SW;
+        /*
+         * Handle some cases which give overlaps in the DSISR values.
+         */
+        if (IS_XFORM(instruction)) {
+                switch (get_xop(instruction)) {
+                case 532:       /* ldbrx */
+                        nb = 8;
+                        flags = LD+SW;
+                        break;
+                case 660:       /* stdbrx */
+                        nb = 8;
+                        flags = ST+SW;
+                        break;
+                case 20:        /* lwarx */
+                case 84:        /* ldarx */
+                case 116:       /* lharx */
+                case 276:       /* lqarx */
+                        return 0;       /* not emulated ever */
+                }
         }
 
         /* Byteswap little endian loads and stores */
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index bb7a1890aeb7..e79b9daa873c 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -77,6 +77,7 @@ extern void __flush_tlb_power8(unsigned int action);
 extern void __flush_tlb_power9(unsigned int action);
 extern long __machine_check_early_realmode_p7(struct pt_regs *regs);
 extern long __machine_check_early_realmode_p8(struct pt_regs *regs);
+extern long __machine_check_early_realmode_p9(struct pt_regs *regs);
 #endif /* CONFIG_PPC64 */
 #if defined(CONFIG_E500)
 extern void __setup_cpu_e5500(unsigned long offset, struct cpu_spec* spec);
@@ -540,6 +541,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_setup              = __setup_cpu_power9,
                 .cpu_restore            = __restore_cpu_power9,
                 .flush_tlb              = __flush_tlb_power9,
+                .machine_check_early    = __machine_check_early_realmode_p9,
                 .platform               = "power9",
         },
         {       /* Power9 */
@@ -559,6 +561,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
                 .cpu_setup              = __setup_cpu_power9,
                 .cpu_restore            = __restore_cpu_power9,
                 .flush_tlb              = __flush_tlb_power9,
+                .machine_check_early    = __machine_check_early_realmode_p9,
                 .platform               = "power9",
         },
         {       /* Cell Broadband Engine */
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6432d4bf08c8..767ef6d68c9e 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -689,7 +689,7 @@ resume_kernel:
 
         addi    r8,r1,INT_FRAME_SIZE    /* Get the kprobed function entry */
 
-        lwz     r3,GPR1(r1)
+        ld      r3,GPR1(r1)
         subi    r3,r3,INT_FRAME_SIZE    /* dst: Allocate a trampoline exception frame */
         mr      r4,r1                   /* src:  current exception frame */
         mr      r1,r3                   /* Reroute the trampoline frame to r1 */
@@ -703,8 +703,8 @@ resume_kernel:
         addi    r6,r6,8
         bdnz    2b
 
-        /* Do real store operation to complete stwu */
-        lwz     r5,GPR1(r1)
+        /* Do real store operation to complete stdu */
+        ld      r5,GPR1(r1)
         std     r8,0(r5)
 
         /* Clear _TIF_EMULATE_STACK_STORE flag */
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 857bf7c5b946..6353019966e6 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -982,7 +982,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
         EXCEPTION_PROLOG_COMMON_2(PACA_EXGEN)
         EXCEPTION_PROLOG_COMMON_3(0xe60)
         addi    r3,r1,STACK_FRAME_OVERHEAD
-        BRANCH_LINK_TO_FAR(r4, hmi_exception_realmode)
+        BRANCH_LINK_TO_FAR(hmi_exception_realmode) /* Function call ABI */
         /* Windup the stack. */
         /* Move original HSRR0 and HSRR1 into the respective regs */
         ld      r9,_MSR(r1)
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 5f61cc0349c0..6fd08219248d 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -276,19 +276,21 @@ power_enter_stop:
  */
         andis.   r4,r3,PSSCR_EC_ESL_MASK_SHIFTED
         clrldi   r3,r3,60 /* r3 = Bits[60:63] = Requested Level (RL) */
-        bne      1f
+        bne      .Lhandle_esl_ec_set
         IDLE_STATE_ENTER_SEQ(PPC_STOP)
         li      r3,0  /* Since we didn't lose state, return 0 */
         b       pnv_wakeup_noloss
+
+.Lhandle_esl_ec_set:
 /*
  * Check if the requested state is a deep idle state.
  */
-1:      LOAD_REG_ADDRBASE(r5,pnv_first_deep_stop_state)
+        LOAD_REG_ADDRBASE(r5,pnv_first_deep_stop_state)
         ld      r4,ADDROFF(pnv_first_deep_stop_state)(r5)
         cmpd    r3,r4
-        bge     2f
+        bge     .Lhandle_deep_stop
         IDLE_STATE_ENTER_SEQ_NORET(PPC_STOP)
-2:
+.Lhandle_deep_stop:
 /*
  * Entering deep idle state.
  * Clear thread bit in PACA_CORE_IDLE_STATE, save SPRs to
@@ -447,9 +449,23 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
 _GLOBAL(pnv_wakeup_tb_loss)
         ld      r1,PACAR1(r13)
         /*
-         * Before entering any idle state, the NVGPRs are saved in the stack
-         * and they are restored before switching to the process context. Hence
-         * until they are restored, they are free to be used.
+         * Before entering any idle state, the NVGPRs are saved in the stack.
+         * If there was a state loss, or PACA_NAPSTATELOST was set, then the
+         * NVGPRs are restored. If we are here, it is likely that state is lost,
+         * but not guaranteed -- neither ISA207 nor ISA300 tests to reach
+         * here are the same as the test to restore NVGPRS:
+         * PACA_THREAD_IDLE_STATE test for ISA207, PSSCR test for ISA300,
+         * and SRR1 test for restoring NVGPRs.
+         *
+         * We are about to clobber NVGPRs now, so set NAPSTATELOST to
+         * guarantee they will always be restored. This might be tightened
+         * with careful reading of specs (particularly for ISA300) but this
+         * is already a slow wakeup path and it's simpler to be safe.
+         */
+        li      r0,1
+        stb     r0,PACA_NAPSTATELOST(r13)
+
+        /*
          *
          * Save SRR1 and LR in NVGPRs as they might be clobbered in
          * opal_call() (called in CHECK_HMI_INTERRUPT). SRR1 is required
diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c
index c6923ff45131..a1475e6aef3a 100644
--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -58,6 +58,15 @@ static void mce_set_error_info(struct machine_check_event *mce,
         case MCE_ERROR_TYPE_TLB:
                 mce->u.tlb_error.tlb_error_type = mce_err->u.tlb_error_type;
                 break;
+        case MCE_ERROR_TYPE_USER:
+                mce->u.user_error.user_error_type = mce_err->u.user_error_type;
+                break;
+        case MCE_ERROR_TYPE_RA:
+                mce->u.ra_error.ra_error_type = mce_err->u.ra_error_type;
+                break;
+        case MCE_ERROR_TYPE_LINK:
+                mce->u.link_error.link_error_type = mce_err->u.link_error_type;
+                break;
         case MCE_ERROR_TYPE_UNKNOWN:
         default:
                 break;
@@ -90,13 +99,14 @@ void save_mce_event(struct pt_regs *regs, long handled,
         mce->gpr3 = regs->gpr[3];
         mce->in_use = 1;
 
-        mce->initiator = MCE_INITIATOR_CPU;
         /* Mark it recovered if we have handled it and MSR(RI=1). */
         if (handled && (regs->msr & MSR_RI))
                 mce->disposition = MCE_DISPOSITION_RECOVERED;
         else
                 mce->disposition = MCE_DISPOSITION_NOT_RECOVERED;
-        mce->severity = MCE_SEV_ERROR_SYNC;
+
+        mce->initiator = mce_err->initiator;
+        mce->severity = mce_err->severity;
 
         /*
          * Populate the mce error_type and type-specific error_type.
@@ -115,6 +125,15 @@ void save_mce_event(struct pt_regs *regs, long handled,
         } else if (mce->error_type == MCE_ERROR_TYPE_ERAT) {
                 mce->u.erat_error.effective_address_provided = true;
                 mce->u.erat_error.effective_address = addr;
+        } else if (mce->error_type == MCE_ERROR_TYPE_USER) {
+                mce->u.user_error.effective_address_provided = true;
+                mce->u.user_error.effective_address = addr;
+        } else if (mce->error_type == MCE_ERROR_TYPE_RA) {
+                mce->u.ra_error.effective_address_provided = true;
+                mce->u.ra_error.effective_address = addr;
+        } else if (mce->error_type == MCE_ERROR_TYPE_LINK) {
+                mce->u.link_error.effective_address_provided = true;
+                mce->u.link_error.effective_address = addr;
         } else if (mce->error_type == MCE_ERROR_TYPE_UE) {
                 mce->u.ue_error.effective_address_provided = true;
                 mce->u.ue_error.effective_address = addr;
@@ -239,6 +258,29 @@ void machine_check_print_event_info(struct machine_check_event *evt)
                 "Parity",
                 "Multihit",
         };
+        static const char *mc_user_types[] = {
+                "Indeterminate",
+                "tlbie(l) invalid",
+        };
+        static const char *mc_ra_types[] = {
+                "Indeterminate",
+                "Instruction fetch (bad)",
+                "Page table walk ifetch (bad)",
+                "Page table walk ifetch (foreign)",
+                "Load (bad)",
+                "Store (bad)",
+                "Page table walk Load/Store (bad)",
+                "Page table walk Load/Store (foreign)",
+                "Load/Store (foreign)",
+        };
+        static const char *mc_link_types[] = {
+                "Indeterminate",
+                "Instruction fetch (timeout)",
+                "Page table walk ifetch (timeout)",
+                "Load (timeout)",
+                "Store (timeout)",
+                "Page table walk Load/Store (timeout)",
+        };
 
         /* Print things out */
         if (evt->version != MCE_V1) {
@@ -315,6 +357,36 @@ void machine_check_print_event_info(struct machine_check_event *evt)
                         printk("%s    Effective address: %016llx\n",
                                level, evt->u.tlb_error.effective_address);
                 break;
+        case MCE_ERROR_TYPE_USER:
+                subtype = evt->u.user_error.user_error_type <
+                        ARRAY_SIZE(mc_user_types) ?
+                        mc_user_types[evt->u.user_error.user_error_type]
+                        : "Unknown";
+                printk("%s  Error type: User [%s]\n", level, subtype);
+                if (evt->u.user_error.effective_address_provided)
+                        printk("%s    Effective address: %016llx\n",
+                               level, evt->u.user_error.effective_address);
+                break;
+        case MCE_ERROR_TYPE_RA:
+                subtype = evt->u.ra_error.ra_error_type <
+                        ARRAY_SIZE(mc_ra_types) ?
+                        mc_ra_types[evt->u.ra_error.ra_error_type]
+                        : "Unknown";
+                printk("%s  Error type: Real address [%s]\n", level, subtype);
+                if (evt->u.ra_error.effective_address_provided)
+                        printk("%s    Effective address: %016llx\n",
+                               level, evt->u.ra_error.effective_address);
+                break;
+        case MCE_ERROR_TYPE_LINK:
+                subtype = evt->u.link_error.link_error_type <
+                        ARRAY_SIZE(mc_link_types) ?
+                        mc_link_types[evt->u.link_error.link_error_type]
+                        : "Unknown";
+                printk("%s  Error type: Link [%s]\n", level, subtype);
+                if (evt->u.link_error.effective_address_provided)
+                        printk("%s    Effective address: %016llx\n",
+                               level, evt->u.link_error.effective_address);
+                break;
         default:
         case MCE_ERROR_TYPE_UNKNOWN:
                 printk("%s  Error type: Unknown\n", level);
@@ -341,6 +413,18 @@ uint64_t get_mce_fault_addr(struct machine_check_event *evt)
                 if (evt->u.tlb_error.effective_address_provided)
                         return evt->u.tlb_error.effective_address;
                 break;
+        case MCE_ERROR_TYPE_USER:
+                if (evt->u.user_error.effective_address_provided)
+                        return evt->u.user_error.effective_address;
+                break;
+        case MCE_ERROR_TYPE_RA:
+                if (evt->u.ra_error.effective_address_provided)
+                        return evt->u.ra_error.effective_address;
+                break;
+        case MCE_ERROR_TYPE_LINK:
+                if (evt->u.link_error.effective_address_provided)
+                        return evt->u.link_error.effective_address;
+                break;
         default:
         case MCE_ERROR_TYPE_UNKNOWN:
                 break;
diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
index 7353991c4ece..763d6f58caa8 100644
--- a/arch/powerpc/kernel/mce_power.c
+++ b/arch/powerpc/kernel/mce_power.c
@@ -116,6 +116,51 @@ static void flush_and_reload_slb(void)
 }
 #endif
 
+static void flush_erat(void)
+{
+        asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+}
+
+#define MCE_FLUSH_SLB 1
+#define MCE_FLUSH_TLB 2
+#define MCE_FLUSH_ERAT 3
+
+static int mce_flush(int what)
+{
+#ifdef CONFIG_PPC_STD_MMU_64
+        if (what == MCE_FLUSH_SLB) {
+                flush_and_reload_slb();
+                return 1;
+        }
+#endif
+        if (what == MCE_FLUSH_ERAT) {
+                flush_erat();
+                return 1;
+        }
+        if (what == MCE_FLUSH_TLB) {
+                if (cur_cpu_spec && cur_cpu_spec->flush_tlb) {
+                        cur_cpu_spec->flush_tlb(TLB_INVAL_SCOPE_GLOBAL);
+                        return 1;
+                }
+        }
+
+        return 0;
+}
+
+static int mce_handle_flush_derrors(uint64_t dsisr, uint64_t slb, uint64_t tlb, uint64_t erat)
+{
+        if ((dsisr & slb) && mce_flush(MCE_FLUSH_SLB))
+                dsisr &= ~slb;
+        if ((dsisr & erat) && mce_flush(MCE_FLUSH_ERAT))
+                dsisr &= ~erat;
+        if ((dsisr & tlb) && mce_flush(MCE_FLUSH_TLB))
+                dsisr &= ~tlb;
+        /* Any other errors we don't understand? */
+        if (dsisr)
+                return 0;
+        return 1;
+}
+
 static long mce_handle_derror(uint64_t dsisr, uint64_t slb_error_bits)
 {
         long handled = 1;
@@ -281,6 +326,9 @@ long __machine_check_early_realmode_p7(struct pt_regs *regs)
         long handled = 1;
         struct mce_error_info mce_error_info = { 0 };
 
+        mce_error_info.severity = MCE_SEV_ERROR_SYNC;
+        mce_error_info.initiator = MCE_INITIATOR_CPU;
+
         srr1 = regs->msr;
         nip = regs->nip;
 
@@ -352,6 +400,9 @@ long __machine_check_early_realmode_p8(struct pt_regs *regs)
         long handled = 1;
         struct mce_error_info mce_error_info = { 0 };
 
+        mce_error_info.severity = MCE_SEV_ERROR_SYNC;
+        mce_error_info.initiator = MCE_INITIATOR_CPU;
+
         srr1 = regs->msr;
         nip = regs->nip;
 
@@ -372,3 +423,189 @@ long __machine_check_early_realmode_p8(struct pt_regs *regs)
         save_mce_event(regs, handled, &mce_error_info, nip, addr);
         return handled;
 }
+
+static int mce_handle_derror_p9(struct pt_regs *regs)
+{
+        uint64_t dsisr = regs->dsisr;
+
+        return mce_handle_flush_derrors(dsisr,
+                        P9_DSISR_MC_SLB_PARITY_MFSLB |
+                        P9_DSISR_MC_SLB_MULTIHIT_MFSLB,
+
+                        P9_DSISR_MC_TLB_MULTIHIT_MFTLB,
+
+                        P9_DSISR_MC_ERAT_MULTIHIT);
+}
+
+static int mce_handle_ierror_p9(struct pt_regs *regs)
+{
+        uint64_t srr1 = regs->msr;
+
+        switch (P9_SRR1_MC_IFETCH(srr1)) {
+        case P9_SRR1_MC_IFETCH_SLB_PARITY:
+        case P9_SRR1_MC_IFETCH_SLB_MULTIHIT:
+                return mce_flush(MCE_FLUSH_SLB);
+        case P9_SRR1_MC_IFETCH_TLB_MULTIHIT:
+                return mce_flush(MCE_FLUSH_TLB);
+        case P9_SRR1_MC_IFETCH_ERAT_MULTIHIT:
+                return mce_flush(MCE_FLUSH_ERAT);
+        default:
+                return 0;
+        }
+}
+
+static void mce_get_derror_p9(struct pt_regs *regs,
+                struct mce_error_info *mce_err, uint64_t *addr)
+{
+        uint64_t dsisr = regs->dsisr;
+
+        mce_err->severity = MCE_SEV_ERROR_SYNC;
+        mce_err->initiator = MCE_INITIATOR_CPU;
+
+        if (dsisr & P9_DSISR_MC_USER_TLBIE)
+                *addr = regs->nip;
+        else
+                *addr = regs->dar;
+
+        if (dsisr & P9_DSISR_MC_UE) {
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_LOAD_STORE;
+        } else if (dsisr & P9_DSISR_MC_UE_TABLEWALK) {
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_PAGE_TABLE_WALK_LOAD_STORE;
+        } else if (dsisr & P9_DSISR_MC_LINK_LOAD_TIMEOUT) {
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_LOAD_TIMEOUT;
+        } else if (dsisr & P9_DSISR_MC_LINK_TABLEWALK_TIMEOUT) {
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_PAGE_TABLE_WALK_LOAD_STORE_TIMEOUT;
+        } else if (dsisr & P9_DSISR_MC_ERAT_MULTIHIT) {
+                mce_err->error_type = MCE_ERROR_TYPE_ERAT;
+                mce_err->u.erat_error_type = MCE_ERAT_ERROR_MULTIHIT;
+        } else if (dsisr & P9_DSISR_MC_TLB_MULTIHIT_MFTLB) {
+                mce_err->error_type = MCE_ERROR_TYPE_TLB;
+                mce_err->u.tlb_error_type = MCE_TLB_ERROR_MULTIHIT;
+        } else if (dsisr & P9_DSISR_MC_USER_TLBIE) {
+                mce_err->error_type = MCE_ERROR_TYPE_USER;
+                mce_err->u.user_error_type = MCE_USER_ERROR_TLBIE;
+        } else if (dsisr & P9_DSISR_MC_SLB_PARITY_MFSLB) {
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_PARITY;
+        } else if (dsisr & P9_DSISR_MC_SLB_MULTIHIT_MFSLB) {
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_MULTIHIT;
+        } else if (dsisr & P9_DSISR_MC_RA_LOAD) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_LOAD;
+        } else if (dsisr & P9_DSISR_MC_RA_TABLEWALK) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE;
+        } else if (dsisr & P9_DSISR_MC_RA_TABLEWALK_FOREIGN) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_LOAD_STORE_FOREIGN;
+        } else if (dsisr & P9_DSISR_MC_RA_FOREIGN) {
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_LOAD_STORE_FOREIGN;
+        }
+}
+
+static void mce_get_ierror_p9(struct pt_regs *regs,
+                struct mce_error_info *mce_err, uint64_t *addr)
+{
+        uint64_t srr1 = regs->msr;
+
+        switch (P9_SRR1_MC_IFETCH(srr1)) {
+        case P9_SRR1_MC_IFETCH_RA_ASYNC_STORE:
+        case P9_SRR1_MC_IFETCH_LINK_ASYNC_STORE_TIMEOUT:
+                mce_err->severity = MCE_SEV_FATAL;
+                break;
+        default:
+                mce_err->severity = MCE_SEV_ERROR_SYNC;
+                break;
+        }
+
+        mce_err->initiator = MCE_INITIATOR_CPU;
+
+        *addr = regs->nip;
+
+        switch (P9_SRR1_MC_IFETCH(srr1)) {
+        case P9_SRR1_MC_IFETCH_UE:
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_SLB_PARITY:
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_PARITY;
+                break;
+        case P9_SRR1_MC_IFETCH_SLB_MULTIHIT:
+                mce_err->error_type = MCE_ERROR_TYPE_SLB;
+                mce_err->u.slb_error_type = MCE_SLB_ERROR_MULTIHIT;
+                break;
+        case P9_SRR1_MC_IFETCH_ERAT_MULTIHIT:
+                mce_err->error_type = MCE_ERROR_TYPE_ERAT;
+                mce_err->u.erat_error_type = MCE_ERAT_ERROR_MULTIHIT;
+                break;
+        case P9_SRR1_MC_IFETCH_TLB_MULTIHIT:
+                mce_err->error_type = MCE_ERROR_TYPE_TLB;
+                mce_err->u.tlb_error_type = MCE_TLB_ERROR_MULTIHIT;
+                break;
+        case P9_SRR1_MC_IFETCH_UE_TLB_RELOAD:
+                mce_err->error_type = MCE_ERROR_TYPE_UE;
+                mce_err->u.ue_error_type = MCE_UE_ERROR_PAGE_TABLE_WALK_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_LINK_TIMEOUT:
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_IFETCH_TIMEOUT;
+                break;
+        case P9_SRR1_MC_IFETCH_LINK_TABLEWALK_TIMEOUT:
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_PAGE_TABLE_WALK_IFETCH_TIMEOUT;
+                break;
+        case P9_SRR1_MC_IFETCH_RA:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_RA_TABLEWALK:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH;
+                break;
+        case P9_SRR1_MC_IFETCH_RA_ASYNC_STORE:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_STORE;
+                break;
+        case P9_SRR1_MC_IFETCH_LINK_ASYNC_STORE_TIMEOUT:
+                mce_err->error_type = MCE_ERROR_TYPE_LINK;
+                mce_err->u.link_error_type = MCE_LINK_ERROR_STORE_TIMEOUT;
+                break;
+        case P9_SRR1_MC_IFETCH_RA_TABLEWALK_FOREIGN:
+                mce_err->error_type = MCE_ERROR_TYPE_RA;
+                mce_err->u.ra_error_type = MCE_RA_ERROR_PAGE_TABLE_WALK_IFETCH_FOREIGN;
+                break;
+        default:
+                break;
+        }
+}
+
+long __machine_check_early_realmode_p9(struct pt_regs *regs)
+{
+        uint64_t nip, addr;
+        long handled;
+        struct mce_error_info mce_error_info = { 0 };
+
+        nip = regs->nip;
+
+        if (P9_SRR1_MC_LOADSTORE(regs->msr)) {
+                handled = mce_handle_derror_p9(regs);
+                mce_get_derror_p9(regs, &mce_error_info, &addr);
+        } else {
+                handled = mce_handle_ierror_p9(regs);
+                mce_get_ierror_p9(regs, &mce_error_info, &addr);
+        }
+
+        /* Handle UE error. */
+        if (mce_error_info.error_type == MCE_ERROR_TYPE_UE)
+                handled = mce_handle_ue_error(regs);
+
+        save_mce_event(regs, handled, &mce_error_info, nip, addr);
+        return handled;
+}
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index ae179cb1bb3c..c119044cad0d 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -67,7 +67,7 @@ PPC64_CACHES:
  *   flush all bytes from start through stop-1 inclusive
  */
 
-_GLOBAL(flush_icache_range)
+_GLOBAL_TOC(flush_icache_range)
 BEGIN_FTR_SECTION
         PURGE_PREFETCHED_INS
         blr
@@ -120,7 +120,7 @@ EXPORT_SYMBOL(flush_icache_range)
  *
  *    flush all bytes from start to stop-1 inclusive
  */
-_GLOBAL(flush_dcache_range)
+_GLOBAL_TOC(flush_dcache_range)
 
 /*
  * Flush the data cache to memory 
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index a3944540fe0d..1c1b44ec7642 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -168,6 +168,14 @@ static unsigned long __initdata prom_tce_alloc_start;
 static unsigned long __initdata prom_tce_alloc_end;
 #endif
 
+static bool __initdata prom_radix_disable;
+
+struct platform_support {
+        bool hash_mmu;
+        bool radix_mmu;
+        bool radix_gtse;
+};
+
 /* Platforms codes are now obsolete in the kernel. Now only used within this
  * file and ultimately gone too. Feel free to change them if you need, they
  * are not shared with anything outside of this file anymore
@@ -626,6 +634,12 @@ static void __init early_cmdline_parse(void)
                 prom_memory_limit = ALIGN(prom_memory_limit, 0x1000000);
 #endif
         }
+
+        opt = strstr(prom_cmd_line, "disable_radix");
+        if (opt) {
+                prom_debug("Radix disabled from cmdline\n");
+                prom_radix_disable = true;
+        }
 }
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
@@ -695,6 +709,8 @@ struct option_vector5 {
         u8 byte22;
         u8 intarch;
         u8 mmu;
+        u8 hash_ext;
+        u8 radix_ext;
 } __packed;
 
 struct option_vector6 {
@@ -850,8 +866,9 @@ struct ibm_arch_vec __cacheline_aligned ibm_architecture_vec = {
                 .reserved3 = 0,
                 .subprocessors = 1,
                 .intarch = 0,
-                .mmu = OV5_FEAT(OV5_MMU_RADIX_300) | OV5_FEAT(OV5_MMU_HASH_300) |
-                        OV5_FEAT(OV5_MMU_PROC_TBL) | OV5_FEAT(OV5_MMU_GTSE),
+                .mmu = 0,
+                .hash_ext = 0,
+                .radix_ext = 0,
         },
 
         /* option vector 6: IBM PAPR hints */
@@ -990,6 +1007,92 @@ static int __init prom_count_smt_threads(void)
 
 }
 
+static void __init prom_parse_mmu_model(u8 val,
+                                        struct platform_support *support)
+{
+        switch (val) {
+        case OV5_FEAT(OV5_MMU_DYNAMIC):
+        case OV5_FEAT(OV5_MMU_EITHER): /* Either Available */
+                prom_debug("MMU - either supported\n");
+                support->radix_mmu = !prom_radix_disable;
+                support->hash_mmu = true;
+                break;
+        case OV5_FEAT(OV5_MMU_RADIX): /* Only Radix */
+                prom_debug("MMU - radix only\n");
+                if (prom_radix_disable) {
+                        /*
+                         * If we __have__ to do radix, we're better off ignoring
+                         * the command line rather than not booting.
+                         */
+                        prom_printf("WARNING: Ignoring cmdline option disable_radix\n");
+                }
+                support->radix_mmu = true;
+                break;
+        case OV5_FEAT(OV5_MMU_HASH):
+                prom_debug("MMU - hash only\n");
+                support->hash_mmu = true;
+                break;
+        default:
+                prom_debug("Unknown mmu support option: 0x%x\n", val);
+                break;
+        }
+}
+
+static void __init prom_parse_platform_support(u8 index, u8 val,
+                                               struct platform_support *support)
+{
+        switch (index) {
+        case OV5_INDX(OV5_MMU_SUPPORT): /* MMU Model */
+                prom_parse_mmu_model(val & OV5_FEAT(OV5_MMU_SUPPORT), support);
+                break;
+        case OV5_INDX(OV5_RADIX_GTSE): /* Radix Extensions */
+                if (val & OV5_FEAT(OV5_RADIX_GTSE)) {
+                        prom_debug("Radix - GTSE supported\n");
+                        support->radix_gtse = true;
+                }
+                break;
+        }
+}
+
+static void __init prom_check_platform_support(void)
+{
+        struct platform_support supported = {
+                .hash_mmu = false,
+                .radix_mmu = false,
+                .radix_gtse = false
+        };
+        int prop_len = prom_getproplen(prom.chosen,
+                                       "ibm,arch-vec-5-platform-support");
+        if (prop_len > 1) {
+                int i;
+                u8 vec[prop_len];
+                prom_debug("Found ibm,arch-vec-5-platform-support, len: %d\n",
+                           prop_len);
+                prom_getprop(prom.chosen, "ibm,arch-vec-5-platform-support",
+                             &vec, sizeof(vec));
+                for (i = 0; i < prop_len; i += 2) {
+                        prom_debug("%d: index = 0x%x val = 0x%x\n", i / 2
+                                                                  , vec[i]
+                                                                  , vec[i + 1]);
+                        prom_parse_platform_support(vec[i], vec[i + 1],
+                                                    &supported);
+                }
+        }
+
+        if (supported.radix_mmu && supported.radix_gtse) {
+                /* Radix preferred - but we require GTSE for now */
+                prom_debug("Asking for radix with GTSE\n");
+                ibm_architecture_vec.vec5.mmu = OV5_FEAT(OV5_MMU_RADIX);
+                ibm_architecture_vec.vec5.radix_ext = OV5_FEAT(OV5_RADIX_GTSE);
+        } else if (supported.hash_mmu) {
+                /* Default to hash mmu (if we can) */
+                prom_debug("Asking for hash\n");
+                ibm_architecture_vec.vec5.mmu = OV5_FEAT(OV5_MMU_HASH);
+        } else {
+                /* We're probably on a legacy hypervisor */
+                prom_debug("Assuming legacy hash support\n");
+        }
+}
 
 static void __init prom_send_capabilities(void)
 {
@@ -997,6 +1100,9 @@ static void __init prom_send_capabilities(void)
         prom_arg_t ret;
         u32 cores;
 
+        /* Check ibm,arch-vec-5-platform-support and fixup vec5 if required */
+        prom_check_platform_support();
+
         root = call_prom("open", 1, 1, ADDR("/"));
         if (root != 0) {
                 /* We need to tell the FW about the number of cores we support.
@@ -2993,6 +3099,11 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
          */
         prom_check_initrd(r3, r4);
 
+        /*
+         * Do early parsing of command line
+         */
+        early_cmdline_parse();
+
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
         /*
          * On pSeries, inform the firmware about our capabilities
@@ -3009,11 +3120,6 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
                 copy_and_flush(0, kbase, 0x100, 0);
 
         /*
-         * Do early parsing of command line
-         */
-        early_cmdline_parse();
-
-        /*
          * Initialize memory management within prom_init
          */
         prom_init_mem();
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index adf2084f214b..f997154dfc41 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -236,6 +236,15 @@ static void cpu_ready_for_interrupts(void)
                 mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3);
         }
 
+        /*
+         * Fixup HFSCR:TM based on CPU features. The bit is set by our
+         * early asm init because at that point we haven't updated our
+         * CPU features from firmware and device-tree. Here we have,
+         * so let's do it.
+         */
+        if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+                mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
+
         /* Set IR and DR in PACA MSR */
         get_paca()->kernel_msr = MSR_KERNEL;
 }
@@ -408,7 +417,10 @@ static void init_cache_info(struct ppc_cache_info *info, u32 size, u32 lsize,
         info->line_size = lsize;
         info->block_size = bsize;
         info->log_block_size = __ilog2(bsize);
-        info->blocks_per_page = PAGE_SIZE / bsize;
+        if (bsize)
+                info->blocks_per_page = PAGE_SIZE / bsize;
+        else
+                info->blocks_per_page = 0;
 
         if (sets == 0)
                 info->assoc = 0xffff;
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index f3158fb16de3..710e491206ed 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -601,7 +601,7 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                                                          hva, NULL, NULL);
                         if (ptep) {
                                 pte = kvmppc_read_update_linux_pte(ptep, 1);
-                                if (pte_write(pte))
+                                if (__pte_write(pte))
                                         write_ok = 1;
                         }
                         local_irq_restore(flags);
@@ -1487,6 +1487,10 @@ long kvm_vm_ioctl_resize_hpt_prepare(struct kvm *kvm,
         /* start new resize */
 
         resize = kzalloc(sizeof(*resize), GFP_KERNEL);
+        if (!resize) {
+                ret = -ENOMEM;
+                goto out;
+        }
         resize->order = shift;
         resize->kvm = kvm;
         INIT_WORK(&resize->work, resize_hpt_prepare_work);
diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
index 6fca970373ee..ce6f2121fffe 100644
--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
@@ -256,7 +256,7 @@ long kvmppc_do_h_enter(struct kvm *kvm, unsigned long flags,
                 }
                 pte = kvmppc_read_update_linux_pte(ptep, writing);
                 if (pte_present(pte) && !pte_protnone(pte)) {
-                        if (writing && !pte_write(pte))
+                        if (writing && !__pte_write(pte))
                                 /* make the actual HPTE be read-only */
                                 ptel = hpte_make_readonly(ptel);
                         is_ci = pte_ci(pte);
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 0e649d72fe8d..2b5e09020cfe 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -20,6 +20,7 @@ obj64-y	+= copypage_64.o copyuser_64.o usercopy_64.o mem_64.o hweight_64.o \
 
 obj64-$(CONFIG_SMP)     += locks.o
 obj64-$(CONFIG_ALTIVEC) += vmx-helper.o
+obj64-$(CONFIG_KPROBES_SANITY_TEST) += test_emulate_step.o
 
 obj-y                   += checksum_$(BITS).o checksum_wrappers.o
 
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 846dba2c6360..9c542ec70c5b 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1799,8 +1799,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto instr_done;
 
         case LARX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (op.ea & (size - 1))
                         break;          /* can't handle misaligned */
                 if (!address_ok(regs, op.ea, size))
@@ -1823,8 +1821,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto ldst_done;
 
         case STCX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (op.ea & (size - 1))
                         break;          /* can't handle misaligned */
                 if (!address_ok(regs, op.ea, size))
@@ -1849,8 +1845,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto ldst_done;
 
         case LOAD:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = read_mem(&regs->gpr[op.reg], op.ea, size, regs);
                 if (!err) {
                         if (op.type & SIGNEXT)
@@ -1862,8 +1856,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 
 #ifdef CONFIG_PPC_FPU
         case LOAD_FP:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (size == 4)
                         err = do_fp_load(op.reg, do_lfs, op.ea, size, regs);
                 else
@@ -1872,15 +1864,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 #endif
 #ifdef CONFIG_ALTIVEC
         case LOAD_VMX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs);
                 goto ldst_done;
 #endif
 #ifdef CONFIG_VSX
         case LOAD_VSX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs);
                 goto ldst_done;
 #endif
@@ -1903,8 +1891,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                 goto instr_done;
 
         case STORE:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if ((op.type & UPDATE) && size == sizeof(long) &&
                     op.reg == 1 && op.update_reg == 1 &&
                     !(regs->msr & MSR_PR) &&
@@ -1917,8 +1903,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 
 #ifdef CONFIG_PPC_FPU
         case STORE_FP:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 if (size == 4)
                         err = do_fp_store(op.reg, do_stfs, op.ea, size, regs);
                 else
@@ -1927,15 +1911,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 #endif
 #ifdef CONFIG_ALTIVEC
         case STORE_VMX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs);
                 goto ldst_done;
 #endif
 #ifdef CONFIG_VSX
         case STORE_VSX:
-                if (regs->msr & MSR_LE)
-                        return 0;
                 err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs);
                 goto ldst_done;
 #endif
diff --git a/arch/powerpc/lib/test_emulate_step.c b/arch/powerpc/lib/test_emulate_step.c
new file mode 100644
index 000000000000..2534c1447554
--- /dev/null
+++ b/arch/powerpc/lib/test_emulate_step.c
@@ -0,0 +1,434 @@
+/*
+ * Simple sanity test for emulate_step load/store instructions.
+ *
+ * Copyright IBM Corp. 2016
+ *
+ * This program is free software;  you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) "emulate_step_test: " fmt
+
+#include <linux/ptrace.h>
+#include <asm/sstep.h>
+#include <asm/ppc-opcode.h>
+
+#define IMM_L(i)                ((uintptr_t)(i) & 0xffff)
+
+/*
+ * Defined with TEST_ prefix so it does not conflict with other
+ * definitions.
+ */
+#define TEST_LD(r, base, i)     (PPC_INST_LD | ___PPC_RT(r) |           \
+                                        ___PPC_RA(base) | IMM_L(i))
+#define TEST_LWZ(r, base, i)    (PPC_INST_LWZ | ___PPC_RT(r) |          \
+                                        ___PPC_RA(base) | IMM_L(i))
+#define TEST_LWZX(t, a, b)      (PPC_INST_LWZX | ___PPC_RT(t) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STD(r, base, i)    (PPC_INST_STD | ___PPC_RS(r) |          \
+                                        ___PPC_RA(base) | ((i) & 0xfffc))
+#define TEST_LDARX(t, a, b, eh) (PPC_INST_LDARX | ___PPC_RT(t) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b) |   \
+                                        __PPC_EH(eh))
+#define TEST_STDCX(s, a, b)     (PPC_INST_STDCX | ___PPC_RS(s) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LFSX(t, a, b)      (PPC_INST_LFSX | ___PPC_RT(t) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STFSX(s, a, b)     (PPC_INST_STFSX | ___PPC_RS(s) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LFDX(t, a, b)      (PPC_INST_LFDX | ___PPC_RT(t) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STFDX(s, a, b)     (PPC_INST_STFDX | ___PPC_RS(s) |        \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LVX(t, a, b)       (PPC_INST_LVX | ___PPC_RT(t) |          \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_STVX(s, a, b)      (PPC_INST_STVX | ___PPC_RS(s) |         \
+                                        ___PPC_RA(a) | ___PPC_RB(b))
+#define TEST_LXVD2X(s, a, b)    (PPC_INST_LXVD2X | VSX_XX1((s), R##a, R##b))
+#define TEST_STXVD2X(s, a, b)   (PPC_INST_STXVD2X | VSX_XX1((s), R##a, R##b))
+
+
+static void __init init_pt_regs(struct pt_regs *regs)
+{
+        static unsigned long msr;
+        static bool msr_cached;
+
+        memset(regs, 0, sizeof(struct pt_regs));
+
+        if (likely(msr_cached)) {
+                regs->msr = msr;
+                return;
+        }
+
+        asm volatile("mfmsr %0" : "=r"(regs->msr));
+
+        regs->msr |= MSR_FP;
+        regs->msr |= MSR_VEC;
+        regs->msr |= MSR_VSX;
+
+        msr = regs->msr;
+        msr_cached = true;
+}
+
+static void __init show_result(char *ins, char *result)
+{
+        pr_info("%-14s : %s\n", ins, result);
+}
+
+static void __init test_ld(void)
+{
+        struct pt_regs regs;
+        unsigned long a = 0x23;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) &a;
+
+        /* ld r5, 0(r3) */
+        stepped = emulate_step(&regs, TEST_LD(5, 3, 0));
+
+        if (stepped == 1 && regs.gpr[5] == a)
+                show_result("ld", "PASS");
+        else
+                show_result("ld", "FAIL");
+}
+
+static void __init test_lwz(void)
+{
+        struct pt_regs regs;
+        unsigned int a = 0x4545;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) &a;
+
+        /* lwz r5, 0(r3) */
+        stepped = emulate_step(&regs, TEST_LWZ(5, 3, 0));
+
+        if (stepped == 1 && regs.gpr[5] == a)
+                show_result("lwz", "PASS");
+        else
+                show_result("lwz", "FAIL");
+}
+
+static void __init test_lwzx(void)
+{
+        struct pt_regs regs;
+        unsigned int a[3] = {0x0, 0x0, 0x1234};
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) a;
+        regs.gpr[4] = 8;
+        regs.gpr[5] = 0x8765;
+
+        /* lwzx r5, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LWZX(5, 3, 4));
+        if (stepped == 1 && regs.gpr[5] == a[2])
+                show_result("lwzx", "PASS");
+        else
+                show_result("lwzx", "FAIL");
+}
+
+static void __init test_std(void)
+{
+        struct pt_regs regs;
+        unsigned long a = 0x1234;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+        regs.gpr[3] = (unsigned long) &a;
+        regs.gpr[5] = 0x5678;
+
+        /* std r5, 0(r3) */
+        stepped = emulate_step(&regs, TEST_STD(5, 3, 0));
+        if (stepped == 1 || regs.gpr[5] == a)
+                show_result("std", "PASS");
+        else
+                show_result("std", "FAIL");
+}
+
+static void __init test_ldarx_stdcx(void)
+{
+        struct pt_regs regs;
+        unsigned long a = 0x1234;
+        int stepped = -1;
+        unsigned long cr0_eq = 0x1 << 29; /* eq bit of CR0 */
+
+        init_pt_regs(&regs);
+        asm volatile("mfcr %0" : "=r"(regs.ccr));
+
+
+        /*** ldarx ***/
+
+        regs.gpr[3] = (unsigned long) &a;
+        regs.gpr[4] = 0;
+        regs.gpr[5] = 0x5678;
+
+        /* ldarx r5, r3, r4, 0 */
+        stepped = emulate_step(&regs, TEST_LDARX(5, 3, 4, 0));
+
+        /*
+         * Don't touch 'a' here. Touching 'a' can do Load/store
+         * of 'a' which result in failure of subsequent stdcx.
+         * Instead, use hardcoded value for comparison.
+         */
+        if (stepped <= 0 || regs.gpr[5] != 0x1234) {
+                show_result("ldarx / stdcx.", "FAIL (ldarx)");
+                return;
+        }
+
+
+        /*** stdcx. ***/
+
+        regs.gpr[5] = 0x9ABC;
+
+        /* stdcx. r5, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STDCX(5, 3, 4));
+
+        /*
+         * Two possible scenarios that indicates successful emulation
+         * of stdcx. :
+         *  1. Reservation is active and store is performed. In this
+         *     case cr0.eq bit will be set to 1.
+         *  2. Reservation is not active and store is not performed.
+         *     In this case cr0.eq bit will be set to 0.
+         */
+        if (stepped == 1 && ((regs.gpr[5] == a && (regs.ccr & cr0_eq))
+                        || (regs.gpr[5] != a && !(regs.ccr & cr0_eq))))
+                show_result("ldarx / stdcx.", "PASS");
+        else
+                show_result("ldarx / stdcx.", "FAIL (stdcx.)");
+}
+
+#ifdef CONFIG_PPC_FPU
+static void __init test_lfsx_stfsx(void)
+{
+        struct pt_regs regs;
+        union {
+                float a;
+                int b;
+        } c;
+        int cached_b;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lfsx ***/
+
+        c.a = 123.45;
+        cached_b = c.b;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lfsx frt10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LFSX(10, 3, 4));
+
+        if (stepped == 1)
+                show_result("lfsx", "PASS");
+        else
+                show_result("lfsx", "FAIL");
+
+
+        /*** stfsx ***/
+
+        c.a = 678.91;
+
+        /* stfsx frs10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STFSX(10, 3, 4));
+
+        if (stepped == 1 && c.b == cached_b)
+                show_result("stfsx", "PASS");
+        else
+                show_result("stfsx", "FAIL");
+}
+
+static void __init test_lfdx_stfdx(void)
+{
+        struct pt_regs regs;
+        union {
+                double a;
+                long b;
+        } c;
+        long cached_b;
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lfdx ***/
+
+        c.a = 123456.78;
+        cached_b = c.b;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lfdx frt10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LFDX(10, 3, 4));
+
+        if (stepped == 1)
+                show_result("lfdx", "PASS");
+        else
+                show_result("lfdx", "FAIL");
+
+
+        /*** stfdx ***/
+
+        c.a = 987654.32;
+
+        /* stfdx frs10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STFDX(10, 3, 4));
+
+        if (stepped == 1 && c.b == cached_b)
+                show_result("stfdx", "PASS");
+        else
+                show_result("stfdx", "FAIL");
+}
+#else
+static void __init test_lfsx_stfsx(void)
+{
+        show_result("lfsx", "SKIP (CONFIG_PPC_FPU is not set)");
+        show_result("stfsx", "SKIP (CONFIG_PPC_FPU is not set)");
+}
+
+static void __init test_lfdx_stfdx(void)
+{
+        show_result("lfdx", "SKIP (CONFIG_PPC_FPU is not set)");
+        show_result("stfdx", "SKIP (CONFIG_PPC_FPU is not set)");
+}
+#endif /* CONFIG_PPC_FPU */
+
+#ifdef CONFIG_ALTIVEC
+static void __init test_lvx_stvx(void)
+{
+        struct pt_regs regs;
+        union {
+                vector128 a;
+                u32 b[4];
+        } c;
+        u32 cached_b[4];
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lvx ***/
+
+        cached_b[0] = c.b[0] = 923745;
+        cached_b[1] = c.b[1] = 2139478;
+        cached_b[2] = c.b[2] = 9012;
+        cached_b[3] = c.b[3] = 982134;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lvx vrt10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LVX(10, 3, 4));
+
+        if (stepped == 1)
+                show_result("lvx", "PASS");
+        else
+                show_result("lvx", "FAIL");
+
+
+        /*** stvx ***/
+
+        c.b[0] = 4987513;
+        c.b[1] = 84313948;
+        c.b[2] = 71;
+        c.b[3] = 498532;
+
+        /* stvx vrs10, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STVX(10, 3, 4));
+
+        if (stepped == 1 && cached_b[0] == c.b[0] && cached_b[1] == c.b[1] &&
+            cached_b[2] == c.b[2] && cached_b[3] == c.b[3])
+                show_result("stvx", "PASS");
+        else
+                show_result("stvx", "FAIL");
+}
+#else
+static void __init test_lvx_stvx(void)
+{
+        show_result("lvx", "SKIP (CONFIG_ALTIVEC is not set)");
+        show_result("stvx", "SKIP (CONFIG_ALTIVEC is not set)");
+}
+#endif /* CONFIG_ALTIVEC */
+
+#ifdef CONFIG_VSX
+static void __init test_lxvd2x_stxvd2x(void)
+{
+        struct pt_regs regs;
+        union {
+                vector128 a;
+                u32 b[4];
+        } c;
+        u32 cached_b[4];
+        int stepped = -1;
+
+        init_pt_regs(&regs);
+
+
+        /*** lxvd2x ***/
+
+        cached_b[0] = c.b[0] = 18233;
+        cached_b[1] = c.b[1] = 34863571;
+        cached_b[2] = c.b[2] = 834;
+        cached_b[3] = c.b[3] = 6138911;
+
+        regs.gpr[3] = (unsigned long) &c.a;
+        regs.gpr[4] = 0;
+
+        /* lxvd2x vsr39, r3, r4 */
+        stepped = emulate_step(&regs, TEST_LXVD2X(39, 3, 4));
+
+        if (stepped == 1)
+                show_result("lxvd2x", "PASS");
+        else
+                show_result("lxvd2x", "FAIL");
+
+
+        /*** stxvd2x ***/
+
+        c.b[0] = 21379463;
+        c.b[1] = 87;
+        c.b[2] = 374234;
+        c.b[3] = 4;
+
+        /* stxvd2x vsr39, r3, r4 */
+        stepped = emulate_step(&regs, TEST_STXVD2X(39, 3, 4));
+
+        if (stepped == 1 && cached_b[0] == c.b[0] && cached_b[1] == c.b[1] &&
+            cached_b[2] == c.b[2] && cached_b[3] == c.b[3])
+                show_result("stxvd2x", "PASS");
+        else
+                show_result("stxvd2x", "FAIL");
+}
+#else
+static void __init test_lxvd2x_stxvd2x(void)
+{
+        show_result("lxvd2x", "SKIP (CONFIG_VSX is not set)");
+        show_result("stxvd2x", "SKIP (CONFIG_VSX is not set)");
+}
+#endif /* CONFIG_VSX */
+
+static int __init test_emulate_step(void)
+{
+        test_ld();
+        test_lwz();
+        test_lwzx();
+        test_std();
+        test_ldarx_stdcx();
+        test_lfsx_stfsx();
+        test_lfdx_stfdx();
+        test_lvx_stvx();
+        test_lxvd2x_stxvd2x();
+
+        return 0;
+}
+late_initcall(test_emulate_step);
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index cc332608e656..65bb8f33b399 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -638,6 +638,10 @@ static void native_flush_hash_range(unsigned long number, int local)
         unsigned long psize = batch->psize;
         int ssize = batch->ssize;
         int i;
+        unsigned int use_local;
+
+        use_local = local && mmu_has_feature(MMU_FTR_TLBIEL) &&
+                mmu_psize_defs[psize].tlbiel && !cxl_ctx_in_use();
 
         local_irq_save(flags);
 
@@ -667,8 +671,7 @@ static void native_flush_hash_range(unsigned long number, int local)
                 } pte_iterate_hashed_end();
         }
 
-        if (mmu_has_feature(MMU_FTR_TLBIEL) &&
-            mmu_psize_defs[psize].tlbiel && local) {
+        if (use_local) {
                 asm volatile("ptesync":::"memory");
                 for (i = 0; i < number; i++) {
                         vpn = batch->vpn[i];
diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
index 6aa3b76aa0d6..c22f207aa656 100644
--- a/arch/powerpc/mm/init_64.c
+++ b/arch/powerpc/mm/init_64.c
@@ -356,25 +356,48 @@ static void early_check_vec5(void)
         unsigned long root, chosen;
         int size;
         const u8 *vec5;
+        u8 mmu_supported;
 
         root = of_get_flat_dt_root();
         chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
-        if (chosen == -FDT_ERR_NOTFOUND)
+        if (chosen == -FDT_ERR_NOTFOUND) {
+                cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
                 return;
+        }
         vec5 = of_get_flat_dt_prop(chosen, "ibm,architecture-vec-5", &size);
-        if (!vec5)
+        if (!vec5) {
+                cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
                 return;
-        if (size <= OV5_INDX(OV5_MMU_RADIX_300) ||
-            !(vec5[OV5_INDX(OV5_MMU_RADIX_300)] & OV5_FEAT(OV5_MMU_RADIX_300)))
-                /* Hypervisor doesn't support radix */
+        }
+        if (size <= OV5_INDX(OV5_MMU_SUPPORT)) {
                 cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
+                return;
+        }
+
+        /* Check for supported configuration */
+        mmu_supported = vec5[OV5_INDX(OV5_MMU_SUPPORT)] &
+                        OV5_FEAT(OV5_MMU_SUPPORT);
+        if (mmu_supported == OV5_FEAT(OV5_MMU_RADIX)) {
+                /* Hypervisor only supports radix - check enabled && GTSE */
+                if (!early_radix_enabled()) {
+                        pr_warn("WARNING: Ignoring cmdline option disable_radix\n");
+                }
+                if (!(vec5[OV5_INDX(OV5_RADIX_GTSE)] &
+                                                OV5_FEAT(OV5_RADIX_GTSE))) {
+                        pr_warn("WARNING: Hypervisor doesn't support RADIX with GTSE\n");
+                }
+                /* Do radix anyway - the hypervisor said we had to */
+                cur_cpu_spec->mmu_features |= MMU_FTR_TYPE_RADIX;
+        } else if (mmu_supported == OV5_FEAT(OV5_MMU_HASH)) {
+                /* Hypervisor only supports hash - disable radix */
+                cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
+        }
 }
 
 void __init mmu_early_init_devtree(void)
 {
         /* Disable radix mode based on kernel command line. */
-        /* We don't yet have the machinery to do radix as a guest. */
-        if (disable_radix || !(mfmsr() & MSR_HV))
+        if (disable_radix)
                 cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
 
         /*
@@ -383,7 +406,7 @@ void __init mmu_early_init_devtree(void)
          * even though the ibm,architecture-vec-5 property created by
          * skiboot doesn't have the necessary bits set.
          */
-        if (early_radix_enabled() && !(mfmsr() & MSR_HV))
+        if (!(mfmsr() & MSR_HV))
                 early_check_vec5();
 
         if (early_radix_enabled())
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 2a590a98e652..c28165d8970b 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -186,6 +186,10 @@ static void __init radix_init_pgtable(void)
          */
         register_process_table(__pa(process_tb), 0, PRTB_SIZE_SHIFT - 12);
         pr_info("Process table %p and radix root for kernel: %p\n", process_tb, init_mm.pgd);
+        asm volatile("ptesync" : : : "memory");
+        asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+                     "r" (TLBIEL_INVAL_SET_LPID), "r" (0));
+        asm volatile("eieio; tlbsync; ptesync" : : : "memory");
 }
 
 static void __init radix_init_partition_table(void)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 595dd718ea87..2ff13249f87a 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -188,6 +188,8 @@ static inline void perf_get_data_addr(struct pt_regs *regs, u64 *addrp)
                         sdsync = POWER7P_MMCRA_SDAR_VALID;
                 else if (ppmu->flags & PPMU_ALT_SIPR)
                         sdsync = POWER6_MMCRA_SDSYNC;
+                else if (ppmu->flags & PPMU_NO_SIAR)
+                        sdsync = MMCRA_SAMPLE_ENABLE;
                 else
                         sdsync = MMCRA_SDSYNC;
 
diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
index e79fb5fb817d..cd951fd231c4 100644
--- a/arch/powerpc/perf/isa207-common.c
+++ b/arch/powerpc/perf/isa207-common.c
@@ -65,12 +65,41 @@ static bool is_event_valid(u64 event)
         return !(event & ~valid_mask);
 }
 
-static u64 mmcra_sdar_mode(u64 event)
+static inline bool is_event_marked(u64 event)
 {
-        if (cpu_has_feature(CPU_FTR_ARCH_300) && !cpu_has_feature(CPU_FTR_POWER9_DD1))
-                return p9_SDAR_MODE(event) << MMCRA_SDAR_MODE_SHIFT;
+        if (event & EVENT_IS_MARKED)
+                return true;
+
+        return false;
+}
 
-        return MMCRA_SDAR_MODE_TLB;
+static void mmcra_sdar_mode(u64 event, unsigned long *mmcra)
+{
+        /*
+         * MMCRA[SDAR_MODE] specifices how the SDAR should be updated in
+         * continous sampling mode.
+         *
+         * Incase of Power8:
+         * MMCRA[SDAR_MODE] will be programmed as "0b01" for continous sampling
+         * mode and will be un-changed when setting MMCRA[63] (Marked events).
+         *
+         * Incase of Power9:
+         * Marked event: MMCRA[SDAR_MODE] will be set to 0b00 ('No Updates'),
+         *               or if group already have any marked events.
+         * Non-Marked events (for DD1):
+         *      MMCRA[SDAR_MODE] will be set to 0b01
+         * For rest
+         *      MMCRA[SDAR_MODE] will be set from event code.
+         */
+        if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+                if (is_event_marked(event) || (*mmcra & MMCRA_SAMPLE_ENABLE))
+                        *mmcra &= MMCRA_SDAR_MODE_NO_UPDATES;
+                else if (!cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        *mmcra |=  p9_SDAR_MODE(event) << MMCRA_SDAR_MODE_SHIFT;
+                else if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+                        *mmcra |= MMCRA_SDAR_MODE_TLB;
+        } else
+                *mmcra |= MMCRA_SDAR_MODE_TLB;
 }
 
 static u64 thresh_cmp_val(u64 value)
@@ -180,7 +209,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
                 value |= CNST_L1_QUAL_VAL(cache);
         }
 
-        if (event & EVENT_IS_MARKED) {
+        if (is_event_marked(event)) {
                 mask  |= CNST_SAMPLE_MASK;
                 value |= CNST_SAMPLE_VAL(event >> EVENT_SAMPLE_SHIFT);
         }
@@ -276,7 +305,7 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
                 }
 
                 /* In continuous sampling mode, update SDAR on TLB miss */
-                mmcra |= mmcra_sdar_mode(event[i]);
+                mmcra_sdar_mode(event[i], &mmcra);
 
                 if (event[i] & EVENT_IS_L1) {
                         cache = event[i] >> EVENT_CACHE_SEL_SHIFT;
@@ -285,7 +314,7 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
                         mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT;
                 }
 
-                if (event[i] & EVENT_IS_MARKED) {
+                if (is_event_marked(event[i])) {
                         mmcra |= MMCRA_SAMPLE_ENABLE;
 
                         val = (event[i] >> EVENT_SAMPLE_SHIFT) & EVENT_SAMPLE_MASK;
diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
index cf9bd8990159..899210f14ee4 100644
--- a/arch/powerpc/perf/isa207-common.h
+++ b/arch/powerpc/perf/isa207-common.h
@@ -246,6 +246,7 @@
 #define MMCRA_THR_CMP_SHIFT             32
 #define MMCRA_SDAR_MODE_SHIFT           42
 #define MMCRA_SDAR_MODE_TLB             (1ull << MMCRA_SDAR_MODE_SHIFT)
+#define MMCRA_SDAR_MODE_NO_UPDATES      ~(0x3ull << MMCRA_SDAR_MODE_SHIFT)
 #define MMCRA_IFM_SHIFT                 30
 
 /* MMCR1 Threshold Compare bit constant for power9 */
diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S
index 6693f75e93d1..da8a0f7a035c 100644
--- a/arch/powerpc/platforms/powernv/opal-wrappers.S
+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S
@@ -39,8 +39,8 @@ opal_tracepoint_refcount:
 BEGIN_FTR_SECTION;                                              \
         b       1f;                                             \
 END_FTR_SECTION(0, 1);                                          \
-        ld      r12,opal_tracepoint_refcount@toc(r2);           \
-        cmpdi   r12,0;                                          \
+        ld      r11,opal_tracepoint_refcount@toc(r2);           \
+        cmpdi   r11,0;                                          \
         bne-    LABEL;                                          \
 1:
 
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 86d9fde93c17..e0f856bfbfe8 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -395,7 +395,6 @@ static int opal_recover_mce(struct pt_regs *regs,
                                         struct machine_check_event *evt)
 {
         int recovered = 0;
-        uint64_t ea = get_mce_fault_addr(evt);
 
         if (!(regs->msr & MSR_RI)) {
                 /* If MSR_RI isn't set, we cannot recover */
@@ -404,26 +403,18 @@ static int opal_recover_mce(struct pt_regs *regs,
         } else if (evt->disposition == MCE_DISPOSITION_RECOVERED) {
                 /* Platform corrected itself */
                 recovered = 1;
-        } else if (ea && !is_kernel_addr(ea)) {
+        } else if (evt->severity == MCE_SEV_FATAL) {
+                /* Fatal machine check */
+                pr_err("Machine check interrupt is fatal\n");
+                recovered = 0;
+        } else if ((evt->severity == MCE_SEV_ERROR_SYNC) &&
+                        (user_mode(regs) && !is_global_init(current))) {
                 /*
-                 * Faulting address is not in kernel text. We should be fine.
-                 * We need to find which process uses this address.
                  * For now, kill the task if we have received exception when
                  * in userspace.
                  *
                  * TODO: Queue up this address for hwpoisioning later.
                  */
-                if (user_mode(regs) && !is_global_init(current)) {
-                        _exception(SIGBUS, regs, BUS_MCEERR_AR, regs->nip);
-                        recovered = 1;
-                } else
-                        recovered = 0;
-        } else if (user_mode(regs) && !is_global_init(current) &&
-                evt->severity == MCE_SEV_ERROR_SYNC) {
-                /*
-                 * If we have received a synchronous error when in userspace
-                 * kill the task.
-                 */
                 _exception(SIGBUS, regs, BUS_MCEERR_AR, regs->nip);
                 recovered = 1;
         }
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 6901a06da2f9..e36738291c32 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -1775,17 +1775,20 @@ static u64 pnv_pci_ioda_dma_get_required_mask(struct pci_dev *pdev)
 }
 
 static void pnv_ioda_setup_bus_dma(struct pnv_ioda_pe *pe,
-                                   struct pci_bus *bus)
+                                   struct pci_bus *bus,
+                                   bool add_to_group)
 {
         struct pci_dev *dev;
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 set_iommu_table_base(&dev->dev, pe->table_group.tables[0]);
                 set_dma_offset(&dev->dev, pe->tce_bypass_base);
-                iommu_add_device(&dev->dev);
+                if (add_to_group)
+                        iommu_add_device(&dev->dev);
 
                 if ((pe->flags & PNV_IODA_PE_BUS_ALL) && dev->subordinate)
-                        pnv_ioda_setup_bus_dma(pe, dev->subordinate);
+                        pnv_ioda_setup_bus_dma(pe, dev->subordinate,
+                                        add_to_group);
         }
 }
 
@@ -2191,7 +2194,7 @@ found:
                 set_iommu_table_base(&pe->pdev->dev, tbl);
                 iommu_add_device(&pe->pdev->dev);
         } else if (pe->flags & (PNV_IODA_PE_BUS | PNV_IODA_PE_BUS_ALL))
-                pnv_ioda_setup_bus_dma(pe, pe->pbus);
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, true);
 
         return;
  fail:
@@ -2426,6 +2429,8 @@ static void pnv_ioda2_take_ownership(struct iommu_table_group *table_group)
 
         pnv_pci_ioda2_set_bypass(pe, false);
         pnv_pci_ioda2_unset_window(&pe->table_group, 0);
+        if (pe->pbus)
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, false);
         pnv_ioda2_table_free(tbl);
 }
 
@@ -2435,6 +2440,8 @@ static void pnv_ioda2_release_ownership(struct iommu_table_group *table_group)
                                                 table_group);
 
         pnv_pci_ioda2_setup_default_config(pe);
+        if (pe->pbus)
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, false);
 }
 
 static struct iommu_table_group_ops pnv_pci_ioda2_ops = {
@@ -2624,6 +2631,9 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
         level_shift = entries_shift + 3;
         level_shift = max_t(unsigned, level_shift, PAGE_SHIFT);
 
+        if ((level_shift - 3) * levels + page_shift >= 60)
+                return -EINVAL;
+
         /* Allocate TCE table */
         addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
                         levels, tce_table_size, &offset, &total_allocated);
@@ -2728,7 +2738,7 @@ static void pnv_pci_ioda2_setup_dma_pe(struct pnv_phb *phb,
         if (pe->flags & PNV_IODA_PE_DEV)
                 iommu_add_device(&pe->pdev->dev);
         else if (pe->flags & (PNV_IODA_PE_BUS | PNV_IODA_PE_BUS_ALL))
-                pnv_ioda_setup_bus_dma(pe, pe->pbus);
+                pnv_ioda_setup_bus_dma(pe, pe->pbus, true);
 }
 
 #ifdef CONFIG_PCI_MSI
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 251060cf1713..8b1fe895daa3 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -751,7 +751,9 @@ void __init hpte_init_pseries(void)
         mmu_hash_ops.flush_hash_range    = pSeries_lpar_flush_hash_range;
         mmu_hash_ops.hpte_clear_all      = pseries_hpte_clear_all;
         mmu_hash_ops.hugepage_invalidate = pSeries_lpar_hugepage_invalidate;
-        mmu_hash_ops.resize_hpt          = pseries_lpar_resize_hpt;
+
+        if (firmware_has_feature(FW_FEATURE_HPT_RESIZE))
+                mmu_hash_ops.resize_hpt = pseries_lpar_resize_hpt;
 }
 
 void radix_init_pseries(void)
diff --git a/arch/powerpc/purgatory/trampoline.S b/arch/powerpc/purgatory/trampoline.S
index f9760ccf4032..3696ea6c4826 100644
--- a/arch/powerpc/purgatory/trampoline.S
+++ b/arch/powerpc/purgatory/trampoline.S
@@ -116,13 +116,13 @@ dt_offset:
 
         .data
         .balign 8
-.globl sha256_digest
-sha256_digest:
+.globl purgatory_sha256_digest
+purgatory_sha256_digest:
         .skip   32
-        .size sha256_digest, . - sha256_digest
+        .size purgatory_sha256_digest, . - purgatory_sha256_digest
 
         .balign 8
-.globl sha_regions
-sha_regions:
+.globl purgatory_sha_regions
+purgatory_sha_regions:
         .skip   8 * 2 * 16
-        .size sha_regions, . - sha_regions
+        .size purgatory_sha_regions, . - purgatory_sha_regions
diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c
index ada29eaed6e2..f523ac883150 100644
--- a/arch/powerpc/sysdev/axonram.c
+++ b/arch/powerpc/sysdev/axonram.c
@@ -274,7 +274,9 @@ failed:
                         if (bank->disk->major > 0)
                                 unregister_blkdev(bank->disk->major,
                                                 bank->disk->disk_name);
-                        del_gendisk(bank->disk);
+                        if (bank->disk->flags & GENHD_FL_UP)
+                                del_gendisk(bank->disk);
+                        put_disk(bank->disk);
                 }
                 device->dev.platform_data = NULL;
                 if (bank->io_addr != 0)
@@ -299,6 +301,7 @@ axon_ram_remove(struct platform_device *device)
         device_remove_file(&device->dev, &dev_attr_ecc);
         free_irq(bank->irq_id, device);
         del_gendisk(bank->disk);
+        put_disk(bank->disk);
         iounmap((void __iomem *) bank->io_addr);
         kfree(bank);
 
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index f9670eabfcfa..b53f80f0b4d8 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -91,6 +91,16 @@ static unsigned int icp_opal_get_irq(void)
 
 static void icp_opal_set_cpu_priority(unsigned char cppr)
 {
+        /*
+         * Here be dragons. The caller has asked to allow only IPI's and not
+         * external interrupts. But OPAL XIVE doesn't support that. So instead
+         * of allowing no interrupts allow all. That's still not right, but
+         * currently the only caller who does this is xics_migrate_irqs_away()
+         * and it works in that case.
+         */
+        if (cppr >= DEFAULT_PRIORITY)
+                cppr = LOWEST_PRIORITY;
+
         xics_set_base_cppr(cppr);
         opal_int_set_cppr(cppr);
         iosync();
diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c
index 69d858e51ac7..23efe4e42172 100644
--- a/arch/powerpc/sysdev/xics/xics-common.c
+++ b/arch/powerpc/sysdev/xics/xics-common.c
@@ -20,6 +20,7 @@
 #include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
+#include <linux/delay.h>
 
 #include <asm/prom.h>
 #include <asm/io.h>
@@ -198,9 +199,6 @@ void xics_migrate_irqs_away(void)
         /* Remove ourselves from the global interrupt queue */
         xics_set_cpu_giq(xics_default_distrib_server, 0);
 
-        /* Allow IPIs again... */
-        icp_ops->set_priority(DEFAULT_PRIORITY);
-
         for_each_irq_desc(virq, desc) {
                 struct irq_chip *chip;
                 long server;
@@ -255,6 +253,19 @@ void xics_migrate_irqs_away(void)
 unlock:
                 raw_spin_unlock_irqrestore(&desc->lock, flags);
         }
+
+        /* Allow "sufficient" time to drop any inflight IRQ's */
+        mdelay(5);
+
+        /*
+         * Allow IPIs again. This is done at the very end, after migrating all
+         * interrupts, the expectation is that we'll only get woken up by an IPI
+         * interrupt beyond this point, but leave externals masked just to be
+         * safe. If we're using icp-opal this may actually allow all
+         * interrupts anyway, but that should be OK.
+         */
+        icp_ops->set_priority(DEFAULT_PRIORITY);
+
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index fa95041fa9f6..33ca29333e18 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -141,31 +141,34 @@ static void check_ipl_parmblock(void *start, unsigned long size)
 
 unsigned long decompress_kernel(void)
 {
-        unsigned long output_addr;
-        unsigned char *output;
+        void *output, *kernel_end;
 
-        output_addr = ((unsigned long) &_end + HEAP_SIZE + 4095UL) & -4096UL;
-        check_ipl_parmblock((void *) 0, output_addr + SZ__bss_start);
-        memset(&_bss, 0, &_ebss - &_bss);
-        free_mem_ptr = (unsigned long)&_end;
-        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
-        output = (unsigned char *) output_addr;
+        output = (void *) ALIGN((unsigned long) &_end + HEAP_SIZE, PAGE_SIZE);
+        kernel_end = output + SZ__bss_start;
+        check_ipl_parmblock((void *) 0, (unsigned long) kernel_end);
 
 #ifdef CONFIG_BLK_DEV_INITRD
         /*
          * Move the initrd right behind the end of the decompressed
-         * kernel image.
+         * kernel image. This also prevents initrd corruption caused by
+         * bss clearing since kernel_end will always be located behind the
+         * current bss section..
          */
-        if (INITRD_START && INITRD_SIZE &&
-            INITRD_START < (unsigned long) output + SZ__bss_start) {
-                check_ipl_parmblock(output + SZ__bss_start,
-                                    INITRD_START + INITRD_SIZE);
-                memmove(output + SZ__bss_start,
-                        (void *) INITRD_START, INITRD_SIZE);
-                INITRD_START = (unsigned long) output + SZ__bss_start;
+        if (INITRD_START && INITRD_SIZE && kernel_end > (void *) INITRD_START) {
+                check_ipl_parmblock(kernel_end, INITRD_SIZE);
+                memmove(kernel_end, (void *) INITRD_START, INITRD_SIZE);
+                INITRD_START = (unsigned long) kernel_end;
         }
 #endif
 
+        /*
+         * Clear bss section. free_mem_ptr and free_mem_end_ptr need to be
+         * initialized afterwards since they reside in bss.
+         */
+        memset(&_bss, 0, &_ebss - &_bss);
+        free_mem_ptr = (unsigned long) &_end;
+        free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
+
         puts("Uncompressing Linux... ");
         __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);
         puts("Ok, booting the kernel.\n");
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 143b1e00b818..4b176fe83da4 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -609,7 +609,7 @@ CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index f05d2d6e1087..0de46cc397f6 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -560,7 +560,7 @@ CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 2358bf33c5ef..e167557b434c 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -558,7 +558,7 @@ CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index d69ea495c4d7..716b17238599 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -474,8 +474,11 @@ static int ctr_paes_crypt(struct blkcipher_desc *desc, unsigned long modifier,
                         ret = blkcipher_walk_done(desc, walk, nbytes - n);
                 }
                 if (k < n) {
-                        if (__ctr_paes_set_key(ctx) != 0)
+                        if (__ctr_paes_set_key(ctx) != 0) {
+                                if (locked)
+                                        spin_unlock(&ctrblk_lock);
                                 return blkcipher_walk_done(desc, walk, -EIO);
+                        }
                 }
         }
         if (locked)
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 68bfd09f1b02..97189dbaf34b 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -179,7 +179,7 @@ CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENT=y
+CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
diff --git a/arch/s390/include/asm/cputime.h b/arch/s390/include/asm/cputime.h
index d1c407ddf703..9072bf63a846 100644
--- a/arch/s390/include/asm/cputime.h
+++ b/arch/s390/include/asm/cputime.h
@@ -8,31 +8,27 @@
 #define _S390_CPUTIME_H
 
 #include <linux/types.h>
-#include <asm/div64.h>
+#include <asm/timex.h>
 
 #define CPUTIME_PER_USEC 4096ULL
 #define CPUTIME_PER_SEC (CPUTIME_PER_USEC * USEC_PER_SEC)
 
 /* We want to use full resolution of the CPU timer: 2**-12 micro-seconds. */
 
-typedef unsigned long long __nocast cputime_t;
-typedef unsigned long long __nocast cputime64_t;
-
 #define cmpxchg_cputime(ptr, old, new) cmpxchg64(ptr, old, new)
 
-static inline unsigned long __div(unsigned long long n, unsigned long base)
-{
-        return n / base;
-}
-
 /*
- * Convert cputime to microseconds and back.
+ * Convert cputime to microseconds.
  */
-static inline unsigned int cputime_to_usecs(const cputime_t cputime)
+static inline u64 cputime_to_usecs(const u64 cputime)
 {
-        return (__force unsigned long long) cputime >> 12;
+        return cputime >> 12;
 }
 
+/*
+ * Convert cputime to nanoseconds.
+ */
+#define cputime_to_nsecs(cputime) tod_to_ns(cputime)
 
 u64 arch_cpu_idle_time(int cpu);
 
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 7ed1972b1920..ecec682bb516 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -24,6 +24,7 @@
  * the S390 page table tree.
  */
 #ifndef __ASSEMBLY__
+#include <asm-generic/5level-fixup.h>
 #include <linux/sched.h>
 #include <linux/mm_types.h>
 #include <linux/page-flags.h>
@@ -1050,6 +1051,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 {
         if (!MACHINE_HAS_NX)
                 pte_val(entry) &= ~_PAGE_NOEXEC;
+        if (pte_present(entry))
+                pte_val(entry) &= ~_PAGE_UNUSED;
         if (mm_has_pgste(mm))
                 ptep_set_pte_at(mm, addr, ptep, entry);
         else
diff --git a/arch/s390/include/asm/sections.h b/arch/s390/include/asm/sections.h
index 5ce29fe100ba..fbd9116eb17b 100644
--- a/arch/s390/include/asm/sections.h
+++ b/arch/s390/include/asm/sections.h
@@ -4,6 +4,5 @@
 #include <asm-generic/sections.h>
 
 extern char _eshared[], _ehead[];
-extern char __start_ro_after_init[], __end_ro_after_init[];
 
 #endif
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index 354344dcc198..118535123f34 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -206,20 +206,16 @@ static inline unsigned long long get_tod_clock_monotonic(void)
  *    ns = (todval * 125) >> 9;
  *
  * In order to avoid an overflow with the multiplication we can rewrite this.
- * With a split todval == 2^32 * th + tl (th upper 32 bits, tl lower 32 bits)
+ * With a split todval == 2^9 * th + tl (th upper 55 bits, tl lower 9 bits)
  * we end up with
  *
- *    ns = ((2^32 * th + tl) * 125 ) >> 9;
- * -> ns = (2^23 * th * 125) + ((tl * 125) >> 9);
+ *    ns = ((2^9 * th + tl) * 125 ) >> 9;
+ * -> ns = (th * 125) + ((tl * 125) >> 9);
  *
  */
 static inline unsigned long long tod_to_ns(unsigned long long todval)
 {
-        unsigned long long ns;
-
-        ns = ((todval >> 32) << 23) * 125;
-        ns += ((todval & 0xffffffff) * 125) >> 9;
-        return ns;
+        return ((todval >> 9) * 125) + (((todval & 0x1ff) * 125) >> 9);
 }
 
 #endif
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 136932ff4250..3ea1554d04b3 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -147,7 +147,7 @@ unsigned long __must_check __copy_to_user(void __user *to, const void *from,
                 "       jg      2b\n"                           \
                 ".popsection\n"                                 \
                 EX_TABLE(0b,3b) EX_TABLE(1b,3b)                 \
-                : "=d" (__rc), "=Q" (*(to))                     \
+                : "=d" (__rc), "+Q" (*(to))                     \
                 : "d" (size), "Q" (*(from)),                    \
                   "d" (__reg0), "K" (-EFAULT)                   \
                 : "cc");                                        \
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 4384bc797a54..152de9b796e1 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -313,7 +313,9 @@
 #define __NR_copy_file_range    375
 #define __NR_preadv2            376
 #define __NR_pwritev2           377
-#define NR_syscalls 378
+/* Number 378 is reserved for guarded storage */
+#define __NR_statx              379
+#define NR_syscalls 380
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index ae2cda5eee5a..e89cc2e71db1 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -178,3 +178,4 @@ COMPAT_SYSCALL_WRAP3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
 COMPAT_SYSCALL_WRAP6(sendto, int, fd, void __user *, buff, size_t, len, unsigned int, flags, struct sockaddr __user *, addr, int, addr_len);
 COMPAT_SYSCALL_WRAP3(mlock2, unsigned long, start, size_t, len, int, flags);
 COMPAT_SYSCALL_WRAP6(copy_file_range, int, fd_in, loff_t __user *, off_in, int, fd_out, loff_t __user *, off_out, size_t, len, unsigned int, flags);
+COMPAT_SYSCALL_WRAP5(statx, int, dfd, const char __user *, path, unsigned, flags, unsigned, mask, struct statx __user *, buffer);
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index dff2152350a7..6a7d737d514c 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -490,7 +490,7 @@ ENTRY(pgm_check_handler)
         jnz     .Lpgm_svcper            # -> single stepped svc
 1:      CHECK_STACK STACK_SIZE,__LC_SAVE_AREA_SYNC
         aghi    %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
-        j       3f
+        j       4f
 2:      UPDATE_VTIME %r14,%r15,__LC_SYNC_ENTER_TIMER
         lg      %r15,__LC_KERNEL_STACK
         lgr     %r14,%r12
@@ -499,8 +499,8 @@ ENTRY(pgm_check_handler)
         tm      __LC_PGM_ILC+2,0x02     # check for transaction abort
         jz      3f
         mvc     __THREAD_trap_tdb(256,%r14),0(%r13)
-3:      la      %r11,STACK_FRAME_OVERHEAD(%r15)
-        stg     %r10,__THREAD_last_break(%r14)
+3:      stg     %r10,__THREAD_last_break(%r14)
+4:      la      %r11,STACK_FRAME_OVERHEAD(%r15)
         stmg    %r0,%r7,__PT_R0(%r11)
         mvc     __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
         stmg    %r8,%r9,__PT_PSW(%r11)
@@ -509,14 +509,14 @@ ENTRY(pgm_check_handler)
         xc      __PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
         stg     %r10,__PT_ARGS(%r11)
         tm      __LC_PGM_ILC+3,0x80     # check for per exception
-        jz      4f
+        jz      5f
         tmhh    %r8,0x0001              # kernel per event ?
         jz      .Lpgm_kprobe
         oi      __PT_FLAGS+7(%r11),_PIF_PER_TRAP
         mvc     __THREAD_per_address(8,%r14),__LC_PER_ADDRESS
         mvc     __THREAD_per_cause(2,%r14),__LC_PER_CODE
         mvc     __THREAD_per_paid(1,%r14),__LC_PER_ACCESS_ID
-4:      REENABLE_IRQS
+5:      REENABLE_IRQS
         xc      __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
         larl    %r1,pgm_check_table
         llgh    %r10,__PT_INT_CODE+2(%r11)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index b67dafb7b7cf..e545ffe5155a 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -564,6 +564,8 @@ static struct kset *ipl_kset;
 
 static void __ipl_run(void *unused)
 {
+        if (MACHINE_IS_LPAR && ipl_info.type == IPL_TYPE_CCW)
+                diag308(DIAG308_LOAD_NORMAL_DUMP, NULL);
         diag308(DIAG308_LOAD_CLEAR, NULL);
         if (MACHINE_IS_VM)
                 __cpcmd("IPL", NULL, 0, NULL);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 20cd339e11ae..f29e41c5e2ec 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -124,7 +124,10 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long new_stackp,
         clear_tsk_thread_flag(p, TIF_SINGLE_STEP);
         /* Initialize per thread user and system timer values */
         p->thread.user_timer = 0;
+        p->thread.guest_timer = 0;
         p->thread.system_timer = 0;
+        p->thread.hardirq_timer = 0;
+        p->thread.softirq_timer = 0;
 
         frame->sf.back_chain = 0;
         /* new return point is ret_from_fork */
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 47a973b5b4f1..5dab859b0d54 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -909,13 +909,11 @@ void __init smp_prepare_boot_cpu(void)
 {
         struct pcpu *pcpu = pcpu_devices;
 
+        WARN_ON(!cpu_present(0) || !cpu_online(0));
         pcpu->state = CPU_STATE_CONFIGURED;
-        pcpu->address = stap();
         pcpu->lowcore = (struct lowcore *)(unsigned long) store_prefix();
         S390_lowcore.percpu_offset = __per_cpu_offset[0];
         smp_cpu_set_polarization(0, POLARIZATION_UNKNOWN);
-        set_cpu_present(0, true);
-        set_cpu_online(0, true);
 }
 
 void __init smp_cpus_done(unsigned int max_cpus)
@@ -924,6 +922,7 @@ void __init smp_cpus_done(unsigned int max_cpus)
 
 void __init smp_setup_processor_id(void)
 {
+        pcpu_devices[0].address = stap();
         S390_lowcore.cpu_nr = 0;
         S390_lowcore.spinlock_lockval = arch_spin_lockval(0);
 }
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 9b59e6212d8f..2659b5cfeddb 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -386,3 +386,5 @@ SYSCALL(sys_mlock2,compat_sys_mlock2)
 SYSCALL(sys_copy_file_range,compat_sys_copy_file_range) /* 375 */
 SYSCALL(sys_preadv2,compat_sys_preadv2)
 SYSCALL(sys_pwritev2,compat_sys_pwritev2)
+NI_SYSCALL
+SYSCALL(sys_statx,compat_sys_statx)
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 5ccf95396251..72307f108c40 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -63,11 +63,9 @@ SECTIONS
 
         . = ALIGN(PAGE_SIZE);
         __start_ro_after_init = .;
-        __start_data_ro_after_init = .;
         .data..ro_after_init : {
                  *(.data..ro_after_init)
         }
-        __end_data_ro_after_init = .;
         EXCEPTION_TABLE(16)
         . = ALIGN(PAGE_SIZE);
         __end_ro_after_init = .;
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index c14fc9029912..072d84ba42a3 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -111,7 +111,7 @@ static inline u64 scale_vtime(u64 vtime)
 }
 
 static void account_system_index_scaled(struct task_struct *p,
-                                        cputime_t cputime, cputime_t scaled,
+                                        u64 cputime, u64 scaled,
                                         enum cpu_usage_stat index)
 {
         p->stimescaled += cputime_to_nsecs(scaled);
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index d55c829a5944..ddbffb715b40 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -168,8 +168,7 @@ union page_table_entry {
                 unsigned long z  : 1; /* Zero Bit */
                 unsigned long i  : 1; /* Page-Invalid Bit */
                 unsigned long p  : 1; /* DAT-Protection Bit */
-                unsigned long co : 1; /* Change-Recording Override */
-                unsigned long    : 8;
+                unsigned long    : 9;
         };
 };
 
@@ -745,8 +744,6 @@ static unsigned long guest_translate(struct kvm_vcpu *vcpu, unsigned long gva,
                 return PGM_PAGE_TRANSLATION;
         if (pte.z)
                 return PGM_TRANSLATION_SPEC;
-        if (pte.co && !edat1)
-                return PGM_TRANSLATION_SPEC;
         dat_protection |= pte.p;
         raddr.pfra = pte.pfra;
 real_address:
@@ -1182,7 +1179,7 @@ int kvm_s390_shadow_fault(struct kvm_vcpu *vcpu, struct gmap *sg,
                 rc = gmap_read_table(sg->parent, pgt + vaddr.px * 8, &pte.val);
         if (!rc && pte.i)
                 rc = PGM_PAGE_TRANSLATION;
-        if (!rc && (pte.z || (pte.co && sg->edat_level < 1)))
+        if (!rc && pte.z)
                 rc = PGM_TRANSLATION_SPEC;
 shadow_page:
         pte.p |= dat_protection;
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index b48dc5f1900b..463e5ef02304 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -608,12 +608,29 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long addr)
 {
         spinlock_t *ptl;
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
         pgste_t pgste;
         pte_t *ptep;
         pte_t pte;
         bool dirty;
 
-        ptep = get_locked_pte(mm, addr, &ptl);
+        pgd = pgd_offset(mm, addr);
+        pud = pud_alloc(mm, pgd, addr);
+        if (!pud)
+                return false;
+        pmd = pmd_alloc(mm, pud, addr);
+        if (!pmd)
+                return false;
+        /* We can't run guests backed by huge pages, but userspace can
+         * still set them up and then try to migrate them without any
+         * migration support.
+         */
+        if (pmd_large(*pmd))
+                return true;
+
+        ptep = pte_alloc_map_lock(mm, pmd, addr, &ptl);
         if (unlikely(!ptep))
                 return false;
 
diff --git a/arch/score/include/asm/pgtable.h b/arch/score/include/asm/pgtable.h
index 0553e5cd5985..46ff8fd678a7 100644
--- a/arch/score/include/asm/pgtable.h
+++ b/arch/score/include/asm/pgtable.h
@@ -2,6 +2,7 @@
 #define _ASM_SCORE_PGTABLE_H
 
 #include <linux/const.h>
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 #include <asm/fixmap.h>
diff --git a/arch/score/kernel/traps.c b/arch/score/kernel/traps.c
index e359ec675869..12daf45369b4 100644
--- a/arch/score/kernel/traps.c
+++ b/arch/score/kernel/traps.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/extable.h>
+#include <linux/ptrace.h>
 #include <linux/sched/mm.h>
 #include <linux/sched/signal.h>
 #include <linux/sched/debug.h>
diff --git a/arch/score/mm/extable.c b/arch/score/mm/extable.c
index ec871355fc2d..6736a3ad6286 100644
--- a/arch/score/mm/extable.c
+++ b/arch/score/mm/extable.c
@@ -24,6 +24,8 @@
  */
 
 #include <linux/extable.h>
+#include <linux/ptrace.h>
+#include <asm/extable.h>
 
 int fixup_exception(struct pt_regs *regs)
 {
diff --git a/arch/sh/boards/mach-cayman/setup.c b/arch/sh/boards/mach-cayman/setup.c
index 340fd40b381d..9c292c27e0d7 100644
--- a/arch/sh/boards/mach-cayman/setup.c
+++ b/arch/sh/boards/mach-cayman/setup.c
@@ -128,7 +128,6 @@ static int __init smsc_superio_setup(void)
         SMSC_SUPERIO_WRITE_INDEXED(1, SMSC_PRIMARY_INT_INDEX);
         SMSC_SUPERIO_WRITE_INDEXED(12, SMSC_SECONDARY_INT_INDEX);
 
-#ifdef CONFIG_IDE
         /*
          * Only IDE1 exists on the Cayman
          */
@@ -158,7 +157,6 @@ static int __init smsc_superio_setup(void)
         SMSC_SUPERIO_WRITE_INDEXED(0x01, 0xc5); /* GP45 = IDE1_IRQ */
         SMSC_SUPERIO_WRITE_INDEXED(0x00, 0xc6); /* GP46 = nIOROP */
         SMSC_SUPERIO_WRITE_INDEXED(0x00, 0xc7); /* GP47 = nIOWOP */
-#endif
 
         /* Exit the configuration state */
         outb(SMSC_EXIT_CONFIG_KEY, SMSC_CONFIG_PORT_ADDR);
diff --git a/arch/sh/include/asm/pgtable-2level.h b/arch/sh/include/asm/pgtable-2level.h
index 19bd89db17e7..f75cf4387257 100644
--- a/arch/sh/include/asm/pgtable-2level.h
+++ b/arch/sh/include/asm/pgtable-2level.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_PGTABLE_2LEVEL_H
 #define __ASM_SH_PGTABLE_2LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /*
diff --git a/arch/sh/include/asm/pgtable-3level.h b/arch/sh/include/asm/pgtable-3level.h
index 249a985d9648..9b1e776eca31 100644
--- a/arch/sh/include/asm/pgtable-3level.h
+++ b/arch/sh/include/asm/pgtable-3level.h
@@ -1,6 +1,7 @@
 #ifndef __ASM_SH_PGTABLE_3LEVEL_H
 #define __ASM_SH_PGTABLE_3LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 /*
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 68ac5c7cd982..a59deaef21e5 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -43,7 +43,7 @@ config SPARC
         select ARCH_HAS_SG_CHAIN
         select CPU_NO_EFFICIENT_FFS
         select HAVE_ARCH_HARDENED_USERCOPY
-        select PROVE_LOCKING_SMALL if PROVE_LOCKING
+        select LOCKDEP_SMALL if LOCKDEP
         select ARCH_WANT_RELAX_ORDER
 
 config SPARC32
diff --git a/arch/sparc/include/asm/page_64.h b/arch/sparc/include/asm/page_64.h
index f294dd42fc7d..5961b2d8398a 100644
--- a/arch/sparc/include/asm/page_64.h
+++ b/arch/sparc/include/asm/page_64.h
@@ -17,6 +17,7 @@
 
 #define HPAGE_SHIFT             23
 #define REAL_HPAGE_SHIFT        22
+#define HPAGE_2GB_SHIFT         31
 #define HPAGE_256MB_SHIFT       28
 #define HPAGE_64K_SHIFT         16
 #define REAL_HPAGE_SIZE         (_AC(1,UL) << REAL_HPAGE_SHIFT)
@@ -27,7 +28,7 @@
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 #define REAL_HPAGE_PER_HPAGE    (_AC(1,UL) << (HPAGE_SHIFT - REAL_HPAGE_SHIFT))
-#define HUGE_MAX_HSTATE         3
+#define HUGE_MAX_HSTATE         4
 #endif
 
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index 56e49c8f770d..6fbd931f0570 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -12,6 +12,7 @@
  * the SpitFire page tables.
  */
 
+#include <asm-generic/5level-fixup.h>
 #include <linux/compiler.h>
 #include <linux/const.h>
 #include <asm/types.h>
@@ -678,26 +679,27 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
         return pte_pfn(pte);
 }
 
-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-static inline unsigned long pmd_dirty(pmd_t pmd)
+#define __HAVE_ARCH_PMD_WRITE
+static inline unsigned long pmd_write(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_dirty(pte);
+        return pte_write(pte);
 }
 
-static inline unsigned long pmd_young(pmd_t pmd)
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+static inline unsigned long pmd_dirty(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_young(pte);
+        return pte_dirty(pte);
 }
 
-static inline unsigned long pmd_write(pmd_t pmd)
+static inline unsigned long pmd_young(pmd_t pmd)
 {
         pte_t pte = __pte(pmd_val(pmd));
 
-        return pte_write(pte);
+        return pte_young(pte);
 }
 
 static inline unsigned long pmd_trans_huge(pmd_t pmd)
diff --git a/arch/sparc/include/asm/processor_32.h b/arch/sparc/include/asm/processor_32.h
index 365d4cb267b4..dd27159819eb 100644
--- a/arch/sparc/include/asm/processor_32.h
+++ b/arch/sparc/include/asm/processor_32.h
@@ -18,12 +18,6 @@
 #include <asm/signal.h>
 #include <asm/page.h>
 
-/*
- * The sparc has no problems with write protection
- */
-#define wp_works_ok 1
-#define wp_works_ok__is_a_macro /* for versions in ksyms.c */
-
 /* Whee, this is STACK_TOP + PAGE_SIZE and the lowest kernel address too...
  * That one page is used to protect kernel from intruders, so that
  * we can make our access_ok test faster
diff --git a/arch/sparc/include/asm/processor_64.h b/arch/sparc/include/asm/processor_64.h
index 6448cfc8292f..b58ee9018433 100644
--- a/arch/sparc/include/asm/processor_64.h
+++ b/arch/sparc/include/asm/processor_64.h
@@ -18,10 +18,6 @@
 #include <asm/ptrace.h>
 #include <asm/page.h>
 
-/* The sparc has no problems with write protection */
-#define wp_works_ok 1
-#define wp_works_ok__is_a_macro /* for versions in ksyms.c */
-
 /*
  * User lives in his very own context, and cannot reference us. Note
  * that TASK_SIZE is a misnomer, it really gives maximum user virtual
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 6aa3da152c20..44101196d02b 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -96,6 +96,7 @@ sparc64_boot:
         andn    %g1, PSTATE_AM, %g1
         wrpr    %g1, 0x0, %pstate
         ba,a,pt %xcc, 1f
+         nop
 
         .globl  prom_finddev_name, prom_chosen_path, prom_root_node
         .globl  prom_getprop_name, prom_mmu_name, prom_peer_name
@@ -613,6 +614,7 @@ niagara_tlb_fixup:
          nop
 
         ba,a,pt %xcc, 80f
+         nop
 niagara4_patch:
         call    niagara4_patch_copyops
          nop
@@ -622,6 +624,7 @@ niagara4_patch:
          nop
 
         ba,a,pt %xcc, 80f
+         nop
 
 niagara2_patch:
         call    niagara2_patch_copyops
@@ -632,6 +635,7 @@ niagara2_patch:
          nop
 
         ba,a,pt %xcc, 80f
+         nop
 
 niagara_patch:
         call    niagara_patch_copyops
diff --git a/arch/sparc/kernel/misctrap.S b/arch/sparc/kernel/misctrap.S
index 34b4933900bf..9276d2f0dd86 100644
--- a/arch/sparc/kernel/misctrap.S
+++ b/arch/sparc/kernel/misctrap.S
@@ -82,6 +82,7 @@ do_stdfmna:
         call            handle_stdfmna
          add            %sp, PTREGS_OFF, %o0
         ba,a,pt         %xcc, rtrap
+         nop
         .size           do_stdfmna,.-do_stdfmna
 
         .type           breakpoint_trap,#function
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index df9e731a76f5..fc5124ccdb53 100644
--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -351,7 +351,7 @@ static int genregs64_set(struct task_struct *target,
         }
 
         if (!ret) {
-                unsigned long y;
+                unsigned long y = regs->y;
 
                 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                          &y,
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index 216948ca4382..709a82ebd294 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -237,6 +237,7 @@ rt_continue:	ldx			[%sp + PTREGS_OFF + PT_V9_G1], %g1
                 bne,pt                  %xcc, user_rtt_fill_32bit
                  wrpr                   %g1, %cwp
                 ba,a,pt                 %xcc, user_rtt_fill_64bit
+                 nop
 
 user_rtt_fill_fixup_dax:
                 ba,pt   %xcc, user_rtt_fill_fixup_common
diff --git a/arch/sparc/kernel/spiterrs.S b/arch/sparc/kernel/spiterrs.S
index 4a73009f66a5..d7e540842809 100644
--- a/arch/sparc/kernel/spiterrs.S
+++ b/arch/sparc/kernel/spiterrs.S
@@ -86,6 +86,7 @@ __spitfire_cee_trap_continue:
          rd             %pc, %g7
 
         ba,a,pt         %xcc, 2f
+         nop
 
 1:      ba,pt           %xcc, etrap_irq
          rd             %pc, %g7
diff --git a/arch/sparc/kernel/sun4v_tlb_miss.S b/arch/sparc/kernel/sun4v_tlb_miss.S
index 6179e19bc9b9..c19f352f46c7 100644
--- a/arch/sparc/kernel/sun4v_tlb_miss.S
+++ b/arch/sparc/kernel/sun4v_tlb_miss.S
@@ -352,6 +352,7 @@ sun4v_mna:
         call    sun4v_do_mna
          add    %sp, PTREGS_OFF, %o0
         ba,a,pt %xcc, rtrap
+         nop
 
         /* Privileged Action.  */
 sun4v_privact:
diff --git a/arch/sparc/kernel/urtt_fill.S b/arch/sparc/kernel/urtt_fill.S
index 5604a2b051d4..364af3250646 100644
--- a/arch/sparc/kernel/urtt_fill.S
+++ b/arch/sparc/kernel/urtt_fill.S
@@ -92,6 +92,7 @@ user_rtt_fill_fixup_common:
                 call    sun4v_data_access_exception
                  nop
                 ba,a,pt %xcc, rtrap
+                 nop
 
 1:              call    spitfire_data_access_exception
                  nop
diff --git a/arch/sparc/kernel/winfixup.S b/arch/sparc/kernel/winfixup.S
index 855019a8590e..1ee173cc3c39 100644
--- a/arch/sparc/kernel/winfixup.S
+++ b/arch/sparc/kernel/winfixup.S
@@ -152,6 +152,8 @@ fill_fixup_dax:
         call    sun4v_data_access_exception
          nop
         ba,a,pt %xcc, rtrap
+         nop
 1:      call    spitfire_data_access_exception
          nop
         ba,a,pt %xcc, rtrap
+         nop
diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
index c629dbd121b6..64dcd6cdb606 100644
--- a/arch/sparc/lib/NG2memcpy.S
+++ b/arch/sparc/lib/NG2memcpy.S
@@ -326,11 +326,13 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         blu             170f
          nop
         ba,a,pt         %xcc, 180f
+         nop
 
 4:      /* 32 <= low bits < 48 */
         blu             150f
          nop
         ba,a,pt         %xcc, 160f
+         nop
 5:      /* 0 < low bits < 32 */
         blu,a           6f
          cmp            %g2, 8
@@ -338,6 +340,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         blu             130f
          nop
         ba,a,pt         %xcc, 140f
+         nop
 6:      /* 0 < low bits < 16 */
         bgeu            120f
          nop
@@ -475,6 +478,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         brz,pt          %o2, 85f
          sub            %o0, %o1, GLOBAL_SPARE
         ba,a,pt         %XCC, 90f
+         nop
 
         .align          64
 75: /* 16 < len <= 64 */
diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
index 75bb93b1437f..78ea962edcbe 100644
--- a/arch/sparc/lib/NG4memcpy.S
+++ b/arch/sparc/lib/NG4memcpy.S
@@ -530,4 +530,5 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
         bne,pt          %icc, 1b
          EX_ST(STORE(stb, %g1, %o0 - 0x01), NG4_retl_o2_plus_1)
         ba,a,pt         %icc, .Lexit
+         nop
         .size           FUNC_NAME, .-FUNC_NAME
diff --git a/arch/sparc/lib/NG4memset.S b/arch/sparc/lib/NG4memset.S
index 41da4bdd95cb..7c0c81f18837 100644
--- a/arch/sparc/lib/NG4memset.S
+++ b/arch/sparc/lib/NG4memset.S
@@ -102,4 +102,5 @@ NG4bzero:
         bne,pt          %icc, 1b
          add            %o0, 0x30, %o0
         ba,a,pt         %icc, .Lpostloop
+         nop
         .size           NG4bzero,.-NG4bzero
diff --git a/arch/sparc/lib/NGmemcpy.S b/arch/sparc/lib/NGmemcpy.S
index d88c4ed50a00..cd654a719b27 100644
--- a/arch/sparc/lib/NGmemcpy.S
+++ b/arch/sparc/lib/NGmemcpy.S
@@ -394,6 +394,7 @@ FUNC_NAME:	/* %i0=dst, %i1=src, %i2=len */
         brz,pt          %i2, 85f
          sub            %o0, %i1, %i3
         ba,a,pt         %XCC, 90f
+         nop
 
         .align          64
 70: /* 16 < len <= 64 */
diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index 323bc6b6e3ad..7c29d38e6b99 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -143,6 +143,10 @@ static pte_t sun4v_hugepage_shift_to_tte(pte_t entry, unsigned int shift)
         pte_val(entry) = pte_val(entry) & ~_PAGE_SZALL_4V;
 
         switch (shift) {
+        case HPAGE_2GB_SHIFT:
+                hugepage_size = _PAGE_SZ2GB_4V;
+                pte_val(entry) |= _PAGE_PMD_HUGE;
+                break;
         case HPAGE_256MB_SHIFT:
                 hugepage_size = _PAGE_SZ256MB_4V;
                 pte_val(entry) |= _PAGE_PMD_HUGE;
@@ -183,6 +187,9 @@ static unsigned int sun4v_huge_tte_to_shift(pte_t entry)
         unsigned int shift;
 
         switch (tte_szbits) {
+        case _PAGE_SZ2GB_4V:
+                shift = HPAGE_2GB_SHIFT;
+                break;
         case _PAGE_SZ256MB_4V:
                 shift = HPAGE_256MB_SHIFT;
                 break;
@@ -261,7 +268,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                 if (!pmd)
                         return NULL;
 
-                if (sz == PMD_SHIFT)
+                if (sz >= PMD_SIZE)
                         pte = (pte_t *)pmd;
                 else
                         pte = pte_alloc_map(mm, pmd, addr);
@@ -454,6 +461,22 @@ void hugetlb_free_pgd_range(struct mmu_gather *tlb,
         pgd_t *pgd;
         unsigned long next;
 
+        addr &= PMD_MASK;
+        if (addr < floor) {
+                addr += PMD_SIZE;
+                if (!addr)
+                        return;
+        }
+        if (ceiling) {
+                ceiling &= PMD_MASK;
+                if (!ceiling)
+                        return;
+        }
+        if (end - 1 > ceiling - 1)
+                end -= PMD_SIZE;
+        if (addr > end - 1)
+                return;
+
         pgd = pgd_offset(tlb->mm, addr);
         do {
                 next = pgd_addr_end(addr, end);
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index ccd455328989..0cda653ae007 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -337,6 +337,10 @@ static int __init setup_hugepagesz(char *string)
         hugepage_shift = ilog2(hugepage_size);
 
         switch (hugepage_shift) {
+        case HPAGE_2GB_SHIFT:
+                hv_pgsz_mask = HV_PGSZ_MASK_2GB;
+                hv_pgsz_idx = HV_PGSZ_IDX_2GB;
+                break;
         case HPAGE_256MB_SHIFT:
                 hv_pgsz_mask = HV_PGSZ_MASK_256MB;
                 hv_pgsz_idx = HV_PGSZ_IDX_256MB;
@@ -1563,7 +1567,7 @@ bool kern_addr_valid(unsigned long addr)
         if ((long)addr < 0L) {
                 unsigned long pa = __pa(addr);
 
-                if ((addr >> max_phys_bits) != 0UL)
+                if ((pa >> max_phys_bits) != 0UL)
                         return false;
 
                 return pfn_valid(pa >> PAGE_SHIFT);
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index def82f6d626f..8e76ebba2986 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -54,6 +54,7 @@
 enum mbus_module srmmu_modtype;
 static unsigned int hwbug_bitmask;
 int vac_cache_size;
+EXPORT_SYMBOL(vac_cache_size);
 int vac_line_size;
 
 extern struct resource sparc_iomap;
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index afda3bbf7854..ee8066c3d96c 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -154,7 +154,7 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
                 if (pte_val(*pte) & _PAGE_VALID) {
                         bool exec = pte_exec(*pte);
 
-                        tlb_batch_add_one(mm, vaddr, exec, false);
+                        tlb_batch_add_one(mm, vaddr, exec, PAGE_SHIFT);
                 }
                 pte++;
                 vaddr += PAGE_SIZE;
@@ -209,9 +209,9 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                         pte_t orig_pte = __pte(pmd_val(orig));
                         bool exec = pte_exec(orig_pte);
 
-                        tlb_batch_add_one(mm, addr, exec, true);
+                        tlb_batch_add_one(mm, addr, exec, REAL_HPAGE_SHIFT);
                         tlb_batch_add_one(mm, addr + REAL_HPAGE_SIZE, exec,
-                                        true);
+                                          REAL_HPAGE_SHIFT);
                 } else {
                         tlb_batch_pmd_scan(mm, addr, orig);
                 }
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index 0a04811f06b7..bedf08b22a47 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -122,7 +122,7 @@ void flush_tsb_user(struct tlb_batch *tb)
 
         spin_lock_irqsave(&mm->context.lock, flags);
 
-        if (tb->hugepage_shift < HPAGE_SHIFT) {
+        if (tb->hugepage_shift < REAL_HPAGE_SHIFT) {
                 base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
                 nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
                 if (tlb_type == cheetah_plus || tlb_type == hypervisor)
@@ -155,7 +155,7 @@ void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr,
 
         spin_lock_irqsave(&mm->context.lock, flags);
 
-        if (hugepage_shift < HPAGE_SHIFT) {
+        if (hugepage_shift < REAL_HPAGE_SHIFT) {
                 base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
                 nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
                 if (tlb_type == cheetah_plus || tlb_type == hypervisor)
diff --git a/arch/tile/include/asm/pgtable_32.h b/arch/tile/include/asm/pgtable_32.h
index d26a42279036..5f8c615cb5e9 100644
--- a/arch/tile/include/asm/pgtable_32.h
+++ b/arch/tile/include/asm/pgtable_32.h
@@ -74,6 +74,7 @@ extern unsigned long VMALLOC_RESERVE /* = CONFIG_VMALLOC_RESERVE */;
 #define MAXMEM          (_VMALLOC_START - PAGE_OFFSET)
 
 /* We have no pmd or pud since we are strictly a two-level page table */
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 static inline int pud_huge_page(pud_t pud)      { return 0; }
diff --git a/arch/tile/include/asm/pgtable_64.h b/arch/tile/include/asm/pgtable_64.h
index e96cec52f6d8..96fe58b45118 100644
--- a/arch/tile/include/asm/pgtable_64.h
+++ b/arch/tile/include/asm/pgtable_64.h
@@ -59,6 +59,7 @@
 #ifndef __ASSEMBLY__
 
 /* We have no pud since we are a three-level page table. */
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 /*
diff --git a/arch/um/include/asm/pgtable-2level.h b/arch/um/include/asm/pgtable-2level.h
index cfbe59752469..179c0ea87a0c 100644
--- a/arch/um/include/asm/pgtable-2level.h
+++ b/arch/um/include/asm/pgtable-2level.h
@@ -8,6 +8,7 @@
 #ifndef __UM_PGTABLE_2LEVEL_H
 #define __UM_PGTABLE_2LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 /* PGDIR_SHIFT determines what a third-level page table entry can map */
diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
index bae8523a162f..c4d876dfb9ac 100644
--- a/arch/um/include/asm/pgtable-3level.h
+++ b/arch/um/include/asm/pgtable-3level.h
@@ -7,6 +7,7 @@
 #ifndef __UM_PGTABLE_3LEVEL_H
 #define __UM_PGTABLE_3LEVEL_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 /* PGDIR_SHIFT determines what a third-level page table entry can map */
diff --git a/arch/unicore32/include/asm/pgtable.h b/arch/unicore32/include/asm/pgtable.h
index 818d0f5598e3..a4f2bef37e70 100644
--- a/arch/unicore32/include/asm/pgtable.h
+++ b/arch/unicore32/include/asm/pgtable.h
@@ -12,6 +12,7 @@
 #ifndef __UNICORE_PGTABLE_H__
 #define __UNICORE_PGTABLE_H__
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #include <asm/cpu-single.h>
 
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 2d449337a360..a94a4d10f2df 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -120,10 +120,6 @@ else
         # -funit-at-a-time shrinks the kernel .text considerably
         # unfortunately it makes reading oopses harder.
         KBUILD_CFLAGS += $(call cc-option,-funit-at-a-time)
-
-        # this works around some issues with generating unwind tables in older gccs
-        # newer gccs do it by default
-        KBUILD_CFLAGS += $(call cc-option,-maccumulate-outgoing-args)
 endif
 
 ifdef CONFIG_X86_X32
@@ -147,6 +143,37 @@ ifeq ($(CONFIG_KMEMCHECK),y)
         KBUILD_CFLAGS += $(call cc-option,-fno-builtin-memcpy)
 endif
 
+#
+# If the function graph tracer is used with mcount instead of fentry,
+# '-maccumulate-outgoing-args' is needed to prevent a GCC bug
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=42109)
+#
+ifdef CONFIG_FUNCTION_GRAPH_TRACER
+  ifndef CONFIG_HAVE_FENTRY
+        ACCUMULATE_OUTGOING_ARGS := 1
+  else
+    ifeq ($(call cc-option-yn, -mfentry), n)
+        ACCUMULATE_OUTGOING_ARGS := 1
+    endif
+  endif
+endif
+
+#
+# Jump labels need '-maccumulate-outgoing-args' for gcc < 4.5.2 to prevent a
+# GCC bug (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=46226).  There's no way
+# to test for this bug at compile-time because the test case needs to execute,
+# which is a no-go for cross compilers.  So check the GCC version instead.
+#
+ifdef CONFIG_JUMP_LABEL
+  ifneq ($(ACCUMULATE_OUTGOING_ARGS), 1)
+        ACCUMULATE_OUTGOING_ARGS = $(call cc-if-fullversion, -lt, 040502, 1)
+  endif
+endif
+
+ifeq ($(ACCUMULATE_OUTGOING_ARGS), 1)
+        KBUILD_CFLAGS += -maccumulate-outgoing-args
+endif
+
 # Stackpointer is addressed different for 32 bit and 64 bit x86
 sp-$(CONFIG_X86_32) := esp
 sp-$(CONFIG_X86_64) := rsp
diff --git a/arch/x86/Makefile_32.cpu b/arch/x86/Makefile_32.cpu
index 6647ed49c66c..a45eb15b7cf2 100644
--- a/arch/x86/Makefile_32.cpu
+++ b/arch/x86/Makefile_32.cpu
@@ -45,24 +45,6 @@ cflags-$(CONFIG_MGEODE_LX)	+= $(call cc-option,-march=geode,-march=pentium-mmx)
 # cpu entries
 cflags-$(CONFIG_X86_GENERIC)    += $(call tune,generic,$(call tune,i686))
 
-# Work around the pentium-mmx code generator madness of gcc4.4.x which
-# does stack alignment by generating horrible code _before_ the mcount
-# prologue (push %ebp, mov %esp, %ebp) which breaks the function graph
-# tracer assumptions. For i686, generic, core2 this is set by the
-# compiler anyway
-ifeq ($(CONFIG_FUNCTION_GRAPH_TRACER), y)
-ADD_ACCUMULATE_OUTGOING_ARGS := y
-endif
-
-# Work around to a bug with asm goto with first implementations of it
-# in gcc causing gcc to mess up the push and pop of the stack in some
-# uses of asm goto.
-ifeq ($(CONFIG_JUMP_LABEL), y)
-ADD_ACCUMULATE_OUTGOING_ARGS := y
-endif
-
-cflags-$(ADD_ACCUMULATE_OUTGOING_ARGS) += $(call cc-option,-maccumulate-outgoing-args)
-
 # Bug fix for binutils: this option is required in order to keep
 # binutils from generating NOPL instructions against our will.
 ifneq ($(CONFIG_X86_P6_NOP),y)
diff --git a/arch/x86/boot/compressed/error.c b/arch/x86/boot/compressed/error.c
index 6248740b68b5..31922023de49 100644
--- a/arch/x86/boot/compressed/error.c
+++ b/arch/x86/boot/compressed/error.c
@@ -4,6 +4,7 @@
  * memcpy() and memmove() are defined for the compressed boot environment.
  */
 #include "misc.h"
+#include "error.h"
 
 void warn(char *m)
 {
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 7ef4a099defc..6205d3b81e6d 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -176,6 +176,7 @@ CONFIG_E1000E=y
 CONFIG_SKY2=y
 CONFIG_FORCEDETH=y
 CONFIG_8139TOO=y
+CONFIG_R8169=y
 CONFIG_FDDI=y
 CONFIG_INPUT_POLLDEV=y
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
index 7853b53959cd..3f9d1a83891a 100644
--- a/arch/x86/entry/vdso/vdso32-setup.c
+++ b/arch/x86/entry/vdso/vdso32-setup.c
@@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s)
 {
         vdso32_enabled = simple_strtoul(s, NULL, 0);
 
-        if (vdso32_enabled > 1)
+        if (vdso32_enabled > 1) {
                 pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n");
+                vdso32_enabled = 0;
+        }
 
         return 1;
 }
@@ -62,13 +64,18 @@ subsys_initcall(sysenter_setup);
 /* Register vsyscall32 into the ABI table */
 #include <linux/sysctl.h>
 
+static const int zero;
+static const int one = 1;
+
 static struct ctl_table abi_table2[] = {
         {
                 .procname       = "vsyscall32",
                 .data           = &vdso32_enabled,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = (int *)&zero,
+                .extra2         = (int *)&one,
         },
         {}
 };
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index afb222b63cae..c84584bb9402 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -604,7 +604,7 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, int idx,
                         return &amd_f15_PMC20;
                 }
         case AMD_EVENT_NB:
-                /* moved to perf_event_amd_uncore.c */
+                /* moved to uncore.c */
                 return &emptyconstraint;
         default:
                 return &emptyconstraint;
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 349d4d17aa7f..580b60f5ac83 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2101,8 +2101,8 @@ static int x86_pmu_event_init(struct perf_event *event)
 
 static void refresh_pce(void *ignored)
 {
-        if (current->mm)
-                load_mm_cr4(current->mm);
+        if (current->active_mm)
+                load_mm_cr4(current->active_mm);
 }
 
 static void x86_pmu_event_mapped(struct perf_event *event)
@@ -2110,6 +2110,18 @@ static void x86_pmu_event_mapped(struct perf_event *event)
         if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
                 return;
 
+        /*
+         * This function relies on not being called concurrently in two
+         * tasks in the same mm.  Otherwise one task could observe
+         * perf_rdpmc_allowed > 1 and return all the way back to
+         * userspace with CR4.PCE clear while another task is still
+         * doing on_each_cpu_mask() to propagate CR4.PCE.
+         *
+         * For now, this can't happen because all callers hold mmap_sem
+         * for write.  If this changes, we'll need a different solution.
+         */
+        lockdep_assert_held_exclusive(&current->mm->mmap_sem);
+
         if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
                 on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
 }
@@ -2244,6 +2256,7 @@ void arch_perf_update_userpage(struct perf_event *event,
                                struct perf_event_mmap_page *userpg, u64 now)
 {
         struct cyc2ns_data *data;
+        u64 offset;
 
         userpg->cap_user_time = 0;
         userpg->cap_user_time_zero = 0;
@@ -2251,11 +2264,13 @@ void arch_perf_update_userpage(struct perf_event *event,
                 !!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED);
         userpg->pmc_width = x86_pmu.cntval_bits;
 
-        if (!sched_clock_stable())
+        if (!using_native_sched_clock() || !sched_clock_stable())
                 return;
 
         data = cyc2ns_read_begin();
 
+        offset = data->cyc2ns_offset + __sched_clock_offset;
+
         /*
          * Internal timekeeping for enabled/running/stopped times
          * is always in the local_clock domain.
@@ -2263,7 +2278,7 @@ void arch_perf_update_userpage(struct perf_event *event,
         userpg->cap_user_time = 1;
         userpg->time_mult = data->cyc2ns_mul;
         userpg->time_shift = data->cyc2ns_shift;
-        userpg->time_offset = data->cyc2ns_offset - now;
+        userpg->time_offset = offset - now;
 
         /*
          * cap_user_time_zero doesn't make sense when we're using a different
@@ -2271,7 +2286,7 @@ void arch_perf_update_userpage(struct perf_event *event,
          */
         if (!event->attr.use_clockid) {
                 userpg->cap_user_time_zero = 1;
-                userpg->time_zero = data->cyc2ns_offset;
+                userpg->time_zero = offset;
         }
 
         cyc2ns_read_end(data);
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index aff4b5b69d40..238ae3248ba5 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -1,5 +1,5 @@
 /*
- * perf_event_intel_cstate.c: support cstate residency counters
+ * Support cstate residency counters
  *
  * Copyright (C) 2015, Intel Corp.
  * Author: Kan Liang (kan.liang@intel.com)
diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index 81b321ace8e0..f924629836a8 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -507,6 +507,9 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
                 cpuc->lbr_entries[i].to         = msr_lastbranch.to;
                 cpuc->lbr_entries[i].mispred    = 0;
                 cpuc->lbr_entries[i].predicted  = 0;
+                cpuc->lbr_entries[i].in_tx      = 0;
+                cpuc->lbr_entries[i].abort      = 0;
+                cpuc->lbr_entries[i].cycles     = 0;
                 cpuc->lbr_entries[i].reserved   = 0;
         }
         cpuc->lbr_stack.nr = i;
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 22054ca49026..9d05c7e67f60 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -1,5 +1,5 @@
 /*
- * perf_event_intel_rapl.c: support Intel RAPL energy consumption counters
+ * Support Intel RAPL energy consumption counters
  * Copyright (C) 2013 Google, Inc., Stephane Eranian
  *
  * Intel RAPL interface is specified in the IA-32 Manual Vol3b
diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
index ad986c1e29bc..df5989f27b1b 100644
--- a/arch/x86/events/intel/uncore.h
+++ b/arch/x86/events/intel/uncore.h
@@ -360,7 +360,7 @@ extern struct list_head pci2phy_map_head;
 extern struct pci_extra_dev *uncore_extra_pci_dev;
 extern struct event_constraint uncore_constraint_empty;
 
-/* perf_event_intel_uncore_snb.c */
+/* uncore_snb.c */
 int snb_uncore_pci_init(void);
 int ivb_uncore_pci_init(void);
 int hsw_uncore_pci_init(void);
@@ -371,7 +371,7 @@ void nhm_uncore_cpu_init(void);
 void skl_uncore_cpu_init(void);
 int snb_pci2phy_map_init(int devid);
 
-/* perf_event_intel_uncore_snbep.c */
+/* uncore_snbep.c */
 int snbep_uncore_pci_init(void);
 void snbep_uncore_cpu_init(void);
 int ivbep_uncore_pci_init(void);
@@ -385,5 +385,5 @@ void knl_uncore_cpu_init(void);
 int skx_uncore_pci_init(void);
 void skx_uncore_cpu_init(void);
 
-/* perf_event_intel_uncore_nhmex.c */
+/* uncore_nhmex.c */
 void nhmex_uncore_cpu_init(void);
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index db64baf0e500..8bef70e7f3cc 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -158,13 +158,13 @@ void hyperv_init(void)
                 clocksource_register_hz(&hyperv_cs_tsc, NSEC_PER_SEC/100);
                 return;
         }
+register_msr_cs:
 #endif
         /*
          * For 32 bit guests just use the MSR based mechanism for reading
          * the partition counter.
          */
 
-register_msr_cs:
         hyperv_cs = &hyperv_cs_msr;
         if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE)
                 clocksource_register_hz(&hyperv_cs_msr, NSEC_PER_SEC/100);
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 4e7772387c6e..b04bb6dfed7f 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -289,7 +289,8 @@
 #define X86_FEATURE_PKU         (16*32+ 3) /* Protection Keys for Userspace */
 #define X86_FEATURE_OSPKE       (16*32+ 4) /* OS Protection Keys Enable */
 #define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */
-#define X86_FEATURE_RDPID       (16*32+ 22) /* RDPID instruction */
+#define X86_FEATURE_LA57        (16*32+16) /* 5-level page tables */
+#define X86_FEATURE_RDPID       (16*32+22) /* RDPID instruction */
 
 /* AMD-defined CPU features, CPUID level 0x80000007 (ebx), word 17 */
 #define X86_FEATURE_OVERFLOW_RECOV (17*32+0) /* MCA overflow recovery support */
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 9d49c18b5ea9..3762536619f8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -287,7 +287,7 @@ struct task_struct;
 
 #define ARCH_DLINFO_IA32                                                \
 do {                                                                    \
-        if (vdso32_enabled) {                                           \
+        if (VDSO_CURRENT_BASE) {                                        \
                 NEW_AUX_ENT(AT_SYSINFO, VDSO_ENTRY);                    \
                 NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);        \
         }                                                               \
diff --git a/arch/x86/include/asm/kvm_page_track.h b/arch/x86/include/asm/kvm_page_track.h
index d74747b031ec..c4eda791f877 100644
--- a/arch/x86/include/asm/kvm_page_track.h
+++ b/arch/x86/include/asm/kvm_page_track.h
@@ -46,6 +46,7 @@ struct kvm_page_track_notifier_node {
 };
 
 void kvm_page_track_init(struct kvm *kvm);
+void kvm_page_track_cleanup(struct kvm *kvm);
 
 void kvm_page_track_free_memslot(struct kvm_memory_slot *free,
                                  struct kvm_memory_slot *dont);
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index 72277b1028a5..50d35e3185f5 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -121,12 +121,9 @@ static inline void native_pmd_clear(pmd_t *pmd)
         *(tmp + 1) = 0;
 }
 
-#if !defined(CONFIG_SMP) || (defined(CONFIG_HIGHMEM64G) && \
-                defined(CONFIG_PARAVIRT))
 static inline void native_pud_clear(pud_t *pudp)
 {
 }
-#endif
 
 static inline void pud_clear(pud_t *pudp)
 {
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 1cfb36b8c024..585ee0d42d18 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -62,7 +62,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
 # define set_pud(pudp, pud)             native_set_pud(pudp, pud)
 #endif
 
-#ifndef __PAGETABLE_PMD_FOLDED
+#ifndef __PAGETABLE_PUD_FOLDED
 #define pud_clear(pud)                  native_pud_clear(pud)
 #endif
 
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 8b4de22d6429..62484333673d 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -273,6 +273,8 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
 }
 
 #if CONFIG_PGTABLE_LEVELS > 3
+#include <asm-generic/5level-fixup.h>
+
 typedef struct { pudval_t pud; } pud_t;
 
 static inline pud_t native_make_pud(pmdval_t val)
@@ -285,6 +287,7 @@ static inline pudval_t native_pud_val(pud_t pud)
         return pud.pud;
 }
 #else
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopud.h>
 
 static inline pudval_t native_pud_val(pud_t pud)
@@ -306,6 +309,7 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
         return pmd.pmd;
 }
 #else
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 
 static inline pmdval_t native_pmd_val(pmd_t pmd)
diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h
index 34684adb6899..b3b09b98896d 100644
--- a/arch/x86/include/asm/pkeys.h
+++ b/arch/x86/include/asm/pkeys.h
@@ -46,6 +46,15 @@ extern int __arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
 static inline
 bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey)
 {
+        /*
+         * "Allocated" pkeys are those that have been returned
+         * from pkey_alloc().  pkey 0 is special, and never
+         * returned from pkey_alloc().
+         */
+        if (pkey <= 0)
+                return false;
+        if (pkey >= arch_max_pkey())
+                return false;
         return mm_pkey_allocation_map(mm) & (1U << pkey);
 }
 
@@ -82,12 +91,6 @@ int mm_pkey_alloc(struct mm_struct *mm)
 static inline
 int mm_pkey_free(struct mm_struct *mm, int pkey)
 {
-        /*
-         * pkey 0 is special, always allocated and can never
-         * be freed.
-         */
-        if (!pkey)
-                return -EINVAL;
         if (!mm_pkey_is_allocated(mm, pkey))
                 return -EINVAL;
 
diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h
index 2c1ebeb4d737..529bb4a6487a 100644
--- a/arch/x86/include/asm/pmem.h
+++ b/arch/x86/include/asm/pmem.h
@@ -55,7 +55,8 @@ static inline int arch_memcpy_from_pmem(void *dst, const void *src, size_t n)
  * @size:       number of bytes to write back
  *
  * Write back a cache range using the CLWB (cache line write back)
- * instruction.
+ * instruction. Note that @size is internally rounded up to be cache
+ * line size aligned.
  */
 static inline void arch_wb_cache_pmem(void *addr, size_t size)
 {
@@ -69,15 +70,6 @@ static inline void arch_wb_cache_pmem(void *addr, size_t size)
                 clwb(p);
 }
 
-/*
- * copy_from_iter_nocache() on x86 only uses non-temporal stores for iovec
- * iterators, so for other types (bvec & kvec) we must do a cache write-back.
- */
-static inline bool __iter_needs_pmem_wb(struct iov_iter *i)
-{
-        return iter_is_iovec(i) == false;
-}
-
 /**
  * arch_copy_from_iter_pmem - copy data from an iterator to PMEM
  * @addr:       PMEM destination address
@@ -94,7 +86,35 @@ static inline size_t arch_copy_from_iter_pmem(void *addr, size_t bytes,
         /* TODO: skip the write-back by always using non-temporal stores */
         len = copy_from_iter_nocache(addr, bytes, i);
 
-        if (__iter_needs_pmem_wb(i))
+        /*
+         * In the iovec case on x86_64 copy_from_iter_nocache() uses
+         * non-temporal stores for the bulk of the transfer, but we need
+         * to manually flush if the transfer is unaligned. A cached
+         * memory copy is used when destination or size is not naturally
+         * aligned. That is:
+         *   - Require 8-byte alignment when size is 8 bytes or larger.
+         *   - Require 4-byte alignment when size is 4 bytes.
+         *
+         * In the non-iovec case the entire destination needs to be
+         * flushed.
+         */
+        if (iter_is_iovec(i)) {
+                unsigned long flushed, dest = (unsigned long) addr;
+
+                if (bytes < 8) {
+                        if (!IS_ALIGNED(dest, 4) || (bytes != 4))
+                                arch_wb_cache_pmem(addr, 1);
+                } else {
+                        if (!IS_ALIGNED(dest, 8)) {
+                                dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
+                                arch_wb_cache_pmem(addr, 1);
+                        }
+
+                        flushed = dest - (unsigned long) addr;
+                        if (bytes > flushed && !IS_ALIGNED(bytes - flushed, 8))
+                                arch_wb_cache_pmem(addr + bytes - 1, 1);
+                }
+        } else
                 arch_wb_cache_pmem(addr, bytes);
 
         return len;
diff --git a/arch/x86/include/asm/purgatory.h b/arch/x86/include/asm/purgatory.h
new file mode 100644
index 000000000000..d7da2729903d
--- /dev/null
+++ b/arch/x86/include/asm/purgatory.h
@@ -0,0 +1,20 @@
+#ifndef _ASM_X86_PURGATORY_H
+#define _ASM_X86_PURGATORY_H
+
+#ifndef __ASSEMBLY__
+#include <linux/purgatory.h>
+
+extern void purgatory(void);
+/*
+ * These forward declarations serve two purposes:
+ *
+ * 1) Make sparse happy when checking arch/purgatory
+ * 2) Document that these are required to be global so the symbol
+ *    lookup in kexec works
+ */
+extern unsigned long purgatory_backup_dest;
+extern unsigned long purgatory_backup_src;
+extern unsigned long purgatory_backup_sz;
+#endif  /* __ASSEMBLY__ */
+
+#endif /* _ASM_PURGATORY_H */
diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
index a04eabd43d06..27e9f9d769b8 100644
--- a/arch/x86/include/asm/timer.h
+++ b/arch/x86/include/asm/timer.h
@@ -12,6 +12,8 @@ extern int recalibrate_cpu_khz(void);
 
 extern int no_timer_check;
 
+extern bool using_native_sched_clock(void);
+
 /*
  * We use the full linear equation: f(x) = a + b*x, in order to allow
  * a continuous function in the face of dynamic freq changes.
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 6fa85944af83..fc5abff9b7fd 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -188,7 +188,7 @@ static inline void __native_flush_tlb_single(unsigned long addr)
 
 static inline void __flush_tlb_all(void)
 {
-        if (static_cpu_has(X86_FEATURE_PGE))
+        if (boot_cpu_has(X86_FEATURE_PGE))
                 __flush_tlb_global();
         else
                 __flush_tlb();
diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
index 72e8300b1e8a..9cffb44a3cf5 100644
--- a/arch/x86/include/asm/uv/uv_hub.h
+++ b/arch/x86/include/asm/uv/uv_hub.h
@@ -485,15 +485,17 @@ static inline unsigned long uv_soc_phys_ram_to_gpa(unsigned long paddr)
 
         if (paddr < uv_hub_info->lowmem_remap_top)
                 paddr |= uv_hub_info->lowmem_remap_base;
-        paddr |= uv_hub_info->gnode_upper;
-        if (m_val)
+
+        if (m_val) {
+                paddr |= uv_hub_info->gnode_upper;
                 paddr = ((paddr << uv_hub_info->m_shift)
                                                 >> uv_hub_info->m_shift) |
                         ((paddr >> uv_hub_info->m_val)
                                                 << uv_hub_info->n_lshift);
-        else
+        } else {
                 paddr |= uv_soc_phys_ram_to_nasid(paddr)
                                                 << uv_hub_info->gpa_shift;
+        }
         return paddr;
 }
 
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 5138dacf8bb8..07244ea16765 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -58,7 +58,7 @@ struct setup_header {
         __u32   header;
         __u16   version;
         __u32   realmode_swtch;
-        __u16   start_sys;
+        __u16   start_sys_seg;
         __u16   kernel_version;
         __u8    type_of_loader;
         __u8    loadflags;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index ae32838cac5f..b2879cc23db4 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -179,10 +179,15 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled)
                 return -EINVAL;
         }
 
+        if (!enabled) {
+                ++disabled_cpus;
+                return -EINVAL;
+        }
+
         if (boot_cpu_physical_apicid != -1U)
                 ver = boot_cpu_apic_version;
 
-        cpu = __generic_processor_info(id, ver, enabled);
+        cpu = generic_processor_info(id, ver);
         if (cpu >= 0)
                 early_per_cpu(x86_cpu_to_acpiid, cpu) = acpiid;
 
@@ -710,7 +715,7 @@ static void __init acpi_set_irq_model_ioapic(void)
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 #include <acpi/processor.h>
 
-int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
+static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
 {
 #ifdef CONFIG_ACPI_NUMA
         int nid;
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 4261b3282ad9..8ccb7ef512e0 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1610,24 +1610,15 @@ static inline void try_to_enable_x2apic(int remap_mode) { }
 static inline void __x2apic_enable(void) { }
 #endif /* !CONFIG_X86_X2APIC */
 
-static int __init try_to_enable_IR(void)
-{
-#ifdef CONFIG_X86_IO_APIC
-        if (!x2apic_enabled() && skip_ioapic_setup) {
-                pr_info("Not enabling interrupt remapping due to skipped IO-APIC setup\n");
-                return -1;
-        }
-#endif
-        return irq_remapping_enable();
-}
-
 void __init enable_IR_x2apic(void)
 {
         unsigned long flags;
         int ret, ir_stat;
 
-        if (skip_ioapic_setup)
+        if (skip_ioapic_setup) {
+                pr_info("Not enabling interrupt remapping due to skipped IO-APIC setup\n");
                 return;
+        }
 
         ir_stat = irq_remapping_prepare();
         if (ir_stat < 0 && !x2apic_supported())
@@ -1645,7 +1636,7 @@ void __init enable_IR_x2apic(void)
 
         /* If irq_remapping_prepare() succeeded, try to enable it */
         if (ir_stat >= 0)
-                ir_stat = try_to_enable_IR();
+                ir_stat = irq_remapping_enable();
         /* ir_stat contains the remap mode or an error code */
         try_to_enable_x2apic(ir_stat);
 
@@ -2062,17 +2053,17 @@ static int allocate_logical_cpuid(int apicid)
 
         /* Allocate a new cpuid. */
         if (nr_logical_cpuids >= nr_cpu_ids) {
-                WARN_ONCE(1, "Only %d processors supported."
+                WARN_ONCE(1, "APIC: NR_CPUS/possible_cpus limit of %i reached. "
                              "Processor %d/0x%x and the rest are ignored.\n",
-                             nr_cpu_ids - 1, nr_logical_cpuids, apicid);
-                return -1;
+                             nr_cpu_ids, nr_logical_cpuids, apicid);
+                return -EINVAL;
         }
 
         cpuid_to_apicid[nr_logical_cpuids] = apicid;
         return nr_logical_cpuids++;
 }
 
-int __generic_processor_info(int apicid, int version, bool enabled)
+int generic_processor_info(int apicid, int version)
 {
         int cpu, max = nr_cpu_ids;
         bool boot_cpu_detected = physid_isset(boot_cpu_physical_apicid,
@@ -2130,11 +2121,9 @@ int __generic_processor_info(int apicid, int version, bool enabled)
         if (num_processors >= nr_cpu_ids) {
                 int thiscpu = max + disabled_cpus;
 
-                if (enabled) {
-                        pr_warning("APIC: NR_CPUS/possible_cpus limit of %i "
-                                   "reached. Processor %d/0x%x ignored.\n",
-                                   max, thiscpu, apicid);
-                }
+                pr_warning("APIC: NR_CPUS/possible_cpus limit of %i "
+                           "reached. Processor %d/0x%x ignored.\n",
+                           max, thiscpu, apicid);
 
                 disabled_cpus++;
                 return -EINVAL;
@@ -2186,23 +2175,13 @@ int __generic_processor_info(int apicid, int version, bool enabled)
                 apic->x86_32_early_logical_apicid(cpu);
 #endif
         set_cpu_possible(cpu, true);
-
-        if (enabled) {
-                num_processors++;
-                physid_set(apicid, phys_cpu_present_map);
-                set_cpu_present(cpu, true);
-        } else {
-                disabled_cpus++;
-        }
+        physid_set(apicid, phys_cpu_present_map);
+        set_cpu_present(cpu, true);
+        num_processors++;
 
         return cpu;
 }
 
-int generic_processor_info(int apicid, int version)
-{
-        return __generic_processor_info(apicid, version, true);
-}
-
 int hard_smp_processor_id(void)
 {
         return read_apic_id();
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index e9f8f8cdd570..86f20cc0a65e 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -1105,7 +1105,8 @@ void __init uv_init_hub_info(struct uv_hub_info_s *hi)
         node_id.v               = uv_read_local_mmr(UVH_NODE_ID);
         uv_cpuid.gnode_shift    = max_t(unsigned int, uv_cpuid.gnode_shift, mn.n_val);
         hi->gnode_extra         = (node_id.s.node_id & ~((1 << uv_cpuid.gnode_shift) - 1)) >> 1;
-        hi->gnode_upper         = (unsigned long)hi->gnode_extra << mn.m_val;
+        if (mn.m_val)
+                hi->gnode_upper = (u64)hi->gnode_extra << mn.m_val;
 
         if (uv_gp_table) {
                 hi->global_mmr_base     = uv_gp_table->mmr_base;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 35a5d5dca2fa..c36140d788fe 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -556,10 +556,6 @@ static void early_init_amd(struct cpuinfo_x86 *c)
         if (c->x86_power & (1 << 8)) {
                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
                 set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
-                if (check_tsc_unstable())
-                        clear_sched_clock_stable();
-        } else {
-                clear_sched_clock_stable();
         }
 
         /* Bit 12 of 8000_0007 edx is accumulated power mechanism. */
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index adc0ebd8bed0..43955ee6715b 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -105,8 +105,6 @@ static void early_init_centaur(struct cpuinfo_x86 *c)
 #ifdef CONFIG_X86_64
         set_cpu_cap(c, X86_FEATURE_SYSENTER32);
 #endif
-
-        clear_sched_clock_stable();
 }
 
 static void init_centaur(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index b11b38c3b0bd..58094a1f9e9d 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -88,7 +88,6 @@ static void default_init(struct cpuinfo_x86 *c)
                         strcpy(c->x86_model_id, "386");
         }
 #endif
-        clear_sched_clock_stable();
 }
 
 static const struct cpu_dev default_cpu = {
@@ -1077,8 +1076,6 @@ static void identify_cpu(struct cpuinfo_x86 *c)
          */
         if (this_cpu->c_init)
                 this_cpu->c_init(c);
-        else
-                clear_sched_clock_stable();
 
         /* Disable the PN if appropriate */
         squash_the_stupid_serial_number(c);
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index 0a3bc19de017..a70fd61095f8 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -185,7 +185,6 @@ static void early_init_cyrix(struct cpuinfo_x86 *c)
                 set_cpu_cap(c, X86_FEATURE_CYRIX_ARR);
                 break;
         }
-        clear_sched_clock_stable();
 }
 
 static void init_cyrix(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index fe0a615a051b..063197771b8d 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -162,10 +162,6 @@ static void early_init_intel(struct cpuinfo_x86 *c)
         if (c->x86_power & (1 << 8)) {
                 set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
                 set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
-                if (check_tsc_unstable())
-                        clear_sched_clock_stable();
-        } else {
-                clear_sched_clock_stable();
         }
 
         /* Penwell and Cloverview have the TSC which doesn't sleep on S3 */
diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
index 0bbe0f3a039f..9ac2a5cdd9c2 100644
--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
@@ -28,7 +28,6 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/task.h>
 #include <linux/slab.h>
-#include <linux/cpu.h>
 #include <linux/task_work.h>
 
 #include <uapi/linux/magic.h>
@@ -728,7 +727,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn)
         if (atomic_dec_and_test(&rdtgrp->waitcount) &&
             (rdtgrp->flags & RDT_DELETED)) {
                 kernfs_unbreak_active_protection(kn);
-                kernfs_put(kn);
+                kernfs_put(rdtgrp->kn);
                 kfree(rdtgrp);
         } else {
                 kernfs_unbreak_active_protection(kn);
diff --git a/arch/x86/kernel/cpu/intel_rdt_schemata.c b/arch/x86/kernel/cpu/intel_rdt_schemata.c
index f369cb8db0d5..badd2b31a560 100644
--- a/arch/x86/kernel/cpu/intel_rdt_schemata.c
+++ b/arch/x86/kernel/cpu/intel_rdt_schemata.c
@@ -200,11 +200,11 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
         }
 
 out:
-        rdtgroup_kn_unlock(of->kn);
         for_each_enabled_rdt_resource(r) {
                 kfree(r->tmp_cbms);
                 r->tmp_cbms = NULL;
         }
+        rdtgroup_kn_unlock(of->kn);
         return ret ?: nbytes;
 }
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
index 1e5a50c11d3c..217cd4449bc9 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c
@@ -85,7 +85,7 @@ void mce_gen_pool_process(struct work_struct *__unused)
         head = llist_reverse_order(head);
         llist_for_each_entry_safe(node, tmp, head, llnode) {
                 mce = &node->mce;
-                atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
+                blocking_notifier_call_chain(&x86_mce_decoder_chain, 0, mce);
                 gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node));
         }
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce-internal.h b/arch/x86/kernel/cpu/mcheck/mce-internal.h
index 903043e6a62b..19592ba1a320 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-internal.h
+++ b/arch/x86/kernel/cpu/mcheck/mce-internal.h
@@ -13,7 +13,7 @@ enum severity_level {
         MCE_PANIC_SEVERITY,
 };
 
-extern struct atomic_notifier_head x86_mce_decoder_chain;
+extern struct blocking_notifier_head x86_mce_decoder_chain;
 
 #define ATTR_LEN                16
 #define INITIAL_CHECK_INTERVAL  5 * 60 /* 5 minutes */
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 8e9725c607ea..af44ebeb593f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -54,6 +54,8 @@
 
 static DEFINE_MUTEX(mce_chrdev_read_mutex);
 
+static int mce_chrdev_open_count;       /* #times opened */
+
 #define mce_log_get_idx_check(p) \
 ({ \
         RCU_LOCKDEP_WARN(!rcu_read_lock_sched_held() && \
@@ -121,7 +123,7 @@ static void (*quirk_no_way_out)(int bank, struct mce *m, struct pt_regs *regs);
  * CPU/chipset specific EDAC code can register a notifier call here to print
  * MCE errors in a human-readable form.
  */
-ATOMIC_NOTIFIER_HEAD(x86_mce_decoder_chain);
+BLOCKING_NOTIFIER_HEAD(x86_mce_decoder_chain);
 
 /* Do initial initialization of a struct mce */
 void mce_setup(struct mce *m)
@@ -218,7 +220,7 @@ void mce_register_decode_chain(struct notifier_block *nb)
 
         WARN_ON(nb->priority > MCE_PRIO_LOWEST && nb->priority < MCE_PRIO_EDAC);
 
-        atomic_notifier_chain_register(&x86_mce_decoder_chain, nb);
+        blocking_notifier_chain_register(&x86_mce_decoder_chain, nb);
 }
 EXPORT_SYMBOL_GPL(mce_register_decode_chain);
 
@@ -226,7 +228,7 @@ void mce_unregister_decode_chain(struct notifier_block *nb)
 {
         atomic_dec(&num_notifiers);
 
-        atomic_notifier_chain_unregister(&x86_mce_decoder_chain, nb);
+        blocking_notifier_chain_unregister(&x86_mce_decoder_chain, nb);
 }
 EXPORT_SYMBOL_GPL(mce_unregister_decode_chain);
 
@@ -319,18 +321,7 @@ static void __print_mce(struct mce *m)
 
 static void print_mce(struct mce *m)
 {
-        int ret = 0;
-
         __print_mce(m);
-
-        /*
-         * Print out human-readable details about the MCE error,
-         * (if the CPU has an implementation for that)
-         */
-        ret = atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, m);
-        if (ret == NOTIFY_STOP)
-                return;
-
         pr_emerg_ratelimited(HW_ERR "Run the above through 'mcelog --ascii'\n");
 }
 
@@ -598,6 +589,10 @@ static int mce_default_notifier(struct notifier_block *nb, unsigned long val,
         if (atomic_read(&num_notifiers) > 2)
                 return NOTIFY_DONE;
 
+        /* Don't print when mcelog is running */
+        if (mce_chrdev_open_count > 0)
+                return NOTIFY_DONE;
+
         __print_mce(m);
 
         return NOTIFY_DONE;
@@ -1828,7 +1823,6 @@ void mcheck_cpu_clear(struct cpuinfo_x86 *c)
  */
 
 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
-static int mce_chrdev_open_count;       /* #times opened */
 static int mce_chrdev_open_exclu;       /* already open exclusive? */
 
 static int mce_chrdev_open(struct inode *inode, struct file *file)
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 524cc5780a77..6e4a047e4b68 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -60,7 +60,7 @@ static const char * const th_names[] = {
         "load_store",
         "insn_fetch",
         "combined_unit",
-        "",
+        "decode_unit",
         "northbridge",
         "execution_unit",
 };
diff --git a/arch/x86/kernel/cpu/transmeta.c b/arch/x86/kernel/cpu/transmeta.c
index 8457b4978668..d77d07ab310b 100644
--- a/arch/x86/kernel/cpu/transmeta.c
+++ b/arch/x86/kernel/cpu/transmeta.c
@@ -16,8 +16,6 @@ static void early_init_transmeta(struct cpuinfo_x86 *c)
                 if (xlvl >= 0x80860001)
                         c->x86_capability[CPUID_8086_0001_EDX] = cpuid_edx(0x80860001);
         }
-
-        clear_sched_clock_stable();
 }
 
 static void init_transmeta(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
index 891f4dad7b2c..22403a28caf5 100644
--- a/arch/x86/kernel/cpu/vmware.c
+++ b/arch/x86/kernel/cpu/vmware.c
@@ -30,7 +30,6 @@
 #include <asm/hypervisor.h>
 #include <asm/timer.h>
 #include <asm/apic.h>
-#include <asm/timer.h>
 
 #undef pr_fmt
 #define pr_fmt(fmt)     "vmware: " fmt
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 8639bb2ae058..cbd73eb42170 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -29,6 +29,12 @@
 #include <asm/ftrace.h>
 #include <asm/nops.h>
 
+#if defined(CONFIG_FUNCTION_GRAPH_TRACER) && \
+        !defined(CC_USING_FENTRY) && \
+        !defined(CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE)
+# error The following combination is not supported: ((compiler missing -mfentry) || (CONFIG_X86_32 and !CONFIG_DYNAMIC_FTRACE)) && CONFIG_FUNCTION_GRAPH_TRACER && CONFIG_CC_OPTIMIZE_FOR_SIZE
+#endif
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 int ftrace_arch_code_modify_prepare(void)
@@ -535,7 +541,7 @@ static void run_sync(void)
 {
         int enable_irqs = irqs_disabled();
 
-        /* We may be called with interrupts disbled (on bootup). */
+        /* We may be called with interrupts disabled (on bootup). */
         if (enable_irqs)
                 local_irq_enable();
         on_each_cpu(do_sync_core, NULL, 1);
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 54a2372f5dbb..b5785c197e53 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -4,6 +4,7 @@
  *  Copyright (C) 2000 Andrea Arcangeli <andrea@suse.de> SuSE
  */
 
+#define DISABLE_BRANCH_PROFILING
 #include <linux/init.h>
 #include <linux/linkage.h>
 #include <linux/types.h>
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index dc6ba5bda9fc..89ff7af2de50 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -354,7 +354,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
 
                 irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
                 irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
-                disable_irq(hdev->irq);
+                disable_hardirq(hdev->irq);
                 irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
                 enable_irq(hdev->irq);
         }
diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
index bdb83e431d89..38b64587b31b 100644
--- a/arch/x86/kernel/kdebugfs.c
+++ b/arch/x86/kernel/kdebugfs.c
@@ -167,7 +167,7 @@ static int __init boot_params_kdebugfs_init(void)
         struct dentry *dbp, *version, *data;
         int error = -ENOMEM;
 
-        dbp = debugfs_create_dir("boot_params", NULL);
+        dbp = debugfs_create_dir("boot_params", arch_debugfs_dir);
         if (!dbp)
                 return -ENOMEM;
 
diff --git a/arch/x86/kernel/kprobes/common.h b/arch/x86/kernel/kprobes/common.h
index c6ee63f927ab..d688826e5736 100644
--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -67,7 +67,7 @@
 #endif
 
 /* Ensure if the instruction can be boostable */
-extern int can_boost(kprobe_opcode_t *instruction);
+extern int can_boost(kprobe_opcode_t *instruction, void *addr);
 /* Recover instruction if given address is probed */
 extern unsigned long recover_probed_instruction(kprobe_opcode_t *buf,
                                          unsigned long addr);
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 6384eb754a58..993fa4fe4f68 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -167,12 +167,12 @@ NOKPROBE_SYMBOL(skip_prefixes);
  * Returns non-zero if opcode is boostable.
  * RIP relative instructions are adjusted at copying time in 64 bits mode
  */
-int can_boost(kprobe_opcode_t *opcodes)
+int can_boost(kprobe_opcode_t *opcodes, void *addr)
 {
         kprobe_opcode_t opcode;
         kprobe_opcode_t *orig_opcodes = opcodes;
 
-        if (search_exception_tables((unsigned long)opcodes))
+        if (search_exception_tables((unsigned long)addr))
                 return 0;       /* Page fault may occur on this address. */
 
 retry:
@@ -417,7 +417,7 @@ static int arch_copy_kprobe(struct kprobe *p)
          * __copy_instruction can modify the displacement of the instruction,
          * but it doesn't affect boostable check.
          */
-        if (can_boost(p->ainsn.insn))
+        if (can_boost(p->ainsn.insn, p->addr))
                 p->ainsn.boostable = 0;
         else
                 p->ainsn.boostable = -1;
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 3d1bee9d6a72..3e7c6e5a08ff 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -178,7 +178,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src)
 
         while (len < RELATIVEJUMP_SIZE) {
                 ret = __copy_instruction(dest + len, src + len);
-                if (!ret || !can_boost(dest + len))
+                if (!ret || !can_boost(dest + len, src + len))
                         return -EINVAL;
                 len += ret;
         }
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 307b1f4543de..857cdbd02867 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -194,19 +194,22 @@ static int arch_update_purgatory(struct kimage *image)
 
         /* Setup copying of backup region */
         if (image->type == KEXEC_TYPE_CRASH) {
-                ret = kexec_purgatory_get_set_symbol(image, "backup_dest",
+                ret = kexec_purgatory_get_set_symbol(image,
+                                "purgatory_backup_dest",
                                 &image->arch.backup_load_addr,
                                 sizeof(image->arch.backup_load_addr), 0);
                 if (ret)
                         return ret;
 
-                ret = kexec_purgatory_get_set_symbol(image, "backup_src",
+                ret = kexec_purgatory_get_set_symbol(image,
+                                "purgatory_backup_src",
                                 &image->arch.backup_src_start,
                                 sizeof(image->arch.backup_src_start), 0);
                 if (ret)
                         return ret;
 
-                ret = kexec_purgatory_get_set_symbol(image, "backup_sz",
+                ret = kexec_purgatory_get_set_symbol(image,
+                                "purgatory_backup_sz",
                                 &image->arch.backup_src_sz,
                                 sizeof(image->arch.backup_src_sz), 0);
                 if (ret)
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index f088ea4c66e7..a723ae9440ab 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -166,11 +166,9 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
         spin_lock_irqsave(&desc->lock, flags);
 
         /*
-         * most handlers of type NMI_UNKNOWN never return because
-         * they just assume the NMI is theirs.  Just a sanity check
-         * to manage expectations
+         * Indicate if there are multiple registrations on the
+         * internal NMI handler call chains (SERR and IO_CHECK).
          */
-        WARN_ON_ONCE(type == NMI_UNKNOWN && !list_empty(&desc->head));
         WARN_ON_ONCE(type == NMI_SERR && !list_empty(&desc->head));
         WARN_ON_ONCE(type == NMI_IO_CHECK && !list_empty(&desc->head));
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index e244c19a2451..067f9813fd2c 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -223,6 +223,22 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
                 },
         },
+        {       /* Handle problems with rebooting on ASUS EeeBook X205TA */
+                .callback = set_acpi_reboot,
+                .ident = "ASUS EeeBook X205TA",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X205TA"),
+                },
+        },
+        {       /* Handle problems with rebooting on ASUS EeeBook X205TAW */
+                .callback = set_acpi_reboot,
+                .ident = "ASUS EeeBook X205TAW",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X205TAW"),
+                },
+        },
 
         /* Certec */
         {       /* Handle problems with rebooting on Certec BPC600 */
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index 396c042e9d0e..cc30a74e4adb 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -846,7 +846,7 @@ void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
                        task_pid_nr(current) > 1 ? KERN_INFO : KERN_EMERG,
                        me->comm, me->pid, where, frame,
                        regs->ip, regs->sp, regs->orig_ax);
-                print_vma_addr(" in ", regs->ip);
+                print_vma_addr(KERN_CONT " in ", regs->ip);
                 pr_cont("\n");
         }
 
diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
index ec1f756f9dc9..71beb28600d4 100644
--- a/arch/x86/kernel/signal_compat.c
+++ b/arch/x86/kernel/signal_compat.c
@@ -151,8 +151,8 @@ int __copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from,
 
                                 if (from->si_signo == SIGSEGV) {
                                         if (from->si_code == SEGV_BNDERR) {
-                                                compat_uptr_t lower = (unsigned long)&to->si_lower;
-                                                compat_uptr_t upper = (unsigned long)&to->si_upper;
+                                                compat_uptr_t lower = (unsigned long)from->si_lower;
+                                                compat_uptr_t upper = (unsigned long)from->si_upper;
                                                 put_user_ex(lower, &to->si_lower);
                                                 put_user_ex(upper, &to->si_upper);
                                         }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 948443e115c1..4e496379a871 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -255,7 +255,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
                 pr_info("%s[%d] trap %s ip:%lx sp:%lx error:%lx",
                         tsk->comm, tsk->pid, str,
                         regs->ip, regs->sp, error_code);
-                print_vma_addr(" in ", regs->ip);
+                print_vma_addr(KERN_CONT " in ", regs->ip);
                 pr_cont("\n");
         }
 
@@ -519,7 +519,7 @@ do_general_protection(struct pt_regs *regs, long error_code)
                 pr_info("%s[%d] general protection ip:%lx sp:%lx error:%lx",
                         tsk->comm, task_pid_nr(tsk),
                         regs->ip, regs->sp, error_code);
-                print_vma_addr(" in ", regs->ip);
+                print_vma_addr(KERN_CONT " in ", regs->ip);
                 pr_cont("\n");
         }
 
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 46bcda4cb1c2..714dfba6a1e7 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -327,9 +327,16 @@ unsigned long long sched_clock(void)
 {
         return paravirt_sched_clock();
 }
+
+bool using_native_sched_clock(void)
+{
+        return pv_time_ops.sched_clock == native_sched_clock;
+}
 #else
 unsigned long long
 sched_clock(void) __attribute__((alias("native_sched_clock")));
+
+bool using_native_sched_clock(void) { return true; }
 #endif
 
 int check_tsc_unstable(void)
@@ -1112,8 +1119,10 @@ static void tsc_cs_mark_unstable(struct clocksource *cs)
 {
         if (tsc_unstable)
                 return;
+
         tsc_unstable = 1;
-        clear_sched_clock_stable();
+        if (using_native_sched_clock())
+                clear_sched_clock_stable();
         disable_sched_clock_irqtime();
         pr_info("Marking TSC unstable due to clocksource watchdog\n");
 }
@@ -1135,18 +1144,20 @@ static struct clocksource clocksource_tsc = {
 
 void mark_tsc_unstable(char *reason)
 {
-        if (!tsc_unstable) {
-                tsc_unstable = 1;
+        if (tsc_unstable)
+                return;
+
+        tsc_unstable = 1;
+        if (using_native_sched_clock())
                 clear_sched_clock_stable();
-                disable_sched_clock_irqtime();
-                pr_info("Marking TSC unstable due to %s\n", reason);
-                /* Change only the rating, when not registered */
-                if (clocksource_tsc.mult)
-                        clocksource_mark_unstable(&clocksource_tsc);
-                else {
-                        clocksource_tsc.flags |= CLOCK_SOURCE_UNSTABLE;
-                        clocksource_tsc.rating = 0;
-                }
+        disable_sched_clock_irqtime();
+        pr_info("Marking TSC unstable due to %s\n", reason);
+        /* Change only the rating, when not registered */
+        if (clocksource_tsc.mult) {
+                clocksource_mark_unstable(&clocksource_tsc);
+        } else {
+                clocksource_tsc.flags |= CLOCK_SOURCE_UNSTABLE;
+                clocksource_tsc.rating = 0;
         }
 }
 
@@ -1322,6 +1333,8 @@ static int __init init_tsc_clocksource(void)
          * the refined calibration and directly register it as a clocksource.
          */
         if (boot_cpu_has(X86_FEATURE_TSC_KNOWN_FREQ)) {
+                if (boot_cpu_has(X86_FEATURE_ART))
+                        art_related_clocksource = &clocksource_tsc;
                 clocksource_register_khz(&clocksource_tsc, tsc_khz);
                 return 0;
         }
diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index 478d15dbaee4..08339262b666 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -82,19 +82,43 @@ static size_t regs_size(struct pt_regs *regs)
         return sizeof(*regs);
 }
 
+#ifdef CONFIG_X86_32
+#define GCC_REALIGN_WORDS 3
+#else
+#define GCC_REALIGN_WORDS 1
+#endif
+
 static bool is_last_task_frame(struct unwind_state *state)
 {
-        unsigned long bp = (unsigned long)state->bp;
-        unsigned long regs = (unsigned long)task_pt_regs(state->task);
+        unsigned long *last_bp = (unsigned long *)task_pt_regs(state->task) - 2;
+        unsigned long *aligned_bp = last_bp - GCC_REALIGN_WORDS;
 
         /*
          * We have to check for the last task frame at two different locations
          * because gcc can occasionally decide to realign the stack pointer and
-         * change the offset of the stack frame by a word in the prologue of a
-         * function called by head/entry code.
+         * change the offset of the stack frame in the prologue of a function
+         * called by head/entry code.  Examples:
+         *
+         * <start_secondary>:
+         *      push   %edi
+         *      lea    0x8(%esp),%edi
+         *      and    $0xfffffff8,%esp
+         *      pushl  -0x4(%edi)
+         *      push   %ebp
+         *      mov    %esp,%ebp
+         *
+         * <x86_64_start_kernel>:
+         *      lea    0x8(%rsp),%r10
+         *      and    $0xfffffffffffffff0,%rsp
+         *      pushq  -0x8(%r10)
+         *      push   %rbp
+         *      mov    %rsp,%rbp
+         *
+         * Note that after aligning the stack, it pushes a duplicate copy of
+         * the return address before pushing the frame pointer.
          */
-        return bp == regs - FRAME_HEADER_SIZE ||
-               bp == regs - FRAME_HEADER_SIZE - sizeof(long);
+        return (state->bp == last_bp ||
+                (state->bp == aligned_bp && *(aligned_bp+1) == *(last_bp+1)));
 }
 
 /*
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index 73ea24d4f119..047b17a26269 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -657,6 +657,9 @@ void kvm_pic_destroy(struct kvm *kvm)
 {
         struct kvm_pic *vpic = kvm->arch.vpic;
 
+        if (!vpic)
+                return;
+
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_master);
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_slave);
         kvm_io_bus_unregister_dev(vpic->kvm, KVM_PIO_BUS, &vpic->dev_eclr);
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 6e219e5c07d2..289270a6aecb 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -635,6 +635,9 @@ void kvm_ioapic_destroy(struct kvm *kvm)
 {
         struct kvm_ioapic *ioapic = kvm->arch.vioapic;
 
+        if (!ioapic)
+                return;
+
         cancel_delayed_work_sync(&ioapic->eoi_inject);
         kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS, &ioapic->dev);
         kvm->arch.vioapic = NULL;
diff --git a/arch/x86/kvm/page_track.c b/arch/x86/kvm/page_track.c
index 37942e419c32..60168cdd0546 100644
--- a/arch/x86/kvm/page_track.c
+++ b/arch/x86/kvm/page_track.c
@@ -160,6 +160,14 @@ bool kvm_page_track_is_active(struct kvm_vcpu *vcpu, gfn_t gfn,
         return !!ACCESS_ONCE(slot->arch.gfn_track[mode][index]);
 }
 
+void kvm_page_track_cleanup(struct kvm *kvm)
+{
+        struct kvm_page_track_notifier_head *head;
+
+        head = &kvm->arch.track_notifier_head;
+        cleanup_srcu_struct(&head->track_srcu);
+}
+
 void kvm_page_track_init(struct kvm *kvm)
 {
         struct kvm_page_track_notifier_head *head;
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d1efe2c62b3f..5fba70646c32 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1379,6 +1379,9 @@ static void avic_vm_destroy(struct kvm *kvm)
         unsigned long flags;
         struct kvm_arch *vm_data = &kvm->arch;
 
+        if (!avic)
+                return;
+
         avic_free_vm_id(vm_data->avic_vm_id);
 
         if (vm_data->avic_logical_id_table_page)
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 283aa8601833..259e9b28ccf8 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1239,6 +1239,11 @@ static inline bool cpu_has_vmx_invvpid_global(void)
         return vmx_capability.vpid & VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT;
 }
 
+static inline bool cpu_has_vmx_invvpid(void)
+{
+        return vmx_capability.vpid & VMX_VPID_INVVPID_BIT;
+}
+
 static inline bool cpu_has_vmx_ept(void)
 {
         return vmcs_config.cpu_based_2nd_exec_ctrl &
@@ -2753,7 +2758,6 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
                 SECONDARY_EXEC_RDTSCP |
                 SECONDARY_EXEC_DESC |
                 SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
-                SECONDARY_EXEC_ENABLE_VPID |
                 SECONDARY_EXEC_APIC_REGISTER_VIRT |
                 SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
                 SECONDARY_EXEC_WBINVD_EXITING |
@@ -2781,10 +2785,12 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
          * though it is treated as global context.  The alternative is
          * not failing the single-context invvpid, and it is worse.
          */
-        if (enable_vpid)
+        if (enable_vpid) {
+                vmx->nested.nested_vmx_secondary_ctls_high |=
+                        SECONDARY_EXEC_ENABLE_VPID;
                 vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT |
                         VMX_VPID_EXTENT_SUPPORTED_MASK;
-        else
+        } else
                 vmx->nested.nested_vmx_vpid_caps = 0;
 
         if (enable_unrestricted_guest)
@@ -4024,6 +4030,12 @@ static void vmx_flush_tlb(struct kvm_vcpu *vcpu)
         __vmx_flush_tlb(vcpu, to_vmx(vcpu)->vpid);
 }
 
+static void vmx_flush_tlb_ept_only(struct kvm_vcpu *vcpu)
+{
+        if (enable_ept)
+                vmx_flush_tlb(vcpu);
+}
+
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu)
 {
         ulong cr0_guest_owned_bits = vcpu->arch.cr0_guest_owned_bits;
@@ -6517,8 +6529,10 @@ static __init int hardware_setup(void)
         if (boot_cpu_has(X86_FEATURE_NX))
                 kvm_enable_efer_bits(EFER_NX);
 
-        if (!cpu_has_vmx_vpid())
+        if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() ||
+                !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global()))
                 enable_vpid = 0;
+
         if (!cpu_has_vmx_shadow_vmcs())
                 enable_shadow_vmcs = 0;
         if (enable_shadow_vmcs)
@@ -7258,9 +7272,8 @@ static int handle_vmoff(struct kvm_vcpu *vcpu)
 static int handle_vmclear(struct kvm_vcpu *vcpu)
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
+        u32 zero = 0;
         gpa_t vmptr;
-        struct vmcs12 *vmcs12;
-        struct page *page;
 
         if (!nested_vmx_check_permission(vcpu))
                 return 1;
@@ -7271,22 +7284,9 @@ static int handle_vmclear(struct kvm_vcpu *vcpu)
         if (vmptr == vmx->nested.current_vmptr)
                 nested_release_vmcs12(vmx);
 
-        page = nested_get_page(vcpu, vmptr);
-        if (page == NULL) {
-                /*
-                 * For accurate processor emulation, VMCLEAR beyond available
-                 * physical memory should do nothing at all. However, it is
-                 * possible that a nested vmx bug, not a guest hypervisor bug,
-                 * resulted in this case, so let's shut down before doing any
-                 * more damage:
-                 */
-                kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
-                return 1;
-        }
-        vmcs12 = kmap(page);
-        vmcs12->launch_state = 0;
-        kunmap(page);
-        nested_release_page(page);
+        kvm_vcpu_write_guest(vcpu,
+                        vmptr + offsetof(struct vmcs12, launch_state),
+                        &zero, sizeof(zero));
 
         nested_free_vmcs02(vmx, vmptr);
 
@@ -8198,6 +8198,9 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                 return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES);
         case EXIT_REASON_PREEMPTION_TIMER:
                 return false;
+        case EXIT_REASON_PML_FULL:
+                /* We don't expose PML support to L1. */
+                return false;
         default:
                 return true;
         }
@@ -8515,7 +8518,8 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
             && kvm_vmx_exit_handlers[exit_reason])
                 return kvm_vmx_exit_handlers[exit_reason](vcpu);
         else {
-                WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason);
+                vcpu_unimpl(vcpu, "vmx: unexpected exit reason 0x%x\n",
+                                exit_reason);
                 kvm_queue_exception(vcpu, UD_VECTOR);
                 return 1;
         }
@@ -8561,6 +8565,7 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
         } else {
                 sec_exec_control &= ~SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE;
                 sec_exec_control |= SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+                vmx_flush_tlb_ept_only(vcpu);
         }
         vmcs_write32(SECONDARY_VM_EXEC_CONTROL, sec_exec_control);
 
@@ -8586,8 +8591,10 @@ static void vmx_set_apic_access_page_addr(struct kvm_vcpu *vcpu, hpa_t hpa)
          */
         if (!is_guest_mode(vcpu) ||
             !nested_cpu_has2(get_vmcs12(&vmx->vcpu),
-                             SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES))
+                             SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
                 vmcs_write64(APIC_ACCESS_ADDR, hpa);
+                vmx_flush_tlb_ept_only(vcpu);
+        }
 }
 
 static void vmx_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr)
@@ -9694,10 +9701,8 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
                 return false;
 
         page = nested_get_page(vcpu, vmcs12->msr_bitmap);
-        if (!page) {
-                WARN_ON(1);
+        if (!page)
                 return false;
-        }
         msr_bitmap_l1 = (unsigned long *)kmap(page);
 
         memset(msr_bitmap_l0, 0xff, PAGE_SIZE);
@@ -9990,7 +9995,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 {
         struct vcpu_vmx *vmx = to_vmx(vcpu);
         u32 exec_control;
-        bool nested_ept_enabled = false;
 
         vmcs_write16(GUEST_ES_SELECTOR, vmcs12->guest_es_selector);
         vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector);
@@ -10137,8 +10141,6 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
                                 vmcs12->guest_intr_status);
                 }
 
-                nested_ept_enabled = (exec_control & SECONDARY_EXEC_ENABLE_EPT) != 0;
-
                 /*
                  * Write an illegal value to APIC_ACCESS_ADDR. Later,
                  * nested_get_vmcs12_pages will either fix it up or
@@ -10268,9 +10270,24 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
 
         }
 
+        if (enable_pml) {
+                /*
+                 * Conceptually we want to copy the PML address and index from
+                 * vmcs01 here, and then back to vmcs01 on nested vmexit. But,
+                 * since we always flush the log on each vmexit, this happens
+                 * to be equivalent to simply resetting the fields in vmcs02.
+                 */
+                ASSERT(vmx->pml_pg);
+                vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg));
+                vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1);
+        }
+
         if (nested_cpu_has_ept(vmcs12)) {
                 kvm_mmu_unload(vcpu);
                 nested_ept_init_mmu_context(vcpu);
+        } else if (nested_cpu_has2(vmcs12,
+                                   SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                vmx_flush_tlb_ept_only(vcpu);
         }
 
         /*
@@ -10298,12 +10315,10 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
         vmx_set_efer(vcpu, vcpu->arch.efer);
 
         /* Shadow page tables on either EPT or shadow page tables. */
-        if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_ept_enabled,
+        if (nested_vmx_load_cr3(vcpu, vmcs12->guest_cr3, nested_cpu_has_ept(vmcs12),
                                 entry_failure_code))
                 return 1;
 
-        kvm_mmu_reset_context(vcpu);
-
         if (!enable_ept)
                 vcpu->arch.walk_mmu->inject_page_fault = vmx_inject_page_fault_nested;
 
@@ -11072,6 +11087,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
                 vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
                 vmx_set_virtual_x2apic_mode(vcpu,
                                 vcpu->arch.apic_base & X2APIC_ENABLE);
+        } else if (!nested_cpu_has_ept(vmcs12) &&
+                   nested_cpu_has2(vmcs12,
+                                   SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES)) {
+                vmx_flush_tlb_ept_only(vcpu);
         }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
@@ -11121,8 +11140,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
  */
 static void vmx_leave_nested(struct kvm_vcpu *vcpu)
 {
-        if (is_guest_mode(vcpu))
+        if (is_guest_mode(vcpu)) {
+                to_vmx(vcpu)->nested.nested_run_pending = 0;
                 nested_vmx_vmexit(vcpu, -1, 0, 0);
+        }
         free_nested(to_vmx(vcpu));
 }
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1faf620a6fdc..ccbd45ecd41a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8153,11 +8153,12 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
         if (kvm_x86_ops->vm_destroy)
                 kvm_x86_ops->vm_destroy(kvm);
         kvm_iommu_unmap_guest(kvm);
-        kfree(kvm->arch.vpic);
-        kfree(kvm->arch.vioapic);
+        kvm_pic_destroy(kvm);
+        kvm_ioapic_destroy(kvm);
         kvm_free_vcpus(kvm);
         kvfree(rcu_dereference_check(kvm->arch.apic_map, 1));
         kvm_mmu_uninit_vm(kvm);
+        kvm_page_track_cleanup(kvm);
 }
 
 void kvm_arch_free_memslot(struct kvm *kvm, struct kvm_memory_slot *free,
@@ -8566,11 +8567,11 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
 {
         struct x86_exception fault;
 
-        trace_kvm_async_pf_ready(work->arch.token, work->gva);
         if (work->wakeup_all)
                 work->arch.token = ~0; /* broadcast wakeup */
         else
                 kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
+        trace_kvm_async_pf_ready(work->arch.token, work->gva);
 
         if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) &&
             !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
index 779782f58324..9a53a06e5a3e 100644
--- a/arch/x86/lib/memcpy_64.S
+++ b/arch/x86/lib/memcpy_64.S
@@ -290,7 +290,7 @@ EXPORT_SYMBOL_GPL(memcpy_mcsafe_unrolled)
         _ASM_EXTABLE_FAULT(.L_copy_leading_bytes, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w0, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w1, .L_memcpy_mcsafe_fail)
-        _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
+        _ASM_EXTABLE_FAULT(.L_cache_w2, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w3, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w4, .L_memcpy_mcsafe_fail)
         _ASM_EXTABLE_FAULT(.L_cache_w5, .L_memcpy_mcsafe_fail)
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index 99c7805a9693..1f3b6ef105cd 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -106,32 +106,35 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                 unsigned long end, int write, struct page **pages, int *nr)
 {
         struct dev_pagemap *pgmap = NULL;
-        int nr_start = *nr;
-        pte_t *ptep;
+        int nr_start = *nr, ret = 0;
+        pte_t *ptep, *ptem;
 
-        ptep = pte_offset_map(&pmd, addr);
+        /*
+         * Keep the original mapped PTE value (ptem) around since we
+         * might increment ptep off the end of the page when finishing
+         * our loop iteration.
+         */
+        ptem = ptep = pte_offset_map(&pmd, addr);
         do {
                 pte_t pte = gup_get_pte(ptep);
                 struct page *page;
 
                 /* Similar to the PMD case, NUMA hinting must take slow path */
-                if (pte_protnone(pte)) {
-                        pte_unmap(ptep);
-                        return 0;
-                }
+                if (pte_protnone(pte))
+                        break;
+
+                if (!pte_allows_gup(pte_val(pte), write))
+                        break;
 
                 if (pte_devmap(pte)) {
                         pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
                         if (unlikely(!pgmap)) {
                                 undo_dev_pagemap(nr, nr_start, pages);
-                                pte_unmap(ptep);
-                                return 0;
+                                break;
                         }
-                } else if (!pte_allows_gup(pte_val(pte), write) ||
-                           pte_special(pte)) {
-                        pte_unmap(ptep);
-                        return 0;
-                }
+                } else if (pte_special(pte))
+                        break;
+
                 VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
                 page = pte_page(pte);
                 get_page(page);
@@ -141,9 +144,11 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                 (*nr)++;
 
         } while (ptep++, addr += PAGE_SIZE, addr != end);
-        pte_unmap(ptep - 1);
+        if (addr == end)
+                ret = 1;
+        pte_unmap(ptem);
 
-        return 1;
+        return ret;
 }
 
 static inline void get_head_page_multiple(struct page *page, int nr)
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 22af912d66d2..889e7619a091 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -643,21 +643,40 @@ void __init init_mem_mapping(void)
  * devmem_is_allowed() checks to see if /dev/mem access to a certain address
  * is valid. The argument is a physical page number.
  *
- *
- * On x86, access has to be given to the first megabyte of ram because that area
- * contains BIOS code and data regions used by X and dosemu and similar apps.
- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
- * mmio resources as well as potential bios/acpi data regions.
+ * On x86, access has to be given to the first megabyte of RAM because that
+ * area traditionally contains BIOS code and data regions used by X, dosemu,
+ * and similar apps. Since they map the entire memory range, the whole range
+ * must be allowed (for mapping), but any areas that would otherwise be
+ * disallowed are flagged as being "zero filled" instead of rejected.
+ * Access has to be given to non-kernel-ram areas as well, these contain the
+ * PCI mmio resources as well as potential bios/acpi data regions.
  */
 int devmem_is_allowed(unsigned long pagenr)
 {
-        if (pagenr < 256)
-                return 1;
-        if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+        if (page_is_ram(pagenr)) {
+                /*
+                 * For disallowed memory regions in the low 1MB range,
+                 * request that the page be shown as all zeros.
+                 */
+                if (pagenr < 256)
+                        return 2;
+
+                return 0;
+        }
+
+        /*
+         * This must follow RAM test, since System RAM is considered a
+         * restricted resource under CONFIG_STRICT_IOMEM.
+         */
+        if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) {
+                /* Low 1MB bypasses iomem restrictions. */
+                if (pagenr < 256)
+                        return 1;
+
                 return 0;
-        if (!page_is_ram(pagenr))
-                return 1;
-        return 0;
+        }
+
+        return 1;
 }
 
 void free_init_pages(char *what, unsigned long begin, unsigned long end)
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index 8d63d7a104c3..4c90cfdc128b 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -1,3 +1,4 @@
+#define DISABLE_BRANCH_PROFILING
 #define pr_fmt(fmt) "kasan: " fmt
 #include <linux/bootmem.h>
 #include <linux/kasan.h>
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 887e57182716..aed206475aa7 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -48,7 +48,7 @@ static const unsigned long vaddr_start = __PAGE_OFFSET_BASE;
 #if defined(CONFIG_X86_ESPFIX64)
 static const unsigned long vaddr_end = ESPFIX_BASE_ADDR;
 #elif defined(CONFIG_EFI)
-static const unsigned long vaddr_end = EFI_VA_START;
+static const unsigned long vaddr_end = EFI_VA_END;
 #else
 static const unsigned long vaddr_end = __START_KERNEL_map;
 #endif
@@ -105,7 +105,7 @@ void __init kernel_randomize_memory(void)
          */
         BUILD_BUG_ON(vaddr_start >= vaddr_end);
         BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_ESPFIX64) &&
-                     vaddr_end >= EFI_VA_START);
+                     vaddr_end >= EFI_VA_END);
         BUILD_BUG_ON((IS_ENABLED(CONFIG_X86_ESPFIX64) ||
                       IS_ENABLED(CONFIG_EFI)) &&
                      vaddr_end >= __START_KERNEL_map);
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 5126dfd52b18..cd44ae727df7 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -590,7 +590,7 @@ static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm,
  * we might run off the end of the bounds table if we are on
  * a 64-bit kernel and try to get 8 bytes.
  */
-int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
+static int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
                 long __user *bd_entry_ptr)
 {
         u32 bd_entry_32;
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 0cb52ae0a8f0..190e718694b1 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -735,6 +735,15 @@ void pcibios_disable_device (struct pci_dev *dev)
                 pcibios_disable_irq(dev);
 }
 
+#ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
+void pcibios_release_device(struct pci_dev *dev)
+{
+        if (atomic_dec_return(&dev->enable_cnt) >= 0)
+                pcibios_disable_device(dev);
+
+}
+#endif
+
 int pci_ext_cfg_avail(void)
 {
         if (raw_pci_ext_ops)
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index e1fb269c87af..292ab0364a89 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -234,23 +234,14 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
                 return 1;
 
         for_each_pci_msi_entry(msidesc, dev) {
-                __pci_read_msi_msg(msidesc, &msg);
-                pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
-                        ((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff);
-                if (msg.data != XEN_PIRQ_MSI_DATA ||
-                    xen_irq_from_pirq(pirq) < 0) {
-                        pirq = xen_allocate_pirq_msi(dev, msidesc);
-                        if (pirq < 0) {
-                                irq = -ENODEV;
-                                goto error;
-                        }
-                        xen_msi_compose_msg(dev, pirq, &msg);
-                        __pci_write_msi_msg(msidesc, &msg);
-                        dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
-                } else {
-                        dev_dbg(&dev->dev,
-                                "xen: msi already bound to pirq=%d\n", pirq);
+                pirq = xen_allocate_pirq_msi(dev, msidesc);
+                if (pirq < 0) {
+                        irq = -ENODEV;
+                        goto error;
                 }
+                xen_msi_compose_msg(dev, pirq, &msg);
+                __pci_write_msi_msg(msidesc, &msg);
+                dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
                 irq = xen_bind_pirq_msi_to_irq(dev, msidesc, pirq,
                                                (type == PCI_CAP_ID_MSI) ? nvec : 1,
                                                (type == PCI_CAP_ID_MSIX) ?
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 30031d5293c4..cdfe8c628959 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -201,6 +201,10 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
                 return;
         }
 
+        /* No need to reserve regions that will never be freed. */
+        if (md.attribute & EFI_MEMORY_RUNTIME)
+                return;
+
         size += addr % EFI_PAGE_SIZE;
         size = round_up(size, EFI_PAGE_SIZE);
         addr = round_down(addr, EFI_PAGE_SIZE);
diff --git a/arch/x86/platform/intel-mid/device_libs/Makefile b/arch/x86/platform/intel-mid/device_libs/Makefile
index a7dbec4dce27..3dbde04febdc 100644
--- a/arch/x86/platform/intel-mid/device_libs/Makefile
+++ b/arch/x86/platform/intel-mid/device_libs/Makefile
@@ -26,5 +26,6 @@ obj-$(subst m,y,$(CONFIG_GPIO_PCA953X)) += platform_pcal9555a.o
 obj-$(subst m,y,$(CONFIG_GPIO_PCA953X)) += platform_tca6416.o
 # MISC Devices
 obj-$(subst m,y,$(CONFIG_KEYBOARD_GPIO)) += platform_gpio_keys.o
+obj-$(subst m,y,$(CONFIG_INTEL_MID_POWER_BUTTON)) += platform_mrfld_power_btn.o
 obj-$(subst m,y,$(CONFIG_RTC_DRV_CMOS)) += platform_mrfld_rtc.o
 obj-$(subst m,y,$(CONFIG_INTEL_MID_WATCHDOG)) += platform_mrfld_wdt.o
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_power_btn.c b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_power_btn.c
new file mode 100644
index 000000000000..a6c3705a28ad
--- /dev/null
+++ b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_power_btn.c
@@ -0,0 +1,82 @@
+/*
+ * Intel Merrifield power button support
+ *
+ * (C) Copyright 2017 Intel Corporation
+ *
+ * Author: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/sfi.h>
+
+#include <asm/intel-mid.h>
+#include <asm/intel_scu_ipc.h>
+
+static struct resource mrfld_power_btn_resources[] = {
+        {
+                .flags          = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device mrfld_power_btn_dev = {
+        .name           = "msic_power_btn",
+        .id             = PLATFORM_DEVID_NONE,
+        .num_resources  = ARRAY_SIZE(mrfld_power_btn_resources),
+        .resource       = mrfld_power_btn_resources,
+};
+
+static int mrfld_power_btn_scu_status_change(struct notifier_block *nb,
+                                             unsigned long code, void *data)
+{
+        if (code == SCU_DOWN) {
+                platform_device_unregister(&mrfld_power_btn_dev);
+                return 0;
+        }
+
+        return platform_device_register(&mrfld_power_btn_dev);
+}
+
+static struct notifier_block mrfld_power_btn_scu_notifier = {
+        .notifier_call  = mrfld_power_btn_scu_status_change,
+};
+
+static int __init register_mrfld_power_btn(void)
+{
+        if (intel_mid_identify_cpu() != INTEL_MID_CPU_CHIP_TANGIER)
+                return -ENODEV;
+
+        /*
+         * We need to be sure that the SCU IPC is ready before
+         * PMIC power button device can be registered:
+         */
+        intel_scu_notifier_add(&mrfld_power_btn_scu_notifier);
+
+        return 0;
+}
+arch_initcall(register_mrfld_power_btn);
+
+static void __init *mrfld_power_btn_platform_data(void *info)
+{
+        struct resource *res = mrfld_power_btn_resources;
+        struct sfi_device_table_entry *pentry = info;
+
+        res->start = res->end = pentry->irq;
+        return NULL;
+}
+
+static const struct devs_id mrfld_power_btn_dev_id __initconst = {
+        .name                   = "bcove_power_btn",
+        .type                   = SFI_DEV_TYPE_IPC,
+        .delay                  = 1,
+        .msic                   = 1,
+        .get_platform_data      = &mrfld_power_btn_platform_data,
+};
+
+sfi_device(mrfld_power_btn_dev_id);
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
index 86edd1e941eb..9e304e2ea4f5 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c
@@ -19,7 +19,7 @@
 #include <asm/intel_scu_ipc.h>
 #include <asm/io_apic.h>
 
-#define TANGIER_EXT_TIMER0_MSI 15
+#define TANGIER_EXT_TIMER0_MSI 12
 
 static struct platform_device wdt_dev = {
         .name = "intel_mid_wdt",
diff --git a/arch/x86/platform/intel-mid/mfld.c b/arch/x86/platform/intel-mid/mfld.c
index e793fe509971..e42978d4deaf 100644
--- a/arch/x86/platform/intel-mid/mfld.c
+++ b/arch/x86/platform/intel-mid/mfld.c
@@ -17,16 +17,6 @@
 
 #include "intel_mid_weak_decls.h"
 
-static void penwell_arch_setup(void);
-/* penwell arch ops */
-static struct intel_mid_ops penwell_ops = {
-        .arch_setup = penwell_arch_setup,
-};
-
-static void mfld_power_off(void)
-{
-}
-
 static unsigned long __init mfld_calibrate_tsc(void)
 {
         unsigned long fast_calibrate;
@@ -63,9 +53,12 @@ static unsigned long __init mfld_calibrate_tsc(void)
 static void __init penwell_arch_setup(void)
 {
         x86_platform.calibrate_tsc = mfld_calibrate_tsc;
-        pm_power_off = mfld_power_off;
 }
 
+static struct intel_mid_ops penwell_ops = {
+        .arch_setup = penwell_arch_setup,
+};
+
 void *get_penwell_ops(void)
 {
         return &penwell_ops;
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 766d4d3529a1..f25982cdff90 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1847,7 +1847,6 @@ static void pq_init(int node, int pnode)
 
         ops.write_payload_first(pnode, first);
         ops.write_payload_last(pnode, last);
-        ops.write_g_sw_ack(pnode, 0xffffUL);
 
         /* in effect, all msg_type's are set to MSG_NOOP */
         memset(pqp, 0, sizeof(struct bau_pq_entry) * DEST_Q_SIZE);
diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
index 555b9fa0ad43..7dbdb780264d 100644
--- a/arch/x86/purgatory/Makefile
+++ b/arch/x86/purgatory/Makefile
@@ -8,6 +8,7 @@ PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
 LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib
 targets += purgatory.ro
 
+KASAN_SANITIZE  := n
 KCOV_INSTRUMENT := n
 
 # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
diff --git a/arch/x86/purgatory/purgatory.c b/arch/x86/purgatory/purgatory.c
index 25e068ba3382..470edad96bb9 100644
--- a/arch/x86/purgatory/purgatory.c
+++ b/arch/x86/purgatory/purgatory.c
@@ -10,21 +10,19 @@
  * Version 2.  See the file COPYING for more details.
  */
 
+#include <linux/bug.h>
+#include <asm/purgatory.h>
+
 #include "sha256.h"
 #include "../boot/string.h"
 
-struct sha_region {
-        unsigned long start;
-        unsigned long len;
-};
-
-unsigned long backup_dest = 0;
-unsigned long backup_src = 0;
-unsigned long backup_sz = 0;
+unsigned long purgatory_backup_dest __section(.kexec-purgatory);
+unsigned long purgatory_backup_src __section(.kexec-purgatory);
+unsigned long purgatory_backup_sz __section(.kexec-purgatory);
 
-u8 sha256_digest[SHA256_DIGEST_SIZE] = { 0 };
+u8 purgatory_sha256_digest[SHA256_DIGEST_SIZE] __section(.kexec-purgatory);
 
-struct sha_region sha_regions[16] = {};
+struct kexec_sha_region purgatory_sha_regions[KEXEC_SEGMENT_MAX] __section(.kexec-purgatory);
 
 /*
  * On x86, second kernel requries first 640K of memory to boot. Copy
@@ -33,26 +31,28 @@ struct sha_region sha_regions[16] = {};
  */
 static int copy_backup_region(void)
 {
-        if (backup_dest)
-                memcpy((void *)backup_dest, (void *)backup_src, backup_sz);
-
+        if (purgatory_backup_dest) {
+                memcpy((void *)purgatory_backup_dest,
+                       (void *)purgatory_backup_src, purgatory_backup_sz);
+        }
         return 0;
 }
 
-int verify_sha256_digest(void)
+static int verify_sha256_digest(void)
 {
-        struct sha_region *ptr, *end;
+        struct kexec_sha_region *ptr, *end;
         u8 digest[SHA256_DIGEST_SIZE];
         struct sha256_state sctx;
 
         sha256_init(&sctx);
-        end = &sha_regions[sizeof(sha_regions)/sizeof(sha_regions[0])];
-        for (ptr = sha_regions; ptr < end; ptr++)
+        end = purgatory_sha_regions + ARRAY_SIZE(purgatory_sha_regions);
+
+        for (ptr = purgatory_sha_regions; ptr < end; ptr++)
                 sha256_update(&sctx, (uint8_t *)(ptr->start), ptr->len);
 
         sha256_final(&sctx, digest);
 
-        if (memcmp(digest, sha256_digest, sizeof(digest)))
+        if (memcmp(digest, purgatory_sha256_digest, sizeof(digest)))
                 return 1;
 
         return 0;
diff --git a/arch/x86/purgatory/setup-x86_64.S b/arch/x86/purgatory/setup-x86_64.S
index fe3c91ba1bd0..dfae9b9e60b5 100644
--- a/arch/x86/purgatory/setup-x86_64.S
+++ b/arch/x86/purgatory/setup-x86_64.S
@@ -9,6 +9,7 @@
  * This source code is licensed under the GNU General Public License,
  * Version 2.  See the file COPYING for more details.
  */
+#include <asm/purgatory.h>
 
         .text
         .globl purgatory_start
diff --git a/arch/x86/purgatory/sha256.h b/arch/x86/purgatory/sha256.h
index bd15a4127735..2867d9825a57 100644
--- a/arch/x86/purgatory/sha256.h
+++ b/arch/x86/purgatory/sha256.h
@@ -10,7 +10,6 @@
 #ifndef SHA256_H
 #define SHA256_H
 
-
 #include <linux/types.h>
 #include <crypto/sha.h>
 
diff --git a/arch/xtensa/include/asm/page.h b/arch/xtensa/include/asm/page.h
index 976b1d70edbc..4ddbfd57a7c8 100644
--- a/arch/xtensa/include/asm/page.h
+++ b/arch/xtensa/include/asm/page.h
@@ -164,8 +164,21 @@ void copy_user_highpage(struct page *to, struct page *from,
 
 #define ARCH_PFN_OFFSET         (PHYS_OFFSET >> PAGE_SHIFT)
 
+#ifdef CONFIG_MMU
+static inline unsigned long ___pa(unsigned long va)
+{
+        unsigned long off = va - PAGE_OFFSET;
+
+        if (off >= XCHAL_KSEG_SIZE)
+                off -= XCHAL_KSEG_SIZE;
+
+        return off + PHYS_OFFSET;
+}
+#define __pa(x) ___pa((unsigned long)(x))
+#else
 #define __pa(x) \
         ((unsigned long) (x) - PAGE_OFFSET + PHYS_OFFSET)
+#endif
 #define __va(x) \
         ((void *)((unsigned long) (x) - PHYS_OFFSET + PAGE_OFFSET))
 #define pfn_valid(pfn) \
diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h
index 8aa0e0d9cbb2..30dd5b2e4ad5 100644
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -11,6 +11,7 @@
 #ifndef _XTENSA_PGTABLE_H
 #define _XTENSA_PGTABLE_H
 
+#define __ARCH_USE_5LEVEL_HACK
 #include <asm-generic/pgtable-nopmd.h>
 #include <asm/page.h>
 #include <asm/kmem_layout.h>
diff --git a/arch/xtensa/include/uapi/asm/unistd.h b/arch/xtensa/include/uapi/asm/unistd.h
index cd400af4a6b2..6be7eb27fd29 100644
--- a/arch/xtensa/include/uapi/asm/unistd.h
+++ b/arch/xtensa/include/uapi/asm/unistd.h
@@ -774,7 +774,10 @@ __SYSCALL(349, sys_pkey_alloc, 2)
 #define __NR_pkey_free                          350
 __SYSCALL(350, sys_pkey_free, 1)
 
-#define __NR_syscall_count                      351
+#define __NR_statx                              351
+__SYSCALL(351, sys_statx, 5)
+
+#define __NR_syscall_count                      352
 
 /*
  * sysxtensa syscall handler
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index c82c43bff296..bae697a06a98 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -483,10 +483,8 @@ void show_regs(struct pt_regs * regs)
 
 static int show_trace_cb(struct stackframe *frame, void *data)
 {
-        if (kernel_text_address(frame->pc)) {
-                pr_cont(" [<%08lx>]", frame->pc);
-                print_symbol(" %s\n", frame->pc);
-        }
+        if (kernel_text_address(frame->pc))
+                pr_cont(" [<%08lx>] %pB\n", frame->pc, (void *)frame->pc);
         return 0;
 }
 
diff --git a/block/bio.c b/block/bio.c
index 5eec5e08417f..e75878f8b14a 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -376,10 +376,14 @@ static void punt_bios_to_rescuer(struct bio_set *bs)
         bio_list_init(&punt);
         bio_list_init(&nopunt);
 
-        while ((bio = bio_list_pop(current->bio_list)))
+        while ((bio = bio_list_pop(&current->bio_list[0])))
                 bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio);
+        current->bio_list[0] = nopunt;
 
-        *current->bio_list = nopunt;
+        bio_list_init(&nopunt);
+        while ((bio = bio_list_pop(&current->bio_list[1])))
+                bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio);
+        current->bio_list[1] = nopunt;
 
         spin_lock(&bs->rescue_lock);
         bio_list_merge(&bs->rescue_list, &punt);
@@ -466,7 +470,9 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
                  * we retry with the original gfp_flags.
                  */
 
-                if (current->bio_list && !bio_list_empty(current->bio_list))
+                if (current->bio_list &&
+                    (!bio_list_empty(&current->bio_list[0]) ||
+                     !bio_list_empty(&current->bio_list[1])))
                         gfp_mask &= ~__GFP_DIRECT_RECLAIM;
 
                 p = mempool_alloc(bs->bio_pool, gfp_mask);
diff --git a/block/blk-core.c b/block/blk-core.c
index 1086dac8724c..d772c221cc17 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -578,8 +578,6 @@ void blk_cleanup_queue(struct request_queue *q)
                 q->queue_lock = &q->__queue_lock;
         spin_unlock_irq(lock);
 
-        put_disk_devt(q->disk_devt);
-
         /* @q is and will stay empty, shutdown and put */
         blk_put_queue(q);
 }
@@ -1975,7 +1973,14 @@ end_io:
  */
 blk_qc_t generic_make_request(struct bio *bio)
 {
-        struct bio_list bio_list_on_stack;
+        /*
+         * bio_list_on_stack[0] contains bios submitted by the current
+         * make_request_fn.
+         * bio_list_on_stack[1] contains bios that were submitted before
+         * the current make_request_fn, but that haven't been processed
+         * yet.
+         */
+        struct bio_list bio_list_on_stack[2];
         blk_qc_t ret = BLK_QC_T_NONE;
 
         if (!generic_make_request_checks(bio))
@@ -1992,7 +1997,7 @@ blk_qc_t generic_make_request(struct bio *bio)
          * should be added at the tail
          */
         if (current->bio_list) {
-                bio_list_add(current->bio_list, bio);
+                bio_list_add(&current->bio_list[0], bio);
                 goto out;
         }
 
@@ -2011,23 +2016,39 @@ blk_qc_t generic_make_request(struct bio *bio)
          * bio_list, and call into ->make_request() again.
          */
         BUG_ON(bio->bi_next);
-        bio_list_init(&bio_list_on_stack);
-        current->bio_list = &bio_list_on_stack;
+        bio_list_init(&bio_list_on_stack[0]);
+        current->bio_list = bio_list_on_stack;
         do {
                 struct request_queue *q = bdev_get_queue(bio->bi_bdev);
 
                 if (likely(blk_queue_enter(q, false) == 0)) {
+                        struct bio_list lower, same;
+
+                        /* Create a fresh bio_list for all subordinate requests */
+                        bio_list_on_stack[1] = bio_list_on_stack[0];
+                        bio_list_init(&bio_list_on_stack[0]);
                         ret = q->make_request_fn(q, bio);
 
                         blk_queue_exit(q);
 
-                        bio = bio_list_pop(current->bio_list);
+                        /* sort new bios into those for a lower level
+                         * and those for the same level
+                         */
+                        bio_list_init(&lower);
+                        bio_list_init(&same);
+                        while ((bio = bio_list_pop(&bio_list_on_stack[0])) != NULL)
+                                if (q == bdev_get_queue(bio->bi_bdev))
+                                        bio_list_add(&same, bio);
+                                else
+                                        bio_list_add(&lower, bio);
+                        /* now assemble so we handle the lowest level first */
+                        bio_list_merge(&bio_list_on_stack[0], &lower);
+                        bio_list_merge(&bio_list_on_stack[0], &same);
+                        bio_list_merge(&bio_list_on_stack[0], &bio_list_on_stack[1]);
                 } else {
-                        struct bio *bio_next = bio_list_pop(current->bio_list);
-
                         bio_io_error(bio);
-                        bio = bio_next;
                 }
+                bio = bio_list_pop(&bio_list_on_stack[0]);
         } while (bio);
         current->bio_list = NULL; /* deactivate */
 
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 09af8ff18719..c974a1bbf4cb 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -171,7 +171,8 @@ void blk_mq_sched_put_request(struct request *rq)
 
 void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)
 {
-        struct elevator_queue *e = hctx->queue->elevator;
+        struct request_queue *q = hctx->queue;
+        struct elevator_queue *e = q->elevator;
         const bool has_sched_dispatch = e && e->type->ops.mq.dispatch_request;
         bool did_work = false;
         LIST_HEAD(rq_list);
@@ -203,10 +204,10 @@ void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)
          */
         if (!list_empty(&rq_list)) {
                 blk_mq_sched_mark_restart_hctx(hctx);
-                did_work = blk_mq_dispatch_rq_list(hctx, &rq_list);
+                did_work = blk_mq_dispatch_rq_list(q, &rq_list);
         } else if (!has_sched_dispatch) {
                 blk_mq_flush_busy_ctxs(hctx, &rq_list);
-                blk_mq_dispatch_rq_list(hctx, &rq_list);
+                blk_mq_dispatch_rq_list(q, &rq_list);
         }
 
         /*
@@ -222,7 +223,7 @@ void blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx)
                         if (!rq)
                                 break;
                         list_add(&rq->queuelist, &rq_list);
-                } while (blk_mq_dispatch_rq_list(hctx, &rq_list));
+                } while (blk_mq_dispatch_rq_list(q, &rq_list));
         }
 }
 
@@ -317,25 +318,68 @@ static bool blk_mq_sched_bypass_insert(struct blk_mq_hw_ctx *hctx,
         return true;
 }
 
-static void blk_mq_sched_restart_hctx(struct blk_mq_hw_ctx *hctx)
+static bool blk_mq_sched_restart_hctx(struct blk_mq_hw_ctx *hctx)
 {
         if (test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state)) {
                 clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
-                if (blk_mq_hctx_has_pending(hctx))
+                if (blk_mq_hctx_has_pending(hctx)) {
                         blk_mq_run_hw_queue(hctx, true);
+                        return true;
+                }
         }
+        return false;
 }
 
-void blk_mq_sched_restart_queues(struct blk_mq_hw_ctx *hctx)
-{
-        struct request_queue *q = hctx->queue;
-        unsigned int i;
+/**
+ * list_for_each_entry_rcu_rr - iterate in a round-robin fashion over rcu list
+ * @pos:    loop cursor.
+ * @skip:   the list element that will not be examined. Iteration starts at
+ *          @skip->next.
+ * @head:   head of the list to examine. This list must have at least one
+ *          element, namely @skip.
+ * @member: name of the list_head structure within typeof(*pos).
+ */
+#define list_for_each_entry_rcu_rr(pos, skip, head, member)             \
+        for ((pos) = (skip);                                            \
+             (pos = (pos)->member.next != (head) ? list_entry_rcu(      \
+                        (pos)->member.next, typeof(*pos), member) :     \
+              list_entry_rcu((pos)->member.next->next, typeof(*pos), member)), \
+             (pos) != (skip); )
 
-        if (test_bit(QUEUE_FLAG_RESTART, &q->queue_flags)) {
-                if (test_and_clear_bit(QUEUE_FLAG_RESTART, &q->queue_flags)) {
-                        queue_for_each_hw_ctx(q, hctx, i)
-                                blk_mq_sched_restart_hctx(hctx);
+/*
+ * Called after a driver tag has been freed to check whether a hctx needs to
+ * be restarted. Restarts @hctx if its tag set is not shared. Restarts hardware
+ * queues in a round-robin fashion if the tag set of @hctx is shared with other
+ * hardware queues.
+ */
+void blk_mq_sched_restart(struct blk_mq_hw_ctx *const hctx)
+{
+        struct blk_mq_tags *const tags = hctx->tags;
+        struct blk_mq_tag_set *const set = hctx->queue->tag_set;
+        struct request_queue *const queue = hctx->queue, *q;
+        struct blk_mq_hw_ctx *hctx2;
+        unsigned int i, j;
+
+        if (set->flags & BLK_MQ_F_TAG_SHARED) {
+                rcu_read_lock();
+                list_for_each_entry_rcu_rr(q, queue, &set->tag_list,
+                                           tag_set_list) {
+                        queue_for_each_hw_ctx(q, hctx2, i)
+                                if (hctx2->tags == tags &&
+                                    blk_mq_sched_restart_hctx(hctx2))
+                                        goto done;
+                }
+                j = hctx->queue_num + 1;
+                for (i = 0; i < queue->nr_hw_queues; i++, j++) {
+                        if (j == queue->nr_hw_queues)
+                                j = 0;
+                        hctx2 = queue->queue_hw_ctx[j];
+                        if (hctx2->tags == tags &&
+                            blk_mq_sched_restart_hctx(hctx2))
+                                break;
                 }
+done:
+                rcu_read_unlock();
         } else {
                 blk_mq_sched_restart_hctx(hctx);
         }
@@ -431,11 +475,67 @@ static void blk_mq_sched_free_tags(struct blk_mq_tag_set *set,
         }
 }
 
-int blk_mq_sched_setup(struct request_queue *q)
+static int blk_mq_sched_alloc_tags(struct request_queue *q,
+                                   struct blk_mq_hw_ctx *hctx,
+                                   unsigned int hctx_idx)
+{
+        struct blk_mq_tag_set *set = q->tag_set;
+        int ret;
+
+        hctx->sched_tags = blk_mq_alloc_rq_map(set, hctx_idx, q->nr_requests,
+                                               set->reserved_tags);
+        if (!hctx->sched_tags)
+                return -ENOMEM;
+
+        ret = blk_mq_alloc_rqs(set, hctx->sched_tags, hctx_idx, q->nr_requests);
+        if (ret)
+                blk_mq_sched_free_tags(set, hctx, hctx_idx);
+
+        return ret;
+}
+
+static void blk_mq_sched_tags_teardown(struct request_queue *q)
 {
         struct blk_mq_tag_set *set = q->tag_set;
         struct blk_mq_hw_ctx *hctx;
-        int ret, i;
+        int i;
+
+        queue_for_each_hw_ctx(q, hctx, i)
+                blk_mq_sched_free_tags(set, hctx, i);
+}
+
+int blk_mq_sched_init_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                           unsigned int hctx_idx)
+{
+        struct elevator_queue *e = q->elevator;
+
+        if (!e)
+                return 0;
+
+        return blk_mq_sched_alloc_tags(q, hctx, hctx_idx);
+}
+
+void blk_mq_sched_exit_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                            unsigned int hctx_idx)
+{
+        struct elevator_queue *e = q->elevator;
+
+        if (!e)
+                return;
+
+        blk_mq_sched_free_tags(q->tag_set, hctx, hctx_idx);
+}
+
+int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e)
+{
+        struct blk_mq_hw_ctx *hctx;
+        unsigned int i;
+        int ret;
+
+        if (!e) {
+                q->elevator = NULL;
+                return 0;
+        }
 
         /*
          * Default to 256, since we don't split into sync/async like the
@@ -443,49 +543,30 @@ int blk_mq_sched_setup(struct request_queue *q)
          */
         q->nr_requests = 2 * BLKDEV_MAX_RQ;
 
-        /*
-         * We're switching to using an IO scheduler, so setup the hctx
-         * scheduler tags and switch the request map from the regular
-         * tags to scheduler tags. First allocate what we need, so we
-         * can safely fail and fallback, if needed.
-         */
-        ret = 0;
         queue_for_each_hw_ctx(q, hctx, i) {
-                hctx->sched_tags = blk_mq_alloc_rq_map(set, i,
-                                q->nr_requests, set->reserved_tags);
-                if (!hctx->sched_tags) {
-                        ret = -ENOMEM;
-                        break;
-                }
-                ret = blk_mq_alloc_rqs(set, hctx->sched_tags, i, q->nr_requests);
+                ret = blk_mq_sched_alloc_tags(q, hctx, i);
                 if (ret)
-                        break;
+                        goto err;
         }
 
-        /*
-         * If we failed, free what we did allocate
-         */
-        if (ret) {
-                queue_for_each_hw_ctx(q, hctx, i) {
-                        if (!hctx->sched_tags)
-                                continue;
-                        blk_mq_sched_free_tags(set, hctx, i);
-                }
-
-                return ret;
-        }
+        ret = e->ops.mq.init_sched(q, e);
+        if (ret)
+                goto err;
 
         return 0;
+
+err:
+        blk_mq_sched_tags_teardown(q);
+        q->elevator = NULL;
+        return ret;
 }
 
-void blk_mq_sched_teardown(struct request_queue *q)
+void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e)
 {
-        struct blk_mq_tag_set *set = q->tag_set;
-        struct blk_mq_hw_ctx *hctx;
-        int i;
-
-        queue_for_each_hw_ctx(q, hctx, i)
-                blk_mq_sched_free_tags(set, hctx, i);
+        if (e->type->ops.mq.exit_sched)
+                e->type->ops.mq.exit_sched(e);
+        blk_mq_sched_tags_teardown(q);
+        q->elevator = NULL;
 }
 
 int blk_mq_sched_init(struct request_queue *q)
diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h
index a75b16b123f7..3a9e6e40558b 100644
--- a/block/blk-mq-sched.h
+++ b/block/blk-mq-sched.h
@@ -19,7 +19,7 @@ bool blk_mq_sched_try_merge(struct request_queue *q, struct bio *bio,
                                 struct request **merged_request);
 bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio);
 bool blk_mq_sched_try_insert_merge(struct request_queue *q, struct request *rq);
-void blk_mq_sched_restart_queues(struct blk_mq_hw_ctx *hctx);
+void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx);
 
 void blk_mq_sched_insert_request(struct request *rq, bool at_head,
                                  bool run_queue, bool async, bool can_block);
@@ -32,8 +32,13 @@ void blk_mq_sched_move_to_dispatch(struct blk_mq_hw_ctx *hctx,
                         struct list_head *rq_list,
                         struct request *(*get_rq)(struct blk_mq_hw_ctx *));
 
-int blk_mq_sched_setup(struct request_queue *q);
-void blk_mq_sched_teardown(struct request_queue *q);
+int blk_mq_init_sched(struct request_queue *q, struct elevator_type *e);
+void blk_mq_exit_sched(struct request_queue *q, struct elevator_queue *e);
+
+int blk_mq_sched_init_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                           unsigned int hctx_idx);
+void blk_mq_sched_exit_hctx(struct request_queue *q, struct blk_mq_hw_ctx *hctx,
+                            unsigned int hctx_idx);
 
 int blk_mq_sched_init(struct request_queue *q);
 
@@ -131,20 +136,6 @@ static inline void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx)
                 set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
 }
 
-/*
- * Mark a hardware queue and the request queue it belongs to as needing a
- * restart.
- */
-static inline void blk_mq_sched_mark_restart_queue(struct blk_mq_hw_ctx *hctx)
-{
-        struct request_queue *q = hctx->queue;
-
-        if (!test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state))
-                set_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
-        if (!test_bit(QUEUE_FLAG_RESTART, &q->queue_flags))
-                set_bit(QUEUE_FLAG_RESTART, &q->queue_flags);
-}
-
 static inline bool blk_mq_sched_needs_restart(struct blk_mq_hw_ctx *hctx)
 {
         return test_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state);
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 295e69670c39..d745ab81033a 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -17,6 +17,15 @@ static void blk_mq_sysfs_release(struct kobject *kobj)
 {
 }
 
+static void blk_mq_hw_sysfs_release(struct kobject *kobj)
+{
+        struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+                                                  kobj);
+        free_cpumask_var(hctx->cpumask);
+        kfree(hctx->ctxs);
+        kfree(hctx);
+}
+
 struct blk_mq_ctx_sysfs_entry {
         struct attribute attr;
         ssize_t (*show)(struct blk_mq_ctx *, char *);
@@ -200,7 +209,7 @@ static struct kobj_type blk_mq_ctx_ktype = {
 static struct kobj_type blk_mq_hw_ktype = {
         .sysfs_ops      = &blk_mq_hw_sysfs_ops,
         .default_attrs  = default_hw_ctx_attrs,
-        .release        = blk_mq_sysfs_release,
+        .release        = blk_mq_hw_sysfs_release,
 };
 
 static void blk_mq_unregister_hctx(struct blk_mq_hw_ctx *hctx)
@@ -242,24 +251,15 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx)
 static void __blk_mq_unregister_dev(struct device *dev, struct request_queue *q)
 {
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx;
-        int i, j;
+        int i;
 
-        queue_for_each_hw_ctx(q, hctx, i) {
+        queue_for_each_hw_ctx(q, hctx, i)
                 blk_mq_unregister_hctx(hctx);
 
-                hctx_for_each_ctx(hctx, ctx, j)
-                        kobject_put(&ctx->kobj);
-
-                kobject_put(&hctx->kobj);
-        }
-
         blk_mq_debugfs_unregister_hctxs(q);
 
         kobject_uevent(&q->mq_kobj, KOBJ_REMOVE);
         kobject_del(&q->mq_kobj);
-        kobject_put(&q->mq_kobj);
-
         kobject_put(&dev->kobj);
 
         q->mq_sysfs_init_done = false;
@@ -277,7 +277,19 @@ void blk_mq_hctx_kobj_init(struct blk_mq_hw_ctx *hctx)
         kobject_init(&hctx->kobj, &blk_mq_hw_ktype);
 }
 
-static void blk_mq_sysfs_init(struct request_queue *q)
+void blk_mq_sysfs_deinit(struct request_queue *q)
+{
+        struct blk_mq_ctx *ctx;
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                ctx = per_cpu_ptr(q->queue_ctx, cpu);
+                kobject_put(&ctx->kobj);
+        }
+        kobject_put(&q->mq_kobj);
+}
+
+void blk_mq_sysfs_init(struct request_queue *q)
 {
         struct blk_mq_ctx *ctx;
         int cpu;
@@ -297,8 +309,6 @@ int blk_mq_register_dev(struct device *dev, struct request_queue *q)
 
         blk_mq_disable_hotplug();
 
-        blk_mq_sysfs_init(q);
-
         ret = kobject_add(&q->mq_kobj, kobject_get(&dev->kobj), "%s", "mq");
         if (ret < 0)
                 goto out;
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index e48bc2c72615..9d97bfc4d465 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -295,6 +295,9 @@ int blk_mq_reinit_tagset(struct blk_mq_tag_set *set)
         for (i = 0; i < set->nr_hw_queues; i++) {
                 struct blk_mq_tags *tags = set->tags[i];
 
+                if (!tags)
+                        continue;
+
                 for (j = 0; j < tags->nr_tags; j++) {
                         if (!tags->static_rqs[j])
                                 continue;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index b2fd175e84d7..c7836a1ded97 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -321,7 +321,6 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, int rw,
 
         rq = blk_mq_sched_get_request(q, NULL, rw, &alloc_data);
 
-        blk_mq_put_ctx(alloc_data.ctx);
         blk_queue_exit(q);
 
         if (!rq)
@@ -349,7 +348,7 @@ void __blk_mq_finish_request(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
                 blk_mq_put_tag(hctx, hctx->tags, ctx, rq->tag);
         if (sched_tag != -1)
                 blk_mq_sched_completed_request(hctx, rq);
-        blk_mq_sched_restart_queues(hctx);
+        blk_mq_sched_restart(hctx);
         blk_queue_exit(q);
 }
 
@@ -697,17 +696,8 @@ static void blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
 {
         struct blk_mq_timeout_data *data = priv;
 
-        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) {
-                /*
-                 * If a request wasn't started before the queue was
-                 * marked dying, kill it here or it'll go unnoticed.
-                 */
-                if (unlikely(blk_queue_dying(rq->q))) {
-                        rq->errors = -EIO;
-                        blk_mq_end_request(rq, rq->errors);
-                }
+        if (!test_bit(REQ_ATOM_STARTED, &rq->atomic_flags))
                 return;
-        }
 
         if (time_after_eq(jiffies, rq->deadline)) {
                 if (!blk_mark_rq_complete(rq))
@@ -855,12 +845,8 @@ bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx,
                 .flags = wait ? 0 : BLK_MQ_REQ_NOWAIT,
         };
 
-        if (rq->tag != -1) {
-done:
-                if (hctx)
-                        *hctx = data.hctx;
-                return true;
-        }
+        if (rq->tag != -1)
+                goto done;
 
         if (blk_mq_tag_is_reserved(data.hctx->sched_tags, rq->internal_tag))
                 data.flags |= BLK_MQ_REQ_RESERVED;
@@ -872,10 +858,12 @@ done:
                         atomic_inc(&data.hctx->nr_active);
                 }
                 data.hctx->tags->rqs[rq->tag] = rq;
-                goto done;
         }
 
-        return false;
+done:
+        if (hctx)
+                *hctx = data.hctx;
+        return rq->tag != -1;
 }
 
 static void __blk_mq_put_driver_tag(struct blk_mq_hw_ctx *hctx,
@@ -972,13 +960,16 @@ static bool blk_mq_dispatch_wait_add(struct blk_mq_hw_ctx *hctx)
         return true;
 }
 
-bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
+bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list)
 {
-        struct request_queue *q = hctx->queue;
+        struct blk_mq_hw_ctx *hctx;
         struct request *rq;
         LIST_HEAD(driver_list);
         struct list_head *dptr;
-        int queued, ret = BLK_MQ_RQ_QUEUE_OK;
+        int errors, queued, ret = BLK_MQ_RQ_QUEUE_OK;
+
+        if (list_empty(list))
+                return false;
 
         /*
          * Start off with dptr being NULL, so we start the first request
@@ -989,8 +980,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
         /*
          * Now process all the entries, sending them to the driver.
          */
-        queued = 0;
-        while (!list_empty(list)) {
+        errors = queued = 0;
+        do {
                 struct blk_mq_queue_data bd;
 
                 rq = list_first_entry(list, struct request, queuelist);
@@ -1046,6 +1037,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                 default:
                         pr_err("blk-mq: bad return on queue: %d\n", ret);
                 case BLK_MQ_RQ_QUEUE_ERROR:
+                        errors++;
                         rq->errors = -EIO;
                         blk_mq_end_request(rq, rq->errors);
                         break;
@@ -1060,7 +1052,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                  */
                 if (!dptr && list->next != list->prev)
                         dptr = &driver_list;
-        }
+        } while (!list_empty(list));
 
         hctx->dispatched[queued_to_index(queued)]++;
 
@@ -1097,7 +1089,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list)
                         blk_mq_run_hw_queue(hctx, true);
         }
 
-        return queued != 0;
+        return (queued + errors) != 0;
 }
 
 static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
@@ -1143,7 +1135,8 @@ static int blk_mq_hctx_next_cpu(struct blk_mq_hw_ctx *hctx)
         return hctx->next_cpu;
 }
 
-void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
+static void __blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async,
+                                        unsigned long msecs)
 {
         if (unlikely(blk_mq_hctx_stopped(hctx) ||
                      !blk_mq_hw_queue_mapped(hctx)))
@@ -1160,7 +1153,24 @@ void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
                 put_cpu();
         }
 
-        kblockd_schedule_work_on(blk_mq_hctx_next_cpu(hctx), &hctx->run_work);
+        if (msecs == 0)
+                kblockd_schedule_work_on(blk_mq_hctx_next_cpu(hctx),
+                                         &hctx->run_work);
+        else
+                kblockd_schedule_delayed_work_on(blk_mq_hctx_next_cpu(hctx),
+                                                 &hctx->delayed_run_work,
+                                                 msecs_to_jiffies(msecs));
+}
+
+void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs)
+{
+        __blk_mq_delay_run_hw_queue(hctx, true, msecs);
+}
+EXPORT_SYMBOL(blk_mq_delay_run_hw_queue);
+
+void blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async)
+{
+        __blk_mq_delay_run_hw_queue(hctx, async, 0);
 }
 
 void blk_mq_run_hw_queues(struct request_queue *q, bool async)
@@ -1263,6 +1273,15 @@ static void blk_mq_run_work_fn(struct work_struct *work)
         __blk_mq_run_hw_queue(hctx);
 }
 
+static void blk_mq_delayed_run_work_fn(struct work_struct *work)
+{
+        struct blk_mq_hw_ctx *hctx;
+
+        hctx = container_of(work, struct blk_mq_hw_ctx, delayed_run_work.work);
+
+        __blk_mq_run_hw_queue(hctx);
+}
+
 static void blk_mq_delay_work_fn(struct work_struct *work)
 {
         struct blk_mq_hw_ctx *hctx;
@@ -1434,7 +1453,8 @@ static blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx, struct request *rq)
         return blk_tag_to_qc_t(rq->internal_tag, hctx->queue_num, true);
 }
 
-static void blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie)
+static void blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
+                                      bool may_sleep)
 {
         struct request_queue *q = rq->q;
         struct blk_mq_queue_data bd = {
@@ -1475,7 +1495,7 @@ static void blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie)
         }
 
 insert:
-        blk_mq_sched_insert_request(rq, false, true, true, false);
+        blk_mq_sched_insert_request(rq, false, true, false, may_sleep);
 }
 
 /*
@@ -1569,11 +1589,11 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
                 if (!(data.hctx->flags & BLK_MQ_F_BLOCKING)) {
                         rcu_read_lock();
-                        blk_mq_try_issue_directly(old_rq, &cookie);
+                        blk_mq_try_issue_directly(old_rq, &cookie, false);
                         rcu_read_unlock();
                 } else {
                         srcu_idx = srcu_read_lock(&data.hctx->queue_rq_srcu);
-                        blk_mq_try_issue_directly(old_rq, &cookie);
+                        blk_mq_try_issue_directly(old_rq, &cookie, true);
                         srcu_read_unlock(&data.hctx->queue_rq_srcu, srcu_idx);
                 }
                 goto done;
@@ -1931,6 +1951,8 @@ static void blk_mq_exit_hctx(struct request_queue *q,
                                        hctx->fq->flush_rq, hctx_idx,
                                        flush_start_tag + hctx_idx);
 
+        blk_mq_sched_exit_hctx(q, hctx, hctx_idx);
+
         if (set->ops->exit_hctx)
                 set->ops->exit_hctx(hctx, hctx_idx);
 
@@ -1955,16 +1977,6 @@ static void blk_mq_exit_hw_queues(struct request_queue *q,
         }
 }
 
-static void blk_mq_free_hw_queues(struct request_queue *q,
-                struct blk_mq_tag_set *set)
-{
-        struct blk_mq_hw_ctx *hctx;
-        unsigned int i;
-
-        queue_for_each_hw_ctx(q, hctx, i)
-                free_cpumask_var(hctx->cpumask);
-}
-
 static int blk_mq_init_hctx(struct request_queue *q,
                 struct blk_mq_tag_set *set,
                 struct blk_mq_hw_ctx *hctx, unsigned hctx_idx)
@@ -1977,6 +1989,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
                 node = hctx->numa_node = set->numa_node;
 
         INIT_WORK(&hctx->run_work, blk_mq_run_work_fn);
+        INIT_DELAYED_WORK(&hctx->delayed_run_work, blk_mq_delayed_run_work_fn);
         INIT_DELAYED_WORK(&hctx->delay_work, blk_mq_delay_work_fn);
         spin_lock_init(&hctx->lock);
         INIT_LIST_HEAD(&hctx->dispatch);
@@ -2007,9 +2020,12 @@ static int blk_mq_init_hctx(struct request_queue *q,
             set->ops->init_hctx(hctx, set->driver_data, hctx_idx))
                 goto free_bitmap;
 
+        if (blk_mq_sched_init_hctx(q, hctx, hctx_idx))
+                goto exit_hctx;
+
         hctx->fq = blk_alloc_flush_queue(q, hctx->numa_node, set->cmd_size);
         if (!hctx->fq)
-                goto exit_hctx;
+                goto sched_exit_hctx;
 
         if (set->ops->init_request &&
             set->ops->init_request(set->driver_data,
@@ -2024,6 +2040,8 @@ static int blk_mq_init_hctx(struct request_queue *q,
 
  free_fq:
         kfree(hctx->fq);
+ sched_exit_hctx:
+        blk_mq_sched_exit_hctx(q, hctx, hctx_idx);
  exit_hctx:
         if (set->ops->exit_hctx)
                 set->ops->exit_hctx(hctx, hctx_idx);
@@ -2045,7 +2063,6 @@ static void blk_mq_init_cpu_queues(struct request_queue *q,
                 struct blk_mq_ctx *__ctx = per_cpu_ptr(q->queue_ctx, i);
                 struct blk_mq_hw_ctx *hctx;
 
-                memset(__ctx, 0, sizeof(*__ctx));
                 __ctx->cpu = i;
                 spin_lock_init(&__ctx->lock);
                 INIT_LIST_HEAD(&__ctx->rq_list);
@@ -2251,21 +2268,23 @@ void blk_mq_release(struct request_queue *q)
         struct blk_mq_hw_ctx *hctx;
         unsigned int i;
 
-        blk_mq_sched_teardown(q);
-
         /* hctx kobj stays in hctx */
         queue_for_each_hw_ctx(q, hctx, i) {
                 if (!hctx)
                         continue;
-                kfree(hctx->ctxs);
-                kfree(hctx);
+                kobject_put(&hctx->kobj);
         }
 
         q->mq_map = NULL;
 
         kfree(q->queue_hw_ctx);
 
-        /* ctx kobj stays in queue_ctx */
+        /*
+         * release .mq_kobj and sw queue's kobject now because
+         * both share lifetime with request queue.
+         */
+        blk_mq_sysfs_deinit(q);
+
         free_percpu(q->queue_ctx);
 }
 
@@ -2330,10 +2349,7 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
                         if (hctx->tags)
                                 blk_mq_free_map_and_requests(set, j);
                         blk_mq_exit_hctx(q, set, hctx, j);
-                        free_cpumask_var(hctx->cpumask);
                         kobject_put(&hctx->kobj);
-                        kfree(hctx->ctxs);
-                        kfree(hctx);
                         hctxs[j] = NULL;
 
                 }
@@ -2352,6 +2368,9 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
         if (!q->queue_ctx)
                 goto err_exit;
 
+        /* init q->mq_kobj and sw queues' kobjects */
+        blk_mq_sysfs_init(q);
+
         q->queue_hw_ctx = kzalloc_node(nr_cpu_ids * sizeof(*(q->queue_hw_ctx)),
                                                 GFP_KERNEL, set->numa_node);
         if (!q->queue_hw_ctx)
@@ -2442,7 +2461,6 @@ void blk_mq_free_queue(struct request_queue *q)
         blk_mq_del_queue_tag_set(q);
 
         blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
-        blk_mq_free_hw_queues(q, set);
 }
 
 /* Basically redo blk_mq_init_queue with queue frozen */
@@ -2580,6 +2598,14 @@ static int blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set)
         return 0;
 }
 
+static int blk_mq_update_queue_map(struct blk_mq_tag_set *set)
+{
+        if (set->ops->map_queues)
+                return set->ops->map_queues(set);
+        else
+                return blk_mq_map_queues(set);
+}
+
 /*
  * Alloc a tag set to be associated with one or more request queues.
  * May fail with EINVAL for various error conditions. May adjust the
@@ -2634,10 +2660,7 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
         if (!set->mq_map)
                 goto out_free_tags;
 
-        if (set->ops->map_queues)
-                ret = set->ops->map_queues(set);
-        else
-                ret = blk_mq_map_queues(set);
+        ret = blk_mq_update_queue_map(set);
         if (ret)
                 goto out_free_mq_map;
 
@@ -2729,6 +2752,7 @@ void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
                 blk_mq_freeze_queue(q);
 
         set->nr_hw_queues = nr_hw_queues;
+        blk_mq_update_queue_map(set);
         list_for_each_entry(q, &set->tag_list, tag_set_list) {
                 blk_mq_realloc_hw_ctxs(set, q);
 
@@ -2904,8 +2928,17 @@ bool blk_mq_poll(struct request_queue *q, blk_qc_t cookie)
         hctx = q->queue_hw_ctx[blk_qc_t_to_queue_num(cookie)];
         if (!blk_qc_t_is_internal(cookie))
                 rq = blk_mq_tag_to_rq(hctx->tags, blk_qc_t_to_tag(cookie));
-        else
+        else {
                 rq = blk_mq_tag_to_rq(hctx->sched_tags, blk_qc_t_to_tag(cookie));
+                /*
+                 * With scheduling, if the request has completed, we'll
+                 * get a NULL return here, as we clear the sched tag when
+                 * that happens. The request still remains valid, like always,
+                 * so we should be safe with just the NULL check.
+                 */
+                if (!rq)
+                        return false;
+        }
 
         return __blk_mq_poll(hctx, rq);
 }
diff --git a/block/blk-mq.h b/block/blk-mq.h
index 088ced003c13..660a17e1d033 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -31,7 +31,7 @@ void blk_mq_freeze_queue(struct request_queue *q);
 void blk_mq_free_queue(struct request_queue *q);
 int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
 void blk_mq_wake_waiters(struct request_queue *q);
-bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *, struct list_head *);
+bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *);
 void blk_mq_flush_busy_ctxs(struct blk_mq_hw_ctx *hctx, struct list_head *list);
 bool blk_mq_hctx_has_pending(struct blk_mq_hw_ctx *hctx);
 bool blk_mq_get_driver_tag(struct request *rq, struct blk_mq_hw_ctx **hctx,
@@ -77,6 +77,8 @@ static inline struct blk_mq_hw_ctx *blk_mq_map_queue(struct request_queue *q,
 /*
  * sysfs helpers
  */
+extern void blk_mq_sysfs_init(struct request_queue *q);
+extern void blk_mq_sysfs_deinit(struct request_queue *q);
 extern int blk_mq_sysfs_register(struct request_queue *q);
 extern void blk_mq_sysfs_unregister(struct request_queue *q);
 extern void blk_mq_hctx_kobj_init(struct blk_mq_hw_ctx *hctx);
diff --git a/block/blk-stat.c b/block/blk-stat.c
index 9b43efb8933f..186fcb981e9b 100644
--- a/block/blk-stat.c
+++ b/block/blk-stat.c
@@ -30,11 +30,11 @@ static void blk_stat_flush_batch(struct blk_rq_stat *stat)
 
 static void blk_stat_sum(struct blk_rq_stat *dst, struct blk_rq_stat *src)
 {
+        blk_stat_flush_batch(src);
+
         if (!src->nr_samples)
                 return;
 
-        blk_stat_flush_batch(src);
-
         dst->min = min(dst->min, src->min);
         dst->max = max(dst->max, src->max);
 
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index c44b321335f3..37f0b3ad635e 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -816,7 +816,7 @@ static void blk_release_queue(struct kobject *kobj)
 
         if (q->elevator) {
                 ioc_clear_queue(q);
-                elevator_exit(q->elevator);
+                elevator_exit(q, q->elevator);
         }
 
         blk_exit_rl(&q->root_rl);
diff --git a/block/elevator.c b/block/elevator.c
index 01139f549b5b..4d9084a14c10 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -242,26 +242,21 @@ int elevator_init(struct request_queue *q, char *name)
                 }
         }
 
-        if (e->uses_mq) {
-                err = blk_mq_sched_setup(q);
-                if (!err)
-                        err = e->ops.mq.init_sched(q, e);
-        } else
+        if (e->uses_mq)
+                err = blk_mq_init_sched(q, e);
+        else
                 err = e->ops.sq.elevator_init_fn(q, e);
-        if (err) {
-                if (e->uses_mq)
-                        blk_mq_sched_teardown(q);
+        if (err)
                 elevator_put(e);
-        }
         return err;
 }
 EXPORT_SYMBOL(elevator_init);
 
-void elevator_exit(struct elevator_queue *e)
+void elevator_exit(struct request_queue *q, struct elevator_queue *e)
 {
         mutex_lock(&e->sysfs_lock);
         if (e->uses_mq && e->type->ops.mq.exit_sched)
-                e->type->ops.mq.exit_sched(e);
+                blk_mq_exit_sched(q, e);
         else if (!e->uses_mq && e->type->ops.sq.elevator_exit_fn)
                 e->type->ops.sq.elevator_exit_fn(e);
         mutex_unlock(&e->sysfs_lock);
@@ -946,6 +941,45 @@ void elv_unregister(struct elevator_type *e)
 }
 EXPORT_SYMBOL_GPL(elv_unregister);
 
+static int elevator_switch_mq(struct request_queue *q,
+                              struct elevator_type *new_e)
+{
+        int ret;
+
+        blk_mq_freeze_queue(q);
+        blk_mq_quiesce_queue(q);
+
+        if (q->elevator) {
+                if (q->elevator->registered)
+                        elv_unregister_queue(q);
+                ioc_clear_queue(q);
+                elevator_exit(q, q->elevator);
+        }
+
+        ret = blk_mq_init_sched(q, new_e);
+        if (ret)
+                goto out;
+
+        if (new_e) {
+                ret = elv_register_queue(q);
+                if (ret) {
+                        elevator_exit(q, q->elevator);
+                        goto out;
+                }
+        }
+
+        if (new_e)
+                blk_add_trace_msg(q, "elv switch: %s", new_e->elevator_name);
+        else
+                blk_add_trace_msg(q, "elv switch: none");
+
+out:
+        blk_mq_unfreeze_queue(q);
+        blk_mq_start_stopped_hw_queues(q, true);
+        return ret;
+
+}
+
 /*
  * switch to new_e io scheduler. be careful not to introduce deadlocks -
  * we don't free the old io scheduler, before we have allocated what we
@@ -958,10 +992,8 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         bool old_registered = false;
         int err;
 
-        if (q->mq_ops) {
-                blk_mq_freeze_queue(q);
-                blk_mq_quiesce_queue(q);
-        }
+        if (q->mq_ops)
+                return elevator_switch_mq(q, new_e);
 
         /*
          * Turn on BYPASS and drain all requests w/ elevator private data.
@@ -973,11 +1005,7 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         if (old) {
                 old_registered = old->registered;
 
-                if (old->uses_mq)
-                        blk_mq_sched_teardown(q);
-
-                if (!q->mq_ops)
-                        blk_queue_bypass_start(q);
+                blk_queue_bypass_start(q);
 
                 /* unregister and clear all auxiliary data of the old elevator */
                 if (old_registered)
@@ -987,56 +1015,32 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
         }
 
         /* allocate, init and register new elevator */
-        if (new_e) {
-                if (new_e->uses_mq) {
-                        err = blk_mq_sched_setup(q);
-                        if (!err)
-                                err = new_e->ops.mq.init_sched(q, new_e);
-                } else
-                        err = new_e->ops.sq.elevator_init_fn(q, new_e);
-                if (err)
-                        goto fail_init;
+        err = new_e->ops.sq.elevator_init_fn(q, new_e);
+        if (err)
+                goto fail_init;
 
-                err = elv_register_queue(q);
-                if (err)
-                        goto fail_register;
-        } else
-                q->elevator = NULL;
+        err = elv_register_queue(q);
+        if (err)
+                goto fail_register;
 
         /* done, kill the old one and finish */
         if (old) {
-                elevator_exit(old);
-                if (!q->mq_ops)
-                        blk_queue_bypass_end(q);
+                elevator_exit(q, old);
+                blk_queue_bypass_end(q);
         }
 
-        if (q->mq_ops) {
-                blk_mq_unfreeze_queue(q);
-                blk_mq_start_stopped_hw_queues(q, true);
-        }
-
-        if (new_e)
-                blk_add_trace_msg(q, "elv switch: %s", new_e->elevator_name);
-        else
-                blk_add_trace_msg(q, "elv switch: none");
+        blk_add_trace_msg(q, "elv switch: %s", new_e->elevator_name);
 
         return 0;
 
 fail_register:
-        if (q->mq_ops)
-                blk_mq_sched_teardown(q);
-        elevator_exit(q->elevator);
+        elevator_exit(q, q->elevator);
 fail_init:
         /* switch failed, restore and re-register old elevator */
         if (old) {
                 q->elevator = old;
                 elv_register_queue(q);
-                if (!q->mq_ops)
-                        blk_queue_bypass_end(q);
-        }
-        if (q->mq_ops) {
-                blk_mq_unfreeze_queue(q);
-                blk_mq_start_stopped_hw_queues(q, true);
+                blk_queue_bypass_end(q);
         }
 
         return err;
@@ -1094,12 +1098,20 @@ int elevator_change(struct request_queue *q, const char *name)
 }
 EXPORT_SYMBOL(elevator_change);
 
+static inline bool elv_support_iosched(struct request_queue *q)
+{
+        if (q->mq_ops && q->tag_set && (q->tag_set->flags &
+                                BLK_MQ_F_NO_SCHED))
+                return false;
+        return true;
+}
+
 ssize_t elv_iosched_store(struct request_queue *q, const char *name,
                           size_t count)
 {
         int ret;
 
-        if (!(q->mq_ops || q->request_fn))
+        if (!(q->mq_ops || q->request_fn) || !elv_support_iosched(q))
                 return count;
 
         ret = __elevator_change(q, name);
@@ -1131,7 +1143,7 @@ ssize_t elv_iosched_show(struct request_queue *q, char *name)
                         len += sprintf(name+len, "[%s] ", elv->elevator_name);
                         continue;
                 }
-                if (__e->uses_mq && q->mq_ops)
+                if (__e->uses_mq && q->mq_ops && elv_support_iosched(q))
                         len += sprintf(name+len, "%s ", __e->elevator_name);
                 else if (!__e->uses_mq && !q->mq_ops)
                         len += sprintf(name+len, "%s ", __e->elevator_name);
diff --git a/block/genhd.c b/block/genhd.c
index b26a5ea115d0..a9c516a8b37d 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -572,20 +572,6 @@ exit:
         disk_part_iter_exit(&piter);
 }
 
-void put_disk_devt(struct disk_devt *disk_devt)
-{
-        if (disk_devt && atomic_dec_and_test(&disk_devt->count))
-                disk_devt->release(disk_devt);
-}
-EXPORT_SYMBOL(put_disk_devt);
-
-void get_disk_devt(struct disk_devt *disk_devt)
-{
-        if (disk_devt)
-                atomic_inc(&disk_devt->count);
-}
-EXPORT_SYMBOL(get_disk_devt);
-
 /**
  * device_add_disk - add partitioning information to kernel list
  * @parent: parent device for the disk
@@ -626,13 +612,6 @@ void device_add_disk(struct device *parent, struct gendisk *disk)
 
         disk_alloc_events(disk);
 
-        /*
-         * Take a reference on the devt and assign it to queue since it
-         * must not be reallocated while the bdi is registered
-         */
-        disk->queue->disk_devt = disk->disk_devt;
-        get_disk_devt(disk->disk_devt);
-
         /* Register BDI before referencing it from bdev */
         bdi = disk->queue->backing_dev_info;
         bdi_register_owner(bdi, disk_to_dev(disk));
@@ -681,12 +660,16 @@ void del_gendisk(struct gendisk *disk)
         disk->flags &= ~GENHD_FL_UP;
 
         sysfs_remove_link(&disk_to_dev(disk)->kobj, "bdi");
-        /*
-         * Unregister bdi before releasing device numbers (as they can get
-         * reused and we'd get clashes in sysfs).
-         */
-        bdi_unregister(disk->queue->backing_dev_info);
-        blk_unregister_queue(disk);
+        if (disk->queue) {
+                /*
+                 * Unregister bdi before releasing device numbers (as they can
+                 * get reused and we'd get clashes in sysfs).
+                 */
+                bdi_unregister(disk->queue->backing_dev_info);
+                blk_unregister_queue(disk);
+        } else {
+                WARN_ON(1);
+        }
         blk_unregister_region(disk_devt(disk), disk->minors);
 
         part_stat_set_all(&disk->part0, 0);
diff --git a/block/sed-opal.c b/block/sed-opal.c
index 1e18dca360fc..14035f826b5e 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -1023,7 +1023,6 @@ static int finalize_and_send(struct opal_dev *dev, cont_fn cont)
 
 static int gen_key(struct opal_dev *dev, void *data)
 {
-        const u8 *method;
         u8 uid[OPAL_UID_LENGTH];
         int err = 0;
 
@@ -1031,7 +1030,6 @@ static int gen_key(struct opal_dev *dev, void *data)
         set_comid(dev, dev->comid);
 
         memcpy(uid, dev->prev_data, min(sizeof(uid), dev->prev_d_len));
-        method = opalmethod[OPAL_GENKEY];
         kfree(dev->prev_data);
         dev->prev_data = NULL;
 
@@ -1669,7 +1667,6 @@ static int add_user_to_lr(struct opal_dev *dev, void *data)
 static int lock_unlock_locking_range(struct opal_dev *dev, void *data)
 {
         u8 lr_buffer[OPAL_UID_LENGTH];
-        const u8 *method;
         struct opal_lock_unlock *lkul = data;
         u8 read_locked = 1, write_locked = 1;
         int err = 0;
@@ -1677,7 +1674,6 @@ static int lock_unlock_locking_range(struct opal_dev *dev, void *data)
         clear_opal_cmd(dev);
         set_comid(dev, dev->comid);
 
-        method = opalmethod[OPAL_SET];
         if (build_locking_range(lr_buffer, sizeof(lr_buffer),
                                 lkul->session.opal_key.lr) < 0)
                 return -ERANGE;
@@ -1733,14 +1729,12 @@ static int lock_unlock_locking_range_sum(struct opal_dev *dev, void *data)
 {
         u8 lr_buffer[OPAL_UID_LENGTH];
         u8 read_locked = 1, write_locked = 1;
-        const u8 *method;
         struct opal_lock_unlock *lkul = data;
         int ret;
 
         clear_opal_cmd(dev);
         set_comid(dev, dev->comid);
 
-        method = opalmethod[OPAL_SET];
         if (build_locking_range(lr_buffer, sizeof(lr_buffer),
                                 lkul->session.opal_key.lr) < 0)
                 return -ERANGE;
@@ -2133,7 +2127,7 @@ static int opal_add_user_to_lr(struct opal_dev *dev,
                 pr_err("Locking state was not RO or RW\n");
                 return -EINVAL;
         }
-        if (lk_unlk->session.who < OPAL_USER1 &&
+        if (lk_unlk->session.who < OPAL_USER1 ||
             lk_unlk->session.who > OPAL_USER9) {
                 pr_err("Authority was not within the range of users: %d\n",
                        lk_unlk->session.who);
@@ -2316,7 +2310,7 @@ static int opal_activate_user(struct opal_dev *dev,
         int ret;
 
         /* We can't activate Admin1 it's active as manufactured */
-        if (opal_session->who < OPAL_USER1 &&
+        if (opal_session->who < OPAL_USER1 ||
             opal_session->who > OPAL_USER9) {
                 pr_err("Who was not a valid user: %d\n", opal_session->who);
                 return -EINVAL;
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index f5e18c2a4852..690deca17c35 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -266,7 +266,7 @@ unlock:
         return err;
 }
 
-int af_alg_accept(struct sock *sk, struct socket *newsock)
+int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern)
 {
         struct alg_sock *ask = alg_sk(sk);
         const struct af_alg_type *type;
@@ -281,7 +281,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
         if (!type)
                 goto unlock;
 
-        sk2 = sk_alloc(sock_net(sk), PF_ALG, GFP_KERNEL, &alg_proto, 0);
+        sk2 = sk_alloc(sock_net(sk), PF_ALG, GFP_KERNEL, &alg_proto, kern);
         err = -ENOMEM;
         if (!sk2)
                 goto unlock;
@@ -323,9 +323,10 @@ unlock:
 }
 EXPORT_SYMBOL_GPL(af_alg_accept);
 
-static int alg_accept(struct socket *sock, struct socket *newsock, int flags)
+static int alg_accept(struct socket *sock, struct socket *newsock, int flags,
+                      bool kern)
 {
-        return af_alg_accept(sock->sk, newsock);
+        return af_alg_accept(sock->sk, newsock, kern);
 }
 
 static const struct proto_ops alg_proto_ops = {
diff --git a/crypto/ahash.c b/crypto/ahash.c
index e58c4970c22b..826cd7ab4d4a 100644
--- a/crypto/ahash.c
+++ b/crypto/ahash.c
@@ -32,6 +32,7 @@ struct ahash_request_priv {
         crypto_completion_t complete;
         void *data;
         u8 *result;
+        u32 flags;
         void *ubuf[] CRYPTO_MINALIGN_ATTR;
 };
 
@@ -253,6 +254,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
         priv->result = req->result;
         priv->complete = req->base.complete;
         priv->data = req->base.data;
+        priv->flags = req->base.flags;
+
         /*
          * WARNING: We do not backup req->priv here! The req->priv
          *          is for internal use of the Crypto API and the
@@ -267,38 +270,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
         return 0;
 }
 
-static void ahash_restore_req(struct ahash_request *req)
+static void ahash_restore_req(struct ahash_request *req, int err)
 {
         struct ahash_request_priv *priv = req->priv;
 
+        if (!err)
+                memcpy(priv->result, req->result,
+                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
+
         /* Restore the original crypto request. */
         req->result = priv->result;
-        req->base.complete = priv->complete;
-        req->base.data = priv->data;
+
+        ahash_request_set_callback(req, priv->flags,
+                                   priv->complete, priv->data);
         req->priv = NULL;
 
         /* Free the req->priv.priv from the ADJUSTED request. */
         kzfree(priv);
 }
 
-static void ahash_op_unaligned_finish(struct ahash_request *req, int err)
+static void ahash_notify_einprogress(struct ahash_request *req)
 {
         struct ahash_request_priv *priv = req->priv;
+        struct crypto_async_request oreq;
 
-        if (err == -EINPROGRESS)
-                return;
-
-        if (!err)
-                memcpy(priv->result, req->result,
-                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
+        oreq.data = priv->data;
 
-        ahash_restore_req(req);
+        priv->complete(&oreq, -EINPROGRESS);
 }
 
 static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
 {
         struct ahash_request *areq = req->data;
 
+        if (err == -EINPROGRESS) {
+                ahash_notify_einprogress(areq);
+                return;
+        }
+
         /*
          * Restore the original request, see ahash_op_unaligned() for what
          * goes where.
@@ -309,7 +318,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
          */
 
         /* First copy req->result into req->priv.result */
-        ahash_op_unaligned_finish(areq, err);
+        ahash_restore_req(areq, err);
 
         /* Complete the ORIGINAL request. */
         areq->base.complete(&areq->base, err);
@@ -325,7 +334,12 @@ static int ahash_op_unaligned(struct ahash_request *req,
                 return err;
 
         err = op(req);
-        ahash_op_unaligned_finish(req, err);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
+
+        ahash_restore_req(req, err);
 
         return err;
 }
@@ -360,25 +374,14 @@ int crypto_ahash_digest(struct ahash_request *req)
 }
 EXPORT_SYMBOL_GPL(crypto_ahash_digest);
 
-static void ahash_def_finup_finish2(struct ahash_request *req, int err)
+static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
 {
-        struct ahash_request_priv *priv = req->priv;
+        struct ahash_request *areq = req->data;
 
         if (err == -EINPROGRESS)
                 return;
 
-        if (!err)
-                memcpy(priv->result, req->result,
-                       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
-
-        ahash_restore_req(req);
-}
-
-static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
-{
-        struct ahash_request *areq = req->data;
-
-        ahash_def_finup_finish2(areq, err);
+        ahash_restore_req(areq, err);
 
         areq->base.complete(&areq->base, err);
 }
@@ -389,11 +392,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err)
                 goto out;
 
         req->base.complete = ahash_def_finup_done2;
-        req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
         err = crypto_ahash_reqtfm(req)->final(req);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
 
 out:
-        ahash_def_finup_finish2(req, err);
+        ahash_restore_req(req, err);
         return err;
 }
 
@@ -401,7 +408,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err)
 {
         struct ahash_request *areq = req->data;
 
+        if (err == -EINPROGRESS) {
+                ahash_notify_einprogress(areq);
+                return;
+        }
+
+        areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+
         err = ahash_def_finup_finish1(areq, err);
+        if (areq->priv)
+                return;
 
         areq->base.complete(&areq->base, err);
 }
@@ -416,6 +432,11 @@ static int ahash_def_finup(struct ahash_request *req)
                 return err;
 
         err = tfm->update(req);
+        if (err == -EINPROGRESS ||
+            (err == -EBUSY && (ahash_request_flags(req) &
+                               CRYPTO_TFM_REQ_MAY_BACKLOG)))
+                return err;
+
         return ahash_def_finup_finish1(req, err);
 }
 
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index 5a8053758657..ef59d9926ee9 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -40,6 +40,7 @@ struct aead_async_req {
         struct aead_async_rsgl first_rsgl;
         struct list_head list;
         struct kiocb *iocb;
+        struct sock *sk;
         unsigned int tsgls;
         char iv[];
 };
@@ -379,12 +380,10 @@ unlock:
 
 static void aead_async_cb(struct crypto_async_request *_req, int err)
 {
-        struct sock *sk = _req->data;
-        struct alg_sock *ask = alg_sk(sk);
-        struct aead_ctx *ctx = ask->private;
-        struct crypto_aead *tfm = crypto_aead_reqtfm(&ctx->aead_req);
-        struct aead_request *req = aead_request_cast(_req);
+        struct aead_request *req = _req->data;
+        struct crypto_aead *tfm = crypto_aead_reqtfm(req);
         struct aead_async_req *areq = GET_ASYM_REQ(req, tfm);
+        struct sock *sk = areq->sk;
         struct scatterlist *sg = areq->tsgl;
         struct aead_async_rsgl *rsgl;
         struct kiocb *iocb = areq->iocb;
@@ -447,11 +446,12 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
         memset(&areq->first_rsgl, '\0', sizeof(areq->first_rsgl));
         INIT_LIST_HEAD(&areq->list);
         areq->iocb = msg->msg_iocb;
+        areq->sk = sk;
         memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
         aead_request_set_tfm(req, tfm);
         aead_request_set_ad(req, ctx->aead_assoclen);
         aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-                                  aead_async_cb, sk);
+                                  aead_async_cb, req);
         used -= ctx->aead_assoclen;
 
         /* take over all tx sgls from ctx */
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 54fc90e8339c..5e92bd275ef3 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -239,7 +239,8 @@ unlock:
         return err ?: len;
 }
 
-static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
+static int hash_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct alg_sock *ask = alg_sk(sk);
@@ -260,7 +261,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
         if (err)
                 return err;
 
-        err = af_alg_accept(ask->parent, newsock);
+        err = af_alg_accept(ask->parent, newsock, kern);
         if (err)
                 return err;
 
@@ -378,7 +379,7 @@ static int hash_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
 }
 
 static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
-                             int flags)
+                             int flags, bool kern)
 {
         int err;
 
@@ -386,7 +387,7 @@ static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
         if (err)
                 return err;
 
-        return hash_accept(sock, newsock, flags);
+        return hash_accept(sock, newsock, flags, kern);
 }
 
 static struct proto_ops algif_hash_ops_nokey = {
diff --git a/crypto/lrw.c b/crypto/lrw.c
index ecd8474018e3..a8bfae4451bf 100644
--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -286,8 +286,11 @@ static int init_crypt(struct skcipher_request *req, crypto_completion_t done)
 
         subreq->cryptlen = LRW_BUFFER_SIZE;
         if (req->cryptlen > LRW_BUFFER_SIZE) {
-                subreq->cryptlen = min(req->cryptlen, (unsigned)PAGE_SIZE);
-                rctx->ext = kmalloc(subreq->cryptlen, gfp);
+                unsigned int n = min(req->cryptlen, (unsigned int)PAGE_SIZE);
+
+                rctx->ext = kmalloc(n, gfp);
+                if (rctx->ext)
+                        subreq->cryptlen = n;
         }
 
         rctx->src = req->src;
@@ -342,6 +345,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -349,6 +359,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
@@ -386,6 +397,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -393,6 +411,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
diff --git a/crypto/xts.c b/crypto/xts.c
index baeb34dd8582..89ace5ebc2da 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -230,8 +230,11 @@ static int init_crypt(struct skcipher_request *req, crypto_completion_t done)
 
         subreq->cryptlen = XTS_BUFFER_SIZE;
         if (req->cryptlen > XTS_BUFFER_SIZE) {
-                subreq->cryptlen = min(req->cryptlen, (unsigned)PAGE_SIZE);
-                rctx->ext = kmalloc(subreq->cryptlen, gfp);
+                unsigned int n = min(req->cryptlen, (unsigned int)PAGE_SIZE);
+
+                rctx->ext = kmalloc(n, gfp);
+                if (rctx->ext)
+                        subreq->cryptlen = n;
         }
 
         rctx->src = req->src;
@@ -283,6 +286,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -290,6 +300,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
@@ -327,6 +338,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         struct rctx *rctx;
 
         rctx = skcipher_request_ctx(req);
+
+        if (err == -EINPROGRESS) {
+                if (rctx->left != req->cryptlen)
+                        return;
+                goto out;
+        }
+
         subreq = &rctx->subreq;
         subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
 
@@ -334,6 +352,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
         if (rctx->left)
                 return;
 
+out:
         skcipher_request_complete(req, err);
 }
 
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index a391bbc48105..d94f92f88ca1 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -2,7 +2,6 @@
 # Makefile for the Linux ACPI interpreter
 #
 
-ccflags-y                       := -Os
 ccflags-$(CONFIG_ACPI_DEBUG)    += -DACPI_DEBUG_OUTPUT
 
 #
diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
index b4c1a6a51da4..03250e1f1103 100644
--- a/drivers/acpi/acpi_platform.c
+++ b/drivers/acpi/acpi_platform.c
@@ -25,9 +25,11 @@
 ACPI_MODULE_NAME("platform");
 
 static const struct acpi_device_id forbidden_id_list[] = {
-        {"PNP0000", 0}, /* PIC */
-        {"PNP0100", 0}, /* Timer */
-        {"PNP0200", 0}, /* AT DMA Controller */
+        {"PNP0000",  0},        /* PIC */
+        {"PNP0100",  0},        /* Timer */
+        {"PNP0200",  0},        /* AT DMA Controller */
+        {"ACPI0009", 0},        /* IOxAPIC */
+        {"ACPI000A", 0},        /* IOAPIC */
         {"", 0},
 };
 
diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
index 4467a8089ab8..0143135b3abe 100644
--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@@ -182,11 +182,6 @@ int __weak arch_register_cpu(int cpu)
 
 void __weak arch_unregister_cpu(int cpu) {}
 
-int __weak acpi_map_cpu2node(acpi_handle handle, int cpu, int physid)
-{
-        return -ENODEV;
-}
-
 static int acpi_processor_hotadd_init(struct acpi_processor *pr)
 {
         unsigned long long sta;
@@ -285,6 +280,13 @@ static int acpi_processor_get_info(struct acpi_device *device)
                 pr->acpi_id = value;
         }
 
+        if (acpi_duplicate_processor_id(pr->acpi_id)) {
+                dev_err(&device->dev,
+                        "Failed to get unique processor _UID (0x%x)\n",
+                        pr->acpi_id);
+                return -ENODEV;
+        }
+
         pr->phys_id = acpi_get_phys_id(pr->handle, device_declaration,
                                         pr->acpi_id);
         if (invalid_phys_cpuid(pr->phys_id))
@@ -585,7 +587,7 @@ static struct acpi_scan_handler processor_container_handler = {
 static int nr_unique_ids __initdata;
 
 /* The number of the duplicate processor IDs */
-static int nr_duplicate_ids __initdata;
+static int nr_duplicate_ids;
 
 /* Used to store the unique processor IDs */
 static int unique_processor_ids[] __initdata = {
@@ -593,7 +595,7 @@ static int unique_processor_ids[] __initdata = {
 };
 
 /* Used to store the duplicate processor IDs */
-static int duplicate_processor_ids[] __initdata = {
+static int duplicate_processor_ids[] = {
         [0 ... NR_CPUS - 1] = -1,
 };
 
@@ -638,28 +640,53 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
                                                   void **rv)
 {
         acpi_status status;
+        acpi_object_type acpi_type;
+        unsigned long long uid;
         union acpi_object object = { 0 };
         struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
 
-        status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
+        status = acpi_get_type(handle, &acpi_type);
         if (ACPI_FAILURE(status))
-                acpi_handle_info(handle, "Not get the processor object\n");
-        else
-                processor_validated_ids_update(object.processor.proc_id);
+                return false;
+
+        switch (acpi_type) {
+        case ACPI_TYPE_PROCESSOR:
+                status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
+                if (ACPI_FAILURE(status))
+                        goto err;
+                uid = object.processor.proc_id;
+                break;
+
+        case ACPI_TYPE_DEVICE:
+                status = acpi_evaluate_integer(handle, "_UID", NULL, &uid);
+                if (ACPI_FAILURE(status))
+                        goto err;
+                break;
+        default:
+                goto err;
+        }
+
+        processor_validated_ids_update(uid);
+        return true;
+
+err:
+        acpi_handle_info(handle, "Invalid processor object\n");
+        return false;
 
-        return AE_OK;
 }
 
-static void __init acpi_processor_check_duplicates(void)
+void __init acpi_processor_check_duplicates(void)
 {
-        /* Search all processor nodes in ACPI namespace */
+        /* check the correctness for all processors in ACPI namespace */
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                                                 ACPI_UINT32_MAX,
                                                 acpi_processor_ids_walk,
                                                 NULL, NULL, NULL);
+        acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, acpi_processor_ids_walk,
+                                                NULL, NULL);
 }
 
-bool __init acpi_processor_validate_proc_id(int proc_id)
+bool acpi_duplicate_processor_id(int proc_id)
 {
         int i;
 
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index c86bae7b1d0f..ff096d9755b9 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -421,10 +421,8 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
 
         ACPI_FUNCTION_TRACE(ut_walk_aml_resources);
 
-        /*
-         * The absolute minimum resource template is one end_tag descriptor.
-         * However, we will treat a lone end_tag as just a simple buffer.
-         */
+        /* The absolute minimum resource template is one end_tag descriptor */
+
         if (aml_length < sizeof(struct aml_resource_end_tag)) {
                 return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
         }
@@ -456,8 +454,9 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                 /* Invoke the user function */
 
                 if (user_function) {
-                        status = user_function(aml, length, offset,
-                                               resource_index, context);
+                        status =
+                            user_function(aml, length, offset, resource_index,
+                                          context);
                         if (ACPI_FAILURE(status)) {
                                 return_ACPI_STATUS(status);
                         }
@@ -481,12 +480,6 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
                                 *context = aml;
                         }
 
-                        /* Check if buffer is defined to be longer than the resource length */
-
-                        if (aml_length > (offset + length)) {
-                                return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
-                        }
-
                         /* Normal exit */
 
                         return_ACPI_STATUS(AE_OK);
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index b192b42a8351..79b3c9c5a3bc 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -1073,6 +1073,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
                 if (list_empty(&ghes_sci))
                         unregister_acpi_hed_notifier(&ghes_notifier_sci);
                 mutex_unlock(&ghes_list_mutex);
+                synchronize_rcu();
                 break;
         case ACPI_HEST_NOTIFY_NMI:
                 ghes_nmi_remove(ghes);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 80cb5eb75b63..34fbe027e73a 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1249,7 +1249,6 @@ static int __init acpi_init(void)
         acpi_wakeup_device_init();
         acpi_debugger_init();
         acpi_setup_sb_notify_handler();
-        acpi_set_processor_mapping();
         return 0;
 }
 
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index fb19e1cdb641..edc8663b5db3 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -99,13 +99,13 @@ static int find_child_checks(struct acpi_device *adev, bool check_children)
                 return -ENODEV;
 
         /*
-         * If the device has a _HID (or _CID) returning a valid ACPI/PNP
-         * device ID, it is better to make it look less attractive here, so that
-         * the other device with the same _ADR value (that may not have a valid
-         * device ID) can be matched going forward.  [This means a second spec
-         * violation in a row, so whatever we do here is best effort anyway.]
+         * If the device has a _HID returning a valid ACPI/PNP device ID, it is
+         * better to make it look less attractive here, so that the other device
+         * with the same _ADR value (that may not have a valid device ID) can be
+         * matched going forward.  [This means a second spec violation in a row,
+         * so whatever we do here is best effort anyway.]
          */
-        return sta_present && list_empty(&adev->pnp.ids) ?
+        return sta_present && !adev->pnp.type.platform_id ?
                         FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
 }
 
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 219b90bc0922..f15900132912 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -41,8 +41,10 @@ void acpi_gpe_apply_masked_gpes(void);
 void acpi_container_init(void);
 void acpi_memory_hotplug_init(void);
 #ifdef  CONFIG_ACPI_HOTPLUG_IOAPIC
+void pci_ioapic_remove(struct acpi_pci_root *root);
 int acpi_ioapic_remove(struct acpi_pci_root *root);
 #else
+static inline void pci_ioapic_remove(struct acpi_pci_root *root) { return; }
 static inline int acpi_ioapic_remove(struct acpi_pci_root *root) { return 0; }
 #endif
 #ifdef CONFIG_ACPI_DOCK
diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c
index 6d7ce6e12aaa..7e4fbf9a53a3 100644
--- a/drivers/acpi/ioapic.c
+++ b/drivers/acpi/ioapic.c
@@ -45,6 +45,12 @@ static acpi_status setup_res(struct acpi_resource *acpi_res, void *data)
         struct resource *res = data;
         struct resource_win win;
 
+        /*
+         * We might assign this to 'res' later, make sure all pointers are
+         * cleared before the resource is added to the global list
+         */
+        memset(&win, 0, sizeof(win));
+
         res->flags = 0;
         if (acpi_dev_filter_resource_type(acpi_res, IORESOURCE_MEM))
                 return AE_OK;
@@ -206,24 +212,34 @@ int acpi_ioapic_add(acpi_handle root_handle)
         return ACPI_SUCCESS(status) && ACPI_SUCCESS(retval) ? 0 : -ENODEV;
 }
 
-int acpi_ioapic_remove(struct acpi_pci_root *root)
+void pci_ioapic_remove(struct acpi_pci_root *root)
 {
-        int retval = 0;
         struct acpi_pci_ioapic *ioapic, *tmp;
 
         mutex_lock(&ioapic_list_lock);
         list_for_each_entry_safe(ioapic, tmp, &ioapic_list, list) {
                 if (root->device->handle != ioapic->root_handle)
                         continue;
-
-                if (acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base))
-                        retval = -EBUSY;
-
                 if (ioapic->pdev) {
                         pci_release_region(ioapic->pdev, 0);
                         pci_disable_device(ioapic->pdev);
                         pci_dev_put(ioapic->pdev);
                 }
+        }
+        mutex_unlock(&ioapic_list_lock);
+}
+
+int acpi_ioapic_remove(struct acpi_pci_root *root)
+{
+        int retval = 0;
+        struct acpi_pci_ioapic *ioapic, *tmp;
+
+        mutex_lock(&ioapic_list_lock);
+        list_for_each_entry_safe(ioapic, tmp, &ioapic_list, list) {
+                if (root->device->handle != ioapic->root_handle)
+                        continue;
+                if (acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base))
+                        retval = -EBUSY;
                 if (ioapic->res.flags && ioapic->res.parent)
                         release_resource(&ioapic->res);
                 list_del(&ioapic->list);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 662036bdc65e..c8ea9d698cd0 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1617,7 +1617,11 @@ static int cmp_map(const void *m0, const void *m1)
         const struct nfit_set_info_map *map0 = m0;
         const struct nfit_set_info_map *map1 = m1;
 
-        return map0->region_offset - map1->region_offset;
+        if (map0->region_offset < map1->region_offset)
+                return -1;
+        else if (map0->region_offset > map1->region_offset)
+                return 1;
+        return 0;
 }
 
 /* Retrieve the nth entry referencing this spa */
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index bf601d4df8cf..919be0aa2578 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -648,12 +648,12 @@ static void acpi_pci_root_remove(struct acpi_device *device)
 
         pci_stop_root_bus(root->bus);
 
-        WARN_ON(acpi_ioapic_remove(root));
-
+        pci_ioapic_remove(root);
         device_set_run_wake(root->bus->bridge, false);
         pci_acpi_remove_bus_pm_notifier(device);
 
         pci_remove_root_bus(root->bus);
+        WARN_ON(acpi_ioapic_remove(root));
 
         dmar_device_remove(device->handle);
 
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fcd4ce6f78d5..1c2b846c5776 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -200,6 +200,7 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
                 return -EINVAL;
 
         /* The state of the list is 'on' IFF all resources are 'on'. */
+        cur_state = 0;
         list_for_each_entry(entry, list, node) {
                 struct acpi_power_resource *resource = entry->resource;
                 acpi_handle handle = resource->device.handle;
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 611a5585a902..b933061b6b60 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -32,12 +32,12 @@ static struct acpi_table_madt *get_madt_table(void)
 }
 
 static int map_lapic_id(struct acpi_subtable_header *entry,
-                 u32 acpi_id, phys_cpuid_t *apic_id, bool ignore_disabled)
+                 u32 acpi_id, phys_cpuid_t *apic_id)
 {
         struct acpi_madt_local_apic *lapic =
                 container_of(entry, struct acpi_madt_local_apic, header);
 
-        if (ignore_disabled && !(lapic->lapic_flags & ACPI_MADT_ENABLED))
+        if (!(lapic->lapic_flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         if (lapic->processor_id != acpi_id)
@@ -48,13 +48,12 @@ static int map_lapic_id(struct acpi_subtable_header *entry,
 }
 
 static int map_x2apic_id(struct acpi_subtable_header *entry,
-                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id,
-                bool ignore_disabled)
+                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id)
 {
         struct acpi_madt_local_x2apic *apic =
                 container_of(entry, struct acpi_madt_local_x2apic, header);
 
-        if (ignore_disabled && !(apic->lapic_flags & ACPI_MADT_ENABLED))
+        if (!(apic->lapic_flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         if (device_declaration && (apic->uid == acpi_id)) {
@@ -66,13 +65,12 @@ static int map_x2apic_id(struct acpi_subtable_header *entry,
 }
 
 static int map_lsapic_id(struct acpi_subtable_header *entry,
-                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id,
-                bool ignore_disabled)
+                int device_declaration, u32 acpi_id, phys_cpuid_t *apic_id)
 {
         struct acpi_madt_local_sapic *lsapic =
                 container_of(entry, struct acpi_madt_local_sapic, header);
 
-        if (ignore_disabled && !(lsapic->lapic_flags & ACPI_MADT_ENABLED))
+        if (!(lsapic->lapic_flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         if (device_declaration) {
@@ -89,13 +87,12 @@ static int map_lsapic_id(struct acpi_subtable_header *entry,
  * Retrieve the ARM CPU physical identifier (MPIDR)
  */
 static int map_gicc_mpidr(struct acpi_subtable_header *entry,
-                int device_declaration, u32 acpi_id, phys_cpuid_t *mpidr,
-                bool ignore_disabled)
+                int device_declaration, u32 acpi_id, phys_cpuid_t *mpidr)
 {
         struct acpi_madt_generic_interrupt *gicc =
             container_of(entry, struct acpi_madt_generic_interrupt, header);
 
-        if (ignore_disabled && !(gicc->flags & ACPI_MADT_ENABLED))
+        if (!(gicc->flags & ACPI_MADT_ENABLED))
                 return -ENODEV;
 
         /* device_declaration means Device object in DSDT, in the
@@ -112,7 +109,7 @@ static int map_gicc_mpidr(struct acpi_subtable_header *entry,
 }
 
 static phys_cpuid_t map_madt_entry(struct acpi_table_madt *madt,
-                                   int type, u32 acpi_id, bool ignore_disabled)
+                                   int type, u32 acpi_id)
 {
         unsigned long madt_end, entry;
         phys_cpuid_t phys_id = PHYS_CPUID_INVALID;      /* CPU hardware ID */
@@ -130,20 +127,16 @@ static phys_cpuid_t map_madt_entry(struct acpi_table_madt *madt,
                 struct acpi_subtable_header *header =
                         (struct acpi_subtable_header *)entry;
                 if (header->type == ACPI_MADT_TYPE_LOCAL_APIC) {
-                        if (!map_lapic_id(header, acpi_id, &phys_id,
-                                          ignore_disabled))
+                        if (!map_lapic_id(header, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC) {
-                        if (!map_x2apic_id(header, type, acpi_id, &phys_id,
-                                           ignore_disabled))
+                        if (!map_x2apic_id(header, type, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC) {
-                        if (!map_lsapic_id(header, type, acpi_id, &phys_id,
-                                           ignore_disabled))
+                        if (!map_lsapic_id(header, type, acpi_id, &phys_id))
                                 break;
                 } else if (header->type == ACPI_MADT_TYPE_GENERIC_INTERRUPT) {
-                        if (!map_gicc_mpidr(header, type, acpi_id, &phys_id,
-                                            ignore_disabled))
+                        if (!map_gicc_mpidr(header, type, acpi_id, &phys_id))
                                 break;
                 }
                 entry += header->length;
@@ -161,15 +154,14 @@ phys_cpuid_t __init acpi_map_madt_entry(u32 acpi_id)
         if (!madt)
                 return PHYS_CPUID_INVALID;
 
-        rv = map_madt_entry(madt, 1, acpi_id, true);
+        rv = map_madt_entry(madt, 1, acpi_id);
 
         acpi_put_table((struct acpi_table_header *)madt);
 
         return rv;
 }
 
-static phys_cpuid_t map_mat_entry(acpi_handle handle, int type, u32 acpi_id,
-                                  bool ignore_disabled)
+static phys_cpuid_t map_mat_entry(acpi_handle handle, int type, u32 acpi_id)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
@@ -190,38 +182,30 @@ static phys_cpuid_t map_mat_entry(acpi_handle handle, int type, u32 acpi_id,
 
         header = (struct acpi_subtable_header *)obj->buffer.pointer;
         if (header->type == ACPI_MADT_TYPE_LOCAL_APIC)
-                map_lapic_id(header, acpi_id, &phys_id, ignore_disabled);
+                map_lapic_id(header, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_LOCAL_SAPIC)
-                map_lsapic_id(header, type, acpi_id, &phys_id, ignore_disabled);
+                map_lsapic_id(header, type, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_LOCAL_X2APIC)
-                map_x2apic_id(header, type, acpi_id, &phys_id, ignore_disabled);
+                map_x2apic_id(header, type, acpi_id, &phys_id);
         else if (header->type == ACPI_MADT_TYPE_GENERIC_INTERRUPT)
-                map_gicc_mpidr(header, type, acpi_id, &phys_id,
-                               ignore_disabled);
+                map_gicc_mpidr(header, type, acpi_id, &phys_id);
 
 exit:
         kfree(buffer.pointer);
         return phys_id;
 }
 
-static phys_cpuid_t __acpi_get_phys_id(acpi_handle handle, int type,
-                                       u32 acpi_id, bool ignore_disabled)
+phys_cpuid_t acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
 {
         phys_cpuid_t phys_id;
 
-        phys_id = map_mat_entry(handle, type, acpi_id, ignore_disabled);
+        phys_id = map_mat_entry(handle, type, acpi_id);
         if (invalid_phys_cpuid(phys_id))
-                phys_id = map_madt_entry(get_madt_table(), type, acpi_id,
-                                           ignore_disabled);
+                phys_id = map_madt_entry(get_madt_table(), type, acpi_id);
 
         return phys_id;
 }
 
-phys_cpuid_t acpi_get_phys_id(acpi_handle handle, int type, u32 acpi_id)
-{
-        return __acpi_get_phys_id(handle, type, acpi_id, true);
-}
-
 int acpi_map_cpuid(phys_cpuid_t phys_id, u32 acpi_id)
 {
 #ifdef CONFIG_SMP
@@ -278,79 +262,6 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
 }
 EXPORT_SYMBOL_GPL(acpi_get_cpuid);
 
-#ifdef CONFIG_ACPI_HOTPLUG_CPU
-static bool __init
-map_processor(acpi_handle handle, phys_cpuid_t *phys_id, int *cpuid)
-{
-        int type, id;
-        u32 acpi_id;
-        acpi_status status;
-        acpi_object_type acpi_type;
-        unsigned long long tmp;
-        union acpi_object object = { 0 };
-        struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
-
-        status = acpi_get_type(handle, &acpi_type);
-        if (ACPI_FAILURE(status))
-                return false;
-
-        switch (acpi_type) {
-        case ACPI_TYPE_PROCESSOR:
-                status = acpi_evaluate_object(handle, NULL, NULL, &buffer);
-                if (ACPI_FAILURE(status))
-                        return false;
-                acpi_id = object.processor.proc_id;
-
-                /* validate the acpi_id */
-                if(acpi_processor_validate_proc_id(acpi_id))
-                        return false;
-                break;
-        case ACPI_TYPE_DEVICE:
-                status = acpi_evaluate_integer(handle, "_UID", NULL, &tmp);
-                if (ACPI_FAILURE(status))
-                        return false;
-                acpi_id = tmp;
-                break;
-        default:
-                return false;
-        }
-
-        type = (acpi_type == ACPI_TYPE_DEVICE) ? 1 : 0;
-
-        *phys_id = __acpi_get_phys_id(handle, type, acpi_id, false);
-        id = acpi_map_cpuid(*phys_id, acpi_id);
-
-        if (id < 0)
-                return false;
-        *cpuid = id;
-        return true;
-}
-
-static acpi_status __init
-set_processor_node_mapping(acpi_handle handle, u32 lvl, void *context,
-                           void **rv)
-{
-        phys_cpuid_t phys_id;
-        int cpu_id;
-
-        if (!map_processor(handle, &phys_id, &cpu_id))
-                return AE_ERROR;
-
-        acpi_map_cpu2node(handle, cpu_id, phys_id);
-        return AE_OK;
-}
-
-void __init acpi_set_processor_mapping(void)
-{
-        /* Set persistent cpu <-> node mapping for all processors. */
-        acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
-                            ACPI_UINT32_MAX, set_processor_node_mapping,
-                            NULL, NULL, NULL);
-}
-#else
-void __init acpi_set_processor_mapping(void) {}
-#endif /* CONFIG_ACPI_HOTPLUG_CPU */
-
 #ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
 static int get_ioapic_id(struct acpi_subtable_header *entry, u32 gsi_base,
                          u64 *phys_addr, int *ioapic_id)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 192691880d55..2433569b02ef 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1857,15 +1857,20 @@ static void acpi_bus_attach(struct acpi_device *device)
                 return;
 
         device->flags.match_driver = true;
-        if (!ret) {
-                ret = device_attach(&device->dev);
-                if (ret < 0)
-                        return;
-
-                if (!ret && device->pnp.type.platform_id)
-                        acpi_default_enumeration(device);
+        if (ret > 0) {
+                acpi_device_set_enumerated(device);
+                goto ok;
         }
 
+        ret = device_attach(&device->dev);
+        if (ret < 0)
+                return;
+
+        if (ret > 0 || !device->pnp.type.platform_id)
+                acpi_device_set_enumerated(device);
+        else
+                acpi_default_enumeration(device);
+
  ok:
         list_for_each_entry(child, &device->children, node)
                 acpi_bus_attach(child);
diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index 01c94669a2b0..3afa8c1fa127 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -30,7 +30,7 @@ static bool qdf2400_erratum_44_present(struct acpi_table_header *h)
                 return true;
 
         if (!memcmp(h->oem_table_id, "QDF2400 ", ACPI_OEM_TABLE_ID_SIZE) &&
-                        h->oem_revision == 0)
+                        h->oem_revision == 1)
                 return true;
 
         return false;
diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c
index 85d833289f28..4c96f3ac4976 100644
--- a/drivers/ata/ahci_qoriq.c
+++ b/drivers/ata/ahci_qoriq.c
@@ -177,7 +177,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
         case AHCI_LS1043A:
                 if (!qpriv->ecc_addr)
                         return -EINVAL;
-                writel(ECC_DIS_ARMV8_CH2, qpriv->ecc_addr);
+                writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
+                                qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
@@ -194,7 +195,8 @@ static int ahci_qoriq_phy_init(struct ahci_host_priv *hpriv)
         case AHCI_LS1046A:
                 if (!qpriv->ecc_addr)
                         return -EINVAL;
-                writel(ECC_DIS_ARMV8_CH2, qpriv->ecc_addr);
+                writel(readl(qpriv->ecc_addr) | ECC_DIS_ARMV8_CH2,
+                                qpriv->ecc_addr);
                 writel(AHCI_PORT_PHY_1_CFG, reg_base + PORT_PHY1);
                 writel(AHCI_PORT_TRANS_CFG, reg_base + PORT_TRANS);
                 if (qpriv->is_dmacoherent)
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 2bd92dca3e62..274d6d7193d7 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1482,7 +1482,6 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc)
                 break;
 
         default:
-                WARN_ON_ONCE(1);
                 return AC_ERR_SYSTEM;
         }
 
diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index 46698232e6bf..19e6e539a061 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -224,7 +224,6 @@ static DECLARE_TRANSPORT_CLASS(ata_port_class,
 
 static void ata_tport_release(struct device *dev)
 {
-        put_device(dev->parent);
 }
 
 /**
@@ -284,7 +283,7 @@ int ata_tport_add(struct device *parent,
         device_initialize(dev);
         dev->type = &ata_port_type;
 
-        dev->parent = get_device(parent);
+        dev->parent = parent;
         dev->release = ata_tport_release;
         dev_set_name(dev, "ata%d", ap->print_id);
         transport_setup_device(dev);
@@ -348,7 +347,6 @@ static DECLARE_TRANSPORT_CLASS(ata_link_class,
 
 static void ata_tlink_release(struct device *dev)
 {
-        put_device(dev->parent);
 }
 
 /**
@@ -410,7 +408,7 @@ int ata_tlink_add(struct ata_link *link)
         int error;
 
         device_initialize(dev);
-        dev->parent = get_device(&ap->tdev);
+        dev->parent = &ap->tdev;
         dev->release = ata_tlink_release;
         if (ata_is_host_link(link))
                 dev_set_name(dev, "link%d", ap->print_id);
@@ -589,7 +587,6 @@ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
 
 static void ata_tdev_release(struct device *dev)
 {
-        put_device(dev->parent);
 }
 
 /**
@@ -662,7 +659,7 @@ static int ata_tdev_add(struct ata_device *ata_dev)
         int error;
 
         device_initialize(dev);
-        dev->parent = get_device(&link->tdev);
+        dev->parent = &link->tdev;
         dev->release = ata_tdev_release;
         if (ata_is_host_link(link))
                 dev_set_name(dev, "dev%d.%d", ap->print_id,ata_dev->devno);
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index 6c9aa95a9a05..49d705c9f0f7 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -278,11 +278,6 @@ static int atiixp_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         };
         const struct ata_port_info *ppi[] = { &info, &info };
 
-        /* SB600/700 don't have secondary port wired */
-        if ((pdev->device == PCI_DEVICE_ID_ATI_IXP600_IDE) ||
-                (pdev->device == PCI_DEVICE_ID_ATI_IXP700_IDE))
-                ppi[1] = &ata_dummy_port_info;
-
         return ata_pci_bmdma_init_one(pdev, ppi, &atiixp_sht, NULL,
                                       ATA_HOST_PARALLEL_SCAN);
 }
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 0636d84fbefe..f3f538eec7b3 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -644,14 +644,16 @@ static void svia_configure(struct pci_dev *pdev, int board_id,
                 pci_write_config_byte(pdev, SATA_NATIVE_MODE, tmp8);
         }
 
-        /* enable IRQ on hotplug */
-        pci_read_config_byte(pdev, SVIA_MISC_3, &tmp8);
-        if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
-                dev_dbg(&pdev->dev,
-                        "enabling SATA hotplug (0x%x)\n",
-                        (int) tmp8);
-                tmp8 |= SATA_HOTPLUG;
-                pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+        if (board_id == vt6421) {
+                /* enable IRQ on hotplug */
+                pci_read_config_byte(pdev, SVIA_MISC_3, &tmp8);
+                if ((tmp8 & SATA_HOTPLUG) != SATA_HOTPLUG) {
+                        dev_dbg(&pdev->dev,
+                                "enabling SATA hotplug (0x%x)\n",
+                                (int) tmp8);
+                        tmp8 |= SATA_HOTPLUG;
+                        pci_write_config_byte(pdev, SVIA_MISC_3, tmp8);
+                }
         }
 
         /*
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index bf43b5d2aafc..83f1439e57fd 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -218,6 +218,7 @@ static const struct of_device_id img_ascii_lcd_matches[] = {
         { .compatible = "img,boston-lcd", .data = &boston_config },
         { .compatible = "mti,malta-lcd", .data = &malta_config },
         { .compatible = "mti,sead3-lcd", .data = &sead3_config },
+        { /* sentinel */ }
 };
 
 /**
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 684bda4d14a1..6bb60fb6a30b 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -639,11 +639,6 @@ int lock_device_hotplug_sysfs(void)
         return restart_syscall();
 }
 
-void assert_held_device_hotplug(void)
-{
-        lockdep_assert_held(&device_hotplug_lock);
-}
-
 #ifdef CONFIG_BLOCK
 static inline int device_is_not_partition(struct device *dev)
 {
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index f96ab717534c..1d1dc11aa5fa 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3969,7 +3969,7 @@ static int mtip_block_initialize(struct driver_data *dd)
         dd->tags.reserved_tags = 1;
         dd->tags.cmd_size = sizeof(struct mtip_cmd);
         dd->tags.numa_node = dd->numa_node;
-        dd->tags.flags = BLK_MQ_F_SHOULD_MERGE;
+        dd->tags.flags = BLK_MQ_F_SHOULD_MERGE | BLK_MQ_F_NO_SCHED;
         dd->tags.driver_data = dd;
         dd->tags.timeout = MTIP_NCQ_CMD_TIMEOUT_MS;
 
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 7e4287bc19e5..d8a23561b4cb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -47,6 +47,8 @@ static DEFINE_MUTEX(nbd_index_mutex);
 struct nbd_sock {
         struct socket *sock;
         struct mutex tx_lock;
+        struct request *pending;
+        int sent;
 };
 
 #define NBD_TIMEDOUT                    0
@@ -124,7 +126,8 @@ static const char *nbdcmd_to_ascii(int cmd)
 
 static int nbd_size_clear(struct nbd_device *nbd, struct block_device *bdev)
 {
-        bd_set_size(bdev, 0);
+        if (bdev->bd_openers <= 1)
+                bd_set_size(bdev, 0);
         set_capacity(nbd->disk, 0);
         kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE);
 
@@ -190,7 +193,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
 
         dev_err(nbd_to_dev(nbd), "Connection timed out, shutting down connection\n");
         set_bit(NBD_TIMEDOUT, &nbd->runtime_flags);
-        req->errors++;
+        req->errors = -EIO;
 
         mutex_lock(&nbd->config_lock);
         sock_shutdown(nbd);
@@ -202,7 +205,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
  *  Send or receive packet.
  */
 static int sock_xmit(struct nbd_device *nbd, int index, int send,
-                     struct iov_iter *iter, int msg_flags)
+                     struct iov_iter *iter, int msg_flags, int *sent)
 {
         struct socket *sock = nbd->socks[index]->sock;
         int result;
@@ -237,6 +240,8 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
                                 result = -EPIPE; /* short read */
                         break;
                 }
+                if (sent)
+                        *sent += result;
         } while (msg_data_left(&msg));
 
         tsk_restore_flags(current, pflags, PF_MEMALLOC);
@@ -248,6 +253,7 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send,
 static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
+        struct nbd_sock *nsock = nbd->socks[index];
         int result;
         struct nbd_request request = {.magic = htonl(NBD_REQUEST_MAGIC)};
         struct kvec iov = {.iov_base = &request, .iov_len = sizeof(request)};
@@ -256,6 +262,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
         struct bio *bio;
         u32 type;
         u32 tag = blk_mq_unique_tag(req);
+        int sent = nsock->sent, skip = 0;
 
         iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
 
@@ -283,6 +290,17 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 return -EIO;
         }
 
+        /* We did a partial send previously, and we at least sent the whole
+         * request struct, so just go and send the rest of the pages in the
+         * request.
+         */
+        if (sent) {
+                if (sent >= sizeof(request)) {
+                        skip = sent - sizeof(request);
+                        goto send_pages;
+                }
+                iov_iter_advance(&from, sent);
+        }
         request.type = htonl(type);
         if (type != NBD_CMD_FLUSH) {
                 request.from = cpu_to_be64((u64)blk_rq_pos(req) << 9);
@@ -294,15 +312,27 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 cmd, nbdcmd_to_ascii(type),
                 (unsigned long long)blk_rq_pos(req) << 9, blk_rq_bytes(req));
         result = sock_xmit(nbd, index, 1, &from,
-                        (type == NBD_CMD_WRITE) ? MSG_MORE : 0);
+                        (type == NBD_CMD_WRITE) ? MSG_MORE : 0, &sent);
         if (result <= 0) {
+                if (result == -ERESTARTSYS) {
+                        /* If we havne't sent anything we can just return BUSY,
+                         * however if we have sent something we need to make
+                         * sure we only allow this req to be sent until we are
+                         * completely done.
+                         */
+                        if (sent) {
+                                nsock->pending = req;
+                                nsock->sent = sent;
+                        }
+                        return BLK_MQ_RQ_QUEUE_BUSY;
+                }
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                         "Send control failed (result %d)\n", result);
                 return -EIO;
         }
-
+send_pages:
         if (type != NBD_CMD_WRITE)
-                return 0;
+                goto out;
 
         bio = req->bio;
         while (bio) {
@@ -318,8 +348,25 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                                 cmd, bvec.bv_len);
                         iov_iter_bvec(&from, ITER_BVEC | WRITE,
                                       &bvec, 1, bvec.bv_len);
-                        result = sock_xmit(nbd, index, 1, &from, flags);
+                        if (skip) {
+                                if (skip >= iov_iter_count(&from)) {
+                                        skip -= iov_iter_count(&from);
+                                        continue;
+                                }
+                                iov_iter_advance(&from, skip);
+                                skip = 0;
+                        }
+                        result = sock_xmit(nbd, index, 1, &from, flags, &sent);
                         if (result <= 0) {
+                                if (result == -ERESTARTSYS) {
+                                        /* We've already sent the header, we
+                                         * have no choice but to set pending and
+                                         * return BUSY.
+                                         */
+                                        nsock->pending = req;
+                                        nsock->sent = sent;
+                                        return BLK_MQ_RQ_QUEUE_BUSY;
+                                }
                                 dev_err(disk_to_dev(nbd->disk),
                                         "Send data failed (result %d)\n",
                                         result);
@@ -336,6 +383,9 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index)
                 }
                 bio = next;
         }
+out:
+        nsock->pending = NULL;
+        nsock->sent = 0;
         return 0;
 }
 
@@ -353,7 +403,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
 
         reply.magic = 0;
         iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(reply));
-        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL);
+        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
         if (result <= 0) {
                 if (!test_bit(NBD_DISCONNECTED, &nbd->runtime_flags) &&
                     !test_bit(NBD_DISCONNECT_REQUESTED, &nbd->runtime_flags))
@@ -383,7 +433,7 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
         if (ntohl(reply.error)) {
                 dev_err(disk_to_dev(nbd->disk), "Other side returned error (%d)\n",
                         ntohl(reply.error));
-                req->errors++;
+                req->errors = -EIO;
                 return cmd;
         }
 
@@ -395,11 +445,11 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
                 rq_for_each_segment(bvec, req, iter) {
                         iov_iter_bvec(&to, ITER_BVEC | READ,
                                       &bvec, 1, bvec.bv_len);
-                        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL);
+                        result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL);
                         if (result <= 0) {
                                 dev_err(disk_to_dev(nbd->disk), "Receive data failed (result %d)\n",
                                         result);
-                                req->errors++;
+                                req->errors = -EIO;
                                 return cmd;
                         }
                         dev_dbg(nbd_to_dev(nbd), "request %p: got %d bytes data\n",
@@ -469,7 +519,7 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved)
         if (!blk_mq_request_started(req))
                 return;
         cmd = blk_mq_rq_to_pdu(req);
-        req->errors++;
+        req->errors = -EIO;
         nbd_end_request(cmd);
 }
 
@@ -482,22 +532,23 @@ static void nbd_clear_que(struct nbd_device *nbd)
 }
 
 
-static void nbd_handle_cmd(struct nbd_cmd *cmd, int index)
+static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 {
         struct request *req = blk_mq_rq_from_pdu(cmd);
         struct nbd_device *nbd = cmd->nbd;
         struct nbd_sock *nsock;
+        int ret;
 
         if (index >= nbd->num_connections) {
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on invalid socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
         if (test_bit(NBD_DISCONNECTED, &nbd->runtime_flags)) {
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on closed socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
         req->errors = 0;
@@ -508,29 +559,30 @@ static void nbd_handle_cmd(struct nbd_cmd *cmd, int index)
                 mutex_unlock(&nsock->tx_lock);
                 dev_err_ratelimited(disk_to_dev(nbd->disk),
                                     "Attempted send on closed socket\n");
-                goto error_out;
+                return -EINVAL;
         }
 
-        if (nbd_send_cmd(nbd, cmd, index) != 0) {
-                dev_err_ratelimited(disk_to_dev(nbd->disk),
-                                    "Request send failed\n");
-                req->errors++;
-                nbd_end_request(cmd);
+        /* Handle the case that we have a pending request that was partially
+         * transmitted that _has_ to be serviced first.  We need to call requeue
+         * here so that it gets put _after_ the request that is already on the
+         * dispatch list.
+         */
+        if (unlikely(nsock->pending && nsock->pending != req)) {
+                blk_mq_requeue_request(req, true);
+                ret = 0;
+                goto out;
         }
-
+        ret = nbd_send_cmd(nbd, cmd, index);
+out:
         mutex_unlock(&nsock->tx_lock);
-
-        return;
-
-error_out:
-        req->errors++;
-        nbd_end_request(cmd);
+        return ret;
 }
 
 static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
                         const struct blk_mq_queue_data *bd)
 {
         struct nbd_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
+        int ret;
 
         /*
          * Since we look at the bio's to send the request over the network we
@@ -543,10 +595,20 @@ static int nbd_queue_rq(struct blk_mq_hw_ctx *hctx,
          */
         init_completion(&cmd->send_complete);
         blk_mq_start_request(bd->rq);
-        nbd_handle_cmd(cmd, hctx->queue_num);
+
+        /* We can be called directly from the user space process, which means we
+         * could possibly have signals pending so our sendmsg will fail.  In
+         * this case we need to return that we are busy, otherwise error out as
+         * appropriate.
+         */
+        ret = nbd_handle_cmd(cmd, hctx->queue_num);
+        if (ret < 0)
+                ret = BLK_MQ_RQ_QUEUE_ERROR;
+        if (!ret)
+                ret = BLK_MQ_RQ_QUEUE_OK;
         complete(&cmd->send_complete);
 
-        return BLK_MQ_RQ_QUEUE_OK;
+        return ret;
 }
 
 static int nbd_add_socket(struct nbd_device *nbd, struct block_device *bdev,
@@ -581,6 +643,8 @@ static int nbd_add_socket(struct nbd_device *nbd, struct block_device *bdev,
 
         mutex_init(&nsock->tx_lock);
         nsock->sock = sock;
+        nsock->pending = NULL;
+        nsock->sent = 0;
         socks[nbd->num_connections++] = nsock;
 
         if (max_part)
@@ -602,6 +666,8 @@ static void nbd_reset(struct nbd_device *nbd)
 
 static void nbd_bdev_reset(struct block_device *bdev)
 {
+        if (bdev->bd_openers > 1)
+                return;
         set_device_ro(bdev, false);
         bdev->bd_inode->i_size = 0;
         if (max_part > 0) {
@@ -634,7 +700,7 @@ static void send_disconnects(struct nbd_device *nbd)
 
         for (i = 0; i < nbd->num_connections; i++) {
                 iov_iter_kvec(&from, WRITE | ITER_KVEC, &iov, 1, sizeof(request));
-                ret = sock_xmit(nbd, i, 1, &from, 0);
+                ret = sock_xmit(nbd, i, 1, &from, 0, NULL);
                 if (ret <= 0)
                         dev_err(disk_to_dev(nbd->disk),
                                 "Send disconnect failed %d\n", ret);
@@ -665,7 +731,8 @@ static int nbd_clear_sock(struct nbd_device *nbd, struct block_device *bdev)
 {
         sock_shutdown(nbd);
         nbd_clear_que(nbd);
-        kill_bdev(bdev);
+
+        __invalidate_device(bdev, true);
         nbd_bdev_reset(bdev);
         /*
          * We want to give the run thread a chance to wait for everybody
@@ -781,7 +848,10 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                 nbd_size_set(nbd, bdev, nbd->blksize, arg);
                 return 0;
         case NBD_SET_TIMEOUT:
-                nbd->tag_set.timeout = arg * HZ;
+                if (arg) {
+                        nbd->tag_set.timeout = arg * HZ;
+                        blk_queue_rq_timeout(nbd->disk->queue, arg * HZ);
+                }
                 return 0;
 
         case NBD_SET_FLAGS:
diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
index 10aed84244f5..939641d6e262 100644
--- a/drivers/block/paride/pcd.c
+++ b/drivers/block/paride/pcd.c
@@ -50,7 +50,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
                         
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (46) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 644ba0888bd4..9cfd2e06a649 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -61,7 +61,7 @@
                         first drive found.
                         
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (45) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pf.c b/drivers/block/paride/pf.c
index ed93e8badf56..14c5d32f5d8b 100644
--- a/drivers/block/paride/pf.c
+++ b/drivers/block/paride/pf.c
@@ -59,7 +59,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (47) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pg.c b/drivers/block/paride/pg.c
index 5db955fe3a94..3b5882bfb736 100644
--- a/drivers/block/paride/pg.c
+++ b/drivers/block/paride/pg.c
@@ -84,7 +84,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (97) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
index 61fc6824299a..e815312a00ad 100644
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -61,7 +61,7 @@
                         the slower the port i/o.  In some cases, setting
                         this to zero will speed up the device. (default -1)
 
-            major       You may use this parameter to overide the
+            major       You may use this parameter to override the
                         default major number (96) that this driver
                         will use.  Be sure to change the device
                         name as well.
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 4d6807723798..517838b65964 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -120,10 +120,11 @@ static int atomic_dec_return_safe(atomic_t *v)
 
 /* Feature bits */
 
-#define RBD_FEATURE_LAYERING    (1<<0)
-#define RBD_FEATURE_STRIPINGV2  (1<<1)
-#define RBD_FEATURE_EXCLUSIVE_LOCK (1<<2)
-#define RBD_FEATURE_DATA_POOL (1<<7)
+#define RBD_FEATURE_LAYERING            (1ULL<<0)
+#define RBD_FEATURE_STRIPINGV2          (1ULL<<1)
+#define RBD_FEATURE_EXCLUSIVE_LOCK      (1ULL<<2)
+#define RBD_FEATURE_DATA_POOL           (1ULL<<7)
+
 #define RBD_FEATURES_ALL        (RBD_FEATURE_LAYERING |         \
                                  RBD_FEATURE_STRIPINGV2 |       \
                                  RBD_FEATURE_EXCLUSIVE_LOCK |   \
@@ -499,16 +500,23 @@ static bool rbd_is_lock_owner(struct rbd_device *rbd_dev)
         return is_lock_owner;
 }
 
+static ssize_t rbd_supported_features_show(struct bus_type *bus, char *buf)
+{
+        return sprintf(buf, "0x%llx\n", RBD_FEATURES_SUPPORTED);
+}
+
 static BUS_ATTR(add, S_IWUSR, NULL, rbd_add);
 static BUS_ATTR(remove, S_IWUSR, NULL, rbd_remove);
 static BUS_ATTR(add_single_major, S_IWUSR, NULL, rbd_add_single_major);
 static BUS_ATTR(remove_single_major, S_IWUSR, NULL, rbd_remove_single_major);
+static BUS_ATTR(supported_features, S_IRUGO, rbd_supported_features_show, NULL);
 
 static struct attribute *rbd_bus_attrs[] = {
         &bus_attr_add.attr,
         &bus_attr_remove.attr,
         &bus_attr_add_single_major.attr,
         &bus_attr_remove_single_major.attr,
+        &bus_attr_supported_features.attr,
         NULL,
 };
 
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index e27d89a36c34..0c09d4256108 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -523,7 +523,7 @@ static int zram_decompress_page(struct zram *zram, char *mem, u32 index)
 
         cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO);
         if (size == PAGE_SIZE) {
-                copy_page(mem, cmem);
+                memcpy(mem, cmem, PAGE_SIZE);
         } else {
                 struct zcomp_strm *zstrm = zcomp_stream_get(zram->comp);
 
@@ -717,7 +717,7 @@ compress_again:
 
         if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
                 src = kmap_atomic(page);
-                copy_page(cmem, src);
+                memcpy(cmem, src, PAGE_SIZE);
                 kunmap_atomic(src);
         } else {
                 memcpy(cmem, src, clen);
@@ -928,7 +928,7 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector,
         }
 
         index = sector >> SECTORS_PER_PAGE_SHIFT;
-        offset = sector & (SECTORS_PER_PAGE - 1) << SECTOR_SHIFT;
+        offset = (sector & (SECTORS_PER_PAGE - 1)) << SECTOR_SHIFT;
 
         bv.bv_page = page;
         bv.bv_len = PAGE_SIZE;
@@ -1189,6 +1189,8 @@ static int zram_add(void)
         blk_queue_io_min(zram->disk->queue, PAGE_SIZE);
         blk_queue_io_opt(zram->disk->queue, PAGE_SIZE);
         zram->disk->queue->limits.discard_granularity = PAGE_SIZE;
+        zram->disk->queue->limits.max_sectors = SECTORS_PER_PAGE;
+        zram->disk->queue->limits.chunk_sectors = 0;
         blk_queue_max_discard_sectors(zram->disk->queue, UINT_MAX);
         /*
          * zram_bio_discard() will clear all logical blocks if logical block
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index c2c14a12713b..08e054507d0b 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -344,7 +344,8 @@ config BT_WILINK
 
 config BT_QCOMSMD
         tristate "Qualcomm SMD based HCI support"
-        depends on (QCOM_SMD && QCOM_WCNSS_CTRL) || COMPILE_TEST
+        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on QCOM_WCNSS_CTRL || (COMPILE_TEST && QCOM_WCNSS_CTRL=n)
         select BT_QCA
         help
           Qualcomm SMD based HCI driver.
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 4a99ac756f08..9959c762da2f 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -55,6 +55,7 @@ MODULE_DEVICE_TABLE(pci, pci_tbl);
 struct amd768_priv {
         void __iomem *iobase;
         struct pci_dev *pcidev;
+        u32 pmbase;
 };
 
 static int amd_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
@@ -148,33 +149,58 @@ found:
         if (pmbase == 0)
                 return -EIO;
 
-        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
-        if (!devm_request_region(&pdev->dev, pmbase + PMBASE_OFFSET,
-                                PMBASE_SIZE, DRV_NAME)) {
+        if (!request_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE, DRV_NAME)) {
                 dev_err(&pdev->dev, DRV_NAME " region 0x%x already in use!\n",
                         pmbase + 0xF0);
-                return -EBUSY;
+                err = -EBUSY;
+                goto out;
         }
 
-        priv->iobase = devm_ioport_map(&pdev->dev, pmbase + PMBASE_OFFSET,
-                        PMBASE_SIZE);
+        priv->iobase = ioport_map(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
         if (!priv->iobase) {
                 pr_err(DRV_NAME "Cannot map ioport\n");
-                return -ENOMEM;
+                err = -EINVAL;
+                goto err_iomap;
         }
 
         amd_rng.priv = (unsigned long)priv;
+        priv->pmbase = pmbase;
         priv->pcidev = pdev;
 
         pr_info(DRV_NAME " detected\n");
-        return devm_hwrng_register(&pdev->dev, &amd_rng);
+        err = hwrng_register(&amd_rng);
+        if (err) {
+                pr_err(DRV_NAME " registering failed (%d)\n", err);
+                goto err_hwrng;
+        }
+        return 0;
+
+err_hwrng:
+        ioport_unmap(priv->iobase);
+err_iomap:
+        release_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+out:
+        kfree(priv);
+        return err;
 }
 
 static void __exit mod_exit(void)
 {
+        struct amd768_priv *priv;
+
+        priv = (struct amd768_priv *)amd_rng.priv;
+
+        hwrng_unregister(&amd_rng);
+
+        ioport_unmap(priv->iobase);
+
+        release_region(priv->pmbase + PMBASE_OFFSET, PMBASE_SIZE);
+
+        kfree(priv);
 }
 
 module_init(mod_init);
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index e7a245942029..e1d421a36a13 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -31,6 +31,9 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 
+
+#define PFX     KBUILD_MODNAME ": "
+
 #define GEODE_RNG_DATA_REG   0x50
 #define GEODE_RNG_STATUS_REG 0x54
 
@@ -82,6 +85,7 @@ static struct hwrng geode_rng = {
 
 static int __init mod_init(void)
 {
+        int err = -ENODEV;
         struct pci_dev *pdev = NULL;
         const struct pci_device_id *ent;
         void __iomem *mem;
@@ -89,27 +93,43 @@ static int __init mod_init(void)
 
         for_each_pci_dev(pdev) {
                 ent = pci_match_id(pci_tbl, pdev);
-                if (ent) {
-                        rng_base = pci_resource_start(pdev, 0);
-                        if (rng_base == 0)
-                                return -ENODEV;
-
-                        mem = devm_ioremap(&pdev->dev, rng_base, 0x58);
-                        if (!mem)
-                                return -ENOMEM;
-                        geode_rng.priv = (unsigned long)mem;
-
-                        pr_info("AMD Geode RNG detected\n");
-                        return devm_hwrng_register(&pdev->dev, &geode_rng);
-                }
+                if (ent)
+                        goto found;
         }
-
         /* Device not found. */
-        return -ENODEV;
+        goto out;
+
+found:
+        rng_base = pci_resource_start(pdev, 0);
+        if (rng_base == 0)
+                goto out;
+        err = -ENOMEM;
+        mem = ioremap(rng_base, 0x58);
+        if (!mem)
+                goto out;
+        geode_rng.priv = (unsigned long)mem;
+
+        pr_info("AMD Geode RNG detected\n");
+        err = hwrng_register(&geode_rng);
+        if (err) {
+                pr_err(PFX "RNG registering failed (%d)\n",
+                       err);
+                goto err_unmap;
+        }
+out:
+        return err;
+
+err_unmap:
+        iounmap(mem);
+        goto out;
 }
 
 static void __exit mod_exit(void)
 {
+        void __iomem *mem = (void __iomem *)geode_rng.priv;
+
+        hwrng_unregister(&geode_rng);
+        iounmap(mem);
 }
 
 module_init(mod_init);
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 3ad86fdf954e..b1ad12552b56 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -397,9 +397,8 @@ static int of_get_omap_rng_device_details(struct omap_rng_dev *priv,
                                 irq, err);
                         return err;
                 }
-                omap_rng_write(priv, RNG_INTMASK_REG, RNG_SHUTDOWN_OFLO_MASK);
 
-                priv->clk = of_clk_get(pdev->dev.of_node, 0);
+                priv->clk = devm_clk_get(&pdev->dev, NULL);
                 if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER)
                         return -EPROBE_DEFER;
                 if (!IS_ERR(priv->clk)) {
@@ -408,6 +407,19 @@ static int of_get_omap_rng_device_details(struct omap_rng_dev *priv,
                                 dev_err(&pdev->dev, "unable to enable the clk, "
                                                     "err = %d\n", err);
                 }
+
+                /*
+                 * On OMAP4, enabling the shutdown_oflo interrupt is
+                 * done in the interrupt mask register. There is no
+                 * such register on EIP76, and it's enabled by the
+                 * same bit in the control register
+                 */
+                if (priv->pdata->regs[RNG_INTMASK_REG])
+                        omap_rng_write(priv, RNG_INTMASK_REG,
+                                       RNG_SHUTDOWN_OFLO_MASK);
+                else
+                        omap_rng_write(priv, RNG_CONTROL_REG,
+                                       RNG_SHUTDOWN_OFLO_MASK);
         }
         return 0;
 }
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6d9cc2d39d22..7e4a9d1296bb 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -60,6 +60,10 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
 #endif
 
 #ifdef CONFIG_STRICT_DEVMEM
+static inline int page_is_allowed(unsigned long pfn)
+{
+        return devmem_is_allowed(pfn);
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
         u64 from = ((u64)pfn) << PAGE_SHIFT;
@@ -75,6 +79,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
         return 1;
 }
 #else
+static inline int page_is_allowed(unsigned long pfn)
+{
+        return 1;
+}
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
         return 1;
@@ -122,23 +130,31 @@ static ssize_t read_mem(struct file *file, char __user *buf,
 
         while (count > 0) {
                 unsigned long remaining;
+                int allowed;
 
                 sz = size_inside_page(p, count);
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, count))
+                allowed = page_is_allowed(p >> PAGE_SHIFT);
+                if (!allowed)
                         return -EPERM;
+                if (allowed == 2) {
+                        /* Show zeros for restricted memory. */
+                        remaining = clear_user(buf, sz);
+                } else {
+                        /*
+                         * On ia64 if a page has been mapped somewhere as
+                         * uncached, then it must also be accessed uncached
+                         * by the kernel or data corruption may occur.
+                         */
+                        ptr = xlate_dev_mem_ptr(p);
+                        if (!ptr)
+                                return -EFAULT;
 
-                /*
-                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * it must also be accessed uncached by the kernel or data
-                 * corruption may occur.
-                 */
-                ptr = xlate_dev_mem_ptr(p);
-                if (!ptr)
-                        return -EFAULT;
+                        remaining = copy_to_user(buf, ptr, sz);
+
+                        unxlate_dev_mem_ptr(p, ptr);
+                }
 
-                remaining = copy_to_user(buf, ptr, sz);
-                unxlate_dev_mem_ptr(p, ptr);
                 if (remaining)
                         return -EFAULT;
 
@@ -181,30 +197,36 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
 #endif
 
         while (count > 0) {
+                int allowed;
+
                 sz = size_inside_page(p, count);
 
-                if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+                allowed = page_is_allowed(p >> PAGE_SHIFT);
+                if (!allowed)
                         return -EPERM;
 
-                /*
-                 * On ia64 if a page has been mapped somewhere as uncached, then
-                 * it must also be accessed uncached by the kernel or data
-                 * corruption may occur.
-                 */
-                ptr = xlate_dev_mem_ptr(p);
-                if (!ptr) {
-                        if (written)
-                                break;
-                        return -EFAULT;
-                }
+                /* Skip actual writing when a page is marked as restricted. */
+                if (allowed == 1) {
+                        /*
+                         * On ia64 if a page has been mapped somewhere as
+                         * uncached, then it must also be accessed uncached
+                         * by the kernel or data corruption may occur.
+                         */
+                        ptr = xlate_dev_mem_ptr(p);
+                        if (!ptr) {
+                                if (written)
+                                        break;
+                                return -EFAULT;
+                        }
 
-                copied = copy_from_user(ptr, buf, sz);
-                unxlate_dev_mem_ptr(p, ptr);
-                if (copied) {
-                        written += sz - copied;
-                        if (written)
-                                break;
-                        return -EFAULT;
+                        copied = copy_from_user(ptr, buf, sz);
+                        unxlate_dev_mem_ptr(p, ptr);
+                        if (copied) {
+                                written += sz - copied;
+                                if (written)
+                                        break;
+                                return -EFAULT;
+                        }
                 }
 
                 buf += sz;
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index a5b1eb276c0b..e6d0d271c58c 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -6,7 +6,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
+#include <linux/sched/signal.h>
 #include <linux/interrupt.h>
 #include <linux/time.h>
 #include <linux/timer.h>
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 2a558c706581..3e73bcdf9e65 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -84,11 +84,14 @@ struct pp_struct {
         struct ieee1284_info state;
         struct ieee1284_info saved_state;
         long default_inactivity;
+        int index;
 };
 
 /* should we use PARDEVICE_MAX here? */
 static struct device *devices[PARPORT_MAX];
 
+static DEFINE_IDA(ida_index);
+
 /* pp_struct.flags bitfields */
 #define PP_CLAIMED    (1<<0)
 #define PP_EXCL       (1<<1)
@@ -290,7 +293,7 @@ static int register_device(int minor, struct pp_struct *pp)
         struct pardevice *pdev = NULL;
         char *name;
         struct pardev_cb ppdev_cb;
-        int rc = 0;
+        int rc = 0, index;
 
         name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor);
         if (name == NULL)
@@ -303,20 +306,23 @@ static int register_device(int minor, struct pp_struct *pp)
                 goto err;
         }
 
+        index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
         memset(&ppdev_cb, 0, sizeof(ppdev_cb));
         ppdev_cb.irq_func = pp_irq;
         ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
         ppdev_cb.private = pp;
-        pdev = parport_register_dev_model(port, name, &ppdev_cb, minor);
+        pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
         parport_put_port(port);
 
         if (!pdev) {
                 pr_warn("%s: failed to register device!\n", name);
                 rc = -ENXIO;
+                ida_simple_remove(&ida_index, index);
                 goto err;
         }
 
         pp->pdev = pdev;
+        pp->index = index;
         dev_dbg(&pdev->dev, "registered pardevice\n");
 err:
         kfree(name);
@@ -755,6 +761,7 @@ static int pp_release(struct inode *inode, struct file *file)
 
         if (pp->pdev) {
                 parport_unregister_device(pp->pdev);
+                ida_simple_remove(&ida_index, pp->index);
                 pp->pdev = NULL;
                 pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
         }
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1ef26403bcc8..0ab024918907 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -313,13 +313,6 @@ static int random_read_wakeup_bits = 64;
 static int random_write_wakeup_bits = 28 * OUTPUT_POOL_WORDS;
 
 /*
- * The minimum number of seconds between urandom pool reseeding.  We
- * do this to limit the amount of entropy that can be drained from the
- * input pool even if there are heavy demands on /dev/urandom.
- */
-static int random_min_urandom_seed = 60;
-
-/*
  * Originally, we used a primitive polynomial of degree .poolwords
  * over GF(2).  The taps for various sizes are defined below.  They
  * were chosen to be evenly spaced except for the last tap, which is 1
@@ -409,7 +402,6 @@ static struct poolinfo {
  */
 static DECLARE_WAIT_QUEUE_HEAD(random_read_wait);
 static DECLARE_WAIT_QUEUE_HEAD(random_write_wait);
-static DECLARE_WAIT_QUEUE_HEAD(urandom_init_wait);
 static struct fasync_struct *fasync;
 
 static DEFINE_SPINLOCK(random_ready_list_lock);
@@ -467,7 +459,6 @@ struct entropy_store {
         int entropy_count;
         int entropy_total;
         unsigned int initialized:1;
-        unsigned int limit:1;
         unsigned int last_data_init:1;
         __u8 last_data[EXTRACT_SIZE];
 };
@@ -485,7 +476,6 @@ static __u32 blocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
 static struct entropy_store input_pool = {
         .poolinfo = &poolinfo_table[0],
         .name = "input",
-        .limit = 1,
         .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock),
         .pool = input_pool_data
 };
@@ -493,7 +483,6 @@ static struct entropy_store input_pool = {
 static struct entropy_store blocking_pool = {
         .poolinfo = &poolinfo_table[1],
         .name = "blocking",
-        .limit = 1,
         .pull = &input_pool,
         .lock = __SPIN_LOCK_UNLOCKED(blocking_pool.lock),
         .pool = blocking_pool_data,
@@ -855,13 +844,6 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
         spin_unlock_irqrestore(&primary_crng.lock, flags);
 }
 
-static inline void maybe_reseed_primary_crng(void)
-{
-        if (crng_init > 2 &&
-            time_after(jiffies, primary_crng.init_time + CRNG_RESEED_INTERVAL))
-                crng_reseed(&primary_crng, &input_pool);
-}
-
 static inline void crng_wait_ready(void)
 {
         wait_event_interruptible(crng_init_wait, crng_ready());
@@ -1220,15 +1202,6 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
             r->entropy_count > r->poolinfo->poolfracbits)
                 return;
 
-        if (r->limit == 0 && random_min_urandom_seed) {
-                unsigned long now = jiffies;
-
-                if (time_before(now,
-                                r->last_pulled + random_min_urandom_seed * HZ))
-                        return;
-                r->last_pulled = now;
-        }
-
         _xfer_secondary_pool(r, nbytes);
 }
 
@@ -1236,8 +1209,6 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
 {
         __u32   tmp[OUTPUT_POOL_WORDS];
 
-        /* For /dev/random's pool, always leave two wakeups' worth */
-        int rsvd_bytes = r->limit ? 0 : random_read_wakeup_bits / 4;
         int bytes = nbytes;
 
         /* pull at least as much as a wakeup */
@@ -1248,7 +1219,7 @@ static void _xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
         trace_xfer_secondary_pool(r->name, bytes * 8, nbytes * 8,
                                   ENTROPY_BITS(r), ENTROPY_BITS(r->pull));
         bytes = extract_entropy(r->pull, tmp, bytes,
-                                random_read_wakeup_bits / 8, rsvd_bytes);
+                                random_read_wakeup_bits / 8, 0);
         mix_pool_bytes(r, tmp, bytes);
         credit_entropy_bits(r, bytes*8);
 }
@@ -1276,7 +1247,7 @@ static void push_to_pool(struct work_struct *work)
 static size_t account(struct entropy_store *r, size_t nbytes, int min,
                       int reserved)
 {
-        int entropy_count, orig;
+        int entropy_count, orig, have_bytes;
         size_t ibytes, nfrac;
 
         BUG_ON(r->entropy_count > r->poolinfo->poolfracbits);
@@ -1285,14 +1256,12 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min,
 retry:
         entropy_count = orig = ACCESS_ONCE(r->entropy_count);
         ibytes = nbytes;
-        /* If limited, never pull more than available */
-        if (r->limit) {
-                int have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
+        /* never pull more than available */
+        have_bytes = entropy_count >> (ENTROPY_SHIFT + 3);
 
-                if ((have_bytes -= reserved) < 0)
-                        have_bytes = 0;
-                ibytes = min_t(size_t, ibytes, have_bytes);
-        }
+        if ((have_bytes -= reserved) < 0)
+                have_bytes = 0;
+        ibytes = min_t(size_t, ibytes, have_bytes);
         if (ibytes < min)
                 ibytes = 0;
 
@@ -1912,6 +1881,7 @@ SYSCALL_DEFINE3(getrandom, char __user *, buf, size_t, count,
 static int min_read_thresh = 8, min_write_thresh;
 static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
 static int max_write_thresh = INPUT_POOL_WORDS * 32;
+static int random_min_urandom_seed = 60;
 static char sysctl_bootid[16];
 
 /*
@@ -2042,63 +2012,64 @@ struct ctl_table random_table[] = {
 };
 #endif  /* CONFIG_SYSCTL */
 
-static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
-
-int random_int_secret_init(void)
-{
-        get_random_bytes(random_int_secret, sizeof(random_int_secret));
-        return 0;
-}
-
-static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash)
-                __aligned(sizeof(unsigned long));
+struct batched_entropy {
+        union {
+                u64 entropy_u64[CHACHA20_BLOCK_SIZE / sizeof(u64)];
+                u32 entropy_u32[CHACHA20_BLOCK_SIZE / sizeof(u32)];
+        };
+        unsigned int position;
+};
 
 /*
- * Get a random word for internal kernel use only. Similar to urandom but
- * with the goal of minimal entropy pool depletion. As a result, the random
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
+ * Get a random word for internal kernel use only. The quality of the random
+ * number is either as good as RDRAND or as good as /dev/urandom, with the
+ * goal of being quite fast and not depleting entropy.
  */
-unsigned int get_random_int(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u64);
+u64 get_random_u64(void)
 {
-        __u32 *hash;
-        unsigned int ret;
+        u64 ret;
+        struct batched_entropy *batch;
 
-        if (arch_get_random_int(&ret))
+#if BITS_PER_LONG == 64
+        if (arch_get_random_long((unsigned long *)&ret))
                 return ret;
+#else
+        if (arch_get_random_long((unsigned long *)&ret) &&
+            arch_get_random_long((unsigned long *)&ret + 1))
+            return ret;
+#endif
 
-        hash = get_cpu_var(get_random_int_hash);
-
-        hash[0] += current->pid + jiffies + random_get_entropy();
-        md5_transform(hash, random_int_secret);
-        ret = hash[0];
-        put_cpu_var(get_random_int_hash);
-
+        batch = &get_cpu_var(batched_entropy_u64);
+        if (batch->position % ARRAY_SIZE(batch->entropy_u64) == 0) {
+                extract_crng((u8 *)batch->entropy_u64);
+                batch->position = 0;
+        }
+        ret = batch->entropy_u64[batch->position++];
+        put_cpu_var(batched_entropy_u64);
         return ret;
 }
-EXPORT_SYMBOL(get_random_int);
+EXPORT_SYMBOL(get_random_u64);
 
-/*
- * Same as get_random_int(), but returns unsigned long.
- */
-unsigned long get_random_long(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_u32);
+u32 get_random_u32(void)
 {
-        __u32 *hash;
-        unsigned long ret;
+        u32 ret;
+        struct batched_entropy *batch;
 
-        if (arch_get_random_long(&ret))
+        if (arch_get_random_int(&ret))
                 return ret;
 
-        hash = get_cpu_var(get_random_int_hash);
-
-        hash[0] += current->pid + jiffies + random_get_entropy();
-        md5_transform(hash, random_int_secret);
-        ret = *(unsigned long *)hash;
-        put_cpu_var(get_random_int_hash);
-
+        batch = &get_cpu_var(batched_entropy_u32);
+        if (batch->position % ARRAY_SIZE(batch->entropy_u32) == 0) {
+                extract_crng((u8 *)batch->entropy_u32);
+                batch->position = 0;
+        }
+        ret = batch->entropy_u32[batch->position++];
+        put_cpu_var(batched_entropy_u32);
         return ret;
 }
-EXPORT_SYMBOL(get_random_long);
+EXPORT_SYMBOL(get_random_u32);
 
 /**
  * randomize_page - Generate a random, page aligned address
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index e9b7e0b3cabe..87fe111d0be6 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2202,14 +2202,16 @@ static int virtcons_freeze(struct virtio_device *vdev)
 
         vdev->config->reset(vdev);
 
-        virtqueue_disable_cb(portdev->c_ivq);
+        if (use_multiport(portdev))
+                virtqueue_disable_cb(portdev->c_ivq);
         cancel_work_sync(&portdev->control_work);
         cancel_work_sync(&portdev->config_work);
         /*
          * Once more: if control_work_handler() was running, it would
          * enable the cb as the last step.
          */
-        virtqueue_disable_cb(portdev->c_ivq);
+        if (use_multiport(portdev))
+                virtqueue_disable_cb(portdev->c_ivq);
         remove_controlq_data(portdev);
 
         list_for_each_entry(port, &portdev->ports, list) {
diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
index ab609a76706f..cf9449b3dbd9 100644
--- a/drivers/clk/clk-stm32f4.c
+++ b/drivers/clk/clk-stm32f4.c
@@ -429,6 +429,13 @@ static const struct clk_div_table pll_divp_table[] = {
         { 0, 2 }, { 1, 4 }, { 2, 6 }, { 3, 8 }, { 0 }
 };
 
+static const struct clk_div_table pll_divq_table[] = {
+        { 2, 2 }, { 3, 3 }, { 4, 4 }, { 5, 5 }, { 6, 6 }, { 7, 7 },
+        { 8, 8 }, { 9, 9 }, { 10, 10 }, { 11, 11 }, { 12, 12 }, { 13, 13 },
+        { 14, 14 }, { 15, 15 },
+        { 0 }
+};
+
 static const struct clk_div_table pll_divr_table[] = {
         { 2, 2 }, { 3, 3 }, { 4, 4 }, { 5, 5 }, { 6, 6 }, { 7, 7 }, { 0 }
 };
@@ -496,9 +503,9 @@ struct stm32f4_div_data {
 
 #define MAX_PLL_DIV 3
 static const struct stm32f4_div_data  div_data[MAX_PLL_DIV] = {
-        { 16, 2, 0,                     pll_divp_table  },
-        { 24, 4, CLK_DIVIDER_ONE_BASED, NULL            },
-        { 28, 3, 0,                     pll_divr_table  },
+        { 16, 2, 0, pll_divp_table },
+        { 24, 4, 0, pll_divq_table },
+        { 28, 3, 0, pll_divr_table },
 };
 
 struct stm32f4_pll_data {
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 0fb39fe217d1..67201f67a14a 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2502,7 +2502,7 @@ struct clk *__clk_create_clk(struct clk_hw *hw, const char *dev_id,
 
         clk->core = hw->core;
         clk->dev_id = dev_id;
-        clk->con_id = con_id;
+        clk->con_id = kstrdup_const(con_id, GFP_KERNEL);
         clk->max_rate = ULONG_MAX;
 
         clk_prepare_lock();
@@ -2518,6 +2518,7 @@ void __clk_free_clk(struct clk *clk)
         hlist_del(&clk->clks_node);
         clk_prepare_unlock();
 
+        kfree_const(clk->con_id);
         kfree(clk);
 }
 
diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
index 924f560dcf80..00d4150e33c3 100644
--- a/drivers/clk/rockchip/clk-rk3036.c
+++ b/drivers/clk/rockchip/clk-rk3036.c
@@ -127,7 +127,7 @@ PNAME(mux_ddrphy_p)		= { "dpll_ddr", "gpll_ddr" };
 PNAME(mux_pll_src_3plls_p)      = { "apll", "dpll", "gpll" };
 PNAME(mux_timer_p)              = { "xin24m", "pclk_peri_src" };
 
-PNAME(mux_pll_src_apll_dpll_gpll_usb480m_p)     = { "apll", "dpll", "gpll" "usb480m" };
+PNAME(mux_pll_src_apll_dpll_gpll_usb480m_p)     = { "apll", "dpll", "gpll", "usb480m" };
 
 PNAME(mux_mmc_src_p)    = { "apll", "dpll", "gpll", "xin24m" };
 PNAME(mux_i2s_pre_p)    = { "i2s_src", "i2s_frac", "ext_i2s", "xin12m" };
@@ -450,6 +450,13 @@ static void __init rk3036_clk_init(struct device_node *np)
                 return;
         }
 
+        /*
+         * Make uart_pll_clk a child of the gpll, as all other sources are
+         * not that usable / stable.
+         */
+        writel_relaxed(HIWORD_UPDATE(0x2, 0x3, 10),
+                       reg_base + RK2928_CLKSEL_CON(13));
+
         ctx = rockchip_clk_init(np, reg_base, CLK_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip clk init failed\n", __func__);
diff --git a/drivers/clk/sunxi-ng/Kconfig b/drivers/clk/sunxi-ng/Kconfig
index 695bbf9ef428..1c2357301017 100644
--- a/drivers/clk/sunxi-ng/Kconfig
+++ b/drivers/clk/sunxi-ng/Kconfig
@@ -1,6 +1,7 @@
 config SUNXI_CCU
         bool "Clock support for Allwinner SoCs"
         depends on ARCH_SUNXI || COMPILE_TEST
+        select RESET_CONTROLLER
         default ARCH_SUNXI
 
 if SUNXI_CCU
@@ -80,6 +81,7 @@ config SUN6I_A31_CCU
         select SUNXI_CCU_DIV
         select SUNXI_CCU_NK
         select SUNXI_CCU_NKM
+        select SUNXI_CCU_NKMP
         select SUNXI_CCU_NM
         select SUNXI_CCU_MP
         select SUNXI_CCU_PHASE
@@ -134,6 +136,7 @@ config SUN8I_V3S_CCU
 config SUN9I_A80_CCU
         bool "Support for the Allwinner A80 CCU"
         select SUNXI_CCU_DIV
+        select SUNXI_CCU_MULT
         select SUNXI_CCU_GATE
         select SUNXI_CCU_NKMP
         select SUNXI_CCU_NM
diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
index e3c084cc6da5..f54114c607df 100644
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
@@ -566,7 +566,7 @@ static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu",
                              0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT);
 
 /* Fixed Factor clocks */
-static CLK_FIXED_FACTOR(osc12M_clk, "osc12M", "osc24M", 1, 2, 0);
+static CLK_FIXED_FACTOR(osc12M_clk, "osc12M", "osc24M", 2, 1, 0);
 
 /* We hardcode the divider to 4 for now */
 static CLK_FIXED_FACTOR(pll_audio_clk, "pll-audio",
diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
index 4c9a920ff4ab..89e68d29bf45 100644
--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
+++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c
@@ -608,7 +608,7 @@ static SUNXI_CCU_M_WITH_MUX_GATE(hdmi_clk, "hdmi", lcd_ch1_parents,
                                  0x150, 0, 4, 24, 2, BIT(31),
                                  CLK_SET_RATE_PARENT);
 
-static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(31), 0);
+static SUNXI_CCU_GATE(hdmi_ddc_clk, "hdmi-ddc", "osc24M", 0x150, BIT(30), 0);
 
 static SUNXI_CCU_GATE(ps_clk, "ps", "lcd1-ch1", 0x140, BIT(31), 0);
 
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
index a7b3c08ed0e2..2c69b631967a 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c
@@ -752,6 +752,13 @@ static const struct sunxi_ccu_desc sun8i_a33_ccu_desc = {
         .num_resets     = ARRAY_SIZE(sun8i_a33_ccu_resets),
 };
 
+static struct ccu_pll_nb sun8i_a33_pll_cpu_nb = {
+        .common = &pll_cpux_clk.common,
+        /* copy from pll_cpux_clk */
+        .enable = BIT(31),
+        .lock   = BIT(28),
+};
+
 static struct ccu_mux_nb sun8i_a33_cpu_nb = {
         .common         = &cpux_clk.common,
         .cm             = &cpux_clk.mux,
@@ -783,6 +790,10 @@ static void __init sun8i_a33_ccu_setup(struct device_node *node)
 
         sunxi_ccu_probe(node, reg, &sun8i_a33_ccu_desc);
 
+        /* Gate then ungate PLL CPU after any rate changes */
+        ccu_pll_notifier_register(&sun8i_a33_pll_cpu_nb);
+
+        /* Reparent CPU during PLL CPU rate changes */
         ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
                                   &sun8i_a33_cpu_nb);
 }
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index 8a47bafd7890..9d8724715a43 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -14,11 +14,13 @@
  * GNU General Public License for more details.
  */
 
+#include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/iopoll.h>
 #include <linux/slab.h>
 
 #include "ccu_common.h"
+#include "ccu_gate.h"
 #include "ccu_reset.h"
 
 static DEFINE_SPINLOCK(ccu_lock);
@@ -39,6 +41,53 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
         WARN_ON(readl_relaxed_poll_timeout(addr, reg, reg & lock, 100, 70000));
 }
 
+/*
+ * This clock notifier is called when the frequency of a PLL clock is
+ * changed. In common PLL designs, changes to the dividers take effect
+ * almost immediately, while changes to the multipliers (implemented
+ * as dividers in the feedback loop) take a few cycles to work into
+ * the feedback loop for the PLL to stablize.
+ *
+ * Sometimes when the PLL clock rate is changed, the decrease in the
+ * divider is too much for the decrease in the multiplier to catch up.
+ * The PLL clock rate will spike, and in some cases, might lock up
+ * completely.
+ *
+ * This notifier callback will gate and then ungate the clock,
+ * effectively resetting it, so it proceeds to work. Care must be
+ * taken to reparent consumers to other temporary clocks during the
+ * rate change, and that this notifier callback must be the first
+ * to be registered.
+ */
+static int ccu_pll_notifier_cb(struct notifier_block *nb,
+                               unsigned long event, void *data)
+{
+        struct ccu_pll_nb *pll = to_ccu_pll_nb(nb);
+        int ret = 0;
+
+        if (event != POST_RATE_CHANGE)
+                goto out;
+
+        ccu_gate_helper_disable(pll->common, pll->enable);
+
+        ret = ccu_gate_helper_enable(pll->common, pll->enable);
+        if (ret)
+                goto out;
+
+        ccu_helper_wait_for_lock(pll->common, pll->lock);
+
+out:
+        return notifier_from_errno(ret);
+}
+
+int ccu_pll_notifier_register(struct ccu_pll_nb *pll_nb)
+{
+        pll_nb->clk_nb.notifier_call = ccu_pll_notifier_cb;
+
+        return clk_notifier_register(pll_nb->common->hw.clk,
+                                     &pll_nb->clk_nb);
+}
+
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
                     const struct sunxi_ccu_desc *desc)
 {
diff --git a/drivers/clk/sunxi-ng/ccu_common.h b/drivers/clk/sunxi-ng/ccu_common.h
index 73d81dc58fc5..d6fdd7a789aa 100644
--- a/drivers/clk/sunxi-ng/ccu_common.h
+++ b/drivers/clk/sunxi-ng/ccu_common.h
@@ -83,6 +83,18 @@ struct sunxi_ccu_desc {
 
 void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock);
 
+struct ccu_pll_nb {
+        struct notifier_block   clk_nb;
+        struct ccu_common       *common;
+
+        u32     enable;
+        u32     lock;
+};
+
+#define to_ccu_pll_nb(_nb) container_of(_nb, struct ccu_pll_nb, clk_nb)
+
+int ccu_pll_notifier_register(struct ccu_pll_nb *pll_nb);
+
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
                     const struct sunxi_ccu_desc *desc);
 
diff --git a/drivers/clk/sunxi-ng/ccu_mp.c b/drivers/clk/sunxi-ng/ccu_mp.c
index 22c2ca7a2a22..b583f186a804 100644
--- a/drivers/clk/sunxi-ng/ccu_mp.c
+++ b/drivers/clk/sunxi-ng/ccu_mp.c
@@ -85,6 +85,10 @@ static unsigned long ccu_mp_recalc_rate(struct clk_hw *hw,
         unsigned int m, p;
         u32 reg;
 
+        /* Adjust parent_rate according to pre-dividers */
+        ccu_mux_helper_adjust_parent_for_prediv(&cmp->common, &cmp->mux,
+                                                -1, &parent_rate);
+
         reg = readl(cmp->common.base + cmp->common.reg);
 
         m = reg >> cmp->m.shift;
@@ -117,6 +121,10 @@ static int ccu_mp_set_rate(struct clk_hw *hw, unsigned long rate,
         unsigned int m, p;
         u32 reg;
 
+        /* Adjust parent_rate according to pre-dividers */
+        ccu_mux_helper_adjust_parent_for_prediv(&cmp->common, &cmp->mux,
+                                                -1, &parent_rate);
+
         max_m = cmp->m.max ?: 1 << cmp->m.width;
         max_p = cmp->p.max ?: 1 << ((1 << cmp->p.width) - 1);
 
diff --git a/drivers/clk/sunxi-ng/ccu_nkmp.c b/drivers/clk/sunxi-ng/ccu_nkmp.c
index a2b40a000157..488055ed944f 100644
--- a/drivers/clk/sunxi-ng/ccu_nkmp.c
+++ b/drivers/clk/sunxi-ng/ccu_nkmp.c
@@ -107,7 +107,7 @@ static unsigned long ccu_nkmp_recalc_rate(struct clk_hw *hw,
         p = reg >> nkmp->p.shift;
         p &= (1 << nkmp->p.width) - 1;
 
-        return parent_rate * n * k >> p / m;
+        return (parent_rate * n * k >> p) / m;
 }
 
 static long ccu_nkmp_round_rate(struct clk_hw *hw, unsigned long rate,
diff --git a/drivers/clocksource/clkevt-probe.c b/drivers/clocksource/clkevt-probe.c
index 8c30fec86094..eb89b502acbd 100644
--- a/drivers/clocksource/clkevt-probe.c
+++ b/drivers/clocksource/clkevt-probe.c
@@ -17,7 +17,7 @@
 
 #include <linux/init.h>
 #include <linux/of.h>
-#include <linux/clockchip.h>
+#include <linux/clockchips.h>
 
 extern struct of_device_id __clkevt_of_table[];
 
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 745844ee973e..d4ca9962a759 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -10,7 +10,6 @@
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/atmel_tc.h>
-#include <linux/sched_clock.h>
 
 
 /*
@@ -57,14 +56,9 @@ static u64 tc_get_cycles(struct clocksource *cs)
         return (upper << 16) | lower;
 }
 
-static u32 tc_get_cv32(void)
-{
-        return __raw_readl(tcaddr + ATMEL_TC_REG(0, CV));
-}
-
 static u64 tc_get_cycles32(struct clocksource *cs)
 {
-        return tc_get_cv32();
+        return __raw_readl(tcaddr + ATMEL_TC_REG(0, CV));
 }
 
 static struct clocksource clksrc = {
@@ -75,11 +69,6 @@ static struct clocksource clksrc = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-static u64 notrace tc_read_sched_clock(void)
-{
-        return tc_get_cv32();
-}
-
 #ifdef CONFIG_GENERIC_CLOCKEVENTS
 
 struct tc_clkevt_device {
@@ -350,9 +339,6 @@ static int __init tcb_clksrc_init(void)
                 clksrc.read = tc_get_cycles32;
                 /* setup ony channel 0 */
                 tcb_setup_single_chan(tc, best_divisor_idx);
-
-                /* register sched_clock on chips with single 32 bit counter */
-                sched_clock_register(tc_read_sched_clock, 32, divided_rate);
         } else {
                 /* tclib will give us three clocks no matter what the
                  * underlying platform supports.
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a47543281864..0e3f6496524d 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -680,9 +680,11 @@ static ssize_t show_cpuinfo_cur_freq(struct cpufreq_policy *policy,
                                         char *buf)
 {
         unsigned int cur_freq = __cpufreq_get(policy);
-        if (!cur_freq)
-                return sprintf(buf, "<unknown>");
-        return sprintf(buf, "%u\n", cur_freq);
+
+        if (cur_freq)
+                return sprintf(buf, "%u\n", cur_freq);
+
+        return sprintf(buf, "<unknown>\n");
 }
 
 /**
@@ -916,11 +918,19 @@ static struct kobj_type ktype_cpufreq = {
         .release        = cpufreq_sysfs_release,
 };
 
-static int add_cpu_dev_symlink(struct cpufreq_policy *policy,
-                               struct device *dev)
+static void add_cpu_dev_symlink(struct cpufreq_policy *policy, unsigned int cpu)
 {
+        struct device *dev = get_cpu_device(cpu);
+
+        if (!dev)
+                return;
+
+        if (cpumask_test_and_set_cpu(cpu, policy->real_cpus))
+                return;
+
         dev_dbg(dev, "%s: Adding symlink\n", __func__);
-        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
+        if (sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq"))
+                dev_err(dev, "cpufreq symlink creation failed\n");
 }
 
 static void remove_cpu_dev_symlink(struct cpufreq_policy *policy,
@@ -1178,10 +1188,13 @@ static int cpufreq_online(unsigned int cpu)
                 policy->user_policy.min = policy->min;
                 policy->user_policy.max = policy->max;
 
-                write_lock_irqsave(&cpufreq_driver_lock, flags);
-                for_each_cpu(j, policy->related_cpus)
+                for_each_cpu(j, policy->related_cpus) {
                         per_cpu(cpufreq_cpu_data, j) = policy;
-                write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+                        add_cpu_dev_symlink(policy, j);
+                }
+        } else {
+                policy->min = policy->user_policy.min;
+                policy->max = policy->user_policy.max;
         }
 
         if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
@@ -1270,13 +1283,15 @@ out_exit_policy:
 
         if (cpufreq_driver->exit)
                 cpufreq_driver->exit(policy);
+
+        for_each_cpu(j, policy->real_cpus)
+                remove_cpu_dev_symlink(policy, get_cpu_device(j));
+
 out_free_policy:
         cpufreq_policy_free(policy);
         return ret;
 }
 
-static int cpufreq_offline(unsigned int cpu);
-
 /**
  * cpufreq_add_dev - the cpufreq interface for a CPU device.
  * @dev: CPU device.
@@ -1298,16 +1313,10 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 
         /* Create sysfs link on CPU registration */
         policy = per_cpu(cpufreq_cpu_data, cpu);
-        if (!policy || cpumask_test_and_set_cpu(cpu, policy->real_cpus))
-                return 0;
+        if (policy)
+                add_cpu_dev_symlink(policy, cpu);
 
-        ret = add_cpu_dev_symlink(policy, dev);
-        if (ret) {
-                cpumask_clear_cpu(cpu, policy->real_cpus);
-                cpufreq_offline(cpu);
-        }
-
-        return ret;
+        return 0;
 }
 
 static int cpufreq_offline(unsigned int cpu)
@@ -2389,6 +2398,20 @@ EXPORT_SYMBOL_GPL(cpufreq_boost_enabled);
  *********************************************************************/
 static enum cpuhp_state hp_online;
 
+static int cpuhp_cpufreq_online(unsigned int cpu)
+{
+        cpufreq_online(cpu);
+
+        return 0;
+}
+
+static int cpuhp_cpufreq_offline(unsigned int cpu)
+{
+        cpufreq_offline(cpu);
+
+        return 0;
+}
+
 /**
  * cpufreq_register_driver - register a CPU Frequency driver
  * @driver_data: A struct cpufreq_driver containing the values#
@@ -2451,8 +2474,8 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
         }
 
         ret = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "cpufreq:online",
-                                        cpufreq_online,
-                                        cpufreq_offline);
+                                        cpuhp_cpufreq_online,
+                                        cpuhp_cpufreq_offline);
         if (ret < 0)
                 goto err_if_unreg;
         hp_online = ret;
@@ -2532,4 +2555,5 @@ static int __init cpufreq_core_init(void)
 
         return 0;
 }
+module_param(off, int, 0444);
 core_initcall(cpufreq_core_init);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b1fbaa30ae04..283491f742d3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -84,6 +84,11 @@ static inline u64 div_ext_fp(u64 x, u64 y)
         return div64_u64(x << EXT_FRAC_BITS, y);
 }
 
+static inline int32_t percent_ext_fp(int percent)
+{
+        return div_ext_fp(percent, 100);
+}
+
 /**
  * struct sample -      Store performance sample
  * @core_avg_perf:      Ratio of APERF/MPERF which is the actual average
@@ -359,9 +364,7 @@ static bool driver_registered __read_mostly;
 static bool acpi_ppc;
 #endif
 
-static struct perf_limits performance_limits;
-static struct perf_limits powersave_limits;
-static struct perf_limits *limits;
+static struct perf_limits global;
 
 static void intel_pstate_init_limits(struct perf_limits *limits)
 {
@@ -372,13 +375,6 @@ static void intel_pstate_init_limits(struct perf_limits *limits)
         limits->max_sysfs_pct = 100;
 }
 
-static void intel_pstate_set_performance_limits(struct perf_limits *limits)
-{
-        intel_pstate_init_limits(limits);
-        limits->min_perf_pct = 100;
-        limits->min_perf = int_ext_tofp(1);
-}
-
 static DEFINE_MUTEX(intel_pstate_driver_lock);
 static DEFINE_MUTEX(intel_pstate_limits_lock);
 
@@ -501,7 +497,7 @@ static void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *policy)
          * correct max turbo frequency based on the turbo state.
          * Also need to convert to MHz as _PSS freq is in MHz.
          */
-        if (!limits->turbo_disabled)
+        if (!global.turbo_disabled)
                 cpu->acpi_perf_data.states[0].core_frequency =
                                         policy->cpuinfo.max_freq / 1000;
         cpu->valid_pss_table = true;
@@ -620,7 +616,7 @@ static inline void update_turbo_state(void)
 
         cpu = all_cpu_data[0];
         rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
-        limits->turbo_disabled =
+        global.turbo_disabled =
                 (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
                  cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
 }
@@ -844,12 +840,11 @@ static struct freq_attr *hwp_cpufreq_attrs[] = {
 
 static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
 {
-        int min, hw_min, max, hw_max, cpu, range, adj_range;
-        struct perf_limits *perf_limits = limits;
+        int min, hw_min, max, hw_max, cpu;
+        struct perf_limits *perf_limits = &global;
         u64 value, cap;
 
         for_each_cpu(cpu, policy->cpus) {
-                int max_perf_pct, min_perf_pct;
                 struct cpudata *cpu_data = all_cpu_data[cpu];
                 s16 epp;
 
@@ -858,24 +853,22 @@ static void intel_pstate_hwp_set(struct cpufreq_policy *policy)
 
                 rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
                 hw_min = HWP_LOWEST_PERF(cap);
-                if (limits->no_turbo)
+                if (global.no_turbo)
                         hw_max = HWP_GUARANTEED_PERF(cap);
                 else
                         hw_max = HWP_HIGHEST_PERF(cap);
-                range = hw_max - hw_min;
 
-                max_perf_pct = perf_limits->max_perf_pct;
-                min_perf_pct = perf_limits->min_perf_pct;
+                max = fp_ext_toint(hw_max * perf_limits->max_perf);
+                if (cpu_data->policy == CPUFREQ_POLICY_PERFORMANCE)
+                        min = max;
+                else
+                        min = fp_ext_toint(hw_max * perf_limits->min_perf);
 
                 rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
-                adj_range = min_perf_pct * range / 100;
-                min = hw_min + adj_range;
+
                 value &= ~HWP_MIN_PERF(~0L);
                 value |= HWP_MIN_PERF(min);
 
-                adj_range = max_perf_pct * range / 100;
-                max = hw_min + adj_range;
-
                 value &= ~HWP_MAX_PERF(~0L);
                 value |= HWP_MAX_PERF(max);
 
@@ -979,6 +972,7 @@ static void intel_pstate_update_policies(void)
 static int pid_param_set(void *data, u64 val)
 {
         *(u32 *)data = val;
+        pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC;
         intel_pstate_reset_all_pid();
         return 0;
 }
@@ -1050,7 +1044,7 @@ static void intel_pstate_debug_hide_params(void)
         static ssize_t show_##file_name                                 \
         (struct kobject *kobj, struct attribute *attr, char *buf)       \
         {                                                               \
-                return sprintf(buf, "%u\n", limits->object);            \
+                return sprintf(buf, "%u\n", global.object);             \
         }
 
 static ssize_t intel_pstate_show_status(char *buf);
@@ -1141,10 +1135,10 @@ static ssize_t show_no_turbo(struct kobject *kobj,
         }
 
         update_turbo_state();
-        if (limits->turbo_disabled)
-                ret = sprintf(buf, "%u\n", limits->turbo_disabled);
+        if (global.turbo_disabled)
+                ret = sprintf(buf, "%u\n", global.turbo_disabled);
         else
-                ret = sprintf(buf, "%u\n", limits->no_turbo);
+                ret = sprintf(buf, "%u\n", global.no_turbo);
 
         mutex_unlock(&intel_pstate_driver_lock);
 
@@ -1171,14 +1165,14 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
         mutex_lock(&intel_pstate_limits_lock);
 
         update_turbo_state();
-        if (limits->turbo_disabled) {
+        if (global.turbo_disabled) {
                 pr_warn("Turbo disabled by BIOS or unavailable on processor\n");
                 mutex_unlock(&intel_pstate_limits_lock);
                 mutex_unlock(&intel_pstate_driver_lock);
                 return -EPERM;
         }
 
-        limits->no_turbo = clamp_t(int, input, 0, 1);
+        global.no_turbo = clamp_t(int, input, 0, 1);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
@@ -1208,14 +1202,11 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        limits->max_sysfs_pct = clamp_t(int, input, 0 , 100);
-        limits->max_perf_pct = min(limits->max_policy_pct,
-                                   limits->max_sysfs_pct);
-        limits->max_perf_pct = max(limits->min_policy_pct,
-                                   limits->max_perf_pct);
-        limits->max_perf_pct = max(limits->min_perf_pct,
-                                   limits->max_perf_pct);
-        limits->max_perf = div_ext_fp(limits->max_perf_pct, 100);
+        global.max_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.max_perf_pct = min(global.max_policy_pct, global.max_sysfs_pct);
+        global.max_perf_pct = max(global.min_policy_pct, global.max_perf_pct);
+        global.max_perf_pct = max(global.min_perf_pct, global.max_perf_pct);
+        global.max_perf = percent_ext_fp(global.max_perf_pct);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
@@ -1245,14 +1236,11 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        limits->min_sysfs_pct = clamp_t(int, input, 0 , 100);
-        limits->min_perf_pct = max(limits->min_policy_pct,
-                                   limits->min_sysfs_pct);
-        limits->min_perf_pct = min(limits->max_policy_pct,
-                                   limits->min_perf_pct);
-        limits->min_perf_pct = min(limits->max_perf_pct,
-                                   limits->min_perf_pct);
-        limits->min_perf = div_ext_fp(limits->min_perf_pct, 100);
+        global.min_sysfs_pct = clamp_t(int, input, 0 , 100);
+        global.min_perf_pct = max(global.min_policy_pct, global.min_sysfs_pct);
+        global.min_perf_pct = min(global.max_policy_pct, global.min_perf_pct);
+        global.min_perf_pct = min(global.max_perf_pct, global.min_perf_pct);
+        global.min_perf = percent_ext_fp(global.min_perf_pct);
 
         mutex_unlock(&intel_pstate_limits_lock);
 
@@ -1377,7 +1365,7 @@ static u64 atom_get_val(struct cpudata *cpudata, int pstate)
         u32 vid;
 
         val = (u64)pstate << 8;
-        if (limits->no_turbo && !limits->turbo_disabled)
+        if (global.no_turbo && !global.turbo_disabled)
                 val |= (u64)1 << 32;
 
         vid_fp = cpudata->vid.min + mul_fp(
@@ -1547,7 +1535,7 @@ static u64 core_get_val(struct cpudata *cpudata, int pstate)
         u64 val;
 
         val = (u64)pstate << 8;
-        if (limits->no_turbo && !limits->turbo_disabled)
+        if (global.no_turbo && !global.turbo_disabled)
                 val |= (u64)1 << 32;
 
         return val;
@@ -1673,9 +1661,9 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
         int max_perf = cpu->pstate.turbo_pstate;
         int max_perf_adj;
         int min_perf;
-        struct perf_limits *perf_limits = limits;
+        struct perf_limits *perf_limits = &global;
 
-        if (limits->no_turbo || limits->turbo_disabled)
+        if (global.no_turbo || global.turbo_disabled)
                 max_perf = cpu->pstate.max_pstate;
 
         if (per_cpu_limits)
@@ -1810,7 +1798,7 @@ static inline int32_t get_target_pstate_use_cpu_load(struct cpudata *cpu)
 
         sample->busy_scaled = busy_frac * 100;
 
-        target = limits->no_turbo || limits->turbo_disabled ?
+        target = global.no_turbo || global.turbo_disabled ?
                         cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
         target += target >> 2;
         target = mul_fp(target, busy_frac);
@@ -1874,13 +1862,11 @@ static int intel_pstate_prepare_request(struct cpudata *cpu, int pstate)
 
         intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
         pstate = clamp_t(int, pstate, min_perf, max_perf);
-        trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
         return pstate;
 }
 
 static void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
 {
-        pstate = intel_pstate_prepare_request(cpu, pstate);
         if (pstate == cpu->pstate.current_pstate)
                 return;
 
@@ -1900,6 +1886,8 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
 
         update_turbo_state();
 
+        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
+        trace_cpu_frequency(target_pstate * cpu->pstate.scaling, cpu->cpu);
         intel_pstate_update_pstate(cpu, target_pstate);
 
         sample = &cpu->sample;
@@ -2070,36 +2058,34 @@ static void intel_pstate_clear_update_util_hook(unsigned int cpu)
 static void intel_pstate_update_perf_limits(struct cpufreq_policy *policy,
                                             struct perf_limits *limits)
 {
+        int32_t max_policy_perf, min_policy_perf;
 
-        limits->max_policy_pct = DIV_ROUND_UP(policy->max * 100,
-                                              policy->cpuinfo.max_freq);
-        limits->max_policy_pct = clamp_t(int, limits->max_policy_pct, 0, 100);
+        max_policy_perf = div_ext_fp(policy->max, policy->cpuinfo.max_freq);
+        max_policy_perf = clamp_t(int32_t, max_policy_perf, 0, int_ext_tofp(1));
         if (policy->max == policy->min) {
-                limits->min_policy_pct = limits->max_policy_pct;
+                min_policy_perf = max_policy_perf;
         } else {
-                limits->min_policy_pct = DIV_ROUND_UP(policy->min * 100,
-                                                      policy->cpuinfo.max_freq);
-                limits->min_policy_pct = clamp_t(int, limits->min_policy_pct,
-                                                 0, 100);
+                min_policy_perf = div_ext_fp(policy->min,
+                                             policy->cpuinfo.max_freq);
+                min_policy_perf = clamp_t(int32_t, min_policy_perf,
+                                          0, max_policy_perf);
         }
 
-        /* Normalize user input to [min_policy_pct, max_policy_pct] */
-        limits->min_perf_pct = max(limits->min_policy_pct,
-                                   limits->min_sysfs_pct);
-        limits->min_perf_pct = min(limits->max_policy_pct,
-                                   limits->min_perf_pct);
-        limits->max_perf_pct = min(limits->max_policy_pct,
-                                   limits->max_sysfs_pct);
-        limits->max_perf_pct = max(limits->min_policy_pct,
-                                   limits->max_perf_pct);
-
-        /* Make sure min_perf_pct <= max_perf_pct */
-        limits->min_perf_pct = min(limits->max_perf_pct, limits->min_perf_pct);
-
-        limits->min_perf = div_ext_fp(limits->min_perf_pct, 100);
-        limits->max_perf = div_ext_fp(limits->max_perf_pct, 100);
+        /* Normalize user input to [min_perf, max_perf] */
+        limits->min_perf = max(min_policy_perf,
+                               percent_ext_fp(limits->min_sysfs_pct));
+        limits->min_perf = min(limits->min_perf, max_policy_perf);
+        limits->max_perf = min(max_policy_perf,
+                               percent_ext_fp(limits->max_sysfs_pct));
+        limits->max_perf = max(min_policy_perf, limits->max_perf);
+
+        /* Make sure min_perf <= max_perf */
+        limits->min_perf = min(limits->min_perf, limits->max_perf);
+
         limits->max_perf = round_up(limits->max_perf, EXT_FRAC_BITS);
         limits->min_perf = round_up(limits->min_perf, EXT_FRAC_BITS);
+        limits->max_perf_pct = fp_ext_toint(limits->max_perf * 100);
+        limits->min_perf_pct = fp_ext_toint(limits->min_perf * 100);
 
         pr_debug("cpu:%d max_perf_pct:%d min_perf_pct:%d\n", policy->cpu,
                  limits->max_perf_pct, limits->min_perf_pct);
@@ -2108,7 +2094,7 @@ static void intel_pstate_update_perf_limits(struct cpufreq_policy *policy,
 static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu;
-        struct perf_limits *perf_limits = NULL;
+        struct perf_limits *perf_limits = &global;
 
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
@@ -2131,28 +2117,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 
         mutex_lock(&intel_pstate_limits_lock);
 
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE) {
-                if (!perf_limits) {
-                        limits = &performance_limits;
-                        perf_limits = limits;
-                }
-                if (policy->max >= policy->cpuinfo.max_freq &&
-                    !limits->no_turbo) {
-                        pr_debug("set performance\n");
-                        intel_pstate_set_performance_limits(perf_limits);
-                        goto out;
-                }
-        } else {
-                pr_debug("set powersave\n");
-                if (!perf_limits) {
-                        limits = &powersave_limits;
-                        perf_limits = limits;
-                }
-
-        }
-
         intel_pstate_update_perf_limits(policy, perf_limits);
- out:
+
         if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
                 /*
                  * NOHZ_FULL CPUs need this as the governor callback may not
@@ -2174,16 +2140,9 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu = all_cpu_data[policy->cpu];
-        struct perf_limits *perf_limits;
-
-        if (policy->policy == CPUFREQ_POLICY_PERFORMANCE)
-                perf_limits = &performance_limits;
-        else
-                perf_limits = &powersave_limits;
 
         update_turbo_state();
-        policy->cpuinfo.max_freq = perf_limits->turbo_disabled ||
-                                        perf_limits->no_turbo ?
+        policy->cpuinfo.max_freq = global.turbo_disabled || global.no_turbo ?
                                         cpu->pstate.max_freq :
                                         cpu->pstate.turbo_freq;
 
@@ -2198,9 +2157,9 @@ static int intel_pstate_verify_policy(struct cpufreq_policy *policy)
                 unsigned int max_freq, min_freq;
 
                 max_freq = policy->cpuinfo.max_freq *
-                                                limits->max_sysfs_pct / 100;
+                                        global.max_sysfs_pct / 100;
                 min_freq = policy->cpuinfo.max_freq *
-                                                limits->min_sysfs_pct / 100;
+                                        global.min_sysfs_pct / 100;
                 cpufreq_verify_within_limits(policy, min_freq, max_freq);
         }
 
@@ -2243,13 +2202,8 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
 
         cpu = all_cpu_data[policy->cpu];
 
-        /*
-         * We need sane value in the cpu->perf_limits, so inherit from global
-         * perf_limits limits, which are seeded with values based on the
-         * CONFIG_CPU_FREQ_DEFAULT_GOV_*, during boot up.
-         */
         if (per_cpu_limits)
-                memcpy(cpu->perf_limits, limits, sizeof(struct perf_limits));
+                intel_pstate_init_limits(cpu->perf_limits);
 
         policy->min = cpu->pstate.min_pstate * cpu->pstate.scaling;
         policy->max = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
@@ -2257,7 +2211,7 @@ static int __intel_pstate_cpu_init(struct cpufreq_policy *policy)
         /* cpuinfo and default policy values */
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
         update_turbo_state();
-        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+        policy->cpuinfo.max_freq = global.turbo_disabled ?
                         cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
         policy->cpuinfo.max_freq *= cpu->pstate.scaling;
 
@@ -2277,7 +2231,7 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
                 return ret;
 
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
-        if (limits->min_perf_pct == 100 && limits->max_perf_pct == 100)
+        if (IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE))
                 policy->policy = CPUFREQ_POLICY_PERFORMANCE;
         else
                 policy->policy = CPUFREQ_POLICY_POWERSAVE;
@@ -2301,46 +2255,16 @@ static struct cpufreq_driver intel_pstate = {
 static int intel_cpufreq_verify_policy(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu = all_cpu_data[policy->cpu];
-        struct perf_limits *perf_limits = limits;
 
         update_turbo_state();
-        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+        policy->cpuinfo.max_freq = global.no_turbo || global.turbo_disabled ?
                         cpu->pstate.max_freq : cpu->pstate.turbo_freq;
 
         cpufreq_verify_within_cpu_limits(policy);
 
-        if (per_cpu_limits)
-                perf_limits = cpu->perf_limits;
-
-        mutex_lock(&intel_pstate_limits_lock);
-
-        intel_pstate_update_perf_limits(policy, perf_limits);
-
-        mutex_unlock(&intel_pstate_limits_lock);
-
         return 0;
 }
 
-static unsigned int intel_cpufreq_turbo_update(struct cpudata *cpu,
-                                               struct cpufreq_policy *policy,
-                                               unsigned int target_freq)
-{
-        unsigned int max_freq;
-
-        update_turbo_state();
-
-        max_freq = limits->no_turbo || limits->turbo_disabled ?
-                        cpu->pstate.max_freq : cpu->pstate.turbo_freq;
-        policy->cpuinfo.max_freq = max_freq;
-        if (policy->max > max_freq)
-                policy->max = max_freq;
-
-        if (target_freq > max_freq)
-                target_freq = max_freq;
-
-        return target_freq;
-}
-
 static int intel_cpufreq_target(struct cpufreq_policy *policy,
                                 unsigned int target_freq,
                                 unsigned int relation)
@@ -2349,8 +2273,10 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy,
         struct cpufreq_freqs freqs;
         int target_pstate;
 
+        update_turbo_state();
+
         freqs.old = policy->cur;
-        freqs.new = intel_cpufreq_turbo_update(cpu, policy, target_freq);
+        freqs.new = target_freq;
 
         cpufreq_freq_transition_begin(policy, &freqs);
         switch (relation) {
@@ -2370,6 +2296,7 @@ static int intel_cpufreq_target(struct cpufreq_policy *policy,
                 wrmsrl_on_cpu(policy->cpu, MSR_IA32_PERF_CTL,
                               pstate_funcs.get_val(cpu, target_pstate));
         }
+        freqs.new = target_pstate * cpu->pstate.scaling;
         cpufreq_freq_transition_end(policy, &freqs, false);
 
         return 0;
@@ -2381,10 +2308,12 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy,
         struct cpudata *cpu = all_cpu_data[policy->cpu];
         int target_pstate;
 
-        target_freq = intel_cpufreq_turbo_update(cpu, policy, target_freq);
+        update_turbo_state();
+
         target_pstate = DIV_ROUND_UP(target_freq, cpu->pstate.scaling);
+        target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
         intel_pstate_update_pstate(cpu, target_pstate);
-        return target_freq;
+        return target_pstate * cpu->pstate.scaling;
 }
 
 static int intel_cpufreq_cpu_init(struct cpufreq_policy *policy)
@@ -2435,10 +2364,7 @@ static int intel_pstate_register_driver(void)
 {
         int ret;
 
-        intel_pstate_init_limits(&powersave_limits);
-        intel_pstate_set_performance_limits(&performance_limits);
-        limits = IS_ENABLED(CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE) ?
-                        &performance_limits : &powersave_limits;
+        intel_pstate_init_limits(&global);
 
         ret = cpufreq_register_driver(intel_pstate_driver);
         if (ret) {
diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c
index 370593006f5f..cda8f62d555b 100644
--- a/drivers/cpuidle/cpuidle-powernv.c
+++ b/drivers/cpuidle/cpuidle-powernv.c
@@ -175,6 +175,24 @@ static int powernv_cpuidle_driver_init(void)
                 drv->state_count += 1;
         }
 
+        /*
+         * On the PowerNV platform cpu_present may be less than cpu_possible in
+         * cases when firmware detects the CPU, but it is not available to the
+         * OS.  If CONFIG_HOTPLUG_CPU=n, then such CPUs are not hotplugable at
+         * run time and hence cpu_devices are not created for those CPUs by the
+         * generic topology_init().
+         *
+         * drv->cpumask defaults to cpu_possible_mask in
+         * __cpuidle_driver_init().  This breaks cpuidle on PowerNV where
+         * cpu_devices are not created for CPUs in cpu_possible_mask that
+         * cannot be hot-added later at run time.
+         *
+         * Trying cpuidle_register_device() on a CPU without a cpu_device is
+         * incorrect, so pass a correct CPU mask to the generic cpuidle driver.
+         */
+
+        drv->cpumask = (struct cpumask *)cpu_present_mask;
+
         return 0;
 }
 
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index c5adc8c9ac43..ae948b1da93a 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -615,6 +615,18 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
         struct device *cpu_dev = get_cpu_device((unsigned long)dev->cpu);
         int error;
 
+        /*
+         * Return if cpu_device is not setup for this CPU.
+         *
+         * This could happen if the arch did not set up cpu_device
+         * since this CPU is not in cpu_present mask and the
+         * driver did not send a correct CPU mask during registration.
+         * Without this check we would end up passing bogus
+         * value for &cpu_dev->kobj in kobject_init_and_add()
+         */
+        if (!cpu_dev)
+                return -ENODEV;
+
         kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
         if (!kdev)
                 return -ENOMEM;
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index 32100c4851dd..49cbdcba7883 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -506,7 +506,7 @@ static int caam_rsa_init_tfm(struct crypto_akcipher *tfm)
         ctx->dev = caam_jr_alloc();
 
         if (IS_ERR(ctx->dev)) {
-                dev_err(ctx->dev, "Job Ring Device allocation for transform failed\n");
+                pr_err("Job Ring Device allocation for transform failed\n");
                 return PTR_ERR(ctx->dev);
         }
 
diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
index fef39f9f41ee..5d7f73d60515 100644
--- a/drivers/crypto/caam/ctrl.c
+++ b/drivers/crypto/caam/ctrl.c
@@ -281,7 +281,8 @@ static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
                         /* Try to run it through DECO0 */
                         ret = run_descriptor_deco0(ctrldev, desc, &status);
 
-                        if (ret || status) {
+                        if (ret ||
+                            (status && status != JRSTA_SSRC_JUMP_HALT_CC)) {
                                 dev_err(ctrldev,
                                         "Failed to deinstantiate RNG4 SH%d\n",
                                         sh_idx);
@@ -301,15 +302,13 @@ static int caam_remove(struct platform_device *pdev)
         struct device *ctrldev;
         struct caam_drv_private *ctrlpriv;
         struct caam_ctrl __iomem *ctrl;
-        int ring;
 
         ctrldev = &pdev->dev;
         ctrlpriv = dev_get_drvdata(ctrldev);
         ctrl = (struct caam_ctrl __iomem *)ctrlpriv->ctrl;
 
-        /* Remove platform devices for JobRs */
-        for (ring = 0; ring < ctrlpriv->total_jobrs; ring++)
-                of_device_unregister(ctrlpriv->jrpdev[ring]);
+        /* Remove platform devices under the crypto node */
+        of_platform_depopulate(ctrldev);
 
         /* De-initialize RNG state handles initialized by this driver. */
         if (ctrlpriv->rng4_sh_init)
@@ -418,10 +417,21 @@ DEFINE_SIMPLE_ATTRIBUTE(caam_fops_u32_ro, caam_debugfs_u32_get, NULL, "%llu\n");
 DEFINE_SIMPLE_ATTRIBUTE(caam_fops_u64_ro, caam_debugfs_u64_get, NULL, "%llu\n");
 #endif
 
+static const struct of_device_id caam_match[] = {
+        {
+                .compatible = "fsl,sec-v4.0",
+        },
+        {
+                .compatible = "fsl,sec4.0",
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(of, caam_match);
+
 /* Probe routine for CAAM top (controller) level */
 static int caam_probe(struct platform_device *pdev)
 {
-        int ret, ring, ridx, rspec, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
+        int ret, ring, gen_sk, ent_delay = RTSDCTL_ENT_DLY_MIN;
         u64 caam_id;
         struct device *dev;
         struct device_node *nprop, *np;
@@ -597,47 +607,24 @@ static int caam_probe(struct platform_device *pdev)
                 goto iounmap_ctrl;
         }
 
-        /*
-         * Detect and enable JobRs
-         * First, find out how many ring spec'ed, allocate references
-         * for all, then go probe each one.
-         */
-        rspec = 0;
-        for_each_available_child_of_node(nprop, np)
-                if (of_device_is_compatible(np, "fsl,sec-v4.0-job-ring") ||
-                    of_device_is_compatible(np, "fsl,sec4.0-job-ring"))
-                        rspec++;
-
-        ctrlpriv->jrpdev = devm_kcalloc(&pdev->dev, rspec,
-                                        sizeof(*ctrlpriv->jrpdev), GFP_KERNEL);
-        if (ctrlpriv->jrpdev == NULL) {
-                ret = -ENOMEM;
+        ret = of_platform_populate(nprop, caam_match, NULL, dev);
+        if (ret) {
+                dev_err(dev, "JR platform devices creation error\n");
                 goto iounmap_ctrl;
         }
 
         ring = 0;
-        ridx = 0;
-        ctrlpriv->total_jobrs = 0;
         for_each_available_child_of_node(nprop, np)
                 if (of_device_is_compatible(np, "fsl,sec-v4.0-job-ring") ||
                     of_device_is_compatible(np, "fsl,sec4.0-job-ring")) {
-                        ctrlpriv->jrpdev[ring] =
-                                of_platform_device_create(np, NULL, dev);
-                        if (!ctrlpriv->jrpdev[ring]) {
-                                pr_warn("JR physical index %d: Platform device creation error\n",
-                                        ridx);
-                                ridx++;
-                                continue;
-                        }
                         ctrlpriv->jr[ring] = (struct caam_job_ring __iomem __force *)
                                              ((__force uint8_t *)ctrl +
-                                             (ridx + JR_BLOCK_NUMBER) *
+                                             (ring + JR_BLOCK_NUMBER) *
                                               BLOCK_OFFSET
                                              );
                         ctrlpriv->total_jobrs++;
                         ring++;
-                        ridx++;
-        }
+                }
 
         /* Check to see if QI present. If so, enable */
         ctrlpriv->qi_present =
@@ -847,17 +834,6 @@ disable_caam_ipg:
         return ret;
 }
 
-static struct of_device_id caam_match[] = {
-        {
-                .compatible = "fsl,sec-v4.0",
-        },
-        {
-                .compatible = "fsl,sec4.0",
-        },
-        {},
-};
-MODULE_DEVICE_TABLE(of, caam_match);
-
 static struct platform_driver caam_driver = {
         .driver = {
                 .name = "caam",
diff --git a/drivers/crypto/caam/intern.h b/drivers/crypto/caam/intern.h
index e2bcacc1a921..dbed8baeebe5 100644
--- a/drivers/crypto/caam/intern.h
+++ b/drivers/crypto/caam/intern.h
@@ -66,7 +66,6 @@ struct caam_drv_private_jr {
 struct caam_drv_private {
 
         struct device *dev;
-        struct platform_device **jrpdev; /* Alloc'ed array per sub-device */
         struct platform_device *pdev;
 
         /* Physical-presence section */
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index 41cc853f8569..fc08b4ed69d9 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -1015,6 +1015,7 @@ const struct ccp_vdata ccpv5a = {
 
 const struct ccp_vdata ccpv5b = {
         .version = CCP_VERSION(5, 0),
+        .dma_chan_attr = DMA_PRIVATE,
         .setup = ccp5other_config,
         .perform = &ccp5_actions,
         .bar = 2,
diff --git a/drivers/crypto/ccp/ccp-dev.c b/drivers/crypto/ccp/ccp-dev.c
index 511ab042b5e7..92d1c6959f08 100644
--- a/drivers/crypto/ccp/ccp-dev.c
+++ b/drivers/crypto/ccp/ccp-dev.c
@@ -283,11 +283,14 @@ EXPORT_SYMBOL_GPL(ccp_version);
  */
 int ccp_enqueue_cmd(struct ccp_cmd *cmd)
 {
-        struct ccp_device *ccp = ccp_get_device();
+        struct ccp_device *ccp;
         unsigned long flags;
         unsigned int i;
         int ret;
 
+        /* Some commands might need to be sent to a specific device */
+        ccp = cmd->ccp ? cmd->ccp : ccp_get_device();
+
         if (!ccp)
                 return -ENODEV;
 
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 2b5c01fade05..aa36f3f81860 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -179,6 +179,10 @@
 
 /* ------------------------ General CCP Defines ------------------------ */
 
+#define CCP_DMA_DFLT                    0x0
+#define CCP_DMA_PRIV                    0x1
+#define CCP_DMA_PUB                     0x2
+
 #define CCP_DMAPOOL_MAX_SIZE            64
 #define CCP_DMAPOOL_ALIGN               BIT(5)
 
@@ -636,6 +640,7 @@ struct ccp_actions {
 /* Structure to hold CCP version-specific values */
 struct ccp_vdata {
         const unsigned int version;
+        const unsigned int dma_chan_attr;
         void (*setup)(struct ccp_device *);
         const struct ccp_actions *perform;
         const unsigned int bar;
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
index e5d9278f4019..e00be01fbf5a 100644
--- a/drivers/crypto/ccp/ccp-dmaengine.c
+++ b/drivers/crypto/ccp/ccp-dmaengine.c
@@ -10,6 +10,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/dmaengine.h>
 #include <linux/spinlock.h>
@@ -25,6 +26,37 @@
         (mask == 0) ? 64 : fls64(mask); \
 })
 
+/* The CCP as a DMA provider can be configured for public or private
+ * channels. Default is specified in the vdata for the device (PCI ID).
+ * This module parameter will override for all channels on all devices:
+ *   dma_chan_attr = 0x2 to force all channels public
+ *                 = 0x1 to force all channels private
+ *                 = 0x0 to defer to the vdata setting
+ *                 = any other value: warning, revert to 0x0
+ */
+static unsigned int dma_chan_attr = CCP_DMA_DFLT;
+module_param(dma_chan_attr, uint, 0444);
+MODULE_PARM_DESC(dma_chan_attr, "Set DMA channel visibility: 0 (default) = device defaults, 1 = make private, 2 = make public");
+
+unsigned int ccp_get_dma_chan_attr(struct ccp_device *ccp)
+{
+        switch (dma_chan_attr) {
+        case CCP_DMA_DFLT:
+                return ccp->vdata->dma_chan_attr;
+
+        case CCP_DMA_PRIV:
+                return DMA_PRIVATE;
+
+        case CCP_DMA_PUB:
+                return 0;
+
+        default:
+                dev_info_once(ccp->dev, "Invalid value for dma_chan_attr: %d\n",
+                              dma_chan_attr);
+                return ccp->vdata->dma_chan_attr;
+        }
+}
+
 static void ccp_free_cmd_resources(struct ccp_device *ccp,
                                    struct list_head *list)
 {
@@ -390,6 +422,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
                         goto err;
 
                 ccp_cmd = &cmd->ccp_cmd;
+                ccp_cmd->ccp = chan->ccp;
                 ccp_pt = &ccp_cmd->u.passthru_nomap;
                 ccp_cmd->flags = CCP_CMD_MAY_BACKLOG;
                 ccp_cmd->flags |= CCP_CMD_PASSTHRU_NO_DMA_MAP;
@@ -674,6 +707,15 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
         dma_cap_set(DMA_SG, dma_dev->cap_mask);
         dma_cap_set(DMA_INTERRUPT, dma_dev->cap_mask);
 
+        /* The DMA channels for this device can be set to public or private,
+         * and overridden by the module parameter dma_chan_attr.
+         * Default: according to the value in vdata (dma_chan_attr=0)
+         * dma_chan_attr=0x1: all channels private (override vdata)
+         * dma_chan_attr=0x2: all channels public (override vdata)
+         */
+        if (ccp_get_dma_chan_attr(ccp) == DMA_PRIVATE)
+                dma_cap_set(DMA_PRIVATE, dma_dev->cap_mask);
+
         INIT_LIST_HEAD(&dma_dev->channels);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 chan = ccp->ccp_dma_chan + i;
diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
index dce1af0ce85c..1b9da3dc799b 100644
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -270,7 +270,7 @@ static void s5p_sg_copy_buf(void *buf, struct scatterlist *sg,
         scatterwalk_done(&walk, out, 0);
 }
 
-static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
+static void s5p_sg_done(struct s5p_aes_dev *dev)
 {
         if (dev->sg_dst_cpy) {
                 dev_dbg(dev->dev,
@@ -281,8 +281,11 @@ static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
         }
         s5p_free_sg_cpy(dev, &dev->sg_src_cpy);
         s5p_free_sg_cpy(dev, &dev->sg_dst_cpy);
+}
 
-        /* holding a lock outside */
+/* Calls the completion. Cannot be called with dev->lock hold. */
+static void s5p_aes_complete(struct s5p_aes_dev *dev, int err)
+{
         dev->req->base.complete(&dev->req->base, err);
         dev->busy = false;
 }
@@ -368,51 +371,44 @@ exit:
 }
 
 /*
- * Returns true if new transmitting (output) data is ready and its
- * address+length have to be written to device (by calling
- * s5p_set_dma_outdata()). False otherwise.
+ * Returns -ERRNO on error (mapping of new data failed).
+ * On success returns:
+ *  - 0 if there is no more data,
+ *  - 1 if new transmitting (output) data is ready and its address+length
+ *     have to be written to device (by calling s5p_set_dma_outdata()).
  */
-static bool s5p_aes_tx(struct s5p_aes_dev *dev)
+static int s5p_aes_tx(struct s5p_aes_dev *dev)
 {
-        int err = 0;
-        bool ret = false;
+        int ret = 0;
 
         s5p_unset_outdata(dev);
 
         if (!sg_is_last(dev->sg_dst)) {
-                err = s5p_set_outdata(dev, sg_next(dev->sg_dst));
-                if (err)
-                        s5p_aes_complete(dev, err);
-                else
-                        ret = true;
-        } else {
-                s5p_aes_complete(dev, err);
-
-                dev->busy = true;
-                tasklet_schedule(&dev->tasklet);
+                ret = s5p_set_outdata(dev, sg_next(dev->sg_dst));
+                if (!ret)
+                        ret = 1;
         }
 
         return ret;
 }
 
 /*
- * Returns true if new receiving (input) data is ready and its
- * address+length have to be written to device (by calling
- * s5p_set_dma_indata()). False otherwise.
+ * Returns -ERRNO on error (mapping of new data failed).
+ * On success returns:
+ *  - 0 if there is no more data,
+ *  - 1 if new receiving (input) data is ready and its address+length
+ *     have to be written to device (by calling s5p_set_dma_indata()).
  */
-static bool s5p_aes_rx(struct s5p_aes_dev *dev)
+static int s5p_aes_rx(struct s5p_aes_dev *dev/*, bool *set_dma*/)
 {
-        int err;
-        bool ret = false;
+        int ret = 0;
 
         s5p_unset_indata(dev);
 
         if (!sg_is_last(dev->sg_src)) {
-                err = s5p_set_indata(dev, sg_next(dev->sg_src));
-                if (err)
-                        s5p_aes_complete(dev, err);
-                else
-                        ret = true;
+                ret = s5p_set_indata(dev, sg_next(dev->sg_src));
+                if (!ret)
+                        ret = 1;
         }
 
         return ret;
@@ -422,33 +418,73 @@ static irqreturn_t s5p_aes_interrupt(int irq, void *dev_id)
 {
         struct platform_device *pdev = dev_id;
         struct s5p_aes_dev *dev = platform_get_drvdata(pdev);
-        bool set_dma_tx = false;
-        bool set_dma_rx = false;
+        int err_dma_tx = 0;
+        int err_dma_rx = 0;
+        bool tx_end = false;
         unsigned long flags;
         uint32_t status;
+        int err;
 
         spin_lock_irqsave(&dev->lock, flags);
 
+        /*
+         * Handle rx or tx interrupt. If there is still data (scatterlist did not
+         * reach end), then map next scatterlist entry.
+         * In case of such mapping error, s5p_aes_complete() should be called.
+         *
+         * If there is no more data in tx scatter list, call s5p_aes_complete()
+         * and schedule new tasklet.
+         */
         status = SSS_READ(dev, FCINTSTAT);
         if (status & SSS_FCINTSTAT_BRDMAINT)
-                set_dma_rx = s5p_aes_rx(dev);
-        if (status & SSS_FCINTSTAT_BTDMAINT)
-                set_dma_tx = s5p_aes_tx(dev);
+                err_dma_rx = s5p_aes_rx(dev);
+
+        if (status & SSS_FCINTSTAT_BTDMAINT) {
+                if (sg_is_last(dev->sg_dst))
+                        tx_end = true;
+                err_dma_tx = s5p_aes_tx(dev);
+        }
 
         SSS_WRITE(dev, FCINTPEND, status);
 
-        /*
-         * Writing length of DMA block (either receiving or transmitting)
-         * will start the operation immediately, so this should be done
-         * at the end (even after clearing pending interrupts to not miss the
-         * interrupt).
-         */
-        if (set_dma_tx)
-                s5p_set_dma_outdata(dev, dev->sg_dst);
-        if (set_dma_rx)
-                s5p_set_dma_indata(dev, dev->sg_src);
+        if (err_dma_rx < 0) {
+                err = err_dma_rx;
+                goto error;
+        }
+        if (err_dma_tx < 0) {
+                err = err_dma_tx;
+                goto error;
+        }
+
+        if (tx_end) {
+                s5p_sg_done(dev);
+
+                spin_unlock_irqrestore(&dev->lock, flags);
+
+                s5p_aes_complete(dev, 0);
+                dev->busy = true;
+                tasklet_schedule(&dev->tasklet);
+        } else {
+                /*
+                 * Writing length of DMA block (either receiving or
+                 * transmitting) will start the operation immediately, so this
+                 * should be done at the end (even after clearing pending
+                 * interrupts to not miss the interrupt).
+                 */
+                if (err_dma_tx == 1)
+                        s5p_set_dma_outdata(dev, dev->sg_dst);
+                if (err_dma_rx == 1)
+                        s5p_set_dma_indata(dev, dev->sg_src);
 
+                spin_unlock_irqrestore(&dev->lock, flags);
+        }
+
+        return IRQ_HANDLED;
+
+error:
+        s5p_sg_done(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
+        s5p_aes_complete(dev, err);
 
         return IRQ_HANDLED;
 }
@@ -597,8 +633,9 @@ outdata_error:
         s5p_unset_indata(dev);
 
 indata_error:
-        s5p_aes_complete(dev, err);
+        s5p_sg_done(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
+        s5p_aes_complete(dev, err);
 }
 
 static void s5p_tasklet_cb(unsigned long data)
@@ -805,8 +842,9 @@ static int s5p_aes_probe(struct platform_device *pdev)
                 dev_warn(dev, "feed control interrupt is not available.\n");
                 goto err_irq;
         }
-        err = devm_request_irq(dev, pdata->irq_fc, s5p_aes_interrupt,
-                               IRQF_SHARED, pdev->name, pdev);
+        err = devm_request_threaded_irq(dev, pdata->irq_fc, NULL,
+                                        s5p_aes_interrupt, IRQF_ONESHOT,
+                                        pdev->name, pdev);
         if (err < 0) {
                 dev_warn(dev, "feed control interrupt is not available.\n");
                 goto err_irq;
diff --git a/drivers/crypto/ux500/cryp/cryp.c b/drivers/crypto/ux500/cryp/cryp.c
index 43a0c8a26ab0..00a16ab601cb 100644
--- a/drivers/crypto/ux500/cryp/cryp.c
+++ b/drivers/crypto/ux500/cryp/cryp.c
@@ -82,7 +82,7 @@ void cryp_activity(struct cryp_device_data *device_data,
 void cryp_flush_inoutfifo(struct cryp_device_data *device_data)
 {
         /*
-         * We always need to disble the hardware before trying to flush the
+         * We always need to disable the hardware before trying to flush the
          * FIFO. This is something that isn't written in the design
          * specification, but we have been informed by the hardware designers
          * that this must be done.
diff --git a/drivers/dax/Kconfig b/drivers/dax/Kconfig
index 3e2ab3b14eea..9e95bf94eb13 100644
--- a/drivers/dax/Kconfig
+++ b/drivers/dax/Kconfig
@@ -2,6 +2,7 @@ menuconfig DEV_DAX
         tristate "DAX: direct access to differentiated memory"
         default m if NVDIMM_DAX
         depends on TRANSPARENT_HUGEPAGE
+        select SRCU
         help
           Support raw access to differentiated (persistence, bandwidth,
           latency...) memory via an mmap(2) capable character
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 8d9829ff2a78..806f180c80d8 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -25,6 +25,7 @@
 #include "dax.h"
 
 static dev_t dax_devt;
+DEFINE_STATIC_SRCU(dax_srcu);
 static struct class *dax_class;
 static DEFINE_IDA(dax_minor_ida);
 static int nr_dax = CONFIG_NR_DEV_DAX;
@@ -60,7 +61,7 @@ struct dax_region {
  * @region - parent region
  * @dev - device backing the character device
  * @cdev - core chardev data
- * @alive - !alive + rcu grace period == no new mappings can be established
+ * @alive - !alive + srcu grace period == no new mappings can be established
  * @id - child id in the region
  * @num_resources - number of physical address extents in this device
  * @res - array of physical address ranges
@@ -427,6 +428,7 @@ static int __dax_dev_pte_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
         int rc = VM_FAULT_SIGBUS;
         phys_addr_t phys;
         pfn_t pfn;
+        unsigned int fault_size = PAGE_SIZE;
 
         if (check_vma(dax_dev, vmf->vma, __func__))
                 return VM_FAULT_SIGBUS;
@@ -437,9 +439,12 @@ static int __dax_dev_pte_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
         }
 
+        if (fault_size != dax_region->align)
+                return VM_FAULT_SIGBUS;
+
         phys = pgoff_to_phys(dax_dev, vmf->pgoff, PAGE_SIZE);
         if (phys == -1) {
-                dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+                dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
                                 vmf->pgoff);
                 return VM_FAULT_SIGBUS;
         }
@@ -464,6 +469,7 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
         phys_addr_t phys;
         pgoff_t pgoff;
         pfn_t pfn;
+        unsigned int fault_size = PMD_SIZE;
 
         if (check_vma(dax_dev, vmf->vma, __func__))
                 return VM_FAULT_SIGBUS;
@@ -480,10 +486,20 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
         }
 
+        if (fault_size < dax_region->align)
+                return VM_FAULT_SIGBUS;
+        else if (fault_size > dax_region->align)
+                return VM_FAULT_FALLBACK;
+
+        /* if we are outside of the VMA */
+        if (pmd_addr < vmf->vma->vm_start ||
+                        (pmd_addr + PMD_SIZE) > vmf->vma->vm_end)
+                return VM_FAULT_SIGBUS;
+
         pgoff = linear_page_index(vmf->vma, pmd_addr);
         phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
         if (phys == -1) {
-                dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+                dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
                                 pgoff);
                 return VM_FAULT_SIGBUS;
         }
@@ -503,6 +519,8 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
         phys_addr_t phys;
         pgoff_t pgoff;
         pfn_t pfn;
+        unsigned int fault_size = PUD_SIZE;
+
 
         if (check_vma(dax_dev, vmf->vma, __func__))
                 return VM_FAULT_SIGBUS;
@@ -519,10 +537,20 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
                 return VM_FAULT_SIGBUS;
         }
 
+        if (fault_size < dax_region->align)
+                return VM_FAULT_SIGBUS;
+        else if (fault_size > dax_region->align)
+                return VM_FAULT_FALLBACK;
+
+        /* if we are outside of the VMA */
+        if (pud_addr < vmf->vma->vm_start ||
+                        (pud_addr + PUD_SIZE) > vmf->vma->vm_end)
+                return VM_FAULT_SIGBUS;
+
         pgoff = linear_page_index(vmf->vma, pud_addr);
         phys = pgoff_to_phys(dax_dev, pgoff, PUD_SIZE);
         if (phys == -1) {
-                dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
+                dev_dbg(dev, "%s: pgoff_to_phys(%#lx) failed\n", __func__,
                                 pgoff);
                 return VM_FAULT_SIGBUS;
         }
@@ -542,7 +570,7 @@ static int __dax_dev_pud_fault(struct dax_dev *dax_dev, struct vm_fault *vmf)
 static int dax_dev_huge_fault(struct vm_fault *vmf,
                 enum page_entry_size pe_size)
 {
-        int rc;
+        int rc, id;
         struct file *filp = vmf->vma->vm_file;
         struct dax_dev *dax_dev = filp->private_data;
 
@@ -551,7 +579,7 @@ static int dax_dev_huge_fault(struct vm_fault *vmf,
                         ? "write" : "read",
                         vmf->vma->vm_start, vmf->vma->vm_end);
 
-        rcu_read_lock();
+        id = srcu_read_lock(&dax_srcu);
         switch (pe_size) {
         case PE_SIZE_PTE:
                 rc = __dax_dev_pte_fault(dax_dev, vmf);
@@ -565,7 +593,7 @@ static int dax_dev_huge_fault(struct vm_fault *vmf,
         default:
                 return VM_FAULT_FALLBACK;
         }
-        rcu_read_unlock();
+        srcu_read_unlock(&dax_srcu, id);
 
         return rc;
 }
@@ -686,11 +714,11 @@ static void unregister_dax_dev(void *dev)
          * Note, rcu is not protecting the liveness of dax_dev, rcu is
          * ensuring that any fault handlers that might have seen
          * dax_dev->alive == true, have completed.  Any fault handlers
-         * that start after synchronize_rcu() has started will abort
+         * that start after synchronize_srcu() has started will abort
          * upon seeing dax_dev->alive == false.
          */
         dax_dev->alive = false;
-        synchronize_rcu();
+        synchronize_srcu(&dax_srcu);
         unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
         cdev_del(cdev);
         device_unregister(dev);
diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
index e18dc596cf24..6204cc32d09c 100644
--- a/drivers/dma/bcm2835-dma.c
+++ b/drivers/dma/bcm2835-dma.c
@@ -251,8 +251,11 @@ static void bcm2835_dma_create_cb_set_length(
          */
 
         /* have we filled in period_length yet? */
-        if (*total_len + control_block->length < period_len)
+        if (*total_len + control_block->length < period_len) {
+                /* update number of bytes in this period so far */
+                *total_len += control_block->length;
                 return;
+        }
 
         /* calculate the length that remains to reach period_length */
         control_block->length = period_len - *total_len;
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 24e0221fd66d..d9118ec23025 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -1108,12 +1108,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr)
         switch (order) {
         case 0 ... 1:
                 return &unmap_pool[0];
+#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID)
         case 2 ... 4:
                 return &unmap_pool[1];
         case 5 ... 7:
                 return &unmap_pool[2];
         case 8:
                 return &unmap_pool[3];
+#endif
         default:
                 BUG();
                 return NULL;
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index 82d85cce81f8..4773f2867234 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -43,6 +43,7 @@ config EDAC_LEGACY_SYSFS
 
 config EDAC_DEBUG
         bool "Debugging"
+        select DEBUG_FS
         help
           This turns on debugging information for the entire EDAC subsystem.
           You do so by inserting edac_module with "edac_debug_level=x." Valid
@@ -259,6 +260,15 @@ config EDAC_SKX
           Support for error detection and correction the Intel
           Skylake server Integrated Memory Controllers.
 
+config EDAC_PND2
+        tristate "Intel Pondicherry2"
+        depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
+        help
+          Support for error detection and correction on the Intel
+          Pondicherry2 Integrated Memory Controller. This SoC IP is
+          first used on the Apollo Lake platform and Denverton
+          micro-server but may appear on others in the future.
+
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
         depends on EDAC_MM_EDAC && FSL_SOC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index 88e472e8b9a9..587107e90996 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -32,6 +32,7 @@ obj-$(CONFIG_EDAC_I7300)		+= i7300_edac.o
 obj-$(CONFIG_EDAC_I7CORE)               += i7core_edac.o
 obj-$(CONFIG_EDAC_SBRIDGE)              += sb_edac.o
 obj-$(CONFIG_EDAC_SKX)                  += skx_edac.o
+obj-$(CONFIG_EDAC_PND2)                 += pnd2_edac.o
 obj-$(CONFIG_EDAC_E7XXX)                += e7xxx_edac.o
 obj-$(CONFIG_EDAC_E752X)                += e752x_edac.o
 obj-$(CONFIG_EDAC_I82443BXGX)           += i82443bxgx_edac.o
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 1670d27bcac8..f683919981b0 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -1293,7 +1293,7 @@ static int i5000_init_csrows(struct mem_ctl_info *mci)
                         dimm->mtype = MEM_FB_DDR2;
 
                         /* ask what device type on this row */
-                        if (MTR_DRAM_WIDTH(mtr))
+                        if (MTR_DRAM_WIDTH(mtr) == 8)
                                 dimm->dtype = DEV_X8;
                         else
                                 dimm->dtype = DEV_X4;
diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
index abf6ef22e220..37a9ba71da44 100644
--- a/drivers/edac/i5400_edac.c
+++ b/drivers/edac/i5400_edac.c
@@ -1207,13 +1207,14 @@ static int i5400_init_dimms(struct mem_ctl_info *mci)
 
                         dimm->nr_pages = size_mb << 8;
                         dimm->grain = 8;
-                        dimm->dtype = MTR_DRAM_WIDTH(mtr) ? DEV_X8 : DEV_X4;
+                        dimm->dtype = MTR_DRAM_WIDTH(mtr) == 8 ?
+                                      DEV_X8 : DEV_X4;
                         dimm->mtype = MEM_FB_DDR2;
                         /*
                          * The eccc mechanism is SDDC (aka SECC), with
                          * is similar to Chipkill.
                          */
-                        dimm->edac_mode = MTR_DRAM_WIDTH(mtr) ?
+                        dimm->edac_mode = MTR_DRAM_WIDTH(mtr) == 8 ?
                                           EDAC_S8ECD8ED : EDAC_S4ECD4ED;
                         ndimms++;
                 }
diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
new file mode 100644
index 000000000000..928e0dba41fc
--- /dev/null
+++ b/drivers/edac/pnd2_edac.c
@@ -0,0 +1,1546 @@
+/*
+ * Driver for Pondicherry2 memory controller.
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * [Derived from sb_edac.c]
+ *
+ * Translation of system physical addresses to DIMM addresses
+ * is a two stage process:
+ *
+ * First the Pondicherry 2 memory controller handles slice and channel interleaving
+ * in "sys2pmi()". This is (almost) completley common between platforms.
+ *
+ * Then a platform specific dunit (DIMM unit) completes the process to provide DIMM,
+ * rank, bank, row and column using the appropriate "dunit_ops" functions/parameters.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/edac.h>
+#include <linux/mmzone.h>
+#include <linux/smp.h>
+#include <linux/bitmap.h>
+#include <linux/math64.h>
+#include <linux/mod_devicetable.h>
+#include <asm/cpu_device_id.h>
+#include <asm/intel-family.h>
+#include <asm/processor.h>
+#include <asm/mce.h>
+
+#include "edac_mc.h"
+#include "edac_module.h"
+#include "pnd2_edac.h"
+
+#define APL_NUM_CHANNELS        4
+#define DNV_NUM_CHANNELS        2
+#define DNV_MAX_DIMMS           2 /* Max DIMMs per channel */
+
+enum type {
+        APL,
+        DNV, /* All requests go to PMI CH0 on each slice (CH1 disabled) */
+};
+
+struct dram_addr {
+        int chan;
+        int dimm;
+        int rank;
+        int bank;
+        int row;
+        int col;
+};
+
+struct pnd2_pvt {
+        int dimm_geom[APL_NUM_CHANNELS];
+        u64 tolm, tohm;
+};
+
+/*
+ * System address space is divided into multiple regions with
+ * different interleave rules in each. The as0/as1 regions
+ * have no interleaving at all. The as2 region is interleaved
+ * between two channels. The mot region is magic and may overlap
+ * other regions, with its interleave rules taking precedence.
+ * Addresses not in any of these regions are interleaved across
+ * all four channels.
+ */
+static struct region {
+        u64     base;
+        u64     limit;
+        u8      enabled;
+} mot, as0, as1, as2;
+
+static struct dunit_ops {
+        char *name;
+        enum type type;
+        int pmiaddr_shift;
+        int pmiidx_shift;
+        int channels;
+        int dimms_per_channel;
+        int (*rd_reg)(int port, int off, int op, void *data, size_t sz, char *name);
+        int (*get_registers)(void);
+        int (*check_ecc)(void);
+        void (*mk_region)(char *name, struct region *rp, void *asym);
+        void (*get_dimm_config)(struct mem_ctl_info *mci);
+        int (*pmi2mem)(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                                   struct dram_addr *daddr, char *msg);
+} *ops;
+
+static struct mem_ctl_info *pnd2_mci;
+
+#define PND2_MSG_SIZE   256
+
+/* Debug macros */
+#define pnd2_printk(level, fmt, arg...)                 \
+        edac_printk(level, "pnd2", fmt, ##arg)
+
+#define pnd2_mc_printk(mci, level, fmt, arg...) \
+        edac_mc_chipset_printk(mci, level, "pnd2", fmt, ##arg)
+
+#define MOT_CHAN_INTLV_BIT_1SLC_2CH 12
+#define MOT_CHAN_INTLV_BIT_2SLC_2CH 13
+#define SELECTOR_DISABLED (-1)
+#define _4GB (1ul << 32)
+
+#define PMI_ADDRESS_WIDTH       31
+#define PND_MAX_PHYS_BIT        39
+
+#define APL_ASYMSHIFT           28
+#define DNV_ASYMSHIFT           31
+#define CH_HASH_MASK_LSB        6
+#define SLICE_HASH_MASK_LSB     6
+#define MOT_SLC_INTLV_BIT       12
+#define LOG2_PMI_ADDR_GRANULARITY       5
+#define MOT_SHIFT       24
+
+#define GET_BITFIELD(v, lo, hi) (((v) & GENMASK_ULL(hi, lo)) >> (lo))
+#define U64_LSHIFT(val, s)      ((u64)(val) << (s))
+
+#ifdef CONFIG_X86_INTEL_SBI_APL
+#include "linux/platform_data/sbi_apl.h"
+int sbi_send(int port, int off, int op, u32 *data)
+{
+        struct sbi_apl_message sbi_arg;
+        int ret, read = 0;
+
+        memset(&sbi_arg, 0, sizeof(sbi_arg));
+
+        if (op == 0 || op == 4 || op == 6)
+                read = 1;
+        else
+                sbi_arg.data = *data;
+
+        sbi_arg.opcode = op;
+        sbi_arg.port_address = port;
+        sbi_arg.register_offset = off;
+        ret = sbi_apl_commit(&sbi_arg);
+        if (ret || sbi_arg.status)
+                edac_dbg(2, "sbi_send status=%d ret=%d data=%x\n",
+                                 sbi_arg.status, ret, sbi_arg.data);
+
+        if (ret == 0)
+                ret = sbi_arg.status;
+
+        if (ret == 0 && read)
+                *data = sbi_arg.data;
+
+        return ret;
+}
+#else
+int sbi_send(int port, int off, int op, u32 *data)
+{
+        return -EUNATCH;
+}
+#endif
+
+static int apl_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+{
+        int     ret = 0;
+
+        edac_dbg(2, "Read %s port=%x off=%x op=%x\n", name, port, off, op);
+        switch (sz) {
+        case 8:
+                ret = sbi_send(port, off + 4, op, (u32 *)(data + 4));
+        case 4:
+                ret = sbi_send(port, off, op, (u32 *)data);
+                pnd2_printk(KERN_DEBUG, "%s=%x%08x ret=%d\n", name,
+                                        sz == 8 ? *((u32 *)(data + 4)) : 0, *((u32 *)data), ret);
+                break;
+        }
+
+        return ret;
+}
+
+static u64 get_mem_ctrl_hub_base_addr(void)
+{
+        struct b_cr_mchbar_lo_pci lo;
+        struct b_cr_mchbar_hi_pci hi;
+        struct pci_dev *pdev;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+        if (pdev) {
+                pci_read_config_dword(pdev, 0x48, (u32 *)&lo);
+                pci_read_config_dword(pdev, 0x4c, (u32 *)&hi);
+                pci_dev_put(pdev);
+        } else {
+                return 0;
+        }
+
+        if (!lo.enable) {
+                edac_dbg(2, "MMIO via memory controller hub base address is disabled!\n");
+                return 0;
+        }
+
+        return U64_LSHIFT(hi.base, 32) | U64_LSHIFT(lo.base, 15);
+}
+
+static u64 get_sideband_reg_base_addr(void)
+{
+        struct pci_dev *pdev;
+        u32 hi, lo;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x19dd, NULL);
+        if (pdev) {
+                pci_read_config_dword(pdev, 0x10, &lo);
+                pci_read_config_dword(pdev, 0x14, &hi);
+                pci_dev_put(pdev);
+                return (U64_LSHIFT(hi, 32) | U64_LSHIFT(lo, 0));
+        } else {
+                return 0xfd000000;
+        }
+}
+
+static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+{
+        struct pci_dev *pdev;
+        char *base;
+        u64 addr;
+
+        if (op == 4) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+                if (!pdev)
+                        return -ENODEV;
+
+                pci_read_config_dword(pdev, off, data);
+                pci_dev_put(pdev);
+        } else {
+                /* MMIO via memory controller hub base address */
+                if (op == 0 && port == 0x4c) {
+                        addr = get_mem_ctrl_hub_base_addr();
+                        if (!addr)
+                                return -ENODEV;
+                } else {
+                        /* MMIO via sideband register base address */
+                        addr = get_sideband_reg_base_addr();
+                        if (!addr)
+                                return -ENODEV;
+                        addr += (port << 16);
+                }
+
+                base = ioremap((resource_size_t)addr, 0x10000);
+                if (!base)
+                        return -ENODEV;
+
+                if (sz == 8)
+                        *(u32 *)(data + 4) = *(u32 *)(base + off + 4);
+                *(u32 *)data = *(u32 *)(base + off);
+
+                iounmap(base);
+        }
+
+        edac_dbg(2, "Read %s=%.8x_%.8x\n", name,
+                        (sz == 8) ? *(u32 *)(data + 4) : 0, *(u32 *)data);
+
+        return 0;
+}
+
+#define RD_REGP(regp, regname, port)    \
+        ops->rd_reg(port,                                       \
+                regname##_offset,                               \
+                regname##_r_opcode,                             \
+                regp, sizeof(struct regname),   \
+                #regname)
+
+#define RD_REG(regp, regname)                   \
+        ops->rd_reg(regname ## _port,           \
+                regname##_offset,                               \
+                regname##_r_opcode,                             \
+                regp, sizeof(struct regname),   \
+                #regname)
+
+static u64 top_lm, top_hm;
+static bool two_slices;
+static bool two_channels; /* Both PMI channels in one slice enabled */
+
+static u8 sym_chan_mask;
+static u8 asym_chan_mask;
+static u8 chan_mask;
+
+static int slice_selector = -1;
+static int chan_selector = -1;
+static u64 slice_hash_mask;
+static u64 chan_hash_mask;
+
+static void mk_region(char *name, struct region *rp, u64 base, u64 limit)
+{
+        rp->enabled = 1;
+        rp->base = base;
+        rp->limit = limit;
+        edac_dbg(2, "Region:%s [%llx, %llx]\n", name, base, limit);
+}
+
+static void mk_region_mask(char *name, struct region *rp, u64 base, u64 mask)
+{
+        if (mask == 0) {
+                pr_info(FW_BUG "MOT mask cannot be zero\n");
+                return;
+        }
+        if (mask != GENMASK_ULL(PND_MAX_PHYS_BIT, __ffs(mask))) {
+                pr_info(FW_BUG "MOT mask not power of two\n");
+                return;
+        }
+        if (base & ~mask) {
+                pr_info(FW_BUG "MOT region base/mask alignment error\n");
+                return;
+        }
+        rp->base = base;
+        rp->limit = (base | ~mask) & GENMASK_ULL(PND_MAX_PHYS_BIT, 0);
+        rp->enabled = 1;
+        edac_dbg(2, "Region:%s [%llx, %llx]\n", name, base, rp->limit);
+}
+
+static bool in_region(struct region *rp, u64 addr)
+{
+        if (!rp->enabled)
+                return false;
+
+        return rp->base <= addr && addr <= rp->limit;
+}
+
+static int gen_sym_mask(struct b_cr_slice_channel_hash *p)
+{
+        int mask = 0;
+
+        if (!p->slice_0_mem_disabled)
+                mask |= p->sym_slice0_channel_enabled;
+
+        if (!p->slice_1_disabled)
+                mask |= p->sym_slice1_channel_enabled << 2;
+
+        if (p->ch_1_disabled || p->enable_pmi_dual_data_mode)
+                mask &= 0x5;
+
+        return mask;
+}
+
+static int gen_asym_mask(struct b_cr_slice_channel_hash *p,
+                         struct b_cr_asym_mem_region0_mchbar *as0,
+                         struct b_cr_asym_mem_region1_mchbar *as1,
+                         struct b_cr_asym_2way_mem_region_mchbar *as2way)
+{
+        const int intlv[] = { 0x5, 0xA, 0x3, 0xC };
+        int mask = 0;
+
+        if (as2way->asym_2way_interleave_enable)
+                mask = intlv[as2way->asym_2way_intlv_mode];
+        if (as0->slice0_asym_enable)
+                mask |= (1 << as0->slice0_asym_channel_select);
+        if (as1->slice1_asym_enable)
+                mask |= (4 << as1->slice1_asym_channel_select);
+        if (p->slice_0_mem_disabled)
+                mask &= 0xc;
+        if (p->slice_1_disabled)
+                mask &= 0x3;
+        if (p->ch_1_disabled || p->enable_pmi_dual_data_mode)
+                mask &= 0x5;
+
+        return mask;
+}
+
+static struct b_cr_tolud_pci tolud;
+static struct b_cr_touud_lo_pci touud_lo;
+static struct b_cr_touud_hi_pci touud_hi;
+static struct b_cr_asym_mem_region0_mchbar asym0;
+static struct b_cr_asym_mem_region1_mchbar asym1;
+static struct b_cr_asym_2way_mem_region_mchbar asym_2way;
+static struct b_cr_mot_out_base_mchbar mot_base;
+static struct b_cr_mot_out_mask_mchbar mot_mask;
+static struct b_cr_slice_channel_hash chash;
+
+/* Apollo Lake dunit */
+/*
+ * Validated on board with just two DIMMs in the [0] and [2] positions
+ * in this array. Other port number matches documentation, but caution
+ * advised.
+ */
+static const int apl_dports[APL_NUM_CHANNELS] = { 0x18, 0x10, 0x11, 0x19 };
+static struct d_cr_drp0 drp0[APL_NUM_CHANNELS];
+
+/* Denverton dunit */
+static const int dnv_dports[DNV_NUM_CHANNELS] = { 0x10, 0x12 };
+static struct d_cr_dsch dsch;
+static struct d_cr_ecc_ctrl ecc_ctrl[DNV_NUM_CHANNELS];
+static struct d_cr_drp drp[DNV_NUM_CHANNELS];
+static struct d_cr_dmap dmap[DNV_NUM_CHANNELS];
+static struct d_cr_dmap1 dmap1[DNV_NUM_CHANNELS];
+static struct d_cr_dmap2 dmap2[DNV_NUM_CHANNELS];
+static struct d_cr_dmap3 dmap3[DNV_NUM_CHANNELS];
+static struct d_cr_dmap4 dmap4[DNV_NUM_CHANNELS];
+static struct d_cr_dmap5 dmap5[DNV_NUM_CHANNELS];
+
+static void apl_mk_region(char *name, struct region *rp, void *asym)
+{
+        struct b_cr_asym_mem_region0_mchbar *a = asym;
+
+        mk_region(name, rp,
+                          U64_LSHIFT(a->slice0_asym_base, APL_ASYMSHIFT),
+                          U64_LSHIFT(a->slice0_asym_limit, APL_ASYMSHIFT) +
+                          GENMASK_ULL(APL_ASYMSHIFT - 1, 0));
+}
+
+static void dnv_mk_region(char *name, struct region *rp, void *asym)
+{
+        struct b_cr_asym_mem_region_denverton *a = asym;
+
+        mk_region(name, rp,
+                          U64_LSHIFT(a->slice_asym_base, DNV_ASYMSHIFT),
+                          U64_LSHIFT(a->slice_asym_limit, DNV_ASYMSHIFT) +
+                          GENMASK_ULL(DNV_ASYMSHIFT - 1, 0));
+}
+
+static int apl_get_registers(void)
+{
+        int i;
+
+        if (RD_REG(&asym_2way, b_cr_asym_2way_mem_region_mchbar))
+                return -ENODEV;
+
+        for (i = 0; i < APL_NUM_CHANNELS; i++)
+                if (RD_REGP(&drp0[i], d_cr_drp0, apl_dports[i]))
+                        return -ENODEV;
+
+        return 0;
+}
+
+static int dnv_get_registers(void)
+{
+        int i;
+
+        if (RD_REG(&dsch, d_cr_dsch))
+                return -ENODEV;
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++)
+                if (RD_REGP(&ecc_ctrl[i], d_cr_ecc_ctrl, dnv_dports[i]) ||
+                        RD_REGP(&drp[i], d_cr_drp, dnv_dports[i]) ||
+                        RD_REGP(&dmap[i], d_cr_dmap, dnv_dports[i]) ||
+                        RD_REGP(&dmap1[i], d_cr_dmap1, dnv_dports[i]) ||
+                        RD_REGP(&dmap2[i], d_cr_dmap2, dnv_dports[i]) ||
+                        RD_REGP(&dmap3[i], d_cr_dmap3, dnv_dports[i]) ||
+                        RD_REGP(&dmap4[i], d_cr_dmap4, dnv_dports[i]) ||
+                        RD_REGP(&dmap5[i], d_cr_dmap5, dnv_dports[i]))
+                        return -ENODEV;
+
+        return 0;
+}
+
+/*
+ * Read all the h/w config registers once here (they don't
+ * change at run time. Figure out which address ranges have
+ * which interleave characteristics.
+ */
+static int get_registers(void)
+{
+        const int intlv[] = { 10, 11, 12, 12 };
+
+        if (RD_REG(&tolud, b_cr_tolud_pci) ||
+                RD_REG(&touud_lo, b_cr_touud_lo_pci) ||
+                RD_REG(&touud_hi, b_cr_touud_hi_pci) ||
+                RD_REG(&asym0, b_cr_asym_mem_region0_mchbar) ||
+                RD_REG(&asym1, b_cr_asym_mem_region1_mchbar) ||
+                RD_REG(&mot_base, b_cr_mot_out_base_mchbar) ||
+                RD_REG(&mot_mask, b_cr_mot_out_mask_mchbar) ||
+                RD_REG(&chash, b_cr_slice_channel_hash))
+                return -ENODEV;
+
+        if (ops->get_registers())
+                return -ENODEV;
+
+        if (ops->type == DNV) {
+                /* PMI channel idx (always 0) for asymmetric region */
+                asym0.slice0_asym_channel_select = 0;
+                asym1.slice1_asym_channel_select = 0;
+                /* PMI channel bitmap (always 1) for symmetric region */
+                chash.sym_slice0_channel_enabled = 0x1;
+                chash.sym_slice1_channel_enabled = 0x1;
+        }
+
+        if (asym0.slice0_asym_enable)
+                ops->mk_region("as0", &as0, &asym0);
+
+        if (asym1.slice1_asym_enable)
+                ops->mk_region("as1", &as1, &asym1);
+
+        if (asym_2way.asym_2way_interleave_enable) {
+                mk_region("as2way", &as2,
+                                  U64_LSHIFT(asym_2way.asym_2way_base, APL_ASYMSHIFT),
+                                  U64_LSHIFT(asym_2way.asym_2way_limit, APL_ASYMSHIFT) +
+                                  GENMASK_ULL(APL_ASYMSHIFT - 1, 0));
+        }
+
+        if (mot_base.imr_en) {
+                mk_region_mask("mot", &mot,
+                                           U64_LSHIFT(mot_base.mot_out_base, MOT_SHIFT),
+                                           U64_LSHIFT(mot_mask.mot_out_mask, MOT_SHIFT));
+        }
+
+        top_lm = U64_LSHIFT(tolud.tolud, 20);
+        top_hm = U64_LSHIFT(touud_hi.touud, 32) | U64_LSHIFT(touud_lo.touud, 20);
+
+        two_slices = !chash.slice_1_disabled &&
+                                 !chash.slice_0_mem_disabled &&
+                                 (chash.sym_slice0_channel_enabled != 0) &&
+                                 (chash.sym_slice1_channel_enabled != 0);
+        two_channels = !chash.ch_1_disabled &&
+                                 !chash.enable_pmi_dual_data_mode &&
+                                 ((chash.sym_slice0_channel_enabled == 3) ||
+                                 (chash.sym_slice1_channel_enabled == 3));
+
+        sym_chan_mask = gen_sym_mask(&chash);
+        asym_chan_mask = gen_asym_mask(&chash, &asym0, &asym1, &asym_2way);
+        chan_mask = sym_chan_mask | asym_chan_mask;
+
+        if (two_slices && !two_channels) {
+                if (chash.hvm_mode)
+                        slice_selector = 29;
+                else
+                        slice_selector = intlv[chash.interleave_mode];
+        } else if (!two_slices && two_channels) {
+                if (chash.hvm_mode)
+                        chan_selector = 29;
+                else
+                        chan_selector = intlv[chash.interleave_mode];
+        } else if (two_slices && two_channels) {
+                if (chash.hvm_mode) {
+                        slice_selector = 29;
+                        chan_selector = 30;
+                } else {
+                        slice_selector = intlv[chash.interleave_mode];
+                        chan_selector = intlv[chash.interleave_mode] + 1;
+                }
+        }
+
+        if (two_slices) {
+                if (!chash.hvm_mode)
+                        slice_hash_mask = chash.slice_hash_mask << SLICE_HASH_MASK_LSB;
+                if (!two_channels)
+                        slice_hash_mask |= BIT_ULL(slice_selector);
+        }
+
+        if (two_channels) {
+                if (!chash.hvm_mode)
+                        chan_hash_mask = chash.ch_hash_mask << CH_HASH_MASK_LSB;
+                if (!two_slices)
+                        chan_hash_mask |= BIT_ULL(chan_selector);
+        }
+
+        return 0;
+}
+
+/* Get a contiguous memory address (remove the MMIO gap) */
+static u64 remove_mmio_gap(u64 sys)
+{
+        return (sys < _4GB) ? sys : sys - (_4GB - top_lm);
+}
+
+/* Squeeze out one address bit, shift upper part down to fill gap */
+static void remove_addr_bit(u64 *addr, int bitidx)
+{
+        u64     mask;
+
+        if (bitidx == -1)
+                return;
+
+        mask = (1ull << bitidx) - 1;
+        *addr = ((*addr >> 1) & ~mask) | (*addr & mask);
+}
+
+/* XOR all the bits from addr specified in mask */
+static int hash_by_mask(u64 addr, u64 mask)
+{
+        u64 result = addr & mask;
+
+        result = (result >> 32) ^ result;
+        result = (result >> 16) ^ result;
+        result = (result >> 8) ^ result;
+        result = (result >> 4) ^ result;
+        result = (result >> 2) ^ result;
+        result = (result >> 1) ^ result;
+
+        return (int)result & 1;
+}
+
+/*
+ * First stage decode. Take the system address and figure out which
+ * second stage will deal with it based on interleave modes.
+ */
+static int sys2pmi(const u64 addr, u32 *pmiidx, u64 *pmiaddr, char *msg)
+{
+        u64 contig_addr, contig_base, contig_offset, contig_base_adj;
+        int mot_intlv_bit = two_slices ? MOT_CHAN_INTLV_BIT_2SLC_2CH :
+                                                MOT_CHAN_INTLV_BIT_1SLC_2CH;
+        int slice_intlv_bit_rm = SELECTOR_DISABLED;
+        int chan_intlv_bit_rm = SELECTOR_DISABLED;
+        /* Determine if address is in the MOT region. */
+        bool mot_hit = in_region(&mot, addr);
+        /* Calculate the number of symmetric regions enabled. */
+        int sym_channels = hweight8(sym_chan_mask);
+
+        /*
+         * The amount we need to shift the asym base can be determined by the
+         * number of enabled symmetric channels.
+         * NOTE: This can only work because symmetric memory is not supposed
+         * to do a 3-way interleave.
+         */
+        int sym_chan_shift = sym_channels >> 1;
+
+        /* Give up if address is out of range, or in MMIO gap */
+        if (addr >= (1ul << PND_MAX_PHYS_BIT) ||
+           (addr >= top_lm && addr < _4GB) || addr >= top_hm) {
+                snprintf(msg, PND2_MSG_SIZE, "Error address 0x%llx is not DRAM", addr);
+                return -EINVAL;
+        }
+
+        /* Get a contiguous memory address (remove the MMIO gap) */
+        contig_addr = remove_mmio_gap(addr);
+
+        if (in_region(&as0, addr)) {
+                *pmiidx = asym0.slice0_asym_channel_select;
+
+                contig_base = remove_mmio_gap(as0.base);
+                contig_offset = contig_addr - contig_base;
+                contig_base_adj = (contig_base >> sym_chan_shift) *
+                                                  ((chash.sym_slice0_channel_enabled >> (*pmiidx & 1)) & 1);
+                contig_addr = contig_offset + ((sym_channels > 0) ? contig_base_adj : 0ull);
+        } else if (in_region(&as1, addr)) {
+                *pmiidx = 2u + asym1.slice1_asym_channel_select;
+
+                contig_base = remove_mmio_gap(as1.base);
+                contig_offset = contig_addr - contig_base;
+                contig_base_adj = (contig_base >> sym_chan_shift) *
+                                                  ((chash.sym_slice1_channel_enabled >> (*pmiidx & 1)) & 1);
+                contig_addr = contig_offset + ((sym_channels > 0) ? contig_base_adj : 0ull);
+        } else if (in_region(&as2, addr) && (asym_2way.asym_2way_intlv_mode == 0x3ul)) {
+                bool channel1;
+
+                mot_intlv_bit = MOT_CHAN_INTLV_BIT_1SLC_2CH;
+                *pmiidx = (asym_2way.asym_2way_intlv_mode & 1) << 1;
+                channel1 = mot_hit ? ((bool)((addr >> mot_intlv_bit) & 1)) :
+                        hash_by_mask(contig_addr, chan_hash_mask);
+                *pmiidx |= (u32)channel1;
+
+                contig_base = remove_mmio_gap(as2.base);
+                chan_intlv_bit_rm = mot_hit ? mot_intlv_bit : chan_selector;
+                contig_offset = contig_addr - contig_base;
+                remove_addr_bit(&contig_offset, chan_intlv_bit_rm);
+                contig_addr = (contig_base >> sym_chan_shift) + contig_offset;
+        } else {
+                /* Otherwise we're in normal, boring symmetric mode. */
+                *pmiidx = 0u;
+
+                if (two_slices) {
+                        bool slice1;
+
+                        if (mot_hit) {
+                                slice_intlv_bit_rm = MOT_SLC_INTLV_BIT;
+                                slice1 = (addr >> MOT_SLC_INTLV_BIT) & 1;
+                        } else {
+                                slice_intlv_bit_rm = slice_selector;
+                                slice1 = hash_by_mask(addr, slice_hash_mask);
+                        }
+
+                        *pmiidx = (u32)slice1 << 1;
+                }
+
+                if (two_channels) {
+                        bool channel1;
+
+                        mot_intlv_bit = two_slices ? MOT_CHAN_INTLV_BIT_2SLC_2CH :
+                                                        MOT_CHAN_INTLV_BIT_1SLC_2CH;
+
+                        if (mot_hit) {
+                                chan_intlv_bit_rm = mot_intlv_bit;
+                                channel1 = (addr >> mot_intlv_bit) & 1;
+                        } else {
+                                chan_intlv_bit_rm = chan_selector;
+                                channel1 = hash_by_mask(contig_addr, chan_hash_mask);
+                        }
+
+                        *pmiidx |= (u32)channel1;
+                }
+        }
+
+        /* Remove the chan_selector bit first */
+        remove_addr_bit(&contig_addr, chan_intlv_bit_rm);
+        /* Remove the slice bit (we remove it second because it must be lower */
+        remove_addr_bit(&contig_addr, slice_intlv_bit_rm);
+        *pmiaddr = contig_addr;
+
+        return 0;
+}
+
+/* Translate PMI address to memory (rank, row, bank, column) */
+#define C(n) (0x10 | (n))       /* column */
+#define B(n) (0x20 | (n))       /* bank */
+#define R(n) (0x40 | (n))       /* row */
+#define RS   (0x80)                     /* rank */
+
+/* addrdec values */
+#define AMAP_1KB        0
+#define AMAP_2KB        1
+#define AMAP_4KB        2
+#define AMAP_RSVD       3
+
+/* dden values */
+#define DEN_4Gb         0
+#define DEN_8Gb         2
+
+/* dwid values */
+#define X8              0
+#define X16             1
+
+static struct dimm_geometry {
+        u8      addrdec;
+        u8      dden;
+        u8      dwid;
+        u8      rowbits, colbits;
+        u16     bits[PMI_ADDRESS_WIDTH];
+} dimms[] = {
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_1KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  B(0),  B(1),  B(2),  R(0),
+                        R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),  R(9),
+                        R(10), C(7),  C(8),  C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_2KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  B(0),  B(1),  B(2),
+                        R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),  R(8),
+                        R(9),  R(10), C(8),  C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_4Gb, .dwid = X16,
+                .rowbits = 15, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        0,     0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_4Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_8Gb, .dwid = X16,
+                .rowbits = 16, .colbits = 10,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    R(12), R(13), R(14),
+                        R(15), 0,     0,     0
+                }
+        },
+        {
+                .addrdec = AMAP_4KB, .dden = DEN_8Gb, .dwid = X8,
+                .rowbits = 16, .colbits = 11,
+                .bits = {
+                        C(2),  C(3),  C(4),  C(5),  C(6),  C(7),  C(8),  B(0),  B(1),
+                        B(2),  R(0),  R(1),  R(2),  R(3),  R(4),  R(5),  R(6),  R(7),
+                        R(8),  R(9),  R(10), C(9),  R(11), RS,    C(11), R(12), R(13),
+                        R(14), R(15), 0,     0
+                }
+        }
+};
+
+static int bank_hash(u64 pmiaddr, int idx, int shft)
+{
+        int bhash = 0;
+
+        switch (idx) {
+        case 0:
+                bhash ^= ((pmiaddr >> (12 + shft)) ^ (pmiaddr >> (9 + shft))) & 1;
+                break;
+        case 1:
+                bhash ^= (((pmiaddr >> (10 + shft)) ^ (pmiaddr >> (8 + shft))) & 1) << 1;
+                bhash ^= ((pmiaddr >> 22) & 1) << 1;
+                break;
+        case 2:
+                bhash ^= (((pmiaddr >> (13 + shft)) ^ (pmiaddr >> (11 + shft))) & 1) << 2;
+                break;
+        }
+
+        return bhash;
+}
+
+static int rank_hash(u64 pmiaddr)
+{
+        return ((pmiaddr >> 16) ^ (pmiaddr >> 10)) & 1;
+}
+
+/* Second stage decode. Compute rank, bank, row & column. */
+static int apl_pmi2mem(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                       struct dram_addr *daddr, char *msg)
+{
+        struct d_cr_drp0 *cr_drp0 = &drp0[pmiidx];
+        struct pnd2_pvt *pvt = mci->pvt_info;
+        int g = pvt->dimm_geom[pmiidx];
+        struct dimm_geometry *d = &dimms[g];
+        int column = 0, bank = 0, row = 0, rank = 0;
+        int i, idx, type, skiprs = 0;
+
+        for (i = 0; i < PMI_ADDRESS_WIDTH; i++) {
+                int     bit = (pmiaddr >> i) & 1;
+
+                if (i + skiprs >= PMI_ADDRESS_WIDTH) {
+                        snprintf(msg, PND2_MSG_SIZE, "Bad dimm_geometry[] table\n");
+                        return -EINVAL;
+                }
+
+                type = d->bits[i + skiprs] & ~0xf;
+                idx = d->bits[i + skiprs] & 0xf;
+
+                /*
+                 * On single rank DIMMs ignore the rank select bit
+                 * and shift remainder of "bits[]" down one place.
+                 */
+                if (type == RS && (cr_drp0->rken0 + cr_drp0->rken1) == 1) {
+                        skiprs = 1;
+                        type = d->bits[i + skiprs] & ~0xf;
+                        idx = d->bits[i + skiprs] & 0xf;
+                }
+
+                switch (type) {
+                case C(0):
+                        column |= (bit << idx);
+                        break;
+                case B(0):
+                        bank |= (bit << idx);
+                        if (cr_drp0->bahen)
+                                bank ^= bank_hash(pmiaddr, idx, d->addrdec);
+                        break;
+                case R(0):
+                        row |= (bit << idx);
+                        break;
+                case RS:
+                        rank = bit;
+                        if (cr_drp0->rsien)
+                                rank ^= rank_hash(pmiaddr);
+                        break;
+                default:
+                        if (bit) {
+                                snprintf(msg, PND2_MSG_SIZE, "Bad translation\n");
+                                return -EINVAL;
+                        }
+                        goto done;
+                }
+        }
+
+done:
+        daddr->col = column;
+        daddr->bank = bank;
+        daddr->row = row;
+        daddr->rank = rank;
+        daddr->dimm = 0;
+
+        return 0;
+}
+
+/* Pluck bit "in" from pmiaddr and return value shifted to bit "out" */
+#define dnv_get_bit(pmi, in, out) ((int)(((pmi) >> (in)) & 1u) << (out))
+
+static int dnv_pmi2mem(struct mem_ctl_info *mci, u64 pmiaddr, u32 pmiidx,
+                                           struct dram_addr *daddr, char *msg)
+{
+        /* Rank 0 or 1 */
+        daddr->rank = dnv_get_bit(pmiaddr, dmap[pmiidx].rs0 + 13, 0);
+        /* Rank 2 or 3 */
+        daddr->rank |= dnv_get_bit(pmiaddr, dmap[pmiidx].rs1 + 13, 1);
+
+        /*
+         * Normally ranks 0,1 are DIMM0, and 2,3 are DIMM1, but we
+         * flip them if DIMM1 is larger than DIMM0.
+         */
+        daddr->dimm = (daddr->rank >= 2) ^ drp[pmiidx].dimmflip;
+
+        daddr->bank = dnv_get_bit(pmiaddr, dmap[pmiidx].ba0 + 6, 0);
+        daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].ba1 + 6, 1);
+        daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].bg0 + 6, 2);
+        if (dsch.ddr4en)
+                daddr->bank |= dnv_get_bit(pmiaddr, dmap[pmiidx].bg1 + 6, 3);
+        if (dmap1[pmiidx].bxor) {
+                if (dsch.ddr4en) {
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 0);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row7 + 6, 1);
+                        if (dsch.chan_width == 0)
+                                /* 64/72 bit dram channel width */
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 2);
+                        else
+                                /* 32/40 bit dram channel width */
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 2);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 3);
+                } else {
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 0);
+                        daddr->bank ^= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 1);
+                        if (dsch.chan_width == 0)
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 2);
+                        else
+                                daddr->bank ^= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 2);
+                }
+        }
+
+        daddr->row = dnv_get_bit(pmiaddr, dmap2[pmiidx].row0 + 6, 0);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row1 + 6, 1);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row2 + 6, 2);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row3 + 6, 3);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row4 + 6, 4);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap2[pmiidx].row5 + 6, 5);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row6 + 6, 6);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row7 + 6, 7);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row8 + 6, 8);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row9 + 6, 9);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row10 + 6, 10);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap3[pmiidx].row11 + 6, 11);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row12 + 6, 12);
+        daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row13 + 6, 13);
+        if (dmap4[pmiidx].row14 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row14 + 6, 14);
+        if (dmap4[pmiidx].row15 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row15 + 6, 15);
+        if (dmap4[pmiidx].row16 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row16 + 6, 16);
+        if (dmap4[pmiidx].row17 != 31)
+                daddr->row |= dnv_get_bit(pmiaddr, dmap4[pmiidx].row17 + 6, 17);
+
+        daddr->col = dnv_get_bit(pmiaddr, dmap5[pmiidx].ca3 + 6, 3);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca4 + 6, 4);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca5 + 6, 5);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca6 + 6, 6);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca7 + 6, 7);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca8 + 6, 8);
+        daddr->col |= dnv_get_bit(pmiaddr, dmap5[pmiidx].ca9 + 6, 9);
+        if (!dsch.ddr4en && dmap1[pmiidx].ca11 != 0x3f)
+                daddr->col |= dnv_get_bit(pmiaddr, dmap1[pmiidx].ca11 + 13, 11);
+
+        return 0;
+}
+
+static int check_channel(int ch)
+{
+        if (drp0[ch].dramtype != 0) {
+                pnd2_printk(KERN_INFO, "Unsupported DIMM in channel %d\n", ch);
+                return 1;
+        } else if (drp0[ch].eccen == 0) {
+                pnd2_printk(KERN_INFO, "ECC disabled on channel %d\n", ch);
+                return 1;
+        }
+        return 0;
+}
+
+static int apl_check_ecc_active(void)
+{
+        int     i, ret = 0;
+
+        /* Check dramtype and ECC mode for each present DIMM */
+        for (i = 0; i < APL_NUM_CHANNELS; i++)
+                if (chan_mask & BIT(i))
+                        ret += check_channel(i);
+        return ret ? -EINVAL : 0;
+}
+
+#define DIMMS_PRESENT(d) ((d)->rken0 + (d)->rken1 + (d)->rken2 + (d)->rken3)
+
+static int check_unit(int ch)
+{
+        struct d_cr_drp *d = &drp[ch];
+
+        if (DIMMS_PRESENT(d) && !ecc_ctrl[ch].eccen) {
+                pnd2_printk(KERN_INFO, "ECC disabled on channel %d\n", ch);
+                return 1;
+        }
+        return 0;
+}
+
+static int dnv_check_ecc_active(void)
+{
+        int     i, ret = 0;
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++)
+                ret += check_unit(i);
+        return ret ? -EINVAL : 0;
+}
+
+static int get_memory_error_data(struct mem_ctl_info *mci, u64 addr,
+                                                                 struct dram_addr *daddr, char *msg)
+{
+        u64     pmiaddr;
+        u32     pmiidx;
+        int     ret;
+
+        ret = sys2pmi(addr, &pmiidx, &pmiaddr, msg);
+        if (ret)
+                return ret;
+
+        pmiaddr >>= ops->pmiaddr_shift;
+        /* pmi channel idx to dimm channel idx */
+        pmiidx >>= ops->pmiidx_shift;
+        daddr->chan = pmiidx;
+
+        ret = ops->pmi2mem(mci, pmiaddr, pmiidx, daddr, msg);
+        if (ret)
+                return ret;
+
+        edac_dbg(0, "SysAddr=%llx PmiAddr=%llx Channel=%d DIMM=%d Rank=%d Bank=%d Row=%d Column=%d\n",
+                         addr, pmiaddr, daddr->chan, daddr->dimm, daddr->rank, daddr->bank, daddr->row, daddr->col);
+
+        return 0;
+}
+
+static void pnd2_mce_output_error(struct mem_ctl_info *mci, const struct mce *m,
+                                  struct dram_addr *daddr)
+{
+        enum hw_event_mc_err_type tp_event;
+        char *optype, msg[PND2_MSG_SIZE];
+        bool ripv = m->mcgstatus & MCG_STATUS_RIPV;
+        bool overflow = m->status & MCI_STATUS_OVER;
+        bool uc_err = m->status & MCI_STATUS_UC;
+        bool recov = m->status & MCI_STATUS_S;
+        u32 core_err_cnt = GET_BITFIELD(m->status, 38, 52);
+        u32 mscod = GET_BITFIELD(m->status, 16, 31);
+        u32 errcode = GET_BITFIELD(m->status, 0, 15);
+        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
+        int rc;
+
+        tp_event = uc_err ? (ripv ? HW_EVENT_ERR_FATAL : HW_EVENT_ERR_UNCORRECTED) :
+                                                 HW_EVENT_ERR_CORRECTED;
+
+        /*
+         * According with Table 15-9 of the Intel Architecture spec vol 3A,
+         * memory errors should fit in this mask:
+         *      000f 0000 1mmm cccc (binary)
+         * where:
+         *      f = Correction Report Filtering Bit. If 1, subsequent errors
+         *          won't be shown
+         *      mmm = error type
+         *      cccc = channel
+         * If the mask doesn't match, report an error to the parsing logic
+         */
+        if (!((errcode & 0xef80) == 0x80)) {
+                optype = "Can't parse: it is not a mem";
+        } else {
+                switch (optypenum) {
+                case 0:
+                        optype = "generic undef request error";
+                        break;
+                case 1:
+                        optype = "memory read error";
+                        break;
+                case 2:
+                        optype = "memory write error";
+                        break;
+                case 3:
+                        optype = "addr/cmd error";
+                        break;
+                case 4:
+                        optype = "memory scrubbing error";
+                        break;
+                default:
+                        optype = "reserved";
+                        break;
+                }
+        }
+
+        /* Only decode errors with an valid address (ADDRV) */
+        if (!(m->status & MCI_STATUS_ADDRV))
+                return;
+
+        rc = get_memory_error_data(mci, m->addr, daddr, msg);
+        if (rc)
+                goto address_error;
+
+        snprintf(msg, sizeof(msg),
+                 "%s%s err_code:%04x:%04x channel:%d DIMM:%d rank:%d row:%d bank:%d col:%d",
+                 overflow ? " OVERFLOW" : "", (uc_err && recov) ? " recoverable" : "", mscod,
+                 errcode, daddr->chan, daddr->dimm, daddr->rank, daddr->row, daddr->bank, daddr->col);
+
+        edac_dbg(0, "%s\n", msg);
+
+        /* Call the helper to output message */
+        edac_mc_handle_error(tp_event, mci, core_err_cnt, m->addr >> PAGE_SHIFT,
+                                                 m->addr & ~PAGE_MASK, 0, daddr->chan, daddr->dimm, -1, optype, msg);
+
+        return;
+
+address_error:
+        edac_mc_handle_error(tp_event, mci, core_err_cnt, 0, 0, 0, -1, -1, -1, msg, "");
+}
+
+static void apl_get_dimm_config(struct mem_ctl_info *mci)
+{
+        struct pnd2_pvt *pvt = mci->pvt_info;
+        struct dimm_info *dimm;
+        struct d_cr_drp0 *d;
+        u64     capacity;
+        int     i, g;
+
+        for (i = 0; i < APL_NUM_CHANNELS; i++) {
+                if (!(chan_mask & BIT(i)))
+                        continue;
+
+                dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, mci->n_layers, i, 0, 0);
+                if (!dimm) {
+                        edac_dbg(0, "No allocated DIMM for channel %d\n", i);
+                        continue;
+                }
+
+                d = &drp0[i];
+                for (g = 0; g < ARRAY_SIZE(dimms); g++)
+                        if (dimms[g].addrdec == d->addrdec &&
+                            dimms[g].dden == d->dden &&
+                            dimms[g].dwid == d->dwid)
+                                break;
+
+                if (g == ARRAY_SIZE(dimms)) {
+                        edac_dbg(0, "Channel %d: unrecognized DIMM\n", i);
+                        continue;
+                }
+
+                pvt->dimm_geom[i] = g;
+                capacity = (d->rken0 + d->rken1) * 8 * (1ul << dimms[g].rowbits) *
+                                   (1ul << dimms[g].colbits);
+                edac_dbg(0, "Channel %d: %lld MByte DIMM\n", i, capacity >> (20 - 3));
+                dimm->nr_pages = MiB_TO_PAGES(capacity >> (20 - 3));
+                dimm->grain = 32;
+                dimm->dtype = (d->dwid == 0) ? DEV_X8 : DEV_X16;
+                dimm->mtype = MEM_DDR3;
+                dimm->edac_mode = EDAC_SECDED;
+                snprintf(dimm->label, sizeof(dimm->label), "Slice#%d_Chan#%d", i / 2, i % 2);
+        }
+}
+
+static const int dnv_dtypes[] = {
+        DEV_X8, DEV_X4, DEV_X16, DEV_UNKNOWN
+};
+
+static void dnv_get_dimm_config(struct mem_ctl_info *mci)
+{
+        int     i, j, ranks_of_dimm[DNV_MAX_DIMMS], banks, rowbits, colbits, memtype;
+        struct dimm_info *dimm;
+        struct d_cr_drp *d;
+        u64     capacity;
+
+        if (dsch.ddr4en) {
+                memtype = MEM_DDR4;
+                banks = 16;
+                colbits = 10;
+        } else {
+                memtype = MEM_DDR3;
+                banks = 8;
+        }
+
+        for (i = 0; i < DNV_NUM_CHANNELS; i++) {
+                if (dmap4[i].row14 == 31)
+                        rowbits = 14;
+                else if (dmap4[i].row15 == 31)
+                        rowbits = 15;
+                else if (dmap4[i].row16 == 31)
+                        rowbits = 16;
+                else if (dmap4[i].row17 == 31)
+                        rowbits = 17;
+                else
+                        rowbits = 18;
+
+                if (memtype == MEM_DDR3) {
+                        if (dmap1[i].ca11 != 0x3f)
+                                colbits = 12;
+                        else
+                                colbits = 10;
+                }
+
+                d = &drp[i];
+                /* DIMM0 is present if rank0 and/or rank1 is enabled */
+                ranks_of_dimm[0] = d->rken0 + d->rken1;
+                /* DIMM1 is present if rank2 and/or rank3 is enabled */
+                ranks_of_dimm[1] = d->rken2 + d->rken3;
+
+                for (j = 0; j < DNV_MAX_DIMMS; j++) {
+                        if (!ranks_of_dimm[j])
+                                continue;
+
+                        dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, mci->n_layers, i, j, 0);
+                        if (!dimm) {
+                                edac_dbg(0, "No allocated DIMM for channel %d DIMM %d\n", i, j);
+                                continue;
+                        }
+
+                        capacity = ranks_of_dimm[j] * banks * (1ul << rowbits) * (1ul << colbits);
+                        edac_dbg(0, "Channel %d DIMM %d: %lld MByte DIMM\n", i, j, capacity >> (20 - 3));
+                        dimm->nr_pages = MiB_TO_PAGES(capacity >> (20 - 3));
+                        dimm->grain = 32;
+                        dimm->dtype = dnv_dtypes[j ? d->dimmdwid0 : d->dimmdwid1];
+                        dimm->mtype = memtype;
+                        dimm->edac_mode = EDAC_SECDED;
+                        snprintf(dimm->label, sizeof(dimm->label), "Chan#%d_DIMM#%d", i, j);
+                }
+        }
+}
+
+static int pnd2_register_mci(struct mem_ctl_info **ppmci)
+{
+        struct edac_mc_layer layers[2];
+        struct mem_ctl_info *mci;
+        struct pnd2_pvt *pvt;
+        int rc;
+
+        rc = ops->check_ecc();
+        if (rc < 0)
+                return rc;
+
+        /* Allocate a new MC control structure */
+        layers[0].type = EDAC_MC_LAYER_CHANNEL;
+        layers[0].size = ops->channels;
+        layers[0].is_virt_csrow = false;
+        layers[1].type = EDAC_MC_LAYER_SLOT;
+        layers[1].size = ops->dimms_per_channel;
+        layers[1].is_virt_csrow = true;
+        mci = edac_mc_alloc(0, ARRAY_SIZE(layers), layers, sizeof(*pvt));
+        if (!mci)
+                return -ENOMEM;
+
+        pvt = mci->pvt_info;
+        memset(pvt, 0, sizeof(*pvt));
+
+        mci->mod_name = "pnd2_edac.c";
+        mci->dev_name = ops->name;
+        mci->ctl_name = "Pondicherry2";
+
+        /* Get dimm basic config and the memory layout */
+        ops->get_dimm_config(mci);
+
+        if (edac_mc_add_mc(mci)) {
+                edac_dbg(0, "MC: failed edac_mc_add_mc()\n");
+                edac_mc_free(mci);
+                return -EINVAL;
+        }
+
+        *ppmci = mci;
+
+        return 0;
+}
+
+static void pnd2_unregister_mci(struct mem_ctl_info *mci)
+{
+        if (unlikely(!mci || !mci->pvt_info)) {
+                pnd2_printk(KERN_ERR, "Couldn't find mci handler\n");
+                return;
+        }
+
+        /* Remove MC sysfs nodes */
+        edac_mc_del_mc(NULL);
+        edac_dbg(1, "%s: free mci struct\n", mci->ctl_name);
+        edac_mc_free(mci);
+}
+
+/*
+ * Callback function registered with core kernel mce code.
+ * Called once for each logged error.
+ */
+static int pnd2_mce_check_error(struct notifier_block *nb, unsigned long val, void *data)
+{
+        struct mce *mce = (struct mce *)data;
+        struct mem_ctl_info *mci;
+        struct dram_addr daddr;
+        char *type;
+
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
+
+        mci = pnd2_mci;
+        if (!mci)
+                return NOTIFY_DONE;
+
+        /*
+         * Just let mcelog handle it if the error is
+         * outside the memory controller. A memory error
+         * is indicated by bit 7 = 1 and bits = 8-11,13-15 = 0.
+         * bit 12 has an special meaning.
+         */
+        if ((mce->status & 0xefff) >> 7 != 1)
+                return NOTIFY_DONE;
+
+        if (mce->mcgstatus & MCG_STATUS_MCIP)
+                type = "Exception";
+        else
+                type = "Event";
+
+        pnd2_mc_printk(mci, KERN_INFO, "HANDLING MCE MEMORY ERROR\n");
+        pnd2_mc_printk(mci, KERN_INFO, "CPU %u: Machine Check %s: %llx Bank %u: %llx\n",
+                                   mce->extcpu, type, mce->mcgstatus, mce->bank, mce->status);
+        pnd2_mc_printk(mci, KERN_INFO, "TSC %llx ", mce->tsc);
+        pnd2_mc_printk(mci, KERN_INFO, "ADDR %llx ", mce->addr);
+        pnd2_mc_printk(mci, KERN_INFO, "MISC %llx ", mce->misc);
+        pnd2_mc_printk(mci, KERN_INFO, "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x\n",
+                                   mce->cpuvendor, mce->cpuid, mce->time, mce->socketid, mce->apicid);
+
+        pnd2_mce_output_error(mci, mce, &daddr);
+
+        /* Advice mcelog that the error were handled */
+        return NOTIFY_STOP;
+}
+
+static struct notifier_block pnd2_mce_dec = {
+        .notifier_call  = pnd2_mce_check_error,
+};
+
+#ifdef CONFIG_EDAC_DEBUG
+/*
+ * Write an address to this file to exercise the address decode
+ * logic in this driver.
+ */
+static u64 pnd2_fake_addr;
+#define PND2_BLOB_SIZE 1024
+static char pnd2_result[PND2_BLOB_SIZE];
+static struct dentry *pnd2_test;
+static struct debugfs_blob_wrapper pnd2_blob = {
+        .data = pnd2_result,
+        .size = 0
+};
+
+static int debugfs_u64_set(void *data, u64 val)
+{
+        struct dram_addr daddr;
+        struct mce m;
+
+        *(u64 *)data = val;
+        m.mcgstatus = 0;
+        /* ADDRV + MemRd + Unknown channel */
+        m.status = MCI_STATUS_ADDRV + 0x9f;
+        m.addr = val;
+        pnd2_mce_output_error(pnd2_mci, &m, &daddr);
+        snprintf(pnd2_blob.data, PND2_BLOB_SIZE,
+                         "SysAddr=%llx Channel=%d DIMM=%d Rank=%d Bank=%d Row=%d Column=%d\n",
+                         m.addr, daddr.chan, daddr.dimm, daddr.rank, daddr.bank, daddr.row, daddr.col);
+        pnd2_blob.size = strlen(pnd2_blob.data);
+
+        return 0;
+}
+DEFINE_DEBUGFS_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+static void setup_pnd2_debug(void)
+{
+        pnd2_test = edac_debugfs_create_dir("pnd2_test");
+        edac_debugfs_create_file("pnd2_debug_addr", 0200, pnd2_test,
+                                                         &pnd2_fake_addr, &fops_u64_wo);
+        debugfs_create_blob("pnd2_debug_results", 0400, pnd2_test, &pnd2_blob);
+}
+
+static void teardown_pnd2_debug(void)
+{
+        debugfs_remove_recursive(pnd2_test);
+}
+#else
+static void setup_pnd2_debug(void)      {}
+static void teardown_pnd2_debug(void)   {}
+#endif /* CONFIG_EDAC_DEBUG */
+
+
+static int pnd2_probe(void)
+{
+        int rc;
+
+        edac_dbg(2, "\n");
+        rc = get_registers();
+        if (rc)
+                return rc;
+
+        return pnd2_register_mci(&pnd2_mci);
+}
+
+static void pnd2_remove(void)
+{
+        edac_dbg(0, "\n");
+        pnd2_unregister_mci(pnd2_mci);
+}
+
+static struct dunit_ops apl_ops = {
+                .name                   = "pnd2/apl",
+                .type                   = APL,
+                .pmiaddr_shift          = LOG2_PMI_ADDR_GRANULARITY,
+                .pmiidx_shift           = 0,
+                .channels               = APL_NUM_CHANNELS,
+                .dimms_per_channel      = 1,
+                .rd_reg                 = apl_rd_reg,
+                .get_registers          = apl_get_registers,
+                .check_ecc              = apl_check_ecc_active,
+                .mk_region              = apl_mk_region,
+                .get_dimm_config        = apl_get_dimm_config,
+                .pmi2mem                = apl_pmi2mem,
+};
+
+static struct dunit_ops dnv_ops = {
+                .name                   = "pnd2/dnv",
+                .type                   = DNV,
+                .pmiaddr_shift          = 0,
+                .pmiidx_shift           = 1,
+                .channels               = DNV_NUM_CHANNELS,
+                .dimms_per_channel      = 2,
+                .rd_reg                 = dnv_rd_reg,
+                .get_registers          = dnv_get_registers,
+                .check_ecc              = dnv_check_ecc_active,
+                .mk_region              = dnv_mk_region,
+                .get_dimm_config        = dnv_get_dimm_config,
+                .pmi2mem                = dnv_pmi2mem,
+};
+
+static const struct x86_cpu_id pnd2_cpuids[] = {
+        { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT, 0, (kernel_ulong_t)&apl_ops },
+        { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON, 0, (kernel_ulong_t)&dnv_ops },
+        { }
+};
+MODULE_DEVICE_TABLE(x86cpu, pnd2_cpuids);
+
+static int __init pnd2_init(void)
+{
+        const struct x86_cpu_id *id;
+        int rc;
+
+        edac_dbg(2, "\n");
+
+        id = x86_match_cpu(pnd2_cpuids);
+        if (!id)
+                return -ENODEV;
+
+        ops = (struct dunit_ops *)id->driver_data;
+
+        /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+        opstate_init();
+
+        rc = pnd2_probe();
+        if (rc < 0) {
+                pnd2_printk(KERN_ERR, "Failed to register device with error %d.\n", rc);
+                return rc;
+        }
+
+        if (!pnd2_mci)
+                return -ENODEV;
+
+        mce_register_decode_chain(&pnd2_mce_dec);
+        setup_pnd2_debug();
+
+        return 0;
+}
+
+static void __exit pnd2_exit(void)
+{
+        edac_dbg(2, "\n");
+        teardown_pnd2_debug();
+        mce_unregister_decode_chain(&pnd2_mce_dec);
+        pnd2_remove();
+}
+
+module_init(pnd2_init);
+module_exit(pnd2_exit);
+
+module_param(edac_op_state, int, 0444);
+MODULE_PARM_DESC(edac_op_state, "EDAC Error Reporting state: 0=Poll,1=NMI");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel SoC using Pondicherry memory controller");
diff --git a/drivers/edac/pnd2_edac.h b/drivers/edac/pnd2_edac.h
new file mode 100644
index 000000000000..61b6e79492bb
--- /dev/null
+++ b/drivers/edac/pnd2_edac.h
@@ -0,0 +1,301 @@
+/*
+ * Register bitfield descriptions for Pondicherry2 memory controller.
+ *
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#ifndef _PND2_REGS_H
+#define _PND2_REGS_H
+
+struct b_cr_touud_lo_pci {
+        u32     lock : 1;
+        u32     reserved_1 : 19;
+        u32     touud : 12;
+};
+
+#define b_cr_touud_lo_pci_port 0x4c
+#define b_cr_touud_lo_pci_offset 0xa8
+#define b_cr_touud_lo_pci_r_opcode 0x04
+
+struct b_cr_touud_hi_pci {
+        u32     touud : 7;
+        u32     reserved_0 : 25;
+};
+
+#define b_cr_touud_hi_pci_port 0x4c
+#define b_cr_touud_hi_pci_offset 0xac
+#define b_cr_touud_hi_pci_r_opcode 0x04
+
+struct b_cr_tolud_pci {
+        u32     lock : 1;
+        u32     reserved_0 : 19;
+        u32     tolud : 12;
+};
+
+#define b_cr_tolud_pci_port 0x4c
+#define b_cr_tolud_pci_offset 0xbc
+#define b_cr_tolud_pci_r_opcode 0x04
+
+struct b_cr_mchbar_lo_pci {
+        u32 enable : 1;
+        u32 pad_3_1 : 3;
+        u32 pad_14_4: 11;
+        u32 base: 17;
+};
+
+struct b_cr_mchbar_hi_pci {
+        u32 base : 7;
+        u32 pad_31_7 : 25;
+};
+
+/* Symmetric region */
+struct b_cr_slice_channel_hash {
+        u64     slice_1_disabled : 1;
+        u64     hvm_mode : 1;
+        u64     interleave_mode : 2;
+        u64     slice_0_mem_disabled : 1;
+        u64     reserved_0 : 1;
+        u64     slice_hash_mask : 14;
+        u64     reserved_1 : 11;
+        u64     enable_pmi_dual_data_mode : 1;
+        u64     ch_1_disabled : 1;
+        u64     reserved_2 : 1;
+        u64     sym_slice0_channel_enabled : 2;
+        u64     sym_slice1_channel_enabled : 2;
+        u64     ch_hash_mask : 14;
+        u64     reserved_3 : 11;
+        u64     lock : 1;
+};
+
+#define b_cr_slice_channel_hash_port 0x4c
+#define b_cr_slice_channel_hash_offset 0x4c58
+#define b_cr_slice_channel_hash_r_opcode 0x06
+
+struct b_cr_mot_out_base_mchbar {
+        u32     reserved_0 : 14;
+        u32     mot_out_base : 15;
+        u32     reserved_1 : 1;
+        u32     tr_en : 1;
+        u32     imr_en : 1;
+};
+
+#define b_cr_mot_out_base_mchbar_port 0x4c
+#define b_cr_mot_out_base_mchbar_offset 0x6af0
+#define b_cr_mot_out_base_mchbar_r_opcode 0x00
+
+struct b_cr_mot_out_mask_mchbar {
+        u32     reserved_0 : 14;
+        u32     mot_out_mask : 15;
+        u32     reserved_1 : 1;
+        u32     ia_iwb_en : 1;
+        u32     gt_iwb_en : 1;
+};
+
+#define b_cr_mot_out_mask_mchbar_port 0x4c
+#define b_cr_mot_out_mask_mchbar_offset 0x6af4
+#define b_cr_mot_out_mask_mchbar_r_opcode 0x00
+
+struct b_cr_asym_mem_region0_mchbar {
+        u32     pad : 4;
+        u32     slice0_asym_base : 11;
+        u32     pad_18_15 : 4;
+        u32     slice0_asym_limit : 11;
+        u32     slice0_asym_channel_select : 1;
+        u32     slice0_asym_enable : 1;
+};
+
+#define b_cr_asym_mem_region0_mchbar_port 0x4c
+#define b_cr_asym_mem_region0_mchbar_offset 0x6e40
+#define b_cr_asym_mem_region0_mchbar_r_opcode 0x00
+
+struct b_cr_asym_mem_region1_mchbar {
+        u32     pad : 4;
+        u32     slice1_asym_base : 11;
+        u32     pad_18_15 : 4;
+        u32     slice1_asym_limit : 11;
+        u32     slice1_asym_channel_select : 1;
+        u32     slice1_asym_enable : 1;
+};
+
+#define b_cr_asym_mem_region1_mchbar_port 0x4c
+#define b_cr_asym_mem_region1_mchbar_offset 0x6e44
+#define b_cr_asym_mem_region1_mchbar_r_opcode 0x00
+
+/* Some bit fields moved in above two structs on Denverton */
+struct b_cr_asym_mem_region_denverton {
+        u32     pad : 4;
+        u32     slice_asym_base : 8;
+        u32     pad_19_12 : 8;
+        u32     slice_asym_limit : 8;
+        u32     pad_28_30 : 3;
+        u32     slice_asym_enable : 1;
+};
+
+struct b_cr_asym_2way_mem_region_mchbar {
+        u32     pad : 2;
+        u32     asym_2way_intlv_mode : 2;
+        u32     asym_2way_base : 11;
+        u32     pad_16_15 : 2;
+        u32     asym_2way_limit : 11;
+        u32     pad_30_28 : 3;
+        u32     asym_2way_interleave_enable : 1;
+};
+
+#define b_cr_asym_2way_mem_region_mchbar_port 0x4c
+#define b_cr_asym_2way_mem_region_mchbar_offset 0x6e50
+#define b_cr_asym_2way_mem_region_mchbar_r_opcode 0x00
+
+/* Apollo Lake d-unit */
+
+struct d_cr_drp0 {
+        u32     rken0 : 1;
+        u32     rken1 : 1;
+        u32     ddmen : 1;
+        u32     rsvd3 : 1;
+        u32     dwid : 2;
+        u32     dden : 3;
+        u32     rsvd13_9 : 5;
+        u32     rsien : 1;
+        u32     bahen : 1;
+        u32     rsvd18_16 : 3;
+        u32     caswizzle : 2;
+        u32     eccen : 1;
+        u32     dramtype : 3;
+        u32     blmode : 3;
+        u32     addrdec : 2;
+        u32     dramdevice_pr : 2;
+};
+
+#define d_cr_drp0_offset 0x1400
+#define d_cr_drp0_r_opcode 0x00
+
+/* Denverton d-unit */
+
+struct d_cr_dsch {
+        u32     ch0en : 1;
+        u32     ch1en : 1;
+        u32     ddr4en : 1;
+        u32     coldwake : 1;
+        u32     newbypdis : 1;
+        u32     chan_width : 1;
+        u32     rsvd6_6 : 1;
+        u32     ooodis : 1;
+        u32     rsvd18_8 : 11;
+        u32     ic : 1;
+        u32     rsvd31_20 : 12;
+};
+
+#define d_cr_dsch_port 0x16
+#define d_cr_dsch_offset 0x0
+#define d_cr_dsch_r_opcode 0x0
+
+struct d_cr_ecc_ctrl {
+        u32     eccen : 1;
+        u32     rsvd31_1 : 31;
+};
+
+#define d_cr_ecc_ctrl_offset 0x180
+#define d_cr_ecc_ctrl_r_opcode 0x0
+
+struct d_cr_drp {
+        u32     rken0 : 1;
+        u32     rken1 : 1;
+        u32     rken2 : 1;
+        u32     rken3 : 1;
+        u32     dimmdwid0 : 2;
+        u32     dimmdden0 : 2;
+        u32     dimmdwid1 : 2;
+        u32     dimmdden1 : 2;
+        u32     rsvd15_12 : 4;
+        u32     dimmflip : 1;
+        u32     rsvd31_17 : 15;
+};
+
+#define d_cr_drp_offset 0x158
+#define d_cr_drp_r_opcode 0x0
+
+struct d_cr_dmap {
+        u32     ba0 : 5;
+        u32     ba1 : 5;
+        u32     bg0 : 5; /* if ddr3, ba2 = bg0 */
+        u32     bg1 : 5; /* if ddr3, ba3 = bg1 */
+        u32     rs0 : 5;
+        u32     rs1 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap_offset 0x174
+#define d_cr_dmap_r_opcode 0x0
+
+struct d_cr_dmap1 {
+        u32     ca11 : 6;
+        u32     bxor : 1;
+        u32     rsvd : 25;
+};
+
+#define d_cr_dmap1_offset 0xb4
+#define d_cr_dmap1_r_opcode 0x0
+
+struct d_cr_dmap2 {
+        u32     row0 : 5;
+        u32     row1 : 5;
+        u32     row2 : 5;
+        u32     row3 : 5;
+        u32     row4 : 5;
+        u32     row5 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap2_offset 0x148
+#define d_cr_dmap2_r_opcode 0x0
+
+struct d_cr_dmap3 {
+        u32     row6 : 5;
+        u32     row7 : 5;
+        u32     row8 : 5;
+        u32     row9 : 5;
+        u32     row10 : 5;
+        u32     row11 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap3_offset 0x14c
+#define d_cr_dmap3_r_opcode 0x0
+
+struct d_cr_dmap4 {
+        u32     row12 : 5;
+        u32     row13 : 5;
+        u32     row14 : 5;
+        u32     row15 : 5;
+        u32     row16 : 5;
+        u32     row17 : 5;
+        u32     rsvd : 2;
+};
+
+#define d_cr_dmap4_offset 0x150
+#define d_cr_dmap4_r_opcode 0x0
+
+struct d_cr_dmap5 {
+        u32     ca3 : 4;
+        u32     ca4 : 4;
+        u32     ca5 : 4;
+        u32     ca6 : 4;
+        u32     ca7 : 4;
+        u32     ca8 : 4;
+        u32     ca9 : 4;
+        u32     rsvd : 4;
+};
+
+#define d_cr_dmap5_offset 0x154
+#define d_cr_dmap5_r_opcode 0x0
+
+#endif /* _PND2_REGS_H */
diff --git a/drivers/edac/xgene_edac.c b/drivers/edac/xgene_edac.c
index 6c270d9d304a..669246056812 100644
--- a/drivers/edac/xgene_edac.c
+++ b/drivers/edac/xgene_edac.c
@@ -1596,7 +1596,7 @@ static void xgene_edac_pa_report(struct edac_device_ctl_info *edac_dev)
         reg = readl(ctx->dev_csr + IOBPATRANSERRINTSTS);
         if (!reg)
                 goto chk_iob_axi0;
-        dev_err(edac_dev->dev, "IOB procesing agent (PA) transaction error\n");
+        dev_err(edac_dev->dev, "IOB processing agent (PA) transaction error\n");
         if (reg & IOBPA_RDATA_CORRUPT_MASK)
                 dev_err(edac_dev->dev, "IOB PA read data RAM error\n");
         if (reg & IOBPA_M_RDATA_CORRUPT_MASK)
diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig
index 96bbae579c0b..fc09c76248b4 100644
--- a/drivers/extcon/Kconfig
+++ b/drivers/extcon/Kconfig
@@ -44,7 +44,7 @@ config EXTCON_GPIO
 
 config EXTCON_INTEL_INT3496
         tristate "Intel INT3496 ACPI device extcon driver"
-        depends on GPIOLIB && ACPI
+        depends on GPIOLIB && ACPI && (X86 || COMPILE_TEST)
         help
           Say Y here to enable extcon support for USB OTG ports controlled by
           an Intel INT3496 ACPI device.
diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
index a3131b036de6..9d17984bbbd4 100644
--- a/drivers/extcon/extcon-intel-int3496.c
+++ b/drivers/extcon/extcon-intel-int3496.c
@@ -45,6 +45,17 @@ static const unsigned int int3496_cable[] = {
         EXTCON_NONE,
 };
 
+static const struct acpi_gpio_params id_gpios = { INT3496_GPIO_USB_ID, 0, false };
+static const struct acpi_gpio_params vbus_gpios = { INT3496_GPIO_VBUS_EN, 0, false };
+static const struct acpi_gpio_params mux_gpios = { INT3496_GPIO_USB_MUX, 0, false };
+
+static const struct acpi_gpio_mapping acpi_int3496_default_gpios[] = {
+        { "id-gpios", &id_gpios, 1 },
+        { "vbus-gpios", &vbus_gpios, 1 },
+        { "mux-gpios", &mux_gpios, 1 },
+        { },
+};
+
 static void int3496_do_usb_id(struct work_struct *work)
 {
         struct int3496_data *data =
@@ -83,6 +94,13 @@ static int int3496_probe(struct platform_device *pdev)
         struct int3496_data *data;
         int ret;
 
+        ret = acpi_dev_add_driver_gpios(ACPI_COMPANION(dev),
+                                        acpi_int3496_default_gpios);
+        if (ret) {
+                dev_err(dev, "can't add GPIO ACPI mapping\n");
+                return ret;
+        }
+
         data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -90,30 +108,27 @@ static int int3496_probe(struct platform_device *pdev)
         data->dev = dev;
         INIT_DELAYED_WORK(&data->work, int3496_do_usb_id);
 
-        data->gpio_usb_id = devm_gpiod_get_index(dev, "id",
-                                                INT3496_GPIO_USB_ID,
-                                                GPIOD_IN);
+        data->gpio_usb_id = devm_gpiod_get(dev, "id", GPIOD_IN);
         if (IS_ERR(data->gpio_usb_id)) {
                 ret = PTR_ERR(data->gpio_usb_id);
                 dev_err(dev, "can't request USB ID GPIO: %d\n", ret);
                 return ret;
+        } else if (gpiod_get_direction(data->gpio_usb_id) != GPIOF_DIR_IN) {
+                dev_warn(dev, FW_BUG "USB ID GPIO not in input mode, fixing\n");
+                gpiod_direction_input(data->gpio_usb_id);
         }
 
         data->usb_id_irq = gpiod_to_irq(data->gpio_usb_id);
-        if (data->usb_id_irq <= 0) {
+        if (data->usb_id_irq < 0) {
                 dev_err(dev, "can't get USB ID IRQ: %d\n", data->usb_id_irq);
-                return -EINVAL;
+                return data->usb_id_irq;
         }
 
-        data->gpio_vbus_en = devm_gpiod_get_index(dev, "vbus en",
-                                                 INT3496_GPIO_VBUS_EN,
-                                                 GPIOD_ASIS);
+        data->gpio_vbus_en = devm_gpiod_get(dev, "vbus", GPIOD_ASIS);
         if (IS_ERR(data->gpio_vbus_en))
                 dev_info(dev, "can't request VBUS EN GPIO\n");
 
-        data->gpio_usb_mux = devm_gpiod_get_index(dev, "usb mux",
-                                                 INT3496_GPIO_USB_MUX,
-                                                 GPIOD_ASIS);
+        data->gpio_usb_mux = devm_gpiod_get(dev, "mux", GPIOD_ASIS);
         if (IS_ERR(data->gpio_usb_mux))
                 dev_info(dev, "can't request USB MUX GPIO\n");
 
@@ -154,6 +169,8 @@ static int int3496_remove(struct platform_device *pdev)
         devm_free_irq(&pdev->dev, data->usb_id_irq, data);
         cancel_delayed_work_sync(&data->work);
 
+        acpi_dev_remove_driver_gpios(ACPI_COMPANION(&pdev->dev));
+
         return 0;
 }
 
diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
index 349dc3e1e52e..974c5a31a005 100644
--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -65,6 +65,7 @@ static bool __init efi_virtmap_init(void)
         bool systab_found;
 
         efi_mm.pgd = pgd_alloc(&efi_mm);
+        mm_init_cpumask(&efi_mm);
         init_new_context(NULL, &efi_mm);
 
         systab_found = false;
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index e7d404059b73..b372aad3b449 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -389,7 +389,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md)
                         return 0;
                 }
         }
-        pr_err_once("requested map not found.\n");
         return -ENOENT;
 }
 
diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index 08b026864d4e..8554d7aec31c 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -254,7 +254,7 @@ void __init efi_esrt_init(void)
 
         rc = efi_mem_desc_lookup(efi.esrt, &md);
         if (rc < 0) {
-                pr_err("ESRT header is not in the memory map.\n");
+                pr_warn("ESRT header is not in the memory map.\n");
                 return;
         }
 
diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
index 932742e4cf23..24c461dea7af 100644
--- a/drivers/firmware/efi/libstub/gop.c
+++ b/drivers/firmware/efi/libstub/gop.c
@@ -149,7 +149,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
 
                 status = __gop_query32(sys_table_arg, gop32, &info, &size,
                                        &current_fb_base);
-                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+                if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+                    info->pixel_format != PIXEL_BLT_ONLY) {
                         /*
                          * Systems that use the UEFI Console Splitter may
                          * provide multiple GOP devices, not all of which are
@@ -266,7 +267,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
 
                 status = __gop_query64(sys_table_arg, gop64, &info, &size,
                                        &current_fb_base);
-                if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+                if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+                    info->pixel_format != PIXEL_BLT_ONLY) {
                         /*
                          * Systems that use the UEFI Console Splitter may
                          * provide multiple GOP devices, not all of which are
diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c
index 6def402bf569..5da36e56b36a 100644
--- a/drivers/firmware/efi/libstub/secureboot.c
+++ b/drivers/firmware/efi/libstub/secureboot.c
@@ -45,6 +45,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
         size = sizeof(secboot);
         status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
                              NULL, &size, &secboot);
+        if (status == EFI_NOT_FOUND)
+                return efi_secureboot_mode_disabled;
         if (status != EFI_SUCCESS)
                 goto out_efi_err;
 
@@ -78,7 +80,5 @@ secure_boot_enabled:
 
 out_efi_err:
         pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n");
-        if (status == EFI_NOT_FOUND)
-                return efi_secureboot_mode_disabled;
         return efi_secureboot_mode_unknown;
 }
diff --git a/drivers/gpio/gpio-altera-a10sr.c b/drivers/gpio/gpio-altera-a10sr.c
index 9e1a138fed53..16a8951b2bed 100644
--- a/drivers/gpio/gpio-altera-a10sr.c
+++ b/drivers/gpio/gpio-altera-a10sr.c
@@ -96,7 +96,7 @@ static int altr_a10sr_gpio_probe(struct platform_device *pdev)
         gpio->regmap = a10sr->regmap;
 
         gpio->gp = altr_a10sr_gc;
-
+        gpio->gp.parent = pdev->dev.parent;
         gpio->gp.of_node = pdev->dev.of_node;
 
         ret = devm_gpiochip_add_data(&pdev->dev, &gpio->gp, gpio);
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 5bddbd507ca9..3fe6a21e05a5 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -90,21 +90,18 @@ static int altera_gpio_irq_set_type(struct irq_data *d,
 
         altera_gc = gpiochip_get_data(irq_data_get_irq_chip_data(d));
 
-        if (type == IRQ_TYPE_NONE)
+        if (type == IRQ_TYPE_NONE) {
+                irq_set_handler_locked(d, handle_bad_irq);
                 return 0;
-        if (type == IRQ_TYPE_LEVEL_HIGH &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_LEVEL_HIGH)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_RISING &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_RISING)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_FALLING &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_FALLING)
-                return 0;
-        if (type == IRQ_TYPE_EDGE_BOTH &&
-                altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_BOTH)
+        }
+        if (type == altera_gc->interrupt_trigger) {
+                if (type == IRQ_TYPE_LEVEL_HIGH)
+                        irq_set_handler_locked(d, handle_level_irq);
+                else
+                        irq_set_handler_locked(d, handle_simple_irq);
                 return 0;
-
+        }
+        irq_set_handler_locked(d, handle_bad_irq);
         return -EINVAL;
 }
 
@@ -230,7 +227,6 @@ static void altera_gpio_irq_edge_handler(struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
-
 static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc)
 {
         struct altera_gpio_chip *altera_gc;
@@ -310,7 +306,7 @@ static int altera_gpio_probe(struct platform_device *pdev)
         altera_gc->interrupt_trigger = reg;
 
         ret = gpiochip_irqchip_add(&altera_gc->mmchip.gc, &altera_irq_chip, 0,
-                handle_simple_irq, IRQ_TYPE_NONE);
+                handle_bad_irq, IRQ_TYPE_NONE);
 
         if (ret) {
                 dev_err(&pdev->dev, "could not add irqchip\n");
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index bdb692345428..2a57d024481d 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -270,8 +270,10 @@ mcp23s08_direction_output(struct gpio_chip *chip, unsigned offset, int value)
 static irqreturn_t mcp23s08_irq(int irq, void *data)
 {
         struct mcp23s08 *mcp = data;
-        int intcap, intf, i;
+        int intcap, intf, i, gpio, gpio_orig, intcap_mask;
         unsigned int child_irq;
+        bool intf_set, intcap_changed, gpio_bit_changed,
+                defval_changed, gpio_set;
 
         mutex_lock(&mcp->lock);
         if (mcp_read(mcp, MCP_INTF, &intf) < 0) {
@@ -287,14 +289,67 @@ static irqreturn_t mcp23s08_irq(int irq, void *data)
         }
 
         mcp->cache[MCP_INTCAP] = intcap;
+
+        /* This clears the interrupt(configurable on S18) */
+        if (mcp_read(mcp, MCP_GPIO, &gpio) < 0) {
+                mutex_unlock(&mcp->lock);
+                return IRQ_HANDLED;
+        }
+        gpio_orig = mcp->cache[MCP_GPIO];
+        mcp->cache[MCP_GPIO] = gpio;
         mutex_unlock(&mcp->lock);
 
+        if (mcp->cache[MCP_INTF] == 0) {
+                /* There is no interrupt pending */
+                return IRQ_HANDLED;
+        }
+
+        dev_dbg(mcp->chip.parent,
+                "intcap 0x%04X intf 0x%04X gpio_orig 0x%04X gpio 0x%04X\n",
+                intcap, intf, gpio_orig, gpio);
 
         for (i = 0; i < mcp->chip.ngpio; i++) {
-                if ((BIT(i) & mcp->cache[MCP_INTF]) &&
-                    ((BIT(i) & intcap & mcp->irq_rise) ||
-                     (mcp->irq_fall & ~intcap & BIT(i)) ||
-                     (BIT(i) & mcp->cache[MCP_INTCON]))) {
+                /* We must check all of the inputs on the chip,
+                 * otherwise we may not notice a change on >=2 pins.
+                 *
+                 * On at least the mcp23s17, INTCAP is only updated
+                 * one byte at a time(INTCAPA and INTCAPB are
+                 * not written to at the same time - only on a per-bank
+                 * basis).
+                 *
+                 * INTF only contains the single bit that caused the
+                 * interrupt per-bank.  On the mcp23s17, there is
+                 * INTFA and INTFB.  If two pins are changed on the A
+                 * side at the same time, INTF will only have one bit
+                 * set.  If one pin on the A side and one pin on the B
+                 * side are changed at the same time, INTF will have
+                 * two bits set.  Thus, INTF can't be the only check
+                 * to see if the input has changed.
+                 */
+
+                intf_set = BIT(i) & mcp->cache[MCP_INTF];
+                if (i < 8 && intf_set)
+                        intcap_mask = 0x00FF;
+                else if (i >= 8 && intf_set)
+                        intcap_mask = 0xFF00;
+                else
+                        intcap_mask = 0x00;
+
+                intcap_changed = (intcap_mask &
+                        (BIT(i) & mcp->cache[MCP_INTCAP])) !=
+                        (intcap_mask & (BIT(i) & gpio_orig));
+                gpio_set = BIT(i) & mcp->cache[MCP_GPIO];
+                gpio_bit_changed = (BIT(i) & gpio_orig) !=
+                        (BIT(i) & mcp->cache[MCP_GPIO]);
+                defval_changed = (BIT(i) & mcp->cache[MCP_INTCON]) &&
+                        ((BIT(i) & mcp->cache[MCP_GPIO]) !=
+                        (BIT(i) & mcp->cache[MCP_DEFVAL]));
+
+                if (((gpio_bit_changed || intcap_changed) &&
+                        (BIT(i) & mcp->irq_rise) && gpio_set) ||
+                    ((gpio_bit_changed || intcap_changed) &&
+                        (BIT(i) & mcp->irq_fall) && !gpio_set) ||
+                    defval_changed) {
                         child_irq = irq_find_mapping(mcp->chip.irqdomain, i);
                         handle_nested_irq(child_irq);
                 }
diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
index 06dac72cb69c..d99338689213 100644
--- a/drivers/gpio/gpio-mockup.c
+++ b/drivers/gpio/gpio-mockup.c
@@ -197,7 +197,7 @@ static ssize_t gpio_mockup_event_write(struct file *file,
         struct seq_file *sfile;
         struct gpio_desc *desc;
         struct gpio_chip *gc;
-        int status, val;
+        int val;
         char buf;
 
         sfile = file->private_data;
@@ -206,9 +206,8 @@ static ssize_t gpio_mockup_event_write(struct file *file,
         chip = priv->chip;
         gc = &chip->gc;
 
-        status = copy_from_user(&buf, usr_buf, 1);
-        if (status)
-                return status;
+        if (copy_from_user(&buf, usr_buf, 1))
+                return -EFAULT;
 
         if (buf == '0')
                 val = 0;
diff --git a/drivers/gpio/gpio-xgene.c b/drivers/gpio/gpio-xgene.c
index 40a8881c2ce8..f1c6ec17b90a 100644
--- a/drivers/gpio/gpio-xgene.c
+++ b/drivers/gpio/gpio-xgene.c
@@ -42,9 +42,7 @@ struct xgene_gpio {
         struct gpio_chip        chip;
         void __iomem            *base;
         spinlock_t              lock;
-#ifdef CONFIG_PM
         u32                     set_dr_val[XGENE_MAX_GPIO_BANKS];
-#endif
 };
 
 static int xgene_gpio_get(struct gpio_chip *gc, unsigned int offset)
@@ -138,8 +136,7 @@ static int xgene_gpio_dir_out(struct gpio_chip *gc,
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int xgene_gpio_suspend(struct device *dev)
+static __maybe_unused int xgene_gpio_suspend(struct device *dev)
 {
         struct xgene_gpio *gpio = dev_get_drvdata(dev);
         unsigned long bank_offset;
@@ -152,7 +149,7 @@ static int xgene_gpio_suspend(struct device *dev)
         return 0;
 }
 
-static int xgene_gpio_resume(struct device *dev)
+static __maybe_unused int xgene_gpio_resume(struct device *dev)
 {
         struct xgene_gpio *gpio = dev_get_drvdata(dev);
         unsigned long bank_offset;
@@ -166,10 +163,6 @@ static int xgene_gpio_resume(struct device *dev)
 }
 
 static SIMPLE_DEV_PM_OPS(xgene_gpio_pm, xgene_gpio_suspend, xgene_gpio_resume);
-#define XGENE_GPIO_PM_OPS       (&xgene_gpio_pm)
-#else
-#define XGENE_GPIO_PM_OPS       NULL
-#endif
 
 static int xgene_gpio_probe(struct platform_device *pdev)
 {
@@ -241,7 +234,7 @@ static struct platform_driver xgene_gpio_driver = {
                 .name = "xgene-gpio",
                 .of_match_table = xgene_gpio_of_match,
                 .acpi_match_table = ACPI_PTR(xgene_gpio_acpi_match),
-                .pm     = XGENE_GPIO_PM_OPS,
+                .pm     = &xgene_gpio_pm,
         },
         .probe = xgene_gpio_probe,
 };
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 9b37a3692b3f..2bd683e2be02 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -266,6 +266,9 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
                 goto fail_free_event;
         }
 
+        if (agpio->wake_capable == ACPI_WAKE_CAPABLE)
+                enable_irq_wake(irq);
+
         list_add_tail(&event->node, &acpi_gpio->events);
         return AE_OK;
 
@@ -339,6 +342,9 @@ void acpi_gpiochip_free_interrupts(struct gpio_chip *chip)
         list_for_each_entry_safe_reverse(event, ep, &acpi_gpio->events, node) {
                 struct gpio_desc *desc;
 
+                if (irqd_is_wakeup_set(irq_get_irq_data(event->irq)))
+                        disable_irq_wake(event->irq);
+
                 free_irq(event->irq, event);
                 desc = event->desc;
                 if (WARN_ON(IS_ERR(desc)))
@@ -571,8 +577,10 @@ struct gpio_desc *acpi_find_gpio(struct device *dev,
                 }
 
                 desc = acpi_get_gpiod_by_index(adev, propname, idx, &info);
-                if (!IS_ERR(desc) || (PTR_ERR(desc) == -EPROBE_DEFER))
+                if (!IS_ERR(desc))
                         break;
+                if (PTR_ERR(desc) == -EPROBE_DEFER)
+                        return ERR_CAST(desc);
         }
 
         /* Then from plain _CRS GPIOs */
diff --git a/drivers/gpu/drm/amd/acp/Makefile b/drivers/gpu/drm/amd/acp/Makefile
index 8363cb57915b..8a08e81ee90d 100644
--- a/drivers/gpu/drm/amd/acp/Makefile
+++ b/drivers/gpu/drm/amd/acp/Makefile
@@ -3,6 +3,4 @@
 # of AMDSOC/AMDGPU drm driver.
 # It provides the HW control for ACP related functionalities.
 
-subdir-ccflags-y += -I$(AMDACPPATH)/ -I$(AMDACPPATH)/include
-
 AMD_ACP_FILES := $(AMDACPPATH)/acp_hw.o
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index d2d0f60ff36d..99424cb8020b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -240,6 +240,8 @@ free_partial_kdata:
         for (; i >= 0; i--)
                 drm_free_large(p->chunks[i].kdata);
         kfree(p->chunks);
+        p->chunks = NULL;
+        p->nchunks = 0;
 put_ctx:
         amdgpu_ctx_put(p->ctx);
 free_chunk:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 6abb238b25c9..de0cf3315484 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -475,7 +475,7 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
         int r;
 
         if (adev->wb.wb_obj == NULL) {
-                r = amdgpu_bo_create_kernel(adev, AMDGPU_MAX_WB * 4,
+                r = amdgpu_bo_create_kernel(adev, AMDGPU_MAX_WB * sizeof(uint32_t),
                                             PAGE_SIZE, AMDGPU_GEM_DOMAIN_GTT,
                                             &adev->wb.wb_obj, &adev->wb.gpu_addr,
                                             (void **)&adev->wb.wb);
@@ -488,7 +488,7 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
                 memset(&adev->wb.used, 0, sizeof(adev->wb.used));
 
                 /* clear wb memory */
-                memset((char *)adev->wb.wb, 0, AMDGPU_GPU_PAGE_SIZE);
+                memset((char *)adev->wb.wb, 0, AMDGPU_MAX_WB * sizeof(uint32_t));
         }
 
         return 0;
@@ -2094,8 +2094,11 @@ int amdgpu_device_resume(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         r = amdgpu_late_init(adev);
-        if (r)
+        if (r) {
+                if (fbcon)
+                        console_unlock();
                 return r;
+        }
 
         /* pin cursors */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
@@ -2587,7 +2590,7 @@ static ssize_t amdgpu_debugfs_regs_read(struct file *f, char __user *buf,
                 use_bank = 0;
         }
 
-        *pos &= 0x3FFFF;
+        *pos &= (1UL << 22) - 1;
 
         if (use_bank) {
                 if ((sh_bank != 0xFFFFFFFF && sh_bank >= adev->gfx.config.max_sh_per_se) ||
@@ -2663,7 +2666,7 @@ static ssize_t amdgpu_debugfs_regs_write(struct file *f, const char __user *buf,
                 use_bank = 0;
         }
 
-        *pos &= 0x3FFFF;
+        *pos &= (1UL << 22) - 1;
 
         if (use_bank) {
                 if ((sh_bank != 0xFFFFFFFF && sh_bank >= adev->gfx.config.max_sh_per_se) ||
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 75fc376ba735..b76cd699eb0d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -59,9 +59,10 @@
  * - 3.7.0 - Add support for VCE clock list packet
  * - 3.8.0 - Add support raster config init in the kernel
  * - 3.9.0 - Add support for memory query info about VRAM and GTT.
+ * - 3.10.0 - Add support for new fences ioctl, new gem ioctl flags
  */
 #define KMS_DRIVER_MAJOR        3
-#define KMS_DRIVER_MINOR        9
+#define KMS_DRIVER_MINOR        10
 #define KMS_DRIVER_PATCHLEVEL   0
 
 int amdgpu_vram_limit = 0;
@@ -420,6 +421,7 @@ static const struct pci_device_id pciidlist[] = {
         {0x1002, 0x6985, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6986, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x6987, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+        {0x1002, 0x6995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
         {0x1002, 0x699F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
 
         {0, 0, 0}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 51d759463384..106cf83c2e6b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -202,6 +202,27 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,
         bool kernel = false;
         int r;
 
+        /* reject invalid gem flags */
+        if (args->in.domain_flags & ~(AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
+                                      AMDGPU_GEM_CREATE_NO_CPU_ACCESS |
+                                      AMDGPU_GEM_CREATE_CPU_GTT_USWC |
+                                      AMDGPU_GEM_CREATE_VRAM_CLEARED|
+                                      AMDGPU_GEM_CREATE_SHADOW |
+                                      AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS)) {
+                r = -EINVAL;
+                goto error_unlock;
+        }
+        /* reject invalid gem domains */
+        if (args->in.domains & ~(AMDGPU_GEM_DOMAIN_CPU |
+                                 AMDGPU_GEM_DOMAIN_GTT |
+                                 AMDGPU_GEM_DOMAIN_VRAM |
+                                 AMDGPU_GEM_DOMAIN_GDS |
+                                 AMDGPU_GEM_DOMAIN_GWS |
+                                 AMDGPU_GEM_DOMAIN_OA)) {
+                r = -EINVAL;
+                goto error_unlock;
+        }
+
         /* create a gem object to contain this object in */
         if (args->in.domains & (AMDGPU_GEM_DOMAIN_GDS |
             AMDGPU_GEM_DOMAIN_GWS | AMDGPU_GEM_DOMAIN_OA)) {
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
index 31375bdde6f1..011800f621c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
@@ -788,7 +788,7 @@ static int sdma_v3_0_start(struct amdgpu_device *adev)
                 }
         }
 
-        /* disble sdma engine before programing it */
+        /* disable sdma engine before programing it */
         sdma_v3_0_ctx_switch_enable(adev, false);
         sdma_v3_0_enable(adev, false);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
index f55e45b52fbc..c5dec210d529 100644
--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
@@ -3464,6 +3464,16 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev,
                     (adev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
                 }
+        } else if (adev->asic_type == CHIP_OLAND) {
+                if ((adev->pdev->revision == 0xC7) ||
+                    (adev->pdev->revision == 0x80) ||
+                    (adev->pdev->revision == 0x81) ||
+                    (adev->pdev->revision == 0x83) ||
+                    (adev->pdev->revision == 0x87) ||
+                    (adev->pdev->device == 0x6604) ||
+                    (adev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                }
         }
 
         if (rps->vce_active) {
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 50bdb24ef8d6..4a785d6acfb9 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1051,7 +1051,7 @@ static int vi_common_early_init(void *handle)
                 /* rev0 hardware requires workarounds to support PG */
                 adev->pg_flags = 0;
                 if (adev->rev_id != 0x00) {
-                        adev->pg_flags |= AMD_PG_SUPPORT_GFX_PG |
+                        adev->pg_flags |=
                                 AMD_PG_SUPPORT_GFX_SMG |
                                 AMD_PG_SUPPORT_GFX_PIPELINE |
                                 AMD_PG_SUPPORT_CP |
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
index 8cf71f3c6d0e..261b828ad590 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c
@@ -178,7 +178,7 @@ int smu7_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate)
         if (bgate) {
                 cgs_set_powergating_state(hwmgr->device,
                                                 AMD_IP_BLOCK_TYPE_VCE,
-                                                AMD_PG_STATE_UNGATE);
+                                                AMD_PG_STATE_GATE);
                 cgs_set_clockgating_state(hwmgr->device,
                                 AMD_IP_BLOCK_TYPE_VCE,
                                 AMD_CG_STATE_GATE);
diff --git a/drivers/gpu/drm/arm/malidp_crtc.c b/drivers/gpu/drm/arm/malidp_crtc.c
index 08e6a71f5d05..294b53697334 100644
--- a/drivers/gpu/drm/arm/malidp_crtc.c
+++ b/drivers/gpu/drm/arm/malidp_crtc.c
@@ -63,8 +63,7 @@ static void malidp_crtc_enable(struct drm_crtc *crtc)
 
         clk_prepare_enable(hwdev->pxlclk);
 
-        /* mclk needs to be set to the same or higher rate than pxlclk */
-        clk_set_rate(hwdev->mclk, crtc->state->adjusted_mode.crtc_clock * 1000);
+        /* We rely on firmware to set mclk to a sensible level. */
         clk_set_rate(hwdev->pxlclk, crtc->state->adjusted_mode.crtc_clock * 1000);
 
         hwdev->modeset(hwdev, &vm);
diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c
index 488aedf5b58d..9f5513006eee 100644
--- a/drivers/gpu/drm/arm/malidp_hw.c
+++ b/drivers/gpu/drm/arm/malidp_hw.c
@@ -83,7 +83,7 @@ static const struct malidp_layer malidp550_layers[] = {
         { DE_VIDEO1, MALIDP550_DE_LV1_BASE, MALIDP550_DE_LV1_PTR_BASE, MALIDP_DE_LV_STRIDE0 },
         { DE_GRAPHICS1, MALIDP550_DE_LG_BASE, MALIDP550_DE_LG_PTR_BASE, MALIDP_DE_LG_STRIDE },
         { DE_VIDEO2, MALIDP550_DE_LV2_BASE, MALIDP550_DE_LV2_PTR_BASE, MALIDP_DE_LV_STRIDE0 },
-        { DE_SMART, MALIDP550_DE_LS_BASE, MALIDP550_DE_LS_PTR_BASE, 0 },
+        { DE_SMART, MALIDP550_DE_LS_BASE, MALIDP550_DE_LS_PTR_BASE, MALIDP550_DE_LS_R1_STRIDE },
 };
 
 #define MALIDP_DE_DEFAULT_PREFETCH_START        5
diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 414aada10fe5..d5aec082294c 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -37,6 +37,8 @@
 #define   LAYER_V_VAL(x)                (((x) & 0x1fff) << 16)
 #define MALIDP_LAYER_COMP_SIZE          0x010
 #define MALIDP_LAYER_OFFSET             0x014
+#define MALIDP550_LS_ENABLE             0x01c
+#define MALIDP550_LS_R1_IN_SIZE         0x020
 
 /*
  * This 4-entry look-up-table is used to determine the full 8-bit alpha value
@@ -242,6 +244,11 @@ static void malidp_de_plane_update(struct drm_plane *plane,
                         LAYER_V_VAL(plane->state->crtc_y),
                         mp->layer->base + MALIDP_LAYER_OFFSET);
 
+        if (mp->layer->id == DE_SMART)
+                malidp_hw_write(mp->hwdev,
+                                LAYER_H_VAL(src_w) | LAYER_V_VAL(src_h),
+                                mp->layer->base + MALIDP550_LS_R1_IN_SIZE);
+
         /* first clear the rotation bits */
         val = malidp_hw_read(mp->hwdev, mp->layer->base + MALIDP_LAYER_CONTROL);
         val &= ~LAYER_ROT_MASK;
@@ -330,9 +337,16 @@ int malidp_de_planes_init(struct drm_device *drm)
                 plane->hwdev = malidp->dev;
                 plane->layer = &map->layers[i];
 
-                /* Skip the features which the SMART layer doesn't have */
-                if (id == DE_SMART)
+                if (id == DE_SMART) {
+                        /*
+                         * Enable the first rectangle in the SMART layer to be
+                         * able to use it as a drm plane.
+                         */
+                        malidp_hw_write(malidp->dev, 1,
+                                        plane->layer->base + MALIDP550_LS_ENABLE);
+                        /* Skip the features which the SMART layer doesn't have. */
                         continue;
+                }
 
                 drm_plane_create_rotation_property(&plane->base, DRM_ROTATE_0, flags);
                 malidp_hw_write(malidp->dev, MALIDP_ALPHA_LUT,
diff --git a/drivers/gpu/drm/arm/malidp_regs.h b/drivers/gpu/drm/arm/malidp_regs.h
index aff6d4a84e99..b816067a65c5 100644
--- a/drivers/gpu/drm/arm/malidp_regs.h
+++ b/drivers/gpu/drm/arm/malidp_regs.h
@@ -84,6 +84,7 @@
 /* Stride register offsets relative to Lx_BASE */
 #define MALIDP_DE_LG_STRIDE             0x18
 #define MALIDP_DE_LV_STRIDE0            0x18
+#define MALIDP550_DE_LS_R1_STRIDE       0x28
 
 /* macros to set values into registers */
 #define MALIDP_DE_H_FRONTPORCH(x)       (((x) & 0xfff) << 0)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c8baab9bee0d..ba58f1b11d1e 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -148,6 +148,9 @@ static const struct edid_quirk {
 
         /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
         { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
+
+        /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/
+        { "ETR", 13896, EDID_QUIRK_FORCE_8BPC },
 };
 
 /*
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index f6d4d9700734..324a688b3f30 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1260,9 +1260,9 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
          * to KMS, hence fail if different settings are requested.
          */
         if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
-            var->xres != fb->width || var->yres != fb->height ||
-            var->xres_virtual != fb->width || var->yres_virtual != fb->height) {
-                DRM_DEBUG("fb userspace requested width/height/bpp different than current fb "
+            var->xres > fb->width || var->yres > fb->height ||
+            var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
+                DRM_DEBUG("fb requested width/height/bpp can't fit in current fb "
                           "request %dx%d-%d (virtual %dx%d) > %dx%d-%d\n",
                           var->xres, var->yres, var->bits_per_pixel,
                           var->xres_virtual, var->yres_virtual,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 130d7d517a19..b78d9239e48f 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1311,15 +1311,15 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
                 goto out_pm_put;
         }
 
+        mutex_lock(&gpu->lock);
+
         fence = etnaviv_gpu_fence_alloc(gpu);
         if (!fence) {
                 event_free(gpu, event);
                 ret = -ENOMEM;
-                goto out_pm_put;
+                goto out_unlock;
         }
 
-        mutex_lock(&gpu->lock);
-
         gpu->event[event].fence = fence;
         submit->fence = fence->seqno;
         gpu->active_fence = submit->fence;
@@ -1357,6 +1357,7 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         hangcheck_timer_reset(gpu);
         ret = 0;
 
+out_unlock:
         mutex_unlock(&gpu->lock);
 
 out_pm_put:
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 0fd6f7a18364..c0e8d3302292 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -68,6 +68,8 @@ struct decon_context {
         unsigned long                   flags;
         unsigned long                   out_type;
         int                             first_win;
+        spinlock_t                      vblank_lock;
+        u32                             frame_id;
 };
 
 static const uint32_t decon_formats[] = {
@@ -103,7 +105,7 @@ static int decon_enable_vblank(struct exynos_drm_crtc *crtc)
                 if (ctx->out_type & IFTYPE_I80)
                         val |= VIDINTCON0_FRAMEDONE;
                 else
-                        val |= VIDINTCON0_INTFRMEN;
+                        val |= VIDINTCON0_INTFRMEN | VIDINTCON0_FRAMESEL_FP;
 
                 writel(val, ctx->addr + DECON_VIDINTCON0);
         }
@@ -122,14 +124,56 @@ static void decon_disable_vblank(struct exynos_drm_crtc *crtc)
                 writel(0, ctx->addr + DECON_VIDINTCON0);
 }
 
+/* return number of starts/ends of frame transmissions since reset */
+static u32 decon_get_frame_count(struct decon_context *ctx, bool end)
+{
+        u32 frm, pfrm, status, cnt = 2;
+
+        /* To get consistent result repeat read until frame id is stable.
+         * Usually the loop will be executed once, in rare cases when the loop
+         * is executed at frame change time 2nd pass will be needed.
+         */
+        frm = readl(ctx->addr + DECON_CRFMID);
+        do {
+                status = readl(ctx->addr + DECON_VIDCON1);
+                pfrm = frm;
+                frm = readl(ctx->addr + DECON_CRFMID);
+        } while (frm != pfrm && --cnt);
+
+        /* CRFMID is incremented on BPORCH in case of I80 and on VSYNC in case
+         * of RGB, it should be taken into account.
+         */
+        if (!frm)
+                return 0;
+
+        switch (status & (VIDCON1_VSTATUS_MASK | VIDCON1_I80_ACTIVE)) {
+        case VIDCON1_VSTATUS_VS:
+                if (!(ctx->out_type & IFTYPE_I80))
+                        --frm;
+                break;
+        case VIDCON1_VSTATUS_BP:
+                --frm;
+                break;
+        case VIDCON1_I80_ACTIVE:
+        case VIDCON1_VSTATUS_AC:
+                if (end)
+                        --frm;
+                break;
+        default:
+                break;
+        }
+
+        return frm;
+}
+
 static void decon_setup_trigger(struct decon_context *ctx)
 {
         if (!(ctx->out_type & (IFTYPE_I80 | I80_HW_TRG)))
                 return;
 
         if (!(ctx->out_type & I80_HW_TRG)) {
-                writel(TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN
-                       | TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN,
+                writel(TRIGCON_TRIGEN_PER_F | TRIGCON_TRIGEN_F |
+                       TRIGCON_TE_AUTO_MASK | TRIGCON_SWTRIGEN,
                        ctx->addr + DECON_TRIGCON);
                 return;
         }
@@ -365,11 +409,14 @@ static void decon_disable_plane(struct exynos_drm_crtc *crtc,
 static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 {
         struct decon_context *ctx = crtc->ctx;
+        unsigned long flags;
         int i;
 
         if (test_bit(BIT_SUSPENDED, &ctx->flags))
                 return;
 
+        spin_lock_irqsave(&ctx->vblank_lock, flags);
+
         for (i = ctx->first_win; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
 
@@ -378,11 +425,18 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 
         if (ctx->out_type & IFTYPE_I80)
                 set_bit(BIT_WIN_UPDATED, &ctx->flags);
+
+        ctx->frame_id = decon_get_frame_count(ctx, true);
+
+        exynos_crtc_handle_event(crtc);
+
+        spin_unlock_irqrestore(&ctx->vblank_lock, flags);
 }
 
 static void decon_swreset(struct decon_context *ctx)
 {
         unsigned int tries;
+        unsigned long flags;
 
         writel(0, ctx->addr + DECON_VIDCON0);
         for (tries = 2000; tries; --tries) {
@@ -400,6 +454,10 @@ static void decon_swreset(struct decon_context *ctx)
 
         WARN(tries == 0, "failed to software reset DECON\n");
 
+        spin_lock_irqsave(&ctx->vblank_lock, flags);
+        ctx->frame_id = 0;
+        spin_unlock_irqrestore(&ctx->vblank_lock, flags);
+
         if (!(ctx->out_type & IFTYPE_HDMI))
                 return;
 
@@ -578,6 +636,24 @@ static const struct component_ops decon_component_ops = {
         .unbind = decon_unbind,
 };
 
+static void decon_handle_vblank(struct decon_context *ctx)
+{
+        u32 frm;
+
+        spin_lock(&ctx->vblank_lock);
+
+        frm = decon_get_frame_count(ctx, true);
+
+        if (frm != ctx->frame_id) {
+                /* handle only if incremented, take care of wrap-around */
+                if ((s32)(frm - ctx->frame_id) > 0)
+                        drm_crtc_handle_vblank(&ctx->crtc->base);
+                ctx->frame_id = frm;
+        }
+
+        spin_unlock(&ctx->vblank_lock);
+}
+
 static irqreturn_t decon_irq_handler(int irq, void *dev_id)
 {
         struct decon_context *ctx = dev_id;
@@ -598,7 +674,7 @@ static irqreturn_t decon_irq_handler(int irq, void *dev_id)
                             (VIDOUT_INTERLACE_EN_F | VIDOUT_INTERLACE_FIELD_F))
                                 return IRQ_HANDLED;
                 }
-                drm_crtc_handle_vblank(&ctx->crtc->base);
+                decon_handle_vblank(ctx);
         }
 
 out:
@@ -671,6 +747,7 @@ static int exynos5433_decon_probe(struct platform_device *pdev)
         __set_bit(BIT_SUSPENDED, &ctx->flags);
         ctx->dev = dev;
         ctx->out_type = (unsigned long)of_device_get_match_data(dev);
+        spin_lock_init(&ctx->vblank_lock);
 
         if (ctx->out_type & IFTYPE_HDMI) {
                 ctx->first_win = 1;
@@ -678,7 +755,7 @@ static int exynos5433_decon_probe(struct platform_device *pdev)
                 ctx->out_type |= IFTYPE_I80;
         }
 
-        if (ctx->out_type | I80_HW_TRG) {
+        if (ctx->out_type & I80_HW_TRG) {
                 ctx->sysreg = syscon_regmap_lookup_by_phandle(dev->of_node,
                                                         "samsung,disp-sysreg");
                 if (IS_ERR(ctx->sysreg)) {
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index f9ab19e205e2..48811806fa27 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -526,6 +526,7 @@ static void decon_atomic_flush(struct exynos_drm_crtc *crtc)
 
         for (i = 0; i < WINDOWS_NR; i++)
                 decon_shadow_protect_win(ctx, i, false);
+        exynos_crtc_handle_event(crtc);
 }
 
 static void decon_init(struct decon_context *ctx)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 5367b6664fe3..c65f4509932c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -85,16 +85,28 @@ static void exynos_crtc_atomic_flush(struct drm_crtc *crtc,
                                      struct drm_crtc_state *old_crtc_state)
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
-        struct drm_pending_vblank_event *event;
-        unsigned long flags;
 
         if (exynos_crtc->ops->atomic_flush)
                 exynos_crtc->ops->atomic_flush(exynos_crtc);
+}
+
+static const struct drm_crtc_helper_funcs exynos_crtc_helper_funcs = {
+        .enable         = exynos_drm_crtc_enable,
+        .disable        = exynos_drm_crtc_disable,
+        .mode_set_nofb  = exynos_drm_crtc_mode_set_nofb,
+        .atomic_check   = exynos_crtc_atomic_check,
+        .atomic_begin   = exynos_crtc_atomic_begin,
+        .atomic_flush   = exynos_crtc_atomic_flush,
+};
+
+void exynos_crtc_handle_event(struct exynos_drm_crtc *exynos_crtc)
+{
+        struct drm_crtc *crtc = &exynos_crtc->base;
+        struct drm_pending_vblank_event *event = crtc->state->event;
+        unsigned long flags;
 
-        event = crtc->state->event;
         if (event) {
                 crtc->state->event = NULL;
-
                 spin_lock_irqsave(&crtc->dev->event_lock, flags);
                 if (drm_crtc_vblank_get(crtc) == 0)
                         drm_crtc_arm_vblank_event(crtc, event);
@@ -105,15 +117,6 @@ static void exynos_crtc_atomic_flush(struct drm_crtc *crtc,
 
 }
 
-static const struct drm_crtc_helper_funcs exynos_crtc_helper_funcs = {
-        .enable         = exynos_drm_crtc_enable,
-        .disable        = exynos_drm_crtc_disable,
-        .mode_set_nofb  = exynos_drm_crtc_mode_set_nofb,
-        .atomic_check   = exynos_crtc_atomic_check,
-        .atomic_begin   = exynos_crtc_atomic_begin,
-        .atomic_flush   = exynos_crtc_atomic_flush,
-};
-
 static void exynos_drm_crtc_destroy(struct drm_crtc *crtc)
 {
         struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.h b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
index 6a581a8af465..abd5d6ceac0c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
@@ -40,4 +40,6 @@ int exynos_drm_crtc_get_pipe_from_type(struct drm_device *drm_dev,
  */
 void exynos_drm_crtc_te_handler(struct drm_crtc *crtc);
 
+void exynos_crtc_handle_event(struct exynos_drm_crtc *exynos_crtc);
+
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 812e2ec0761d..d7ef26370e67 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -86,7 +86,7 @@
 #define DSIM_SYNC_INFORM                (1 << 27)
 #define DSIM_EOT_DISABLE                (1 << 28)
 #define DSIM_MFLUSH_VS                  (1 << 29)
-/* This flag is valid only for exynos3250/3472/4415/5260/5430 */
+/* This flag is valid only for exynos3250/3472/5260/5430 */
 #define DSIM_CLKLANE_STOP               (1 << 30)
 
 /* DSIM_ESCMODE */
@@ -473,17 +473,6 @@ static const struct exynos_dsi_driver_data exynos4_dsi_driver_data = {
         .reg_values = reg_values,
 };
 
-static const struct exynos_dsi_driver_data exynos4415_dsi_driver_data = {
-        .reg_ofs = exynos_reg_ofs,
-        .plltmr_reg = 0x58,
-        .has_clklane_stop = 1,
-        .num_clks = 2,
-        .max_freq = 1000,
-        .wait_for_reset = 1,
-        .num_bits_resol = 11,
-        .reg_values = reg_values,
-};
-
 static const struct exynos_dsi_driver_data exynos5_dsi_driver_data = {
         .reg_ofs = exynos_reg_ofs,
         .plltmr_reg = 0x58,
@@ -521,8 +510,6 @@ static const struct of_device_id exynos_dsi_of_match[] = {
           .data = &exynos3_dsi_driver_data },
         { .compatible = "samsung,exynos4210-mipi-dsi",
           .data = &exynos4_dsi_driver_data },
-        { .compatible = "samsung,exynos4415-mipi-dsi",
-          .data = &exynos4415_dsi_driver_data },
         { .compatible = "samsung,exynos5410-mipi-dsi",
           .data = &exynos5_dsi_driver_data },
         { .compatible = "samsung,exynos5422-mipi-dsi",
@@ -979,7 +966,7 @@ static void exynos_dsi_send_to_fifo(struct exynos_dsi *dsi,
         bool first = !xfer->tx_done;
         u32 reg;
 
-        dev_dbg(dev, "< xfer %p: tx len %u, done %u, rx len %u, done %u\n",
+        dev_dbg(dev, "< xfer %pK: tx len %u, done %u, rx len %u, done %u\n",
                 xfer, length, xfer->tx_done, xfer->rx_len, xfer->rx_done);
 
         if (length > DSI_TX_FIFO_SIZE)
@@ -1177,7 +1164,7 @@ static bool exynos_dsi_transfer_finish(struct exynos_dsi *dsi)
         spin_unlock_irqrestore(&dsi->transfer_lock, flags);
 
         dev_dbg(dsi->dev,
-                "> xfer %p, tx_len %zu, tx_done %u, rx_len %u, rx_done %u\n",
+                "> xfer %pK, tx_len %zu, tx_done %u, rx_len %u, rx_done %u\n",
                 xfer, xfer->packet.payload_length, xfer->tx_done, xfer->rx_len,
                 xfer->rx_done);
 
@@ -1348,9 +1335,12 @@ static int exynos_dsi_register_te_irq(struct exynos_dsi *dsi)
         int te_gpio_irq;
 
         dsi->te_gpio = of_get_named_gpio(dsi->panel_node, "te-gpios", 0);
+        if (dsi->te_gpio == -ENOENT)
+                return 0;
+
         if (!gpio_is_valid(dsi->te_gpio)) {
-                dev_err(dsi->dev, "no te-gpios specified\n");
                 ret = dsi->te_gpio;
+                dev_err(dsi->dev, "cannot get te-gpios, %d\n", ret);
                 goto out;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 95871577015d..5b18b5c5fdf2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1695,7 +1695,7 @@ static int fimc_probe(struct platform_device *pdev)
                 goto err_put_clk;
         }
 
-        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%pK]\n", ctx->id, ippdrv);
 
         spin_lock_init(&ctx->lock);
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index a9fa444c6053..3f04d72c448d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -71,10 +71,10 @@
 #define TRIGCON                         0x1A4
 #define TRGMODE_ENABLE                  (1 << 0)
 #define SWTRGCMD_ENABLE                 (1 << 1)
-/* Exynos3250, 3472, 4415, 5260 5410, 5420 and 5422 only supported. */
+/* Exynos3250, 3472, 5260 5410, 5420 and 5422 only supported. */
 #define HWTRGEN_ENABLE                  (1 << 3)
 #define HWTRGMASK_ENABLE                (1 << 4)
-/* Exynos3250, 3472, 4415, 5260, 5420 and 5422 only supported. */
+/* Exynos3250, 3472, 5260, 5420 and 5422 only supported. */
 #define HWTRIGEN_PER_ENABLE             (1 << 31)
 
 /* display mode change control register except exynos4 */
@@ -138,18 +138,6 @@ static struct fimd_driver_data exynos4_fimd_driver_data = {
         .has_vtsel = 1,
 };
 
-static struct fimd_driver_data exynos4415_fimd_driver_data = {
-        .timing_base = 0x20000,
-        .lcdblk_offset = 0x210,
-        .lcdblk_vt_shift = 10,
-        .lcdblk_bypass_shift = 1,
-        .trg_type = I80_HW_TRG,
-        .has_shadowcon = 1,
-        .has_vidoutcon = 1,
-        .has_vtsel = 1,
-        .has_trigger_per_te = 1,
-};
-
 static struct fimd_driver_data exynos5_fimd_driver_data = {
         .timing_base = 0x20000,
         .lcdblk_offset = 0x214,
@@ -210,8 +198,6 @@ static const struct of_device_id fimd_driver_dt_match[] = {
           .data = &exynos3_fimd_driver_data },
         { .compatible = "samsung,exynos4210-fimd",
           .data = &exynos4_fimd_driver_data },
-        { .compatible = "samsung,exynos4415-fimd",
-          .data = &exynos4415_fimd_driver_data },
         { .compatible = "samsung,exynos5250-fimd",
           .data = &exynos5_fimd_driver_data },
         { .compatible = "samsung,exynos5420-fimd",
@@ -257,7 +243,7 @@ static int fimd_enable_vblank(struct exynos_drm_crtc *crtc)
                         val |= VIDINTCON0_INT_FRAME;
 
                         val &= ~VIDINTCON0_FRAMESEL0_MASK;
-                        val |= VIDINTCON0_FRAMESEL0_VSYNC;
+                        val |= VIDINTCON0_FRAMESEL0_FRONTPORCH;
                         val &= ~VIDINTCON0_FRAMESEL1_MASK;
                         val |= VIDINTCON0_FRAMESEL1_NONE;
                 }
@@ -723,6 +709,8 @@ static void fimd_atomic_flush(struct exynos_drm_crtc *crtc)
 
         for (i = 0; i < WINDOWS_NR; i++)
                 fimd_shadow_protect_win(ctx, i, false);
+
+        exynos_crtc_handle_event(crtc);
 }
 
 static void fimd_update_plane(struct exynos_drm_crtc *crtc,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 4c28f7ffcc4d..55a1579d11b3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -218,7 +218,7 @@ static struct exynos_drm_gem *exynos_drm_gem_init(struct drm_device *dev,
                 return ERR_PTR(ret);
         }
 
-        DRM_DEBUG_KMS("created file object = %p\n", obj->filp);
+        DRM_DEBUG_KMS("created file object = %pK\n", obj->filp);
 
         return exynos_gem;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index bef57987759d..0506b2b17ac1 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1723,7 +1723,7 @@ static int gsc_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%pK]\n", ctx->id, ippdrv);
 
         mutex_init(&ctx->lock);
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 9c84ee76f18a..3edda18cc2d2 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -208,7 +208,7 @@ static struct exynos_drm_ippdrv *ipp_find_drv_by_handle(u32 prop_id)
          * e.g PAUSE state, queue buf, command control.
          */
         list_for_each_entry(ippdrv, &exynos_drm_ippdrv_list, drv_list) {
-                DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n", count++, ippdrv);
+                DRM_DEBUG_KMS("count[%d]ippdrv[%pK]\n", count++, ippdrv);
 
                 mutex_lock(&ippdrv->cmd_lock);
                 list_for_each_entry(c_node, &ippdrv->cmd_list, list) {
@@ -388,7 +388,7 @@ int exynos_drm_ipp_set_property(struct drm_device *drm_dev, void *data,
         }
         property->prop_id = ret;
 
-        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%p]\n",
+        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%pK]\n",
                 property->prop_id, property->cmd, ippdrv);
 
         /* stored property information and ippdrv in private data */
@@ -518,7 +518,7 @@ static int ipp_put_mem_node(struct drm_device *drm_dev,
 {
         int i;
 
-        DRM_DEBUG_KMS("node[%p]\n", m_node);
+        DRM_DEBUG_KMS("node[%pK]\n", m_node);
 
         if (!m_node) {
                 DRM_ERROR("invalid dequeue node.\n");
@@ -562,7 +562,7 @@ static struct drm_exynos_ipp_mem_node
         m_node->buf_id = qbuf->buf_id;
         INIT_LIST_HEAD(&m_node->list);
 
-        DRM_DEBUG_KMS("m_node[%p]ops_id[%d]\n", m_node, qbuf->ops_id);
+        DRM_DEBUG_KMS("m_node[%pK]ops_id[%d]\n", m_node, qbuf->ops_id);
         DRM_DEBUG_KMS("prop_id[%d]buf_id[%d]\n", qbuf->prop_id, m_node->buf_id);
 
         for_each_ipp_planar(i) {
@@ -659,7 +659,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
 
         mutex_lock(&c_node->event_lock);
         list_for_each_entry_safe(e, te, &c_node->event_list, base.link) {
-                DRM_DEBUG_KMS("count[%d]e[%p]\n", count++, e);
+                DRM_DEBUG_KMS("count[%d]e[%pK]\n", count++, e);
 
                 /*
                  * qbuf == NULL condition means all event deletion.
@@ -750,7 +750,7 @@ static struct drm_exynos_ipp_mem_node
 
         /* find memory node from memory list */
         list_for_each_entry(m_node, head, list) {
-                DRM_DEBUG_KMS("count[%d]m_node[%p]\n", count++, m_node);
+                DRM_DEBUG_KMS("count[%d]m_node[%pK]\n", count++, m_node);
 
                 /* compare buffer id */
                 if (m_node->buf_id == qbuf->buf_id)
@@ -767,7 +767,7 @@ static int ipp_set_mem_node(struct exynos_drm_ippdrv *ippdrv,
         struct exynos_drm_ipp_ops *ops = NULL;
         int ret = 0;
 
-        DRM_DEBUG_KMS("node[%p]\n", m_node);
+        DRM_DEBUG_KMS("node[%pK]\n", m_node);
 
         if (!m_node) {
                 DRM_ERROR("invalid queue node.\n");
@@ -1232,7 +1232,7 @@ static int ipp_start_property(struct exynos_drm_ippdrv *ippdrv,
                         m_node = list_first_entry(head,
                                 struct drm_exynos_ipp_mem_node, list);
 
-                        DRM_DEBUG_KMS("m_node[%p]\n", m_node);
+                        DRM_DEBUG_KMS("m_node[%pK]\n", m_node);
 
                         ret = ipp_set_mem_node(ippdrv, c_node, m_node);
                         if (ret) {
@@ -1601,7 +1601,7 @@ static int ipp_subdrv_probe(struct drm_device *drm_dev, struct device *dev)
                 }
                 ippdrv->prop_list.ipp_id = ret;
 
-                DRM_DEBUG_KMS("count[%d]ippdrv[%p]ipp_id[%d]\n",
+                DRM_DEBUG_KMS("count[%d]ippdrv[%pK]ipp_id[%d]\n",
                         count++, ippdrv, ret);
 
                 /* store parent device for node */
@@ -1659,7 +1659,7 @@ static int ipp_subdrv_open(struct drm_device *drm_dev, struct device *dev,
 
         file_priv->ipp_dev = dev;
 
-        DRM_DEBUG_KMS("done priv[%p]\n", dev);
+        DRM_DEBUG_KMS("done priv[%pK]\n", dev);
 
         return 0;
 }
@@ -1676,7 +1676,7 @@ static void ipp_subdrv_close(struct drm_device *drm_dev, struct device *dev,
                 mutex_lock(&ippdrv->cmd_lock);
                 list_for_each_entry_safe(c_node, tc_node,
                         &ippdrv->cmd_list, list) {
-                        DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n",
+                        DRM_DEBUG_KMS("count[%d]ippdrv[%pK]\n",
                                 count++, ippdrv);
 
                         if (c_node->filp == file) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 6591e406084c..79282a820ecc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -748,7 +748,7 @@ static int rotator_probe(struct platform_device *pdev)
                 goto err_ippdrv_register;
         }
 
-        DRM_DEBUG_KMS("ippdrv[%p]\n", ippdrv);
+        DRM_DEBUG_KMS("ippdrv[%pK]\n", ippdrv);
 
         platform_set_drvdata(pdev, rot);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 57fe514d5c5b..5d9a62a87eec 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -170,6 +170,7 @@ static const struct exynos_drm_crtc_ops vidi_crtc_ops = {
         .enable_vblank = vidi_enable_vblank,
         .disable_vblank = vidi_disable_vblank,
         .update_plane = vidi_update_plane,
+        .atomic_flush = exynos_crtc_handle_event,
 };
 
 static void vidi_fake_vblank_timer(unsigned long arg)
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 72143ac10525..25edb635a197 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -1012,6 +1012,7 @@ static void mixer_atomic_flush(struct exynos_drm_crtc *crtc)
                 return;
 
         mixer_vsync_set_update(mixer_ctx, true);
+        exynos_crtc_handle_event(crtc);
 }
 
 static void mixer_enable(struct exynos_drm_crtc *crtc)
diff --git a/drivers/gpu/drm/i915/gvt/aperture_gm.c b/drivers/gpu/drm/i915/gvt/aperture_gm.c
index 3b6caaca9751..325618d969fe 100644
--- a/drivers/gpu/drm/i915/gvt/aperture_gm.c
+++ b/drivers/gpu/drm/i915/gvt/aperture_gm.c
@@ -242,7 +242,7 @@ static int alloc_resource(struct intel_vgpu *vgpu,
         const char *item;
 
         if (!param->low_gm_sz || !param->high_gm_sz || !param->fence_sz) {
-                gvt_err("Invalid vGPU creation params\n");
+                gvt_vgpu_err("Invalid vGPU creation params\n");
                 return -EINVAL;
         }
 
@@ -285,9 +285,9 @@ static int alloc_resource(struct intel_vgpu *vgpu,
         return 0;
 
 no_enough_resource:
-        gvt_err("vgpu%d: fail to allocate resource %s\n", vgpu->id, item);
-        gvt_err("vgpu%d: request %luMB avail %luMB max %luMB taken %luMB\n",
-                vgpu->id, BYTES_TO_MB(request), BYTES_TO_MB(avail),
+        gvt_vgpu_err("fail to allocate resource %s\n", item);
+        gvt_vgpu_err("request %luMB avail %luMB max %luMB taken %luMB\n",
+                BYTES_TO_MB(request), BYTES_TO_MB(avail),
                 BYTES_TO_MB(max), BYTES_TO_MB(taken));
         return -ENOSPC;
 }
diff --git a/drivers/gpu/drm/i915/gvt/cfg_space.c b/drivers/gpu/drm/i915/gvt/cfg_space.c
index 4a6a2ed65732..40af17ec6312 100644
--- a/drivers/gpu/drm/i915/gvt/cfg_space.c
+++ b/drivers/gpu/drm/i915/gvt/cfg_space.c
@@ -41,6 +41,54 @@ enum {
         INTEL_GVT_PCI_BAR_MAX,
 };
 
+/* bitmap for writable bits (RW or RW1C bits, but cannot co-exist in one
+ * byte) byte by byte in standard pci configuration space. (not the full
+ * 256 bytes.)
+ */
+static const u8 pci_cfg_space_rw_bmp[PCI_INTERRUPT_LINE + 4] = {
+        [PCI_COMMAND]           = 0xff, 0x07,
+        [PCI_STATUS]            = 0x00, 0xf9, /* the only one RW1C byte */
+        [PCI_CACHE_LINE_SIZE]   = 0xff,
+        [PCI_BASE_ADDRESS_0 ... PCI_CARDBUS_CIS - 1] = 0xff,
+        [PCI_ROM_ADDRESS]       = 0x01, 0xf8, 0xff, 0xff,
+        [PCI_INTERRUPT_LINE]    = 0xff,
+};
+
+/**
+ * vgpu_pci_cfg_mem_write - write virtual cfg space memory
+ *
+ * Use this function to write virtual cfg space memory.
+ * For standard cfg space, only RW bits can be changed,
+ * and we emulates the RW1C behavior of PCI_STATUS register.
+ */
+static void vgpu_pci_cfg_mem_write(struct intel_vgpu *vgpu, unsigned int off,
+                                   u8 *src, unsigned int bytes)
+{
+        u8 *cfg_base = vgpu_cfg_space(vgpu);
+        u8 mask, new, old;
+        int i = 0;
+
+        for (; i < bytes && (off + i < sizeof(pci_cfg_space_rw_bmp)); i++) {
+                mask = pci_cfg_space_rw_bmp[off + i];
+                old = cfg_base[off + i];
+                new = src[i] & mask;
+
+                /**
+                 * The PCI_STATUS high byte has RW1C bits, here
+                 * emulates clear by writing 1 for these bits.
+                 * Writing a 0b to RW1C bits has no effect.
+                 */
+                if (off + i == PCI_STATUS + 1)
+                        new = (~new & old) & mask;
+
+                cfg_base[off + i] = (old & ~mask) | new;
+        }
+
+        /* For other configuration space directly copy as it is. */
+        if (i < bytes)
+                memcpy(cfg_base + off + i, src + i, bytes - i);
+}
+
 /**
  * intel_vgpu_emulate_cfg_read - emulate vGPU configuration space read
  *
@@ -123,7 +171,7 @@ static int emulate_pci_command_write(struct intel_vgpu *vgpu,
         u8 changed = old ^ new;
         int ret;
 
-        memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+        vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
         if (!(changed & PCI_COMMAND_MEMORY))
                 return 0;
 
@@ -274,10 +322,10 @@ int intel_vgpu_emulate_cfg_write(struct intel_vgpu *vgpu, unsigned int offset,
                 if (ret)
                         return ret;
 
-                memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
                 break;
         default:
-                memcpy(vgpu_cfg_space(vgpu) + offset, p_data, bytes);
+                vgpu_pci_cfg_mem_write(vgpu, offset, p_data, bytes);
                 break;
         }
         return 0;
diff --git a/drivers/gpu/drm/i915/gvt/cmd_parser.c b/drivers/gpu/drm/i915/gvt/cmd_parser.c
index b9c8e2407682..2b92cc8a7d1a 100644
--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c
+++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c
@@ -668,7 +668,7 @@ static inline void print_opcode(u32 cmd, int ring_id)
         if (d_info == NULL)
                 return;
 
-        gvt_err("opcode=0x%x %s sub_ops:",
+        gvt_dbg_cmd("opcode=0x%x %s sub_ops:",
                         cmd >> (32 - d_info->op_len), d_info->name);
 
         for (i = 0; i < d_info->nr_sub_op; i++)
@@ -693,23 +693,23 @@ static void parser_exec_state_dump(struct parser_exec_state *s)
         int cnt = 0;
         int i;
 
-        gvt_err("  vgpu%d RING%d: ring_start(%08lx) ring_end(%08lx)"
+        gvt_dbg_cmd("  vgpu%d RING%d: ring_start(%08lx) ring_end(%08lx)"
                         " ring_head(%08lx) ring_tail(%08lx)\n", s->vgpu->id,
                         s->ring_id, s->ring_start, s->ring_start + s->ring_size,
                         s->ring_head, s->ring_tail);
 
-        gvt_err("  %s %s ip_gma(%08lx) ",
+        gvt_dbg_cmd("  %s %s ip_gma(%08lx) ",
                         s->buf_type == RING_BUFFER_INSTRUCTION ?
                         "RING_BUFFER" : "BATCH_BUFFER",
                         s->buf_addr_type == GTT_BUFFER ?
                         "GTT" : "PPGTT", s->ip_gma);
 
         if (s->ip_va == NULL) {
-                gvt_err(" ip_va(NULL)");
+                gvt_dbg_cmd(" ip_va(NULL)");
                 return;
         }
 
-        gvt_err("  ip_va=%p: %08x %08x %08x %08x\n",
+        gvt_dbg_cmd("  ip_va=%p: %08x %08x %08x %08x\n",
                         s->ip_va, cmd_val(s, 0), cmd_val(s, 1),
                         cmd_val(s, 2), cmd_val(s, 3));
 
@@ -817,6 +817,25 @@ static bool is_shadowed_mmio(unsigned int offset)
         return ret;
 }
 
+static inline bool is_force_nonpriv_mmio(unsigned int offset)
+{
+        return (offset >= 0x24d0 && offset < 0x2500);
+}
+
+static int force_nonpriv_reg_handler(struct parser_exec_state *s,
+                                     unsigned int offset, unsigned int index)
+{
+        struct intel_gvt *gvt = s->vgpu->gvt;
+        unsigned int data = cmd_val(s, index + 1);
+
+        if (!intel_gvt_in_force_nonpriv_whitelist(gvt, data)) {
+                gvt_err("Unexpected forcenonpriv 0x%x LRI write, value=0x%x\n",
+                        offset, data);
+                return -EINVAL;
+        }
+        return 0;
+}
+
 static int cmd_reg_handler(struct parser_exec_state *s,
         unsigned int offset, unsigned int index, char *cmd)
 {
@@ -824,23 +843,26 @@ static int cmd_reg_handler(struct parser_exec_state *s,
         struct intel_gvt *gvt = vgpu->gvt;
 
         if (offset + 4 > gvt->device_info.mmio_size) {
-                gvt_err("%s access to (%x) outside of MMIO range\n",
+                gvt_vgpu_err("%s access to (%x) outside of MMIO range\n",
                                 cmd, offset);
                 return -EINVAL;
         }
 
         if (!intel_gvt_mmio_is_cmd_access(gvt, offset)) {
-                gvt_err("vgpu%d: %s access to non-render register (%x)\n",
-                                s->vgpu->id, cmd, offset);
+                gvt_vgpu_err("%s access to non-render register (%x)\n",
+                                cmd, offset);
                 return 0;
         }
 
         if (is_shadowed_mmio(offset)) {
-                gvt_err("vgpu%d: found access of shadowed MMIO %x\n",
-                                s->vgpu->id, offset);
+                gvt_vgpu_err("found access of shadowed MMIO %x\n", offset);
                 return 0;
         }
 
+        if (is_force_nonpriv_mmio(offset) &&
+            force_nonpriv_reg_handler(s, offset, index))
+                return -EINVAL;
+
         if (offset == i915_mmio_reg_offset(DERRMR) ||
                 offset == i915_mmio_reg_offset(FORCEWAKE_MT)) {
                 /* Writing to HW VGT_PVINFO_PAGE offset will be discarded */
@@ -1008,7 +1030,7 @@ static int cmd_handler_pipe_control(struct parser_exec_state *s)
                         ret = cmd_reg_handler(s, 0x2358, 1, "pipe_ctrl");
                 else if (post_sync == 1) {
                         /* check ggtt*/
-                        if ((cmd_val(s, 2) & (1 << 2))) {
+                        if ((cmd_val(s, 1) & PIPE_CONTROL_GLOBAL_GTT_IVB)) {
                                 gma = cmd_val(s, 2) & GENMASK(31, 3);
                                 if (gmadr_bytes == 8)
                                         gma |= (cmd_gma_hi(s, 3)) << 32;
@@ -1129,6 +1151,7 @@ static int skl_decode_mi_display_flip(struct parser_exec_state *s,
                 struct mi_display_flip_command_info *info)
 {
         struct drm_i915_private *dev_priv = s->vgpu->gvt->dev_priv;
+        struct intel_vgpu *vgpu = s->vgpu;
         u32 dword0 = cmd_val(s, 0);
         u32 dword1 = cmd_val(s, 1);
         u32 dword2 = cmd_val(s, 2);
@@ -1167,7 +1190,7 @@ static int skl_decode_mi_display_flip(struct parser_exec_state *s,
                 break;
 
         default:
-                gvt_err("unknown plane code %d\n", plane);
+                gvt_vgpu_err("unknown plane code %d\n", plane);
                 return -EINVAL;
         }
 
@@ -1274,25 +1297,26 @@ static int update_plane_mmio_from_mi_display_flip(
 static int cmd_handler_mi_display_flip(struct parser_exec_state *s)
 {
         struct mi_display_flip_command_info info;
+        struct intel_vgpu *vgpu = s->vgpu;
         int ret;
         int i;
         int len = cmd_length(s);
 
         ret = decode_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("fail to decode MI display flip command\n");
+                gvt_vgpu_err("fail to decode MI display flip command\n");
                 return ret;
         }
 
         ret = check_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("invalid MI display flip command\n");
+                gvt_vgpu_err("invalid MI display flip command\n");
                 return ret;
         }
 
         ret = update_plane_mmio_from_mi_display_flip(s, &info);
         if (ret) {
-                gvt_err("fail to update plane mmio\n");
+                gvt_vgpu_err("fail to update plane mmio\n");
                 return ret;
         }
 
@@ -1350,7 +1374,8 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         int ret;
 
         if (op_size > max_surface_size) {
-                gvt_err("command address audit fail name %s\n", s->info->name);
+                gvt_vgpu_err("command address audit fail name %s\n",
+                        s->info->name);
                 return -EINVAL;
         }
 
@@ -1367,7 +1392,7 @@ static inline int cmd_address_audit(struct parser_exec_state *s,
         }
         return 0;
 err:
-        gvt_err("cmd_parser: Malicious %s detected, addr=0x%lx, len=%d!\n",
+        gvt_vgpu_err("cmd_parser: Malicious %s detected, addr=0x%lx, len=%d!\n",
                         s->info->name, guest_gma, op_size);
 
         pr_err("cmd dump: ");
@@ -1412,8 +1437,10 @@ static int cmd_handler_mi_store_data_imm(struct parser_exec_state *s)
 
 static inline int unexpected_cmd(struct parser_exec_state *s)
 {
-        gvt_err("vgpu%d: Unexpected %s in command buffer!\n",
-                        s->vgpu->id, s->info->name);
+        struct intel_vgpu *vgpu = s->vgpu;
+
+        gvt_vgpu_err("Unexpected %s in command buffer!\n", s->info->name);
+
         return -EINVAL;
 }
 
@@ -1516,7 +1543,7 @@ static int copy_gma_to_hva(struct intel_vgpu *vgpu, struct intel_vgpu_mm *mm,
         while (gma != end_gma) {
                 gpa = intel_vgpu_gma_to_gpa(mm, gma);
                 if (gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("invalid gma address: %lx\n", gma);
+                        gvt_vgpu_err("invalid gma address: %lx\n", gma);
                         return -EFAULT;
                 }
 
@@ -1557,6 +1584,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
         uint32_t bb_size = 0;
         uint32_t cmd_len = 0;
         bool met_bb_end = false;
+        struct intel_vgpu *vgpu = s->vgpu;
         u32 cmd;
 
         /* get the start gm address of the batch buffer */
@@ -1565,7 +1593,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
 
         info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
         if (info == NULL) {
-                gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                 return -EINVAL;
         }
@@ -1574,7 +1602,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
                                 gma, gma + 4, &cmd);
                 info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
                 if (info == NULL) {
-                        gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                        gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                         return -EINVAL;
                 }
@@ -1599,6 +1627,7 @@ static uint32_t find_bb_size(struct parser_exec_state *s)
 static int perform_bb_shadow(struct parser_exec_state *s)
 {
         struct intel_shadow_bb_entry *entry_obj;
+        struct intel_vgpu *vgpu = s->vgpu;
         unsigned long gma = 0;
         uint32_t bb_size;
         void *dst = NULL;
@@ -1633,7 +1662,7 @@ static int perform_bb_shadow(struct parser_exec_state *s)
 
         ret = i915_gem_object_set_to_cpu_domain(entry_obj->obj, false);
         if (ret) {
-                gvt_err("failed to set shadow batch to CPU\n");
+                gvt_vgpu_err("failed to set shadow batch to CPU\n");
                 goto unmap_src;
         }
 
@@ -1645,7 +1674,7 @@ static int perform_bb_shadow(struct parser_exec_state *s)
                               gma, gma + bb_size,
                               dst);
         if (ret) {
-                gvt_err("fail to copy guest ring buffer\n");
+                gvt_vgpu_err("fail to copy guest ring buffer\n");
                 goto unmap_src;
         }
 
@@ -1676,15 +1705,16 @@ static int cmd_handler_mi_batch_buffer_start(struct parser_exec_state *s)
 {
         bool second_level;
         int ret = 0;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         if (s->buf_type == BATCH_BUFFER_2ND_LEVEL) {
-                gvt_err("Found MI_BATCH_BUFFER_START in 2nd level BB\n");
+                gvt_vgpu_err("Found MI_BATCH_BUFFER_START in 2nd level BB\n");
                 return -EINVAL;
         }
 
         second_level = BATCH_BUFFER_2ND_LEVEL_BIT(cmd_val(s, 0)) == 1;
         if (second_level && (s->buf_type != BATCH_BUFFER_INSTRUCTION)) {
-                gvt_err("Jumping to 2nd level BB from RB is not allowed\n");
+                gvt_vgpu_err("Jumping to 2nd level BB from RB is not allowed\n");
                 return -EINVAL;
         }
 
@@ -1702,7 +1732,7 @@ static int cmd_handler_mi_batch_buffer_start(struct parser_exec_state *s)
         if (batch_buffer_needs_scan(s)) {
                 ret = perform_bb_shadow(s);
                 if (ret < 0)
-                        gvt_err("invalid shadow batch buffer\n");
+                        gvt_vgpu_err("invalid shadow batch buffer\n");
         } else {
                 /* emulate a batch buffer end to do return right */
                 ret = cmd_handler_mi_batch_buffer_end(s);
@@ -2429,6 +2459,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         int ret = 0;
         cycles_t t0, t1, t2;
         struct parser_exec_state s_before_advance_custom;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         t0 = get_cycles();
 
@@ -2436,7 +2467,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
 
         info = get_cmd_info(s->vgpu->gvt, cmd, s->ring_id);
         if (info == NULL) {
-                gvt_err("unknown cmd 0x%x, opcode=0x%x\n",
+                gvt_vgpu_err("unknown cmd 0x%x, opcode=0x%x\n",
                                 cmd, get_opcode(cmd, s->ring_id));
                 return -EINVAL;
         }
@@ -2452,7 +2483,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         if (info->handler) {
                 ret = info->handler(s);
                 if (ret < 0) {
-                        gvt_err("%s handler error\n", info->name);
+                        gvt_vgpu_err("%s handler error\n", info->name);
                         return ret;
                 }
         }
@@ -2463,7 +2494,7 @@ static int cmd_parser_exec(struct parser_exec_state *s)
         if (!(info->flag & F_IP_ADVANCE_CUSTOM)) {
                 ret = cmd_advance_default(s);
                 if (ret) {
-                        gvt_err("%s IP advance error\n", info->name);
+                        gvt_vgpu_err("%s IP advance error\n", info->name);
                         return ret;
                 }
         }
@@ -2486,6 +2517,7 @@ static int command_scan(struct parser_exec_state *s,
 
         unsigned long gma_head, gma_tail, gma_bottom;
         int ret = 0;
+        struct intel_vgpu *vgpu = s->vgpu;
 
         gma_head = rb_start + rb_head;
         gma_tail = rb_start + rb_tail;
@@ -2497,7 +2529,7 @@ static int command_scan(struct parser_exec_state *s,
                 if (s->buf_type == RING_BUFFER_INSTRUCTION) {
                         if (!(s->ip_gma >= rb_start) ||
                                 !(s->ip_gma < gma_bottom)) {
-                                gvt_err("ip_gma %lx out of ring scope."
+                                gvt_vgpu_err("ip_gma %lx out of ring scope."
                                         "(base:0x%lx, bottom: 0x%lx)\n",
                                         s->ip_gma, rb_start,
                                         gma_bottom);
@@ -2505,7 +2537,7 @@ static int command_scan(struct parser_exec_state *s,
                                 return -EINVAL;
                         }
                         if (gma_out_of_range(s->ip_gma, gma_head, gma_tail)) {
-                                gvt_err("ip_gma %lx out of range."
+                                gvt_vgpu_err("ip_gma %lx out of range."
                                         "base 0x%lx head 0x%lx tail 0x%lx\n",
                                         s->ip_gma, rb_start,
                                         rb_head, rb_tail);
@@ -2515,7 +2547,7 @@ static int command_scan(struct parser_exec_state *s,
                 }
                 ret = cmd_parser_exec(s);
                 if (ret) {
-                        gvt_err("cmd parser error\n");
+                        gvt_vgpu_err("cmd parser error\n");
                         parser_exec_state_dump(s);
                         break;
                 }
@@ -2639,7 +2671,7 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
                                 gma_head, gma_top,
                                 workload->shadow_ring_buffer_va);
                 if (ret) {
-                        gvt_err("fail to copy guest ring buffer\n");
+                        gvt_vgpu_err("fail to copy guest ring buffer\n");
                         return ret;
                 }
                 copy_len = gma_top - gma_head;
@@ -2651,7 +2683,7 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
                         gma_head, gma_tail,
                         workload->shadow_ring_buffer_va + copy_len);
         if (ret) {
-                gvt_err("fail to copy guest ring buffer\n");
+                gvt_vgpu_err("fail to copy guest ring buffer\n");
                 return ret;
         }
         ring->tail += workload->rb_len;
@@ -2662,16 +2694,17 @@ static int shadow_workload_ring_buffer(struct intel_vgpu_workload *workload)
 int intel_gvt_scan_and_shadow_workload(struct intel_vgpu_workload *workload)
 {
         int ret;
+        struct intel_vgpu *vgpu = workload->vgpu;
 
         ret = shadow_workload_ring_buffer(workload);
         if (ret) {
-                gvt_err("fail to shadow workload ring_buffer\n");
+                gvt_vgpu_err("fail to shadow workload ring_buffer\n");
                 return ret;
         }
 
         ret = scan_workload(workload);
         if (ret) {
-                gvt_err("scan workload error\n");
+                gvt_vgpu_err("scan workload error\n");
                 return ret;
         }
         return 0;
@@ -2681,6 +2714,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 {
         int ctx_size = wa_ctx->indirect_ctx.size;
         unsigned long guest_gma = wa_ctx->indirect_ctx.guest_gma;
+        struct intel_vgpu *vgpu = wa_ctx->workload->vgpu;
         struct drm_i915_gem_object *obj;
         int ret = 0;
         void *map;
@@ -2694,14 +2728,14 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         /* get the va of the shadow batch buffer */
         map = i915_gem_object_pin_map(obj, I915_MAP_WB);
         if (IS_ERR(map)) {
-                gvt_err("failed to vmap shadow indirect ctx\n");
+                gvt_vgpu_err("failed to vmap shadow indirect ctx\n");
                 ret = PTR_ERR(map);
                 goto put_obj;
         }
 
         ret = i915_gem_object_set_to_cpu_domain(obj, false);
         if (ret) {
-                gvt_err("failed to set shadow indirect ctx to CPU\n");
+                gvt_vgpu_err("failed to set shadow indirect ctx to CPU\n");
                 goto unmap_src;
         }
 
@@ -2710,7 +2744,7 @@ static int shadow_indirect_ctx(struct intel_shadow_wa_ctx *wa_ctx)
                                 guest_gma, guest_gma + ctx_size,
                                 map);
         if (ret) {
-                gvt_err("fail to copy guest indirect ctx\n");
+                gvt_vgpu_err("fail to copy guest indirect ctx\n");
                 goto unmap_src;
         }
 
@@ -2744,13 +2778,14 @@ static int combine_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 {
         int ret;
+        struct intel_vgpu *vgpu = wa_ctx->workload->vgpu;
 
         if (wa_ctx->indirect_ctx.size == 0)
                 return 0;
 
         ret = shadow_indirect_ctx(wa_ctx);
         if (ret) {
-                gvt_err("fail to shadow indirect ctx\n");
+                gvt_vgpu_err("fail to shadow indirect ctx\n");
                 return ret;
         }
 
@@ -2758,7 +2793,7 @@ int intel_gvt_scan_and_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
 
         ret = scan_wa_ctx(wa_ctx);
         if (ret) {
-                gvt_err("scan wa ctx error\n");
+                gvt_vgpu_err("scan wa ctx error\n");
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/i915/gvt/debug.h b/drivers/gpu/drm/i915/gvt/debug.h
index 68cba7bd980a..b0cff4dc2684 100644
--- a/drivers/gpu/drm/i915/gvt/debug.h
+++ b/drivers/gpu/drm/i915/gvt/debug.h
@@ -27,6 +27,14 @@
 #define gvt_err(fmt, args...) \
         DRM_ERROR("gvt: "fmt, ##args)
 
+#define gvt_vgpu_err(fmt, args...)                                      \
+do {                                                                    \
+        if (IS_ERR_OR_NULL(vgpu))                                       \
+                DRM_DEBUG_DRIVER("gvt: "fmt, ##args);                   \
+        else                                                            \
+                DRM_DEBUG_DRIVER("gvt: vgpu %d: "fmt, vgpu->id, ##args);\
+} while (0)
+
 #define gvt_dbg_core(fmt, args...) \
         DRM_DEBUG_DRIVER("gvt: core: "fmt, ##args)
 
diff --git a/drivers/gpu/drm/i915/gvt/display.c b/drivers/gpu/drm/i915/gvt/display.c
index 6d8fde880c39..5419ae6ec633 100644
--- a/drivers/gpu/drm/i915/gvt/display.c
+++ b/drivers/gpu/drm/i915/gvt/display.c
@@ -83,44 +83,80 @@ static int pipe_is_enabled(struct intel_vgpu *vgpu, int pipe)
         return 0;
 }
 
+static unsigned char virtual_dp_monitor_edid[GVT_EDID_NUM][EDID_SIZE] = {
+        {
+/* EDID with 1024x768 as its resolution */
+                /*Header*/
+                0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
+                /* Vendor & Product Identification */
+                0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
+                /* Version & Revision */
+                0x01, 0x04,
+                /* Basic Display Parameters & Features */
+                0xa5, 0x34, 0x20, 0x78, 0x23,
+                /* Color Characteristics */
+                0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
+                /* Established Timings: maximum resolution is 1024x768 */
+                0x21, 0x08, 0x00,
+                /* Standard Timings. All invalid */
+                0x00, 0xc0, 0x00, 0xc0, 0x00, 0x40, 0x00, 0x80, 0x00, 0x00,
+                0x00, 0x40, 0x00, 0x00, 0x00, 0x01,
+                /* 18 Byte Data Blocks 1: invalid */
+                0x00, 0x00, 0x80, 0xa0, 0x70, 0xb0,
+                0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
+                /* 18 Byte Data Blocks 2: invalid */
+                0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                /* 18 Byte Data Blocks 3: invalid */
+                0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
+                0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
+                /* 18 Byte Data Blocks 4: invalid */
+                0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
+                0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
+                /* Extension Block Count */
+                0x00,
+                /* Checksum */
+                0xef,
+        },
+        {
 /* EDID with 1920x1200 as its resolution */
-static unsigned char virtual_dp_monitor_edid[] = {
-        /*Header*/
-        0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
-        /* Vendor & Product Identification */
-        0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
-        /* Version & Revision */
-        0x01, 0x04,
-        /* Basic Display Parameters & Features */
-        0xa5, 0x34, 0x20, 0x78, 0x23,
-        /* Color Characteristics */
-        0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
-        /* Established Timings: maximum resolution is 1024x768 */
-        0x21, 0x08, 0x00,
-        /*
-         * Standard Timings.
-         * below new resolutions can be supported:
-         * 1920x1080, 1280x720, 1280x960, 1280x1024,
-         * 1440x900, 1600x1200, 1680x1050
-         */
-        0xd1, 0xc0, 0x81, 0xc0, 0x81, 0x40, 0x81, 0x80, 0x95, 0x00,
-        0xa9, 0x40, 0xb3, 0x00, 0x01, 0x01,
-        /* 18 Byte Data Blocks 1: max resolution is 1920x1200 */
-        0x28, 0x3c, 0x80, 0xa0, 0x70, 0xb0,
-        0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
-        /* 18 Byte Data Blocks 2: invalid */
-        0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
-        0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-        /* 18 Byte Data Blocks 3: invalid */
-        0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
-        0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
-        /* 18 Byte Data Blocks 4: invalid */
-        0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
-        0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
-        /* Extension Block Count */
-        0x00,
-        /* Checksum */
-        0x45,
+                /*Header*/
+                0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
+                /* Vendor & Product Identification */
+                0x22, 0xf0, 0x54, 0x29, 0x00, 0x00, 0x00, 0x00, 0x04, 0x17,
+                /* Version & Revision */
+                0x01, 0x04,
+                /* Basic Display Parameters & Features */
+                0xa5, 0x34, 0x20, 0x78, 0x23,
+                /* Color Characteristics */
+                0xfc, 0x81, 0xa4, 0x55, 0x4d, 0x9d, 0x25, 0x12, 0x50, 0x54,
+                /* Established Timings: maximum resolution is 1024x768 */
+                0x21, 0x08, 0x00,
+                /*
+                 * Standard Timings.
+                 * below new resolutions can be supported:
+                 * 1920x1080, 1280x720, 1280x960, 1280x1024,
+                 * 1440x900, 1600x1200, 1680x1050
+                 */
+                0xd1, 0xc0, 0x81, 0xc0, 0x81, 0x40, 0x81, 0x80, 0x95, 0x00,
+                0xa9, 0x40, 0xb3, 0x00, 0x01, 0x01,
+                /* 18 Byte Data Blocks 1: max resolution is 1920x1200 */
+                0x28, 0x3c, 0x80, 0xa0, 0x70, 0xb0,
+                0x23, 0x40, 0x30, 0x20, 0x36, 0x00, 0x06, 0x44, 0x21, 0x00, 0x00, 0x1a,
+                /* 18 Byte Data Blocks 2: invalid */
+                0x00, 0x00, 0x00, 0xfd, 0x00, 0x18, 0x3c, 0x18, 0x50, 0x11, 0x00, 0x0a,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                /* 18 Byte Data Blocks 3: invalid */
+                0x00, 0x00, 0x00, 0xfc, 0x00, 0x48,
+                0x50, 0x20, 0x5a, 0x52, 0x32, 0x34, 0x34, 0x30, 0x77, 0x0a, 0x20, 0x20,
+                /* 18 Byte Data Blocks 4: invalid */
+                0x00, 0x00, 0x00, 0xff, 0x00, 0x43, 0x4e, 0x34, 0x33, 0x30, 0x34, 0x30,
+                0x44, 0x58, 0x51, 0x0a, 0x20, 0x20,
+                /* Extension Block Count */
+                0x00,
+                /* Checksum */
+                0x45,
+        },
 };
 
 #define DPCD_HEADER_SIZE        0xb
@@ -140,14 +176,20 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                 vgpu_vreg(vgpu, SDEISR) &= ~(SDE_PORTA_HOTPLUG_SPT |
                                 SDE_PORTE_HOTPLUG_SPT);
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_B)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTB_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIB_DETECTED;
+        }
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_C)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTC_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDIC_DETECTED;
+        }
 
-        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D))
+        if (intel_vgpu_has_monitor_on_port(vgpu, PORT_D)) {
                 vgpu_vreg(vgpu, SDEISR) |= SDE_PORTD_HOTPLUG_CPT;
+                vgpu_vreg(vgpu, SFUSE_STRAP) |= SFUSE_STRAP_DDID_DETECTED;
+        }
 
         if (IS_SKYLAKE(dev_priv) &&
                         intel_vgpu_has_monitor_on_port(vgpu, PORT_E)) {
@@ -160,6 +202,8 @@ static void emulate_monitor_status_change(struct intel_vgpu *vgpu)
                                 GEN8_PORT_DP_A_HOTPLUG;
                 else
                         vgpu_vreg(vgpu, SDEISR) |= SDE_PORTA_HOTPLUG_SPT;
+
+                vgpu_vreg(vgpu, DDI_BUF_CTL(PORT_A)) |= DDI_INIT_DISPLAY_DETECTED;
         }
 }
 
@@ -175,10 +219,13 @@ static void clean_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num)
 }
 
 static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
-                int type)
+                                    int type, unsigned int resolution)
 {
         struct intel_vgpu_port *port = intel_vgpu_port(vgpu, port_num);
 
+        if (WARN_ON(resolution >= GVT_EDID_NUM))
+                return -EINVAL;
+
         port->edid = kzalloc(sizeof(*(port->edid)), GFP_KERNEL);
         if (!port->edid)
                 return -ENOMEM;
@@ -189,7 +236,7 @@ static int setup_virtual_dp_monitor(struct intel_vgpu *vgpu, int port_num,
                 return -ENOMEM;
         }
 
-        memcpy(port->edid->edid_block, virtual_dp_monitor_edid,
+        memcpy(port->edid->edid_block, virtual_dp_monitor_edid[resolution],
                         EDID_SIZE);
         port->edid->data_valid = true;
 
@@ -322,16 +369,18 @@ void intel_vgpu_clean_display(struct intel_vgpu *vgpu)
  * Zero on success, negative error code if failed.
  *
  */
-int intel_vgpu_init_display(struct intel_vgpu *vgpu)
+int intel_vgpu_init_display(struct intel_vgpu *vgpu, u64 resolution)
 {
         struct drm_i915_private *dev_priv = vgpu->gvt->dev_priv;
 
         intel_vgpu_init_i2c_edid(vgpu);
 
         if (IS_SKYLAKE(dev_priv))
-                return setup_virtual_dp_monitor(vgpu, PORT_D, GVT_DP_D);
+                return setup_virtual_dp_monitor(vgpu, PORT_D, GVT_DP_D,
+                                                resolution);
         else
-                return setup_virtual_dp_monitor(vgpu, PORT_B, GVT_DP_B);
+                return setup_virtual_dp_monitor(vgpu, PORT_B, GVT_DP_B,
+                                                resolution);
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/display.h b/drivers/gpu/drm/i915/gvt/display.h
index 8b234ea961f6..d73de22102e2 100644
--- a/drivers/gpu/drm/i915/gvt/display.h
+++ b/drivers/gpu/drm/i915/gvt/display.h
@@ -154,10 +154,28 @@ struct intel_vgpu_port {
         int type;
 };
 
+enum intel_vgpu_edid {
+        GVT_EDID_1024_768,
+        GVT_EDID_1920_1200,
+        GVT_EDID_NUM,
+};
+
+static inline char *vgpu_edid_str(enum intel_vgpu_edid id)
+{
+        switch (id) {
+        case GVT_EDID_1024_768:
+                return "1024x768";
+        case GVT_EDID_1920_1200:
+                return "1920x1200";
+        default:
+                return "";
+        }
+}
+
 void intel_gvt_emulate_vblank(struct intel_gvt *gvt);
 void intel_gvt_check_vblank_emulation(struct intel_gvt *gvt);
 
-int intel_vgpu_init_display(struct intel_vgpu *vgpu);
+int intel_vgpu_init_display(struct intel_vgpu *vgpu, u64 resolution);
 void intel_vgpu_reset_display(struct intel_vgpu *vgpu);
 void intel_vgpu_clean_display(struct intel_vgpu *vgpu);
 
diff --git a/drivers/gpu/drm/i915/gvt/edid.c b/drivers/gpu/drm/i915/gvt/edid.c
index bda85dff7b2a..42cd09ec63fa 100644
--- a/drivers/gpu/drm/i915/gvt/edid.c
+++ b/drivers/gpu/drm/i915/gvt/edid.c
@@ -52,16 +52,16 @@ static unsigned char edid_get_byte(struct intel_vgpu *vgpu)
         unsigned char chr = 0;
 
         if (edid->state == I2C_NOT_SPECIFIED || !edid->slave_selected) {
-                gvt_err("Driver tries to read EDID without proper sequence!\n");
+                gvt_vgpu_err("Driver tries to read EDID without proper sequence!\n");
                 return 0;
         }
         if (edid->current_edid_read >= EDID_SIZE) {
-                gvt_err("edid_get_byte() exceeds the size of EDID!\n");
+                gvt_vgpu_err("edid_get_byte() exceeds the size of EDID!\n");
                 return 0;
         }
 
         if (!edid->edid_available) {
-                gvt_err("Reading EDID but EDID is not available!\n");
+                gvt_vgpu_err("Reading EDID but EDID is not available!\n");
                 return 0;
         }
 
@@ -72,7 +72,7 @@ static unsigned char edid_get_byte(struct intel_vgpu *vgpu)
                 chr = edid_data->edid_block[edid->current_edid_read];
                 edid->current_edid_read++;
         } else {
-                gvt_err("No EDID available during the reading?\n");
+                gvt_vgpu_err("No EDID available during the reading?\n");
         }
         return chr;
 }
@@ -223,7 +223,7 @@ static int gmbus1_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                         vgpu_vreg(vgpu, PCH_GMBUS2) |= GMBUS_ACTIVE;
                         break;
                 default:
-                        gvt_err("Unknown/reserved GMBUS cycle detected!\n");
+                        gvt_vgpu_err("Unknown/reserved GMBUS cycle detected!\n");
                         break;
                 }
                 /*
@@ -292,8 +292,7 @@ static int gmbus3_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                  */
         } else {
                 memcpy(p_data, &vgpu_vreg(vgpu, offset), bytes);
-                gvt_err("vgpu%d: warning: gmbus3 read with nothing returned\n",
-                                vgpu->id);
+                gvt_vgpu_err("warning: gmbus3 read with nothing returned\n");
         }
         return 0;
 }
@@ -496,7 +495,8 @@ void intel_gvt_i2c_handle_aux_ch_write(struct intel_vgpu *vgpu,
                         unsigned char val = edid_get_byte(vgpu);
 
                         aux_data_for_write = (val << 16);
-                }
+                } else
+                        aux_data_for_write = (0xff << 16);
         }
         /* write the return value in AUX_CH_DATA reg which includes:
          * ACK of I2C_WRITE
diff --git a/drivers/gpu/drm/i915/gvt/execlist.c b/drivers/gpu/drm/i915/gvt/execlist.c
index 46eb9fd3c03f..d186c157f65f 100644
--- a/drivers/gpu/drm/i915/gvt/execlist.c
+++ b/drivers/gpu/drm/i915/gvt/execlist.c
@@ -172,6 +172,7 @@ static int emulate_execlist_ctx_schedule_out(
                 struct intel_vgpu_execlist *execlist,
                 struct execlist_ctx_descriptor_format *ctx)
 {
+        struct intel_vgpu *vgpu = execlist->vgpu;
         struct intel_vgpu_execlist_slot *running = execlist->running_slot;
         struct intel_vgpu_execlist_slot *pending = execlist->pending_slot;
         struct execlist_ctx_descriptor_format *ctx0 = &running->ctx[0];
@@ -183,7 +184,7 @@ static int emulate_execlist_ctx_schedule_out(
         gvt_dbg_el("schedule out context id %x\n", ctx->context_id);
 
         if (WARN_ON(!same_context(ctx, execlist->running_context))) {
-                gvt_err("schedule out context is not running context,"
+                gvt_vgpu_err("schedule out context is not running context,"
                                 "ctx id %x running ctx id %x\n",
                                 ctx->context_id,
                                 execlist->running_context->context_id);
@@ -254,7 +255,7 @@ static struct intel_vgpu_execlist_slot *get_next_execlist_slot(
         status.udw = vgpu_vreg(vgpu, status_reg + 4);
 
         if (status.execlist_queue_full) {
-                gvt_err("virtual execlist slots are full\n");
+                gvt_vgpu_err("virtual execlist slots are full\n");
                 return NULL;
         }
 
@@ -270,11 +271,12 @@ static int emulate_execlist_schedule_in(struct intel_vgpu_execlist *execlist,
 
         struct execlist_ctx_descriptor_format *ctx0, *ctx1;
         struct execlist_context_status_format status;
+        struct intel_vgpu *vgpu = execlist->vgpu;
 
         gvt_dbg_el("emulate schedule-in\n");
 
         if (!slot) {
-                gvt_err("no available execlist slot\n");
+                gvt_vgpu_err("no available execlist slot\n");
                 return -EINVAL;
         }
 
@@ -375,7 +377,6 @@ static void prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)
 
                 vma = i915_gem_object_ggtt_pin(entry_obj->obj, NULL, 0, 4, 0);
                 if (IS_ERR(vma)) {
-                        gvt_err("Cannot pin\n");
                         return;
                 }
 
@@ -428,7 +429,6 @@ static void prepare_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)
         vma = i915_gem_object_ggtt_pin(wa_ctx->indirect_ctx.obj, NULL,
                                        0, CACHELINE_BYTES, 0);
         if (IS_ERR(vma)) {
-                gvt_err("Cannot pin indirect ctx obj\n");
                 return;
         }
 
@@ -561,6 +561,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
 {
         struct execlist_ctx_descriptor_format *desc = &workload->ctx_desc;
         struct intel_vgpu_mm *mm;
+        struct intel_vgpu *vgpu = workload->vgpu;
         int page_table_level;
         u32 pdp[8];
 
@@ -569,7 +570,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
         } else if (desc->addressing_mode == 3) { /* legacy 64 bit */
                 page_table_level = 4;
         } else {
-                gvt_err("Advanced Context mode(SVM) is not supported!\n");
+                gvt_vgpu_err("Advanced Context mode(SVM) is not supported!\n");
                 return -EINVAL;
         }
 
@@ -583,7 +584,7 @@ static int prepare_mm(struct intel_vgpu_workload *workload)
                 mm = intel_vgpu_create_mm(workload->vgpu, INTEL_GVT_MM_PPGTT,
                                 pdp, page_table_level, 0);
                 if (IS_ERR(mm)) {
-                        gvt_err("fail to create mm object.\n");
+                        gvt_vgpu_err("fail to create mm object.\n");
                         return PTR_ERR(mm);
                 }
         }
@@ -609,7 +610,7 @@ static int submit_context(struct intel_vgpu *vgpu, int ring_id,
         ring_context_gpa = intel_vgpu_gma_to_gpa(vgpu->gtt.ggtt_mm,
                         (u32)((desc->lrca + 1) << GTT_PAGE_SHIFT));
         if (ring_context_gpa == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("invalid guest context LRCA: %x\n", desc->lrca);
+                gvt_vgpu_err("invalid guest context LRCA: %x\n", desc->lrca);
                 return -EINVAL;
         }
 
@@ -724,8 +725,7 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
                         continue;
 
                 if (!desc[i]->privilege_access) {
-                        gvt_err("vgpu%d: unexpected GGTT elsp submission\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("unexpected GGTT elsp submission\n");
                         return -EINVAL;
                 }
 
@@ -735,15 +735,13 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
         }
 
         if (!valid_desc_bitmap) {
-                gvt_err("vgpu%d: no valid desc in a elsp submission\n",
-                                vgpu->id);
+                gvt_vgpu_err("no valid desc in a elsp submission\n");
                 return -EINVAL;
         }
 
         if (!test_bit(0, (void *)&valid_desc_bitmap) &&
                         test_bit(1, (void *)&valid_desc_bitmap)) {
-                gvt_err("vgpu%d: weird elsp submission, desc 0 is not valid\n",
-                                vgpu->id);
+                gvt_vgpu_err("weird elsp submission, desc 0 is not valid\n");
                 return -EINVAL;
         }
 
@@ -752,8 +750,7 @@ int intel_vgpu_submit_execlist(struct intel_vgpu *vgpu, int ring_id)
                 ret = submit_context(vgpu, ring_id, &valid_desc[i],
                                 emulate_schedule_in);
                 if (ret) {
-                        gvt_err("vgpu%d: fail to schedule workload\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("fail to schedule workload\n");
                         return ret;
                 }
                 emulate_schedule_in = false;
@@ -778,7 +775,8 @@ static void init_vgpu_execlist(struct intel_vgpu *vgpu, int ring_id)
                         _EL_OFFSET_STATUS_PTR);
 
         ctx_status_ptr.dw = vgpu_vreg(vgpu, ctx_status_ptr_reg);
-        ctx_status_ptr.read_ptr = ctx_status_ptr.write_ptr = 0x7;
+        ctx_status_ptr.read_ptr = 0;
+        ctx_status_ptr.write_ptr = 0x7;
         vgpu_vreg(vgpu, ctx_status_ptr_reg) = ctx_status_ptr.dw;
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/firmware.c b/drivers/gpu/drm/i915/gvt/firmware.c
index 1cb29b2d7dc6..dce8d15f706f 100644
--- a/drivers/gpu/drm/i915/gvt/firmware.c
+++ b/drivers/gpu/drm/i915/gvt/firmware.c
@@ -75,12 +75,12 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
         struct gvt_firmware_header *h;
         void *firmware;
         void *p;
-        unsigned long size;
+        unsigned long size, crc32_start;
         int i;
         int ret;
 
-        size = sizeof(*h) + info->mmio_size + info->cfg_space_size - 1;
-        firmware = vmalloc(size);
+        size = sizeof(*h) + info->mmio_size + info->cfg_space_size;
+        firmware = vzalloc(size);
         if (!firmware)
                 return -ENOMEM;
 
@@ -112,6 +112,9 @@ static int expose_firmware_sysfs(struct intel_gvt *gvt)
 
         memcpy(gvt->firmware.mmio, p, info->mmio_size);
 
+        crc32_start = offsetof(struct gvt_firmware_header, crc32) + 4;
+        h->crc32 = crc32_le(0, firmware + crc32_start, size - crc32_start);
+
         firmware_attr.size = size;
         firmware_attr.private = firmware;
 
@@ -234,7 +237,7 @@ int intel_gvt_load_firmware(struct intel_gvt *gvt)
 
         firmware->mmio = mem;
 
-        sprintf(path, "%s/vid_0x%04x_did_0x%04x_rid_0x%04x.golden_hw_state",
+        sprintf(path, "%s/vid_0x%04x_did_0x%04x_rid_0x%02x.golden_hw_state",
                  GVT_FIRMWARE_PATH, pdev->vendor, pdev->device,
                  pdev->revision);
 
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 28c92346db0e..b832bea64e03 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -49,8 +49,8 @@ bool intel_gvt_ggtt_validate_range(struct intel_vgpu *vgpu, u64 addr, u32 size)
 {
         if ((!vgpu_gmadr_is_valid(vgpu, addr)) || (size
                         && !vgpu_gmadr_is_valid(vgpu, addr + size - 1))) {
-                gvt_err("vgpu%d: invalid range gmadr 0x%llx size 0x%x\n",
-                                vgpu->id, addr, size);
+                gvt_vgpu_err("invalid range gmadr 0x%llx size 0x%x\n",
+                                addr, size);
                 return false;
         }
         return true;
@@ -430,7 +430,7 @@ static int gtt_entry_p2m(struct intel_vgpu *vgpu, struct intel_gvt_gtt_entry *p,
 
         mfn = intel_gvt_hypervisor_gfn_to_mfn(vgpu, gfn);
         if (mfn == INTEL_GVT_INVALID_ADDR) {
-                gvt_err("fail to translate gfn: 0x%lx\n", gfn);
+                gvt_vgpu_err("fail to translate gfn: 0x%lx\n", gfn);
                 return -ENXIO;
         }
 
@@ -611,7 +611,7 @@ static inline int init_shadow_page(struct intel_vgpu *vgpu,
 
         daddr = dma_map_page(kdev, p->page, 0, 4096, PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(kdev, daddr)) {
-                gvt_err("fail to map dma addr\n");
+                gvt_vgpu_err("fail to map dma addr\n");
                 return -EINVAL;
         }
 
@@ -735,7 +735,7 @@ retry:
                 if (reclaim_one_mm(vgpu->gvt))
                         goto retry;
 
-                gvt_err("fail to allocate ppgtt shadow page\n");
+                gvt_vgpu_err("fail to allocate ppgtt shadow page\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -750,14 +750,14 @@ retry:
          */
         ret = init_shadow_page(vgpu, &spt->shadow_page, type);
         if (ret) {
-                gvt_err("fail to initialize shadow page for spt\n");
+                gvt_vgpu_err("fail to initialize shadow page for spt\n");
                 goto err;
         }
 
         ret = intel_vgpu_init_guest_page(vgpu, &spt->guest_page,
                         gfn, ppgtt_write_protection_handler, NULL);
         if (ret) {
-                gvt_err("fail to initialize guest page for spt\n");
+                gvt_vgpu_err("fail to initialize guest page for spt\n");
                 goto err;
         }
 
@@ -776,8 +776,7 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_find_shadow_page(
         if (p)
                 return shadow_page_to_ppgtt_spt(p);
 
-        gvt_err("vgpu%d: fail to find ppgtt shadow page: 0x%lx\n",
-                        vgpu->id, mfn);
+        gvt_vgpu_err("fail to find ppgtt shadow page: 0x%lx\n", mfn);
         return NULL;
 }
 
@@ -827,8 +826,8 @@ static int ppgtt_invalidate_shadow_page_by_shadow_entry(struct intel_vgpu *vgpu,
         }
         s = ppgtt_find_shadow_page(vgpu, ops->get_pfn(e));
         if (!s) {
-                gvt_err("vgpu%d: fail to find shadow page: mfn: 0x%lx\n",
-                                vgpu->id, ops->get_pfn(e));
+                gvt_vgpu_err("fail to find shadow page: mfn: 0x%lx\n",
+                                ops->get_pfn(e));
                 return -ENXIO;
         }
         return ppgtt_invalidate_shadow_page(s);
@@ -836,6 +835,7 @@ static int ppgtt_invalidate_shadow_page_by_shadow_entry(struct intel_vgpu *vgpu,
 
 static int ppgtt_invalidate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 {
+        struct intel_vgpu *vgpu = spt->vgpu;
         struct intel_gvt_gtt_entry e;
         unsigned long index;
         int ret;
@@ -854,7 +854,7 @@ static int ppgtt_invalidate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 
         for_each_present_shadow_entry(spt, &e, index) {
                 if (!gtt_type_is_pt(get_next_pt_type(e.type))) {
-                        gvt_err("GVT doesn't support pse bit for now\n");
+                        gvt_vgpu_err("GVT doesn't support pse bit for now\n");
                         return -EINVAL;
                 }
                 ret = ppgtt_invalidate_shadow_page_by_shadow_entry(
@@ -868,8 +868,8 @@ release:
         ppgtt_free_shadow_page(spt);
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p shadow entry 0x%llx type %d\n",
-                        spt->vgpu->id, spt, e.val64, e.type);
+        gvt_vgpu_err("fail: shadow page %p shadow entry 0x%llx type %d\n",
+                        spt, e.val64, e.type);
         return ret;
 }
 
@@ -914,8 +914,8 @@ static struct intel_vgpu_ppgtt_spt *ppgtt_populate_shadow_page_by_guest_entry(
         }
         return s;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, s, we->val64, we->type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        s, we->val64, we->type);
         return ERR_PTR(ret);
 }
 
@@ -953,7 +953,7 @@ static int ppgtt_populate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
 
         for_each_present_guest_entry(spt, &ge, i) {
                 if (!gtt_type_is_pt(get_next_pt_type(ge.type))) {
-                        gvt_err("GVT doesn't support pse bit now\n");
+                        gvt_vgpu_err("GVT doesn't support pse bit now\n");
                         ret = -EINVAL;
                         goto fail;
                 }
@@ -969,8 +969,8 @@ static int ppgtt_populate_shadow_page(struct intel_vgpu_ppgtt_spt *spt)
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, spt, ge.val64, ge.type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        spt, ge.val64, ge.type);
         return ret;
 }
 
@@ -999,7 +999,7 @@ static int ppgtt_handle_guest_entry_removal(struct intel_vgpu_guest_page *gpt,
                 struct intel_vgpu_ppgtt_spt *s =
                         ppgtt_find_shadow_page(vgpu, ops->get_pfn(&e));
                 if (!s) {
-                        gvt_err("fail to find guest page\n");
+                        gvt_vgpu_err("fail to find guest page\n");
                         ret = -ENXIO;
                         goto fail;
                 }
@@ -1011,8 +1011,8 @@ static int ppgtt_handle_guest_entry_removal(struct intel_vgpu_guest_page *gpt,
         ppgtt_set_shadow_entry(spt, &e, index);
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d\n",
-                        vgpu->id, spt, e.val64, e.type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d\n",
+                        spt, e.val64, e.type);
         return ret;
 }
 
@@ -1046,8 +1046,8 @@ static int ppgtt_handle_guest_entry_add(struct intel_vgpu_guest_page *gpt,
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: spt %p guest entry 0x%llx type %d\n", vgpu->id,
-                        spt, we->val64, we->type);
+        gvt_vgpu_err("fail: spt %p guest entry 0x%llx type %d\n",
+                spt, we->val64, we->type);
         return ret;
 }
 
@@ -1250,8 +1250,8 @@ static int ppgtt_handle_guest_write_page_table(
         }
         return 0;
 fail:
-        gvt_err("vgpu%d: fail: shadow page %p guest entry 0x%llx type %d.\n",
-                        vgpu->id, spt, we->val64, we->type);
+        gvt_vgpu_err("fail: shadow page %p guest entry 0x%llx type %d.\n",
+                        spt, we->val64, we->type);
         return ret;
 }
 
@@ -1493,7 +1493,7 @@ static int shadow_mm(struct intel_vgpu_mm *mm)
 
                 spt = ppgtt_populate_shadow_page_by_guest_entry(vgpu, &ge);
                 if (IS_ERR(spt)) {
-                        gvt_err("fail to populate guest root pointer\n");
+                        gvt_vgpu_err("fail to populate guest root pointer\n");
                         ret = PTR_ERR(spt);
                         goto fail;
                 }
@@ -1566,7 +1566,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
 
         ret = gtt->mm_alloc_page_table(mm);
         if (ret) {
-                gvt_err("fail to allocate page table for mm\n");
+                gvt_vgpu_err("fail to allocate page table for mm\n");
                 goto fail;
         }
 
@@ -1584,7 +1584,7 @@ struct intel_vgpu_mm *intel_vgpu_create_mm(struct intel_vgpu *vgpu,
         }
         return mm;
 fail:
-        gvt_err("fail to create mm\n");
+        gvt_vgpu_err("fail to create mm\n");
         if (mm)
                 intel_gvt_mm_unreference(mm);
         return ERR_PTR(ret);
@@ -1760,7 +1760,7 @@ unsigned long intel_vgpu_gma_to_gpa(struct intel_vgpu_mm *mm, unsigned long gma)
                         mm->page_table_level, gma, gpa);
         return gpa;
 err:
-        gvt_err("invalid mm type: %d gma %lx\n", mm->type, gma);
+        gvt_vgpu_err("invalid mm type: %d gma %lx\n", mm->type, gma);
         return INTEL_GVT_INVALID_ADDR;
 }
 
@@ -1825,11 +1825,8 @@ static int emulate_gtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         gma = g_gtt_index << GTT_PAGE_SHIFT;
 
         /* the VM may configure the whole GM space when ballooning is used */
-        if (WARN_ONCE(!vgpu_gmadr_is_valid(vgpu, gma),
-                                "vgpu%d: found oob ggtt write, offset %x\n",
-                                vgpu->id, off)) {
+        if (!vgpu_gmadr_is_valid(vgpu, gma))
                 return 0;
-        }
 
         ggtt_get_guest_entry(ggtt_mm, &e, g_gtt_index);
 
@@ -1839,13 +1836,16 @@ static int emulate_gtt_mmio_write(struct intel_vgpu *vgpu, unsigned int off,
         if (ops->test_present(&e)) {
                 ret = gtt_entry_p2m(vgpu, &e, &m);
                 if (ret) {
-                        gvt_err("vgpu%d: fail to translate guest gtt entry\n",
-                                        vgpu->id);
-                        return ret;
+                        gvt_vgpu_err("fail to translate guest gtt entry\n");
+                        /* guest driver may read/write the entry when partial
+                         * update the entry in this situation p2m will fail
+                         * settting the shadow entry to point to a scratch page
+                         */
+                        ops->set_pfn(&m, gvt->gtt.scratch_ggtt_mfn);
                 }
         } else {
                 m = e;
-                m.val64 = 0;
+                ops->set_pfn(&m, gvt->gtt.scratch_ggtt_mfn);
         }
 
         ggtt_set_shadow_entry(ggtt_mm, &m, g_gtt_index);
@@ -1896,14 +1896,14 @@ static int alloc_scratch_pages(struct intel_vgpu *vgpu,
 
         scratch_pt = (void *)get_zeroed_page(GFP_KERNEL);
         if (!scratch_pt) {
-                gvt_err("fail to allocate scratch page\n");
+                gvt_vgpu_err("fail to allocate scratch page\n");
                 return -ENOMEM;
         }
 
         daddr = dma_map_page(dev, virt_to_page(scratch_pt), 0,
                         4096, PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, daddr)) {
-                gvt_err("fail to dmamap scratch_pt\n");
+                gvt_vgpu_err("fail to dmamap scratch_pt\n");
                 __free_page(virt_to_page(scratch_pt));
                 return -ENOMEM;
         }
@@ -2006,7 +2006,7 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
         ggtt_mm = intel_vgpu_create_mm(vgpu, INTEL_GVT_MM_GGTT,
                         NULL, 1, 0);
         if (IS_ERR(ggtt_mm)) {
-                gvt_err("fail to create mm for ggtt.\n");
+                gvt_vgpu_err("fail to create mm for ggtt.\n");
                 return PTR_ERR(ggtt_mm);
         }
 
@@ -2015,6 +2015,22 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
         return create_scratch_page_tree(vgpu);
 }
 
+static void intel_vgpu_free_mm(struct intel_vgpu *vgpu, int type)
+{
+        struct list_head *pos, *n;
+        struct intel_vgpu_mm *mm;
+
+        list_for_each_safe(pos, n, &vgpu->gtt.mm_list_head) {
+                mm = container_of(pos, struct intel_vgpu_mm, list);
+                if (mm->type == type) {
+                        vgpu->gvt->gtt.mm_free_page_table(mm);
+                        list_del(&mm->list);
+                        list_del(&mm->lru_list);
+                        kfree(mm);
+                }
+        }
+}
+
 /**
  * intel_vgpu_clean_gtt - clean up per-vGPU graphics memory virulization
  * @vgpu: a vGPU
@@ -2027,19 +2043,11 @@ int intel_vgpu_init_gtt(struct intel_vgpu *vgpu)
  */
 void intel_vgpu_clean_gtt(struct intel_vgpu *vgpu)
 {
-        struct list_head *pos, *n;
-        struct intel_vgpu_mm *mm;
-
         ppgtt_free_all_shadow_page(vgpu);
         release_scratch_page_tree(vgpu);
 
-        list_for_each_safe(pos, n, &vgpu->gtt.mm_list_head) {
-                mm = container_of(pos, struct intel_vgpu_mm, list);
-                vgpu->gvt->gtt.mm_free_page_table(mm);
-                list_del(&mm->list);
-                list_del(&mm->lru_list);
-                kfree(mm);
-        }
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_PPGTT);
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_GGTT);
 }
 
 static void clean_spt_oos(struct intel_gvt *gvt)
@@ -2071,7 +2079,6 @@ static int setup_spt_oos(struct intel_gvt *gvt)
         for (i = 0; i < preallocated_oos_pages; i++) {
                 oos_page = kzalloc(sizeof(*oos_page), GFP_KERNEL);
                 if (!oos_page) {
-                        gvt_err("fail to pre-allocate oos page\n");
                         ret = -ENOMEM;
                         goto fail;
                 }
@@ -2161,7 +2168,7 @@ int intel_vgpu_g2v_create_ppgtt_mm(struct intel_vgpu *vgpu,
                 mm = intel_vgpu_create_mm(vgpu, INTEL_GVT_MM_PPGTT,
                                 pdp, page_table_level, 0);
                 if (IS_ERR(mm)) {
-                        gvt_err("fail to create mm\n");
+                        gvt_vgpu_err("fail to create mm\n");
                         return PTR_ERR(mm);
                 }
         }
@@ -2191,7 +2198,7 @@ int intel_vgpu_g2v_destroy_ppgtt_mm(struct intel_vgpu *vgpu,
 
         mm = intel_vgpu_find_ppgtt_mm(vgpu, page_table_level, pdp);
         if (!mm) {
-                gvt_err("fail to find ppgtt instance.\n");
+                gvt_vgpu_err("fail to find ppgtt instance.\n");
                 return -EINVAL;
         }
         intel_gvt_mm_unreference(mm);
@@ -2322,6 +2329,13 @@ void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu, bool dmlr)
         int i;
 
         ppgtt_free_all_shadow_page(vgpu);
+
+        /* Shadow pages are only created when there is no page
+         * table tracking data, so remove page tracking data after
+         * removing the shadow pages.
+         */
+        intel_vgpu_free_mm(vgpu, INTEL_GVT_MM_PPGTT);
+
         if (!dmlr)
                 return;
 
diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
index 3b9d59e457ba..ef3baa0c4754 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.c
+++ b/drivers/gpu/drm/i915/gvt/gvt.c
@@ -52,6 +52,8 @@ static const struct intel_gvt_ops intel_gvt_ops = {
         .vgpu_create = intel_gvt_create_vgpu,
         .vgpu_destroy = intel_gvt_destroy_vgpu,
         .vgpu_reset = intel_gvt_reset_vgpu,
+        .vgpu_activate = intel_gvt_activate_vgpu,
+        .vgpu_deactivate = intel_gvt_deactivate_vgpu,
 };
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index e227caf5859e..becae2fa3b29 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -143,6 +143,8 @@ struct intel_vgpu {
         int id;
         unsigned long handle; /* vGPU handle used by hypervisor MPT modules */
         bool active;
+        bool pv_notified;
+        bool failsafe;
         bool resetting;
         void *sched_data;
 
@@ -160,7 +162,6 @@ struct intel_vgpu {
         atomic_t running_workload_num;
         DECLARE_BITMAP(tlb_handle_pending, I915_NUM_ENGINES);
         struct i915_gem_context *shadow_ctx;
-        struct notifier_block shadow_ctx_notifier_block;
 
 #if IS_ENABLED(CONFIG_DRM_I915_GVT_KVMGT)
         struct {
@@ -203,18 +204,18 @@ struct intel_gvt_firmware {
 };
 
 struct intel_gvt_opregion {
-        void __iomem *opregion_va;
+        void *opregion_va;
         u32 opregion_pa;
 };
 
 #define NR_MAX_INTEL_VGPU_TYPES 20
 struct intel_vgpu_type {
         char name[16];
-        unsigned int max_instance;
         unsigned int avail_instance;
         unsigned int low_gm_size;
         unsigned int high_gm_size;
         unsigned int fence;
+        enum intel_vgpu_edid resolution;
 };
 
 struct intel_gvt {
@@ -231,6 +232,7 @@ struct intel_gvt {
         struct intel_gvt_gtt gtt;
         struct intel_gvt_opregion opregion;
         struct intel_gvt_workload_scheduler scheduler;
+        struct notifier_block shadow_ctx_notifier_block[I915_NUM_ENGINES];
         DECLARE_HASHTABLE(cmd_table, GVT_CMD_HASH_BITS);
         struct intel_vgpu_type *types;
         unsigned int num_types;
@@ -317,6 +319,7 @@ struct intel_vgpu_creation_params {
         __u64 low_gm_sz;  /* in MB */
         __u64 high_gm_sz; /* in MB */
         __u64 fence_sz;
+        __u64 resolution;
         __s32 primary;
         __u64 vgpu_id;
 };
@@ -379,7 +382,8 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu);
 void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                                  unsigned int engine_mask);
 void intel_gvt_reset_vgpu(struct intel_vgpu *vgpu);
-
+void intel_gvt_activate_vgpu(struct intel_vgpu *vgpu);
+void intel_gvt_deactivate_vgpu(struct intel_vgpu *vgpu);
 
 /* validating GM functions */
 #define vgpu_gmadr_is_aperture(vgpu, gmadr) \
@@ -446,9 +450,16 @@ struct intel_gvt_ops {
                                 struct intel_vgpu_type *);
         void (*vgpu_destroy)(struct intel_vgpu *);
         void (*vgpu_reset)(struct intel_vgpu *);
+        void (*vgpu_activate)(struct intel_vgpu *);
+        void (*vgpu_deactivate)(struct intel_vgpu *);
 };
 
 
+enum {
+        GVT_FAILSAFE_UNSUPPORTED_GUEST,
+        GVT_FAILSAFE_INSUFFICIENT_RESOURCE,
+};
+
 #include "mpt.h"
 
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 1d450627ff65..6da9ae1618e3 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -121,6 +121,7 @@ static int new_mmio_info(struct intel_gvt *gvt,
                 info->size = size;
                 info->length = (i + 4) < end ? 4 : (end - i);
                 info->addr_mask = addr_mask;
+                info->ro_mask = ro_mask;
                 info->device = device;
                 info->read = read ? read : intel_vgpu_default_mmio_read;
                 info->write = write ? write : intel_vgpu_default_mmio_write;
@@ -150,15 +151,42 @@ static int render_mmio_to_ring_id(struct intel_gvt *gvt, unsigned int reg)
 #define fence_num_to_offset(num) \
         (num * 8 + i915_mmio_reg_offset(FENCE_REG_GEN6_LO(0)))
 
+
+static void enter_failsafe_mode(struct intel_vgpu *vgpu, int reason)
+{
+        switch (reason) {
+        case GVT_FAILSAFE_UNSUPPORTED_GUEST:
+                pr_err("Detected your guest driver doesn't support GVT-g.\n");
+                break;
+        case GVT_FAILSAFE_INSUFFICIENT_RESOURCE:
+                pr_err("Graphics resource is not enough for the guest\n");
+        default:
+                break;
+        }
+        pr_err("Now vgpu %d will enter failsafe mode.\n", vgpu->id);
+        vgpu->failsafe = true;
+}
+
 static int sanitize_fence_mmio_access(struct intel_vgpu *vgpu,
                 unsigned int fence_num, void *p_data, unsigned int bytes)
 {
         if (fence_num >= vgpu_fence_sz(vgpu)) {
-                gvt_err("vgpu%d: found oob fence register access\n",
-                                vgpu->id);
-                gvt_err("vgpu%d: total fence num %d access fence num %d\n",
-                                vgpu->id, vgpu_fence_sz(vgpu), fence_num);
+
+                /* When guest access oob fence regs without access
+                 * pv_info first, we treat guest not supporting GVT,
+                 * and we will let vgpu enter failsafe mode.
+                 */
+                if (!vgpu->pv_notified)
+                        enter_failsafe_mode(vgpu,
+                                        GVT_FAILSAFE_UNSUPPORTED_GUEST);
+
+                if (!vgpu->mmio.disable_warn_untrack) {
+                        gvt_vgpu_err("found oob fence register access\n");
+                        gvt_vgpu_err("total fence %d, access fence %d\n",
+                                        vgpu_fence_sz(vgpu), fence_num);
+                }
                 memset(p_data, 0, bytes);
+                return -EINVAL;
         }
         return 0;
 }
@@ -219,7 +247,7 @@ static int mul_force_wake_write(struct intel_vgpu *vgpu,
                         break;
                 default:
                         /*should not hit here*/
-                        gvt_err("invalid forcewake offset 0x%x\n", offset);
+                        gvt_vgpu_err("invalid forcewake offset 0x%x\n", offset);
                         return -EINVAL;
                 }
         } else {
@@ -369,6 +397,74 @@ static int pipeconf_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         return 0;
 }
 
+/* ascendingly sorted */
+static i915_reg_t force_nonpriv_white_list[] = {
+        GEN9_CS_DEBUG_MODE1, //_MMIO(0x20ec)
+        GEN9_CTX_PREEMPT_REG,//_MMIO(0x2248)
+        GEN8_CS_CHICKEN1,//_MMIO(0x2580)
+        _MMIO(0x2690),
+        _MMIO(0x2694),
+        _MMIO(0x2698),
+        _MMIO(0x4de0),
+        _MMIO(0x4de4),
+        _MMIO(0x4dfc),
+        GEN7_COMMON_SLICE_CHICKEN1,//_MMIO(0x7010)
+        _MMIO(0x7014),
+        HDC_CHICKEN0,//_MMIO(0x7300)
+        GEN8_HDC_CHICKEN1,//_MMIO(0x7304)
+        _MMIO(0x7700),
+        _MMIO(0x7704),
+        _MMIO(0x7708),
+        _MMIO(0x770c),
+        _MMIO(0xb110),
+        GEN8_L3SQCREG4,//_MMIO(0xb118)
+        _MMIO(0xe100),
+        _MMIO(0xe18c),
+        _MMIO(0xe48c),
+        _MMIO(0xe5f4),
+};
+
+/* a simple bsearch */
+static inline bool in_whitelist(unsigned int reg)
+{
+        int left = 0, right = ARRAY_SIZE(force_nonpriv_white_list);
+        i915_reg_t *array = force_nonpriv_white_list;
+
+        while (left < right) {
+                int mid = (left + right)/2;
+
+                if (reg > array[mid].reg)
+                        left = mid + 1;
+                else if (reg < array[mid].reg)
+                        right = mid;
+                else
+                        return true;
+        }
+        return false;
+}
+
+static int force_nonpriv_write(struct intel_vgpu *vgpu,
+        unsigned int offset, void *p_data, unsigned int bytes)
+{
+        u32 reg_nonpriv = *(u32 *)p_data;
+        int ret = -EINVAL;
+
+        if ((bytes != 4) || ((offset & (bytes - 1)) != 0)) {
+                gvt_err("vgpu(%d) Invalid FORCE_NONPRIV offset %x(%dB)\n",
+                        vgpu->id, offset, bytes);
+                return ret;
+        }
+
+        if (in_whitelist(reg_nonpriv)) {
+                ret = intel_vgpu_default_mmio_write(vgpu, offset, p_data,
+                        bytes);
+        } else {
+                gvt_err("vgpu(%d) Invalid FORCE_NONPRIV write %x\n",
+                        vgpu->id, reg_nonpriv);
+        }
+        return ret;
+}
+
 static int ddi_buf_ctl_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
@@ -432,7 +528,7 @@ static int check_fdi_rx_train_status(struct intel_vgpu *vgpu,
                 fdi_tx_train_bits = FDI_LINK_TRAIN_PATTERN_2;
                 fdi_iir_check_bits = FDI_RX_SYMBOL_LOCK;
         } else {
-                gvt_err("Invalid train pattern %d\n", train_pattern);
+                gvt_vgpu_err("Invalid train pattern %d\n", train_pattern);
                 return -EINVAL;
         }
 
@@ -490,7 +586,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *vgpu,
         else if (FDI_RX_IMR_TO_PIPE(offset) != INVALID_INDEX)
                 index = FDI_RX_IMR_TO_PIPE(offset);
         else {
-                gvt_err("Unsupport registers %x\n", offset);
+                gvt_vgpu_err("Unsupport registers %x\n", offset);
                 return -EINVAL;
         }
 
@@ -720,7 +816,7 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
         u32 data;
 
         if (!dpy_is_valid_port(port_index)) {
-                gvt_err("GVT(%d): Unsupported DP port access!\n", vgpu->id);
+                gvt_vgpu_err("Unsupported DP port access!\n");
                 return 0;
         }
 
@@ -874,6 +970,14 @@ static int dp_aux_ch_ctl_mmio_write(struct intel_vgpu *vgpu,
         return 0;
 }
 
+static int mbctl_write(struct intel_vgpu *vgpu, unsigned int offset,
+                void *p_data, unsigned int bytes)
+{
+        *(u32 *)p_data &= (~GEN6_MBCTL_ENABLE_BOOT_FETCH);
+        write_vreg(vgpu, offset, p_data, bytes);
+        return 0;
+}
+
 static int vga_control_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                 void *p_data, unsigned int bytes)
 {
@@ -918,8 +1022,7 @@ static void write_virtual_sbi_register(struct intel_vgpu *vgpu,
 
         if (i == num) {
                 if (num == SBI_REG_MAX) {
-                        gvt_err("vgpu%d: SBI caching meets maximum limits\n",
-                                        vgpu->id);
+                        gvt_vgpu_err("SBI caching meets maximum limits\n");
                         return;
                 }
                 display->sbi.number++;
@@ -999,8 +1102,9 @@ static int pvinfo_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                 break;
         }
         if (invalid_read)
-                gvt_err("invalid pvinfo read: [%x:%x] = %x\n",
+                gvt_vgpu_err("invalid pvinfo read: [%x:%x] = %x\n",
                                 offset, bytes, *(u32 *)p_data);
+        vgpu->pv_notified = true;
         return 0;
 }
 
@@ -1026,7 +1130,7 @@ static int handle_g2v_notification(struct intel_vgpu *vgpu, int notification)
         case 1: /* Remove this in guest driver. */
                 break;
         default:
-                gvt_err("Invalid PV notification %d\n", notification);
+                gvt_vgpu_err("Invalid PV notification %d\n", notification);
         }
         return ret;
 }
@@ -1039,7 +1143,7 @@ static int send_display_ready_uevent(struct intel_vgpu *vgpu, int ready)
         char vmid_str[20];
         char display_ready_str[20];
 
-        snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d\n", ready);
+        snprintf(display_ready_str, 20, "GVT_DISPLAY_READY=%d", ready);
         env[0] = display_ready_str;
 
         snprintf(vmid_str, 20, "VMID=%d", vgpu->id);
@@ -1078,8 +1182,11 @@ static int pvinfo_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         case _vgtif_reg(execlist_context_descriptor_lo):
         case _vgtif_reg(execlist_context_descriptor_hi):
                 break;
+        case _vgtif_reg(rsv5[0])..._vgtif_reg(rsv5[3]):
+                enter_failsafe_mode(vgpu, GVT_FAILSAFE_INSUFFICIENT_RESOURCE);
+                break;
         default:
-                gvt_err("invalid pvinfo write offset %x bytes %x data %x\n",
+                gvt_vgpu_err("invalid pvinfo write offset %x bytes %x data %x\n",
                                 offset, bytes, data);
                 break;
         }
@@ -1203,26 +1310,37 @@ static int mailbox_write(struct intel_vgpu *vgpu, unsigned int offset,
         u32 *data0 = &vgpu_vreg(vgpu, GEN6_PCODE_DATA);
 
         switch (cmd) {
-        case 0x6:
-                /**
-                 * "Read memory latency" command on gen9.
-                 * Below memory latency values are read
-                 * from skylake platform.
-                 */
-                if (!*data0)
-                        *data0 = 0x1e1a1100;
-                else
-                        *data0 = 0x61514b3d;
+        case GEN9_PCODE_READ_MEM_LATENCY:
+                if (IS_SKYLAKE(vgpu->gvt->dev_priv)) {
+                        /**
+                         * "Read memory latency" command on gen9.
+                         * Below memory latency values are read
+                         * from skylake platform.
+                         */
+                        if (!*data0)
+                                *data0 = 0x1e1a1100;
+                        else
+                                *data0 = 0x61514b3d;
+                }
                 break;
-        case 0x5:
+        case SKL_PCODE_CDCLK_CONTROL:
+                if (IS_SKYLAKE(vgpu->gvt->dev_priv))
+                        *data0 = SKL_CDCLK_READY_FOR_CHANGE;
+                break;
+        case GEN6_PCODE_READ_RC6VIDS:
                 *data0 |= 0x1;
                 break;
         }
 
         gvt_dbg_core("VM(%d) write %x to mailbox, return data0 %x\n",
                      vgpu->id, value, *data0);
-
-        value &= ~(1 << 31);
+        /**
+         * PCODE_READY clear means ready for pcode read/write,
+         * PCODE_ERROR_MASK clear means no error happened. In GVT-g we
+         * always emulate as pcode read/write success and ready for access
+         * anytime, since we don't touch real physical registers here.
+         */
+        value &= ~(GEN6_PCODE_READY | GEN6_PCODE_ERROR_MASK);
         return intel_vgpu_default_mmio_write(vgpu, offset, &value, bytes);
 }
 
@@ -1302,7 +1420,8 @@ static int elsp_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         if (execlist->elsp_dwords.index == 3) {
                 ret = intel_vgpu_submit_execlist(vgpu, ring_id);
                 if(ret)
-                        gvt_err("fail submit workload on ring %d\n", ring_id);
+                        gvt_vgpu_err("fail submit workload on ring %d\n",
+                                ring_id);
         }
 
         ++execlist->elsp_dwords.index;
@@ -1318,6 +1437,17 @@ static int ring_mode_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         bool enable_execlist;
 
         write_vreg(vgpu, offset, p_data, bytes);
+
+        /* when PPGTT mode enabled, we will check if guest has called
+         * pvinfo, if not, we will treat this guest as non-gvtg-aware
+         * guest, and stop emulating its cfg space, mmio, gtt, etc.
+         */
+        if (((data & _MASKED_BIT_ENABLE(GFX_PPGTT_ENABLE)) ||
+                        (data & _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE)))
+                        && !vgpu->pv_notified) {
+                enter_failsafe_mode(vgpu, GVT_FAILSAFE_UNSUPPORTED_GUEST);
+                return 0;
+        }
         if ((data & _MASKED_BIT_ENABLE(GFX_RUN_LIST_ENABLE))
                         || (data & _MASKED_BIT_DISABLE(GFX_RUN_LIST_ENABLE))) {
                 enable_execlist = !!(data & GFX_RUN_LIST_ENABLE);
@@ -1400,6 +1530,9 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
 #define MMIO_GM(reg, d, r, w) \
         MMIO_F(reg, 4, F_GMADR, 0xFFFFF000, 0, d, r, w)
 
+#define MMIO_GM_RDR(reg, d, r, w) \
+        MMIO_F(reg, 4, F_GMADR | F_CMD_ACCESS, 0xFFFFF000, 0, d, r, w)
+
 #define MMIO_RO(reg, d, f, rm, r, w) \
         MMIO_F(reg, 4, F_RO | f, 0, rm, d, r, w)
 
@@ -1419,6 +1552,9 @@ static int ring_reset_ctl_write(struct intel_vgpu *vgpu,
 #define MMIO_RING_GM(prefix, d, r, w) \
         MMIO_RING_F(prefix, 4, F_GMADR, 0xFFFF0000, 0, d, r, w)
 
+#define MMIO_RING_GM_RDR(prefix, d, r, w) \
+        MMIO_RING_F(prefix, 4, F_GMADR | F_CMD_ACCESS, 0xFFFF0000, 0, d, r, w)
+
 #define MMIO_RING_RO(prefix, d, f, rm, r, w) \
         MMIO_RING_F(prefix, 4, F_RO | f, 0, rm, d, r, w)
 
@@ -1427,73 +1563,81 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_RING_DFH(RING_IMR, D_ALL, 0, NULL, intel_vgpu_reg_imr_handler);
+        MMIO_RING_DFH(RING_IMR, D_ALL, F_CMD_ACCESS, NULL,
+                intel_vgpu_reg_imr_handler);
 
         MMIO_DFH(SDEIMR, D_ALL, 0, NULL, intel_vgpu_reg_imr_handler);
         MMIO_DFH(SDEIER, D_ALL, 0, NULL, intel_vgpu_reg_ier_handler);
         MMIO_DFH(SDEIIR, D_ALL, 0, NULL, intel_vgpu_reg_iir_handler);
         MMIO_D(SDEISR, D_ALL);
 
-        MMIO_RING_D(RING_HWSTAM, D_ALL);
+        MMIO_RING_DFH(RING_HWSTAM, D_ALL, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_GM(RENDER_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(BSD_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(BLT_HWS_PGA_GEN7, D_ALL, NULL, NULL);
-        MMIO_GM(VEBOX_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(RENDER_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(BSD_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(BLT_HWS_PGA_GEN7, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(VEBOX_HWS_PGA_GEN7, D_ALL, NULL, NULL);
 
 #define RING_REG(base) (base + 0x28)
-        MMIO_RING_D(RING_REG, D_ALL);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_CMD_ACCESS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x134)
-        MMIO_RING_D(RING_REG, D_ALL);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_CMD_ACCESS, NULL, NULL);
 #undef RING_REG
 
-        MMIO_GM(0x2148, D_ALL, NULL, NULL);
-        MMIO_GM(CCID, D_ALL, NULL, NULL);
-        MMIO_GM(0x12198, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(0x2148, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(CCID, D_ALL, NULL, NULL);
+        MMIO_GM_RDR(0x12198, D_ALL, NULL, NULL);
         MMIO_D(GEN7_CXT_SIZE, D_ALL);
 
-        MMIO_RING_D(RING_TAIL, D_ALL);
-        MMIO_RING_D(RING_HEAD, D_ALL);
-        MMIO_RING_D(RING_CTL, D_ALL);
-        MMIO_RING_D(RING_ACTHD, D_ALL);
-        MMIO_RING_GM(RING_START, D_ALL, NULL, NULL);
+        MMIO_RING_DFH(RING_TAIL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_HEAD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_CTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_ACTHD, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_START, D_ALL, NULL, NULL);
 
         /* RING MODE */
 #define RING_REG(base) (base + 0x29c)
-        MMIO_RING_DFH(RING_REG, D_ALL, F_MODE_MASK, NULL, ring_mode_mmio_write);
+        MMIO_RING_DFH(RING_REG, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                ring_mode_mmio_write);
 #undef RING_REG
 
-        MMIO_RING_DFH(RING_MI_MODE, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_RING_DFH(RING_MI_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_RING_DFH(RING_INSTPM, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                        NULL, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP, D_ALL, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
         MMIO_RING_DFH(RING_TIMESTAMP_UDW, D_ALL, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
 
-        MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(GEN7_GT_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(CACHE_MODE_0_GEN7, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         MMIO_DFH(CACHE_MODE_1, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-
-        MMIO_DFH(0x20dc, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(_3D_CHICKEN3, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x2088, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x20e4, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_DFH(0x2470, D_ALL, F_MODE_MASK, NULL, NULL);
-        MMIO_D(GAM_ECOCHK, D_ALL);
-        MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(CACHE_MODE_0, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2124, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0x20dc, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(_3D_CHICKEN3, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2088, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x20e4, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2470, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GAM_ECOCHK, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GEN7_COMMON_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         MMIO_DFH(COMMON_SLICE_CHICKEN2, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(0x9030, D_ALL);
-        MMIO_D(0x20a0, D_ALL);
-        MMIO_D(0x2420, D_ALL);
-        MMIO_D(0x2430, D_ALL);
-        MMIO_D(0x2434, D_ALL);
-        MMIO_D(0x2438, D_ALL);
-        MMIO_D(0x243c, D_ALL);
-        MMIO_DFH(0x7018, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(0x9030, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x20a0, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2420, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2430, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2434, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2438, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x243c, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x7018, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN3, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0xe100, D_ALL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(GEN7_HALF_SLICE_CHICKEN1, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
         /* display */
         MMIO_F(0x60220, 0x20, 0, 0, 0, D_ALL, NULL, NULL);
@@ -2022,8 +2166,8 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(FORCEWAKE_ACK, D_ALL);
         MMIO_D(GEN6_GT_CORE_STATUS, D_ALL);
         MMIO_D(GEN6_GT_THREAD_STATUS_REG, D_ALL);
-        MMIO_D(GTFIFODBG, D_ALL);
-        MMIO_D(GTFIFOCTL, D_ALL);
+        MMIO_DFH(GTFIFODBG, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GTFIFOCTL, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DH(FORCEWAKE_MT, D_PRE_SKL, NULL, mul_force_wake_write);
         MMIO_DH(FORCEWAKE_ACK_HSW, D_HSW | D_BDW, NULL, NULL);
         MMIO_D(ECOBUS, D_ALL);
@@ -2080,7 +2224,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
 
         MMIO_F(0x4f000, 0x90, 0, 0, 0, D_ALL, NULL, NULL);
 
-        MMIO_D(GEN6_PCODE_MAILBOX, D_PRE_SKL);
+        MMIO_D(GEN6_PCODE_MAILBOX, D_PRE_BDW);
         MMIO_D(GEN6_PCODE_DATA, D_ALL);
         MMIO_D(0x13812c, D_ALL);
         MMIO_DH(GEN7_ERR_INT, D_ALL, NULL, NULL);
@@ -2102,7 +2246,7 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x7180, D_ALL);
         MMIO_D(0x7408, D_ALL);
         MMIO_D(0x7c00, D_ALL);
-        MMIO_D(GEN6_MBCTL, D_ALL);
+        MMIO_DH(GEN6_MBCTL, D_ALL, NULL, mbctl_write);
         MMIO_D(0x911c, D_ALL);
         MMIO_D(0x9120, D_ALL);
         MMIO_DFH(GEN7_UCGCTL4, D_ALL, F_CMD_ACCESS, NULL, NULL);
@@ -2159,36 +2303,35 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x1a054, D_ALL);
 
         MMIO_D(0x44070, D_ALL);
-
-        MMIO_D(0x215c, D_HSW_PLUS);
+        MMIO_DFH(0x215c, D_HSW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x2178, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x217c, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x12178, D_ALL, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x1217c, D_ALL, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_F(0x2290, 8, 0, 0, 0, D_HSW_PLUS, NULL, NULL);
-        MMIO_D(GEN7_OACONTROL, D_HSW);
+        MMIO_F(0x2290, 8, F_CMD_ACCESS, 0, 0, D_HSW_PLUS, NULL, NULL);
+        MMIO_DFH(GEN7_OACONTROL, D_HSW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x2b00, D_BDW_PLUS);
         MMIO_D(0x2360, D_BDW_PLUS);
-        MMIO_F(0x5200, 32, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(0x5240, 32, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(0x5280, 16, 0, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5200, 32, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5240, 32, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(0x5280, 16, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
 
         MMIO_DFH(0x1c17c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0x1c178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(BCS_SWCTRL, D_ALL);
-
-        MMIO_F(HS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(DS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(IA_VERTICES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(IA_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(VS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(GS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(GS_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(CL_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(CL_PRIMITIVES_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(PS_INVOCATION_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
-        MMIO_F(PS_DEPTH_COUNT, 8, 0, 0, 0, D_ALL, NULL, NULL);
+        MMIO_DFH(BCS_SWCTRL, D_ALL, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_F(HS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(DS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(IA_VERTICES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(IA_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(VS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(GS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(GS_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(CL_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(CL_PRIMITIVES_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(PS_INVOCATION_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
+        MMIO_F(PS_DEPTH_COUNT, 8, F_CMD_ACCESS, 0, 0, D_ALL, NULL, NULL);
         MMIO_DH(0x4260, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DH(0x4264, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DH(0x4268, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
@@ -2196,6 +2339,17 @@ static int init_generic_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(0x4270, D_BDW_PLUS, NULL, gvt_reg_tlb_control_handler);
         MMIO_DFH(0x4094, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
+        MMIO_DFH(ARB_MODE, D_ALL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_BBADDR, D_ALL, NULL, NULL);
+        MMIO_DFH(0x2220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x12220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x22220, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_SYNC_1, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_RING_DFH(RING_SYNC_0, D_ALL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x22178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1a178, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1a17c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x2217c, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
@@ -2204,7 +2358,7 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         struct drm_i915_private *dev_priv = gvt->dev_priv;
         int ret;
 
-        MMIO_DH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL,
+        MMIO_DFH(RING_IMR(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS, NULL,
                         intel_vgpu_reg_imr_handler);
 
         MMIO_DH(GEN8_GT_IMR(0), D_BDW_PLUS, NULL, intel_vgpu_reg_imr_handler);
@@ -2269,24 +2423,31 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DH(GEN8_MASTER_IRQ, D_BDW_PLUS, NULL,
                 intel_vgpu_reg_master_irq_handler);
 
-        MMIO_D(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(0x1c134, D_BDW_PLUS);
-
-        MMIO_D(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS);
-        MMIO_GM(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
-        MMIO_D(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_D(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
-        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK, NULL, ring_mode_mmio_write);
-        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK,
-                        NULL, NULL);
-        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_MODE_MASK,
-                        NULL, NULL);
+        MMIO_DFH(RING_HWSTAM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1c134, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(RING_TAIL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(RING_HEAD(GEN8_BSD2_RING_BASE),  D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_GM_RDR(RING_START(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
+        MMIO_DFH(RING_CTL(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(RING_ACTHD(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_ACTHD_UDW(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x1c29c, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL,
+                ring_mode_mmio_write);
+        MMIO_DFH(RING_MI_MODE(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_INSTPM(GEN8_BSD2_RING_BASE), D_BDW_PLUS,
+                F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(RING_TIMESTAMP(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
                         ring_timestamp_mmio_read, NULL);
 
-        MMIO_RING_D(RING_ACTHD_UDW, D_BDW_PLUS);
+        MMIO_RING_DFH(RING_ACTHD_UDW, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
 #define RING_REG(base) (base + 0xd0)
         MMIO_RING_F(RING_REG, 4, F_RO, 0,
@@ -2303,13 +2464,16 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x234)
-        MMIO_RING_F(RING_REG, 8, F_RO, 0, ~0, D_BDW_PLUS, NULL, NULL);
-        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO, 0, ~0LL, D_BDW_PLUS, NULL, NULL);
+        MMIO_RING_F(RING_REG, 8, F_RO | F_CMD_ACCESS, 0, ~0, D_BDW_PLUS,
+                NULL, NULL);
+        MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 4, F_RO | F_CMD_ACCESS, 0,
+                ~0LL, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x244)
-        MMIO_RING_D(RING_REG, D_BDW_PLUS);
-        MMIO_D(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS);
+        MMIO_RING_DFH(RING_REG, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(RING_REG(GEN8_BSD2_RING_BASE), D_BDW_PLUS, F_CMD_ACCESS,
+                NULL, NULL);
 #undef RING_REG
 
 #define RING_REG(base) (base + 0x370)
@@ -2331,6 +2495,8 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(GEN7_MISCCPCTL, D_BDW_PLUS);
         MMIO_D(0x1c054, D_BDW_PLUS);
 
+        MMIO_DH(GEN6_PCODE_MAILBOX, D_BDW_PLUS, NULL, mailbox_write);
+
         MMIO_D(GEN8_PRIVATE_PAT_LO, D_BDW_PLUS);
         MMIO_D(GEN8_PRIVATE_PAT_HI, D_BDW_PLUS);
 
@@ -2341,14 +2507,14 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_F(RING_REG(GEN8_BSD2_RING_BASE), 32, 0, 0, 0, D_BDW_PLUS, NULL, NULL);
 #undef RING_REG
 
-        MMIO_RING_GM(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
-        MMIO_GM(0x1c080, D_BDW_PLUS, NULL, NULL);
+        MMIO_RING_GM_RDR(RING_HWS_PGA, D_BDW_PLUS, NULL, NULL);
+        MMIO_GM_RDR(RING_HWS_PGA(GEN8_BSD2_RING_BASE), D_BDW_PLUS, NULL, NULL);
 
         MMIO_DFH(HDC_CHICKEN0, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_A), D_BDW);
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_B), D_BDW);
-        MMIO_D(CHICKEN_PIPESL_1(PIPE_C), D_BDW);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_A), D_BDW_PLUS);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_B), D_BDW_PLUS);
+        MMIO_D(CHICKEN_PIPESL_1(PIPE_C), D_BDW_PLUS);
 
         MMIO_D(WM_MISC, D_BDW);
         MMIO_D(BDW_EDP_PSR_BASE, D_BDW);
@@ -2362,27 +2528,31 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_D(GEN8_EU_DISABLE1, D_BDW_PLUS);
         MMIO_D(GEN8_EU_DISABLE2, D_BDW_PLUS);
 
-        MMIO_D(0xfdc, D_BDW);
-        MMIO_DFH(GEN8_ROW_CHICKEN, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(GEN7_ROW_CHICKEN2, D_BDW_PLUS);
-        MMIO_D(GEN8_UCGCTL6, D_BDW_PLUS);
+        MMIO_D(0xfdc, D_BDW_PLUS);
+        MMIO_DFH(GEN8_ROW_CHICKEN, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(GEN7_ROW_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
+        MMIO_DFH(GEN8_UCGCTL6, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
 
-        MMIO_D(0xb1f0, D_BDW);
-        MMIO_D(0xb1c0, D_BDW);
+        MMIO_DFH(0xb1f0, D_BDW, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xb1c0, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(GEN8_L3SQCREG4, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_D(0xb100, D_BDW);
-        MMIO_D(0xb10c, D_BDW);
+        MMIO_DFH(0xb100, D_BDW, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xb10c, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0xb110, D_BDW);
 
-        MMIO_DFH(0x24d0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24d4, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24d8, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x24dc, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_F(0x24d0, 48, F_CMD_ACCESS, 0, 0, D_BDW_PLUS,
+                NULL, force_nonpriv_write);
 
-        MMIO_D(0x83a4, D_BDW);
+        MMIO_D(0x22040, D_BDW_PLUS);
+        MMIO_D(0x44484, D_BDW_PLUS);
+        MMIO_D(0x4448c, D_BDW_PLUS);
+
+        MMIO_DFH(0x83a4, D_BDW, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(GEN8_L3_LRA_1_GPGPU, D_BDW_PLUS);
 
-        MMIO_D(0x8430, D_BDW);
+        MMIO_DFH(0x8430, D_BDW, F_CMD_ACCESS, NULL, NULL);
 
         MMIO_D(0x110000, D_BDW_PLUS);
 
@@ -2394,10 +2564,19 @@ static int init_broadwell_mmio_info(struct intel_gvt *gvt)
         MMIO_DFH(0xe194, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(0xe188, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
         MMIO_DFH(HALF_SLICE_CHICKEN2, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
-        MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK, NULL, NULL);
-
-        MMIO_D(0x2248, D_BDW);
-
+        MMIO_DFH(0x2580, D_BDW_PLUS, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0x2248, D_BDW, F_CMD_ACCESS, NULL, NULL);
+
+        MMIO_DFH(0xe220, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe230, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe240, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe260, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe270, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe280, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2a0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2b0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0xe2c0, D_BDW_PLUS, F_CMD_ACCESS, NULL, NULL);
         return 0;
 }
 
@@ -2420,7 +2599,6 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(HSW_PWR_WELL_BIOS, D_SKL);
         MMIO_DH(HSW_PWR_WELL_DRIVER, D_SKL, NULL, skl_power_well_ctl_write);
 
-        MMIO_DH(GEN6_PCODE_MAILBOX, D_SKL, NULL, mailbox_write);
         MMIO_D(0xa210, D_SKL_PLUS);
         MMIO_D(GEN9_MEDIA_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
         MMIO_D(GEN9_RENDER_PG_IDLE_HYSTERESIS, D_SKL_PLUS);
@@ -2578,16 +2756,16 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_F(0xb020, 0x80, F_CMD_ACCESS, 0, 0, D_SKL, NULL, NULL);
 
         MMIO_D(0xd08, D_SKL);
-        MMIO_D(0x20e0, D_SKL);
-        MMIO_D(0x20ec, D_SKL);
+        MMIO_DFH(0x20e0, D_SKL, F_MODE_MASK, NULL, NULL);
+        MMIO_DFH(0x20ec, D_SKL, F_MODE_MASK | F_CMD_ACCESS, NULL, NULL);
 
         /* TRTT */
-        MMIO_D(0x4de0, D_SKL);
-        MMIO_D(0x4de4, D_SKL);
-        MMIO_D(0x4de8, D_SKL);
-        MMIO_D(0x4dec, D_SKL);
-        MMIO_D(0x4df0, D_SKL);
-        MMIO_DH(0x4df4, D_SKL, NULL, gen9_trtte_write);
+        MMIO_DFH(0x4de0, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4de4, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4de8, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4dec, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4df0, D_SKL, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(0x4df4, D_SKL, F_CMD_ACCESS, NULL, gen9_trtte_write);
         MMIO_DH(0x4dfc, D_SKL, NULL, gen9_trtt_chicken_write);
 
         MMIO_D(0x45008, D_SKL);
@@ -2611,7 +2789,7 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(0x65f08, D_SKL);
         MMIO_D(0x320f0, D_SKL);
 
-        MMIO_D(_REG_VCS2_EXCC, D_SKL);
+        MMIO_DFH(_REG_VCS2_EXCC, D_SKL, F_CMD_ACCESS, NULL, NULL);
         MMIO_D(0x70034, D_SKL);
         MMIO_D(0x71034, D_SKL);
         MMIO_D(0x72034, D_SKL);
@@ -2624,6 +2802,9 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
         MMIO_D(_PLANE_KEYMSK_1(PIPE_C), D_SKL);
 
         MMIO_D(0x44500, D_SKL);
+        MMIO_DFH(GEN9_CSFE_CHICKEN1_RCS, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
+        MMIO_DFH(GEN8_HDC_CHICKEN1, D_SKL, F_MODE_MASK | F_CMD_ACCESS,
+                NULL, NULL);
         return 0;
 }
 
@@ -2813,3 +2994,20 @@ int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
         write_vreg(vgpu, offset, p_data, bytes);
         return 0;
 }
+
+/**
+ * intel_gvt_in_force_nonpriv_whitelist - if a mmio is in whitelist to be
+ * force-nopriv register
+ *
+ * @gvt: a GVT device
+ * @offset: register offset
+ *
+ * Returns:
+ * True if the register is in force-nonpriv whitelist;
+ * False if outside;
+ */
+bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
+                                          unsigned int offset)
+{
+        return in_whitelist(offset);
+}
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 0f7f5d97f582..e466259034e2 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -96,10 +96,10 @@ static int gvt_dma_map_iova(struct intel_vgpu *vgpu, kvm_pfn_t pfn,
         struct device *dev = &vgpu->gvt->dev_priv->drm.pdev->dev;
         dma_addr_t daddr;
 
-        page = pfn_to_page(pfn);
-        if (is_error_page(page))
+        if (unlikely(!pfn_valid(pfn)))
                 return -EFAULT;
 
+        page = pfn_to_page(pfn);
         daddr = dma_map_page(dev, page, 0, PAGE_SIZE,
                         PCI_DMA_BIDIRECTIONAL);
         if (dma_mapping_error(dev, daddr))
@@ -295,10 +295,10 @@ static ssize_t description_show(struct kobject *kobj, struct device *dev,
                 return 0;
 
         return sprintf(buf, "low_gm_size: %dMB\nhigh_gm_size: %dMB\n"
-                                "fence: %d\n",
-                                BYTES_TO_MB(type->low_gm_size),
-                                BYTES_TO_MB(type->high_gm_size),
-                                type->fence);
+                       "fence: %d\nresolution: %s\n",
+                       BYTES_TO_MB(type->low_gm_size),
+                       BYTES_TO_MB(type->high_gm_size),
+                       type->fence, vgpu_edid_str(type->resolution));
 }
 
 static MDEV_TYPE_ATTR_RO(available_instances);
@@ -426,7 +426,7 @@ static void kvmgt_protect_table_del(struct kvmgt_guest_info *info,
 
 static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 {
-        struct intel_vgpu *vgpu;
+        struct intel_vgpu *vgpu = NULL;
         struct intel_vgpu_type *type;
         struct device *pdev;
         void *gvt;
@@ -437,7 +437,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
 
         type = intel_gvt_find_vgpu_type(gvt, kobject_name(kobj));
         if (!type) {
-                gvt_err("failed to find type %s to create\n",
+                gvt_vgpu_err("failed to find type %s to create\n",
                                                 kobject_name(kobj));
                 ret = -EINVAL;
                 goto out;
@@ -446,7 +446,7 @@ static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
         vgpu = intel_gvt_ops->vgpu_create(gvt, type);
         if (IS_ERR_OR_NULL(vgpu)) {
                 ret = vgpu == NULL ? -EFAULT : PTR_ERR(vgpu);
-                gvt_err("failed to create intel vgpu: %d\n", ret);
+                gvt_vgpu_err("failed to create intel vgpu: %d\n", ret);
                 goto out;
         }
 
@@ -526,7 +526,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         ret = vfio_register_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY, &events,
                                 &vgpu->vdev.iommu_notifier);
         if (ret != 0) {
-                gvt_err("vfio_register_notifier for iommu failed: %d\n", ret);
+                gvt_vgpu_err("vfio_register_notifier for iommu failed: %d\n",
+                        ret);
                 goto out;
         }
 
@@ -534,7 +535,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         ret = vfio_register_notifier(mdev_dev(mdev), VFIO_GROUP_NOTIFY, &events,
                                 &vgpu->vdev.group_notifier);
         if (ret != 0) {
-                gvt_err("vfio_register_notifier for group failed: %d\n", ret);
+                gvt_vgpu_err("vfio_register_notifier for group failed: %d\n",
+                        ret);
                 goto undo_iommu;
         }
 
@@ -542,6 +544,8 @@ static int intel_vgpu_open(struct mdev_device *mdev)
         if (ret)
                 goto undo_group;
 
+        intel_gvt_ops->vgpu_activate(vgpu);
+
         atomic_set(&vgpu->vdev.released, 0);
         return ret;
 
@@ -567,6 +571,8 @@ static void __intel_vgpu_release(struct intel_vgpu *vgpu)
         if (atomic_cmpxchg(&vgpu->vdev.released, 0, 1))
                 return;
 
+        intel_gvt_ops->vgpu_deactivate(vgpu);
+
         ret = vfio_unregister_notifier(mdev_dev(vgpu->vdev.mdev), VFIO_IOMMU_NOTIFY,
                                         &vgpu->vdev.iommu_notifier);
         WARN(ret, "vfio_unregister_notifier for iommu failed: %d\n", ret);
@@ -635,7 +641,7 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
 
 
         if (index >= VFIO_PCI_NUM_REGIONS) {
-                gvt_err("invalid index: %u\n", index);
+                gvt_vgpu_err("invalid index: %u\n", index);
                 return -EINVAL;
         }
 
@@ -669,7 +675,7 @@ static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
         case VFIO_PCI_VGA_REGION_INDEX:
         case VFIO_PCI_ROM_REGION_INDEX:
         default:
-                gvt_err("unsupported region: %u\n", index);
+                gvt_vgpu_err("unsupported region: %u\n", index);
         }
 
         return ret == 0 ? count : ret;
@@ -861,7 +867,7 @@ static int intel_vgpu_set_msi_trigger(struct intel_vgpu *vgpu,
 
                 trigger = eventfd_ctx_fdget(fd);
                 if (IS_ERR(trigger)) {
-                        gvt_err("eventfd_ctx_fdget failed\n");
+                        gvt_vgpu_err("eventfd_ctx_fdget failed\n");
                         return PTR_ERR(trigger);
                 }
                 vgpu->vdev.msi_trigger = trigger;
@@ -1120,7 +1126,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
                         ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
                                                 VFIO_PCI_NUM_IRQS, &data_size);
                         if (ret) {
-                                gvt_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
+                                gvt_vgpu_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
                                 return -EINVAL;
                         }
                         if (data_size) {
@@ -1310,7 +1316,7 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
 
         kvm = vgpu->vdev.kvm;
         if (!kvm || kvm->mm != current->mm) {
-                gvt_err("KVM is required to use Intel vGPU\n");
+                gvt_vgpu_err("KVM is required to use Intel vGPU\n");
                 return -ESRCH;
         }
 
@@ -1324,6 +1330,7 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
         vgpu->handle = (unsigned long)info;
         info->vgpu = vgpu;
         info->kvm = kvm;
+        kvm_get_kvm(info->kvm);
 
         kvmgt_protect_table_init(info);
         gvt_cache_init(vgpu);
@@ -1337,12 +1344,8 @@ static int kvmgt_guest_init(struct mdev_device *mdev)
 
 static bool kvmgt_guest_exit(struct kvmgt_guest_info *info)
 {
-        if (!info) {
-                gvt_err("kvmgt_guest_info invalid\n");
-                return false;
-        }
-
         kvm_page_track_unregister_notifier(info->kvm, &info->track_node);
+        kvm_put_kvm(info->kvm);
         kvmgt_protect_table_destroy(info);
         gvt_cache_destroy(info->vgpu);
         vfree(info);
@@ -1383,12 +1386,14 @@ static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
         unsigned long iova, pfn;
         struct kvmgt_guest_info *info;
         struct device *dev;
+        struct intel_vgpu *vgpu;
         int rc;
 
         if (!handle_valid(handle))
                 return INTEL_GVT_INVALID_ADDR;
 
         info = (struct kvmgt_guest_info *)handle;
+        vgpu = info->vgpu;
         iova = gvt_cache_find(info->vgpu, gfn);
         if (iova != INTEL_GVT_INVALID_ADDR)
                 return iova;
@@ -1397,13 +1402,14 @@ static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
         dev = mdev_dev(info->vgpu->vdev.mdev);
         rc = vfio_pin_pages(dev, &gfn, 1, IOMMU_READ | IOMMU_WRITE, &pfn);
         if (rc != 1) {
-                gvt_err("vfio_pin_pages failed for gfn 0x%lx: %d\n", gfn, rc);
+                gvt_vgpu_err("vfio_pin_pages failed for gfn 0x%lx: %d\n",
+                        gfn, rc);
                 return INTEL_GVT_INVALID_ADDR;
         }
         /* transfer to host iova for GFX to use DMA */
         rc = gvt_dma_map_iova(info->vgpu, pfn, &iova);
         if (rc) {
-                gvt_err("gvt_dma_map_iova failed for gfn: 0x%lx\n", gfn);
+                gvt_vgpu_err("gvt_dma_map_iova failed for gfn: 0x%lx\n", gfn);
                 vfio_unpin_pages(dev, &gfn, 1);
                 return INTEL_GVT_INVALID_ADDR;
         }
@@ -1417,7 +1423,7 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
 {
         struct kvmgt_guest_info *info;
         struct kvm *kvm;
-        int ret;
+        int idx, ret;
         bool kthread = current->mm == NULL;
 
         if (!handle_valid(handle))
@@ -1429,8 +1435,10 @@ static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
         if (kthread)
                 use_mm(kvm->mm);
 
+        idx = srcu_read_lock(&kvm->srcu);
         ret = write ? kvm_write_guest(kvm, gpa, buf, len) :
                       kvm_read_guest(kvm, gpa, buf, len);
+        srcu_read_unlock(&kvm->srcu, idx);
 
         if (kthread)
                 unuse_mm(kvm->mm);
diff --git a/drivers/gpu/drm/i915/gvt/mmio.c b/drivers/gpu/drm/i915/gvt/mmio.c
index 4df078bc5d04..1ba3bdb09341 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.c
+++ b/drivers/gpu/drm/i915/gvt/mmio.c
@@ -57,6 +57,58 @@ int intel_vgpu_gpa_to_mmio_offset(struct intel_vgpu *vgpu, u64 gpa)
         (reg >= gvt->device_info.gtt_start_offset \
          && reg < gvt->device_info.gtt_start_offset + gvt_ggtt_sz(gvt))
 
+static void failsafe_emulate_mmio_rw(struct intel_vgpu *vgpu, uint64_t pa,
+                void *p_data, unsigned int bytes, bool read)
+{
+        struct intel_gvt *gvt = NULL;
+        void *pt = NULL;
+        unsigned int offset = 0;
+
+        if (!vgpu || !p_data)
+                return;
+
+        gvt = vgpu->gvt;
+        mutex_lock(&gvt->lock);
+        offset = intel_vgpu_gpa_to_mmio_offset(vgpu, pa);
+        if (reg_is_mmio(gvt, offset)) {
+                if (read)
+                        intel_vgpu_default_mmio_read(vgpu, offset, p_data,
+                                        bytes);
+                else
+                        intel_vgpu_default_mmio_write(vgpu, offset, p_data,
+                                        bytes);
+        } else if (reg_is_gtt(gvt, offset) &&
+                        vgpu->gtt.ggtt_mm->virtual_page_table) {
+                offset -= gvt->device_info.gtt_start_offset;
+                pt = vgpu->gtt.ggtt_mm->virtual_page_table + offset;
+                if (read)
+                        memcpy(p_data, pt, bytes);
+                else
+                        memcpy(pt, p_data, bytes);
+
+        } else if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
+                struct intel_vgpu_guest_page *gp;
+
+                /* Since we enter the failsafe mode early during guest boot,
+                 * guest may not have chance to set up its ppgtt table, so
+                 * there should not be any wp pages for guest. Keep the wp
+                 * related code here in case we need to handle it in furture.
+                 */
+                gp = intel_vgpu_find_guest_page(vgpu, pa >> PAGE_SHIFT);
+                if (gp) {
+                        /* remove write protection to prevent furture traps */
+                        intel_vgpu_clean_guest_page(vgpu, gp);
+                        if (read)
+                                intel_gvt_hypervisor_read_gpa(vgpu, pa,
+                                                p_data, bytes);
+                        else
+                                intel_gvt_hypervisor_write_gpa(vgpu, pa,
+                                                p_data, bytes);
+                }
+        }
+        mutex_unlock(&gvt->lock);
+}
+
 /**
  * intel_vgpu_emulate_mmio_read - emulate MMIO read
  * @vgpu: a vGPU
@@ -75,6 +127,11 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         unsigned int offset = 0;
         int ret = -EINVAL;
 
+
+        if (vgpu->failsafe) {
+                failsafe_emulate_mmio_rw(vgpu, pa, p_data, bytes, true);
+                return 0;
+        }
         mutex_lock(&gvt->lock);
 
         if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
@@ -85,10 +142,10 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                         ret = intel_gvt_hypervisor_read_gpa(vgpu, pa,
                                         p_data, bytes);
                         if (ret) {
-                                gvt_err("vgpu%d: guest page read error %d, "
+                                gvt_vgpu_err("guest page read error %d, "
                                         "gfn 0x%lx, pa 0x%llx, var 0x%x, len %d\n",
-                                        vgpu->id, ret,
-                                        gp->gfn, pa, *(u32 *)p_data, bytes);
+                                        ret, gp->gfn, pa, *(u32 *)p_data,
+                                        bytes);
                         }
                         mutex_unlock(&gvt->lock);
                         return ret;
@@ -143,14 +200,13 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
                 ret = intel_vgpu_default_mmio_read(vgpu, offset, p_data, bytes);
 
                 if (!vgpu->mmio.disable_warn_untrack) {
-                        gvt_err("vgpu%d: read untracked MMIO %x(%dB) val %x\n",
-                                vgpu->id, offset, bytes, *(u32 *)p_data);
+                        gvt_vgpu_err("read untracked MMIO %x(%dB) val %x\n",
+                                offset, bytes, *(u32 *)p_data);
 
                         if (offset == 0x206c) {
-                                gvt_err("------------------------------------------\n");
-                                gvt_err("vgpu%d: likely triggers a gfx reset\n",
-                                        vgpu->id);
-                                gvt_err("------------------------------------------\n");
+                                gvt_vgpu_err("------------------------------------------\n");
+                                gvt_vgpu_err("likely triggers a gfx reset\n");
+                                gvt_vgpu_err("------------------------------------------\n");
                                 vgpu->mmio.disable_warn_untrack = true;
                         }
                 }
@@ -163,8 +219,8 @@ int intel_vgpu_emulate_mmio_read(struct intel_vgpu *vgpu, uint64_t pa,
         mutex_unlock(&gvt->lock);
         return 0;
 err:
-        gvt_err("vgpu%d: fail to emulate MMIO read %08x len %d\n",
-                        vgpu->id, offset, bytes);
+        gvt_vgpu_err("fail to emulate MMIO read %08x len %d\n",
+                        offset, bytes);
         mutex_unlock(&gvt->lock);
         return ret;
 }
@@ -188,6 +244,11 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
         u32 old_vreg = 0, old_sreg = 0;
         int ret = -EINVAL;
 
+        if (vgpu->failsafe) {
+                failsafe_emulate_mmio_rw(vgpu, pa, p_data, bytes, false);
+                return 0;
+        }
+
         mutex_lock(&gvt->lock);
 
         if (atomic_read(&vgpu->gtt.n_write_protected_guest_page)) {
@@ -197,10 +258,11 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
                 if (gp) {
                         ret = gp->handler(gp, pa, p_data, bytes);
                         if (ret) {
-                                gvt_err("vgpu%d: guest page write error %d, "
-                                        "gfn 0x%lx, pa 0x%llx, var 0x%x, len %d\n",
-                                        vgpu->id, ret,
-                                        gp->gfn, pa, *(u32 *)p_data, bytes);
+                                gvt_err("guest page write error %d, "
+                                        "gfn 0x%lx, pa 0x%llx, "
+                                        "var 0x%x, len %d\n",
+                                        ret, gp->gfn, pa,
+                                        *(u32 *)p_data, bytes);
                         }
                         mutex_unlock(&gvt->lock);
                         return ret;
@@ -236,7 +298,7 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
 
         mmio = intel_gvt_find_mmio_info(gvt, rounddown(offset, 4));
         if (!mmio && !vgpu->mmio.disable_warn_untrack)
-                gvt_err("vgpu%d: write untracked MMIO %x len %d val %x\n",
+                gvt_dbg_mmio("vgpu%d: write untracked MMIO %x len %d val %x\n",
                                 vgpu->id, offset, bytes, *(u32 *)p_data);
 
         if (!intel_gvt_mmio_is_unalign(gvt, offset)) {
@@ -267,8 +329,8 @@ int intel_vgpu_emulate_mmio_write(struct intel_vgpu *vgpu, uint64_t pa,
 
                         /* all register bits are RO. */
                         if (ro_mask == ~(u64)0) {
-                                gvt_err("vgpu%d: try to write RO reg %x\n",
-                                                vgpu->id, offset);
+                                gvt_vgpu_err("try to write RO reg %x\n",
+                                        offset);
                                 ret = 0;
                                 goto out;
                         }
@@ -298,8 +360,8 @@ out:
         mutex_unlock(&gvt->lock);
         return 0;
 err:
-        gvt_err("vgpu%d: fail to emulate MMIO write %08x len %d\n",
-                        vgpu->id, offset, bytes);
+        gvt_vgpu_err("fail to emulate MMIO write %08x len %d\n", offset,
+                     bytes);
         mutex_unlock(&gvt->lock);
         return ret;
 }
@@ -322,6 +384,8 @@ void intel_vgpu_reset_mmio(struct intel_vgpu *vgpu)
 
         /* set the bit 0:2(Core C-State ) to C0 */
         vgpu_vreg(vgpu, GEN6_GT_CORE_STATUS) = 0;
+
+        vgpu->mmio.disable_warn_untrack = false;
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index 3bc620f56f35..a3a027025cd0 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -107,4 +107,7 @@ int intel_vgpu_default_mmio_read(struct intel_vgpu *vgpu, unsigned int offset,
                                  void *p_data, unsigned int bytes);
 int intel_vgpu_default_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
                                   void *p_data, unsigned int bytes);
+
+bool intel_gvt_in_force_nonpriv_whitelist(struct intel_gvt *gvt,
+                                          unsigned int offset);
 #endif
diff --git a/drivers/gpu/drm/i915/gvt/opregion.c b/drivers/gpu/drm/i915/gvt/opregion.c
index d9fb41ab7119..311799136d7f 100644
--- a/drivers/gpu/drm/i915/gvt/opregion.c
+++ b/drivers/gpu/drm/i915/gvt/opregion.c
@@ -27,7 +27,6 @@
 
 static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
 {
-        void __iomem *host_va = vgpu->gvt->opregion.opregion_va;
         u8 *buf;
         int i;
 
@@ -43,8 +42,8 @@ static int init_vgpu_opregion(struct intel_vgpu *vgpu, u32 gpa)
         if (!vgpu_opregion(vgpu)->va)
                 return -ENOMEM;
 
-        memcpy_fromio(vgpu_opregion(vgpu)->va, host_va,
-                        INTEL_GVT_OPREGION_SIZE);
+        memcpy(vgpu_opregion(vgpu)->va, vgpu->gvt->opregion.opregion_va,
+               INTEL_GVT_OPREGION_SIZE);
 
         for (i = 0; i < INTEL_GVT_OPREGION_PAGES; i++)
                 vgpu_opregion(vgpu)->gfn[i] = (gpa >> PAGE_SHIFT) + i;
@@ -68,14 +67,15 @@ static int map_vgpu_opregion(struct intel_vgpu *vgpu, bool map)
                 mfn = intel_gvt_hypervisor_virt_to_mfn(vgpu_opregion(vgpu)->va
                         + i * PAGE_SIZE);
                 if (mfn == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("fail to get MFN from VA\n");
+                        gvt_vgpu_err("fail to get MFN from VA\n");
                         return -EINVAL;
                 }
                 ret = intel_gvt_hypervisor_map_gfn_to_mfn(vgpu,
                                 vgpu_opregion(vgpu)->gfn[i],
                                 mfn, 1, map);
                 if (ret) {
-                        gvt_err("fail to map GFN to MFN, errno: %d\n", ret);
+                        gvt_vgpu_err("fail to map GFN to MFN, errno: %d\n",
+                                ret);
                         return ret;
                 }
         }
@@ -288,7 +288,7 @@ int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci)
         parm = vgpu_opregion(vgpu)->va + INTEL_GVT_OPREGION_PARM;
 
         if (!(swsci & SWSCI_SCI_SELECT)) {
-                gvt_err("vgpu%d: requesting SMI service\n", vgpu->id);
+                gvt_vgpu_err("requesting SMI service\n");
                 return 0;
         }
         /* ignore non 0->1 trasitions */
@@ -301,9 +301,8 @@ int intel_vgpu_emulate_opregion_request(struct intel_vgpu *vgpu, u32 swsci)
         func = GVT_OPREGION_FUNC(*scic);
         subfunc = GVT_OPREGION_SUBFUNC(*scic);
         if (!querying_capabilities(*scic)) {
-                gvt_err("vgpu%d: requesting runtime service: func \"%s\","
+                gvt_vgpu_err("requesting runtime service: func \"%s\","
                                 " subfunc \"%s\"\n",
-                                vgpu->id,
                                 opregion_func_name(func),
                                 opregion_subfunc_name(subfunc));
                 /*
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index 2b3a642284b6..0beb83563b08 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -53,6 +53,14 @@ static struct render_mmio gen8_render_mmio_list[] = {
         {RCS, _MMIO(0x24d4), 0, false},
         {RCS, _MMIO(0x24d8), 0, false},
         {RCS, _MMIO(0x24dc), 0, false},
+        {RCS, _MMIO(0x24e0), 0, false},
+        {RCS, _MMIO(0x24e4), 0, false},
+        {RCS, _MMIO(0x24e8), 0, false},
+        {RCS, _MMIO(0x24ec), 0, false},
+        {RCS, _MMIO(0x24f0), 0, false},
+        {RCS, _MMIO(0x24f4), 0, false},
+        {RCS, _MMIO(0x24f8), 0, false},
+        {RCS, _MMIO(0x24fc), 0, false},
         {RCS, _MMIO(0x7004), 0xffff, true},
         {RCS, _MMIO(0x7008), 0xffff, true},
         {RCS, _MMIO(0x7000), 0xffff, true},
@@ -76,6 +84,14 @@ static struct render_mmio gen9_render_mmio_list[] = {
         {RCS, _MMIO(0x24d4), 0, false},
         {RCS, _MMIO(0x24d8), 0, false},
         {RCS, _MMIO(0x24dc), 0, false},
+        {RCS, _MMIO(0x24e0), 0, false},
+        {RCS, _MMIO(0x24e4), 0, false},
+        {RCS, _MMIO(0x24e8), 0, false},
+        {RCS, _MMIO(0x24ec), 0, false},
+        {RCS, _MMIO(0x24f0), 0, false},
+        {RCS, _MMIO(0x24f4), 0, false},
+        {RCS, _MMIO(0x24f8), 0, false},
+        {RCS, _MMIO(0x24fc), 0, false},
         {RCS, _MMIO(0x7004), 0xffff, true},
         {RCS, _MMIO(0x7008), 0xffff, true},
         {RCS, _MMIO(0x7000), 0xffff, true},
@@ -151,7 +167,7 @@ static void handle_tlb_pending_event(struct intel_vgpu *vgpu, int ring_id)
         I915_WRITE_FW(reg, 0x1);
 
         if (wait_for_atomic((I915_READ_FW(reg) == 0), 50))
-                gvt_err("timeout in invalidate ring (%d) tlb\n", ring_id);
+                gvt_vgpu_err("timeout in invalidate ring (%d) tlb\n", ring_id);
         else
                 vgpu_vreg(vgpu, regs[ring_id]) = 0;
 
@@ -191,7 +207,7 @@ static void load_mocs(struct intel_vgpu *vgpu, int ring_id)
                 l3_offset.reg = 0xb020;
                 for (i = 0; i < 32; i++) {
                         gen9_render_mocs_L3[i] = I915_READ(l3_offset);
-                        I915_WRITE(l3_offset, vgpu_vreg(vgpu, offset));
+                        I915_WRITE(l3_offset, vgpu_vreg(vgpu, l3_offset));
                         POSTING_READ(l3_offset);
                         l3_offset.reg += 4;
                 }
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 06c9584ac5f0..34b9acdf3479 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -101,7 +101,7 @@ struct tbs_sched_data {
         struct list_head runq_head;
 };
 
-#define GVT_DEFAULT_TIME_SLICE (1 * HZ / 1000)
+#define GVT_DEFAULT_TIME_SLICE (msecs_to_jiffies(1))
 
 static void tbs_sched_func(struct work_struct *work)
 {
@@ -223,7 +223,7 @@ static void tbs_sched_start_schedule(struct intel_vgpu *vgpu)
                 return;
 
         list_add_tail(&vgpu_data->list, &sched_data->runq_head);
-        schedule_delayed_work(&sched_data->work, sched_data->period);
+        schedule_delayed_work(&sched_data->work, 0);
 }
 
 static void tbs_sched_stop_schedule(struct intel_vgpu *vgpu)
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c
index d6b6d0efdd1a..a44782412f2c 100644
--- a/drivers/gpu/drm/i915/gvt/scheduler.c
+++ b/drivers/gpu/drm/i915/gvt/scheduler.c
@@ -84,7 +84,7 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
                                 (u32)((workload->ctx_desc.lrca + i) <<
                                 GTT_PAGE_SHIFT));
                 if (context_gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("Invalid guest context descriptor\n");
+                        gvt_vgpu_err("Invalid guest context descriptor\n");
                         return -EINVAL;
                 }
 
@@ -127,18 +127,24 @@ static int populate_shadow_context(struct intel_vgpu_workload *workload)
         return 0;
 }
 
+static inline bool is_gvt_request(struct drm_i915_gem_request *req)
+{
+        return i915_gem_context_force_single_submission(req->ctx);
+}
+
 static int shadow_context_status_change(struct notifier_block *nb,
                 unsigned long action, void *data)
 {
-        struct intel_vgpu *vgpu = container_of(nb,
-                        struct intel_vgpu, shadow_ctx_notifier_block);
-        struct drm_i915_gem_request *req =
-                (struct drm_i915_gem_request *)data;
-        struct intel_gvt_workload_scheduler *scheduler =
-                &vgpu->gvt->scheduler;
+        struct drm_i915_gem_request *req = (struct drm_i915_gem_request *)data;
+        struct intel_gvt *gvt = container_of(nb, struct intel_gvt,
+                                shadow_ctx_notifier_block[req->engine->id]);
+        struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload =
                 scheduler->current_workload[req->engine->id];
 
+        if (!is_gvt_request(req) || unlikely(!workload))
+                return NOTIFY_OK;
+
         switch (action) {
         case INTEL_CONTEXT_SCHEDULE_IN:
                 intel_gvt_load_render_mmio(workload->vgpu,
@@ -148,6 +154,15 @@ static int shadow_context_status_change(struct notifier_block *nb,
         case INTEL_CONTEXT_SCHEDULE_OUT:
                 intel_gvt_restore_render_mmio(workload->vgpu,
                                               workload->ring_id);
+                /* If the status is -EINPROGRESS means this workload
+                 * doesn't meet any issue during dispatching so when
+                 * get the SCHEDULE_OUT set the status to be zero for
+                 * good. If the status is NOT -EINPROGRESS means there
+                 * is something wrong happened during dispatching and
+                 * the status should not be set to zero
+                 */
+                if (workload->status == -EINPROGRESS)
+                        workload->status = 0;
                 atomic_set(&workload->shadow_ctx_active, 0);
                 break;
         default:
@@ -163,7 +178,9 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         int ring_id = workload->ring_id;
         struct i915_gem_context *shadow_ctx = workload->vgpu->shadow_ctx;
         struct drm_i915_private *dev_priv = workload->vgpu->gvt->dev_priv;
+        struct intel_engine_cs *engine = dev_priv->engine[ring_id];
         struct drm_i915_gem_request *rq;
+        struct intel_vgpu *vgpu = workload->vgpu;
         int ret;
 
         gvt_dbg_sched("ring id %d prepare to dispatch workload %p\n",
@@ -175,9 +192,24 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
 
         mutex_lock(&dev_priv->drm.struct_mutex);
 
+        /* pin shadow context by gvt even the shadow context will be pinned
+         * when i915 alloc request. That is because gvt will update the guest
+         * context from shadow context when workload is completed, and at that
+         * moment, i915 may already unpined the shadow context to make the
+         * shadow_ctx pages invalid. So gvt need to pin itself. After update
+         * the guest context, gvt can unpin the shadow_ctx safely.
+         */
+        ret = engine->context_pin(engine, shadow_ctx);
+        if (ret) {
+                gvt_vgpu_err("fail to pin shadow context\n");
+                workload->status = ret;
+                mutex_unlock(&dev_priv->drm.struct_mutex);
+                return ret;
+        }
+
         rq = i915_gem_request_alloc(dev_priv->engine[ring_id], shadow_ctx);
         if (IS_ERR(rq)) {
-                gvt_err("fail to allocate gem request\n");
+                gvt_vgpu_err("fail to allocate gem request\n");
                 ret = PTR_ERR(rq);
                 goto out;
         }
@@ -190,9 +222,12 @@ static int dispatch_workload(struct intel_vgpu_workload *workload)
         if (ret)
                 goto out;
 
-        ret = intel_gvt_scan_and_shadow_wa_ctx(&workload->wa_ctx);
-        if (ret)
-                goto out;
+        if ((workload->ring_id == RCS) &&
+            (workload->wa_ctx.indirect_ctx.size != 0)) {
+                ret = intel_gvt_scan_and_shadow_wa_ctx(&workload->wa_ctx);
+                if (ret)
+                        goto out;
+        }
 
         ret = populate_shadow_context(workload);
         if (ret)
@@ -215,6 +250,9 @@ out:
 
         if (!IS_ERR_OR_NULL(rq))
                 i915_add_request_no_flush(rq);
+        else
+                engine->context_unpin(engine, shadow_ctx);
+
         mutex_unlock(&dev_priv->drm.struct_mutex);
         return ret;
 }
@@ -310,7 +348,7 @@ static void update_guest_context(struct intel_vgpu_workload *workload)
                                 (u32)((workload->ctx_desc.lrca + i) <<
                                         GTT_PAGE_SHIFT));
                 if (context_gpa == INTEL_GVT_INVALID_ADDR) {
-                        gvt_err("invalid guest context descriptor\n");
+                        gvt_vgpu_err("invalid guest context descriptor\n");
                         return;
                 }
 
@@ -359,15 +397,31 @@ static void complete_current_workload(struct intel_gvt *gvt, int ring_id)
         workload = scheduler->current_workload[ring_id];
         vgpu = workload->vgpu;
 
-        if (!workload->status && !vgpu->resetting) {
+        /* For the workload w/ request, needs to wait for the context
+         * switch to make sure request is completed.
+         * For the workload w/o request, directly complete the workload.
+         */
+        if (workload->req) {
+                struct drm_i915_private *dev_priv =
+                        workload->vgpu->gvt->dev_priv;
+                struct intel_engine_cs *engine =
+                        dev_priv->engine[workload->ring_id];
                 wait_event(workload->shadow_ctx_status_wq,
                            !atomic_read(&workload->shadow_ctx_active));
 
-                update_guest_context(workload);
+                i915_gem_request_put(fetch_and_zero(&workload->req));
+
+                if (!workload->status && !vgpu->resetting) {
+                        update_guest_context(workload);
 
-                for_each_set_bit(event, workload->pending_events,
-                                 INTEL_GVT_EVENT_MAX)
-                        intel_vgpu_trigger_virtual_event(vgpu, event);
+                        for_each_set_bit(event, workload->pending_events,
+                                         INTEL_GVT_EVENT_MAX)
+                                intel_vgpu_trigger_virtual_event(vgpu, event);
+                }
+                mutex_lock(&dev_priv->drm.struct_mutex);
+                /* unpin shadow ctx as the shadow_ctx update is done */
+                engine->context_unpin(engine, workload->vgpu->shadow_ctx);
+                mutex_unlock(&dev_priv->drm.struct_mutex);
         }
 
         gvt_dbg_sched("ring id %d complete workload %p status %d\n",
@@ -397,7 +451,7 @@ static int workload_thread(void *priv)
         int ring_id = p->ring_id;
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct intel_vgpu_workload *workload = NULL;
-        long lret;
+        struct intel_vgpu *vgpu = NULL;
         int ret;
         bool need_force_wake = IS_SKYLAKE(gvt->dev_priv);
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
@@ -440,29 +494,19 @@ static int workload_thread(void *priv)
                 mutex_unlock(&gvt->lock);
 
                 if (ret) {
-                        gvt_err("fail to dispatch workload, skip\n");
+                        vgpu = workload->vgpu;
+                        gvt_vgpu_err("fail to dispatch workload, skip\n");
                         goto complete;
                 }
 
                 gvt_dbg_sched("ring id %d wait workload %p\n",
                                 workload->ring_id, workload);
-
-                lret = i915_wait_request(workload->req,
-                                         0, MAX_SCHEDULE_TIMEOUT);
-                if (lret < 0) {
-                        workload->status = lret;
-                        gvt_err("fail to wait workload, skip\n");
-                } else {
-                        workload->status = 0;
-                }
+                i915_wait_request(workload->req, 0, MAX_SCHEDULE_TIMEOUT);
 
 complete:
                 gvt_dbg_sched("will complete workload %p, status: %d\n",
                                 workload, workload->status);
 
-                if (workload->req)
-                        i915_gem_request_put(fetch_and_zero(&workload->req));
-
                 complete_current_workload(gvt, ring_id);
 
                 if (need_force_wake)
@@ -493,15 +537,16 @@ void intel_gvt_wait_vgpu_idle(struct intel_vgpu *vgpu)
 void intel_gvt_clean_workload_scheduler(struct intel_gvt *gvt)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
-        int i;
+        struct intel_engine_cs *engine;
+        enum intel_engine_id i;
 
         gvt_dbg_core("clean workload scheduler\n");
 
-        for (i = 0; i < I915_NUM_ENGINES; i++) {
-                if (scheduler->thread[i]) {
-                        kthread_stop(scheduler->thread[i]);
-                        scheduler->thread[i] = NULL;
-                }
+        for_each_engine(engine, gvt->dev_priv, i) {
+                atomic_notifier_chain_unregister(
+                                        &engine->context_status_notifier,
+                                        &gvt->shadow_ctx_notifier_block[i]);
+                kthread_stop(scheduler->thread[i]);
         }
 }
 
@@ -509,18 +554,15 @@ int intel_gvt_init_workload_scheduler(struct intel_gvt *gvt)
 {
         struct intel_gvt_workload_scheduler *scheduler = &gvt->scheduler;
         struct workload_thread_param *param = NULL;
+        struct intel_engine_cs *engine;
+        enum intel_engine_id i;
         int ret;
-        int i;
 
         gvt_dbg_core("init workload scheduler\n");
 
         init_waitqueue_head(&scheduler->workload_complete_wq);
 
-        for (i = 0; i < I915_NUM_ENGINES; i++) {
-                /* check ring mask at init time */
-                if (!HAS_ENGINE(gvt->dev_priv, i))
-                        continue;
-
+        for_each_engine(engine, gvt->dev_priv, i) {
                 init_waitqueue_head(&scheduler->waitq[i]);
 
                 param = kzalloc(sizeof(*param), GFP_KERNEL);
@@ -539,6 +581,11 @@ int intel_gvt_init_workload_scheduler(struct intel_gvt *gvt)
                         ret = PTR_ERR(scheduler->thread[i]);
                         goto err;
                 }
+
+                gvt->shadow_ctx_notifier_block[i].notifier_call =
+                                        shadow_context_status_change;
+                atomic_notifier_chain_register(&engine->context_status_notifier,
+                                        &gvt->shadow_ctx_notifier_block[i]);
         }
         return 0;
 err:
@@ -550,9 +597,6 @@ err:
 
 void intel_vgpu_clean_gvt_context(struct intel_vgpu *vgpu)
 {
-        atomic_notifier_chain_unregister(&vgpu->shadow_ctx->status_notifier,
-                        &vgpu->shadow_ctx_notifier_block);
-
         i915_gem_context_put_unlocked(vgpu->shadow_ctx);
 }
 
@@ -567,10 +611,5 @@ int intel_vgpu_init_gvt_context(struct intel_vgpu *vgpu)
 
         vgpu->shadow_ctx->engine[RCS].initialised = true;
 
-        vgpu->shadow_ctx_notifier_block.notifier_call =
-                shadow_context_status_change;
-
-        atomic_notifier_chain_register(&vgpu->shadow_ctx->status_notifier,
-                                       &vgpu->shadow_ctx_notifier_block);
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c
index 95a97aa0051e..649ef280cc9a 100644
--- a/drivers/gpu/drm/i915/gvt/vgpu.c
+++ b/drivers/gpu/drm/i915/gvt/vgpu.c
@@ -64,6 +64,20 @@ void populate_pvinfo_page(struct intel_vgpu *vgpu)
         WARN_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 }
 
+static struct {
+        unsigned int low_mm;
+        unsigned int high_mm;
+        unsigned int fence;
+        enum intel_vgpu_edid edid;
+        char *name;
+} vgpu_types[] = {
+/* Fixed vGPU type table */
+        { MB_TO_BYTES(64), MB_TO_BYTES(384), 4, GVT_EDID_1024_768, "8" },
+        { MB_TO_BYTES(128), MB_TO_BYTES(512), 4, GVT_EDID_1920_1200, "4" },
+        { MB_TO_BYTES(256), MB_TO_BYTES(1024), 4, GVT_EDID_1920_1200, "2" },
+        { MB_TO_BYTES(512), MB_TO_BYTES(2048), 4, GVT_EDID_1920_1200, "1" },
+};
+
 /**
  * intel_gvt_init_vgpu_types - initialize vGPU type list
  * @gvt : GVT device
@@ -78,9 +92,8 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
         unsigned int min_low;
 
         /* vGPU type name is defined as GVTg_Vx_y which contains
-         * physical GPU generation type and 'y' means maximum vGPU
-         * instances user can create on one physical GPU for this
-         * type.
+         * physical GPU generation type (e.g V4 as BDW server, V5 as
+         * SKL server).
          *
          * Depend on physical SKU resource, might see vGPU types like
          * GVTg_V4_8, GVTg_V4_4, GVTg_V4_2, etc. We can create
@@ -92,7 +105,7 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
          */
         low_avail = gvt_aperture_sz(gvt) - HOST_LOW_GM_SIZE;
         high_avail = gvt_hidden_sz(gvt) - HOST_HIGH_GM_SIZE;
-        num_types = 4;
+        num_types = sizeof(vgpu_types) / sizeof(vgpu_types[0]);
 
         gvt->types = kzalloc(num_types * sizeof(struct intel_vgpu_type),
                              GFP_KERNEL);
@@ -101,28 +114,29 @@ int intel_gvt_init_vgpu_types(struct intel_gvt *gvt)
 
         min_low = MB_TO_BYTES(32);
         for (i = 0; i < num_types; ++i) {
-                if (low_avail / min_low == 0)
+                if (low_avail / vgpu_types[i].low_mm == 0)
                         break;
-                gvt->types[i].low_gm_size = min_low;
-                gvt->types[i].high_gm_size = max((min_low<<3), MB_TO_BYTES(384U));
-                gvt->types[i].fence = 4;
-                gvt->types[i].max_instance = min(low_avail / min_low,
-                                                 high_avail / gvt->types[i].high_gm_size);
-                gvt->types[i].avail_instance = gvt->types[i].max_instance;
+
+                gvt->types[i].low_gm_size = vgpu_types[i].low_mm;
+                gvt->types[i].high_gm_size = vgpu_types[i].high_mm;
+                gvt->types[i].fence = vgpu_types[i].fence;
+                gvt->types[i].resolution = vgpu_types[i].edid;
+                gvt->types[i].avail_instance = min(low_avail / vgpu_types[i].low_mm,
+                                                   high_avail / vgpu_types[i].high_mm);
 
                 if (IS_GEN8(gvt->dev_priv))
-                        sprintf(gvt->types[i].name, "GVTg_V4_%u",
-                                                gvt->types[i].max_instance);
+                        sprintf(gvt->types[i].name, "GVTg_V4_%s",
+                                                vgpu_types[i].name);
                 else if (IS_GEN9(gvt->dev_priv))
-                        sprintf(gvt->types[i].name, "GVTg_V5_%u",
-                                                gvt->types[i].max_instance);
+                        sprintf(gvt->types[i].name, "GVTg_V5_%s",
+                                                vgpu_types[i].name);
 
-                min_low <<= 1;
-                gvt_dbg_core("type[%d]: %s max %u avail %u low %u high %u fence %u\n",
-                             i, gvt->types[i].name, gvt->types[i].max_instance,
+                gvt_dbg_core("type[%d]: %s avail %u low %u high %u fence %u res %s\n",
+                             i, gvt->types[i].name,
                              gvt->types[i].avail_instance,
                              gvt->types[i].low_gm_size,
-                             gvt->types[i].high_gm_size, gvt->types[i].fence);
+                             gvt->types[i].high_gm_size, gvt->types[i].fence,
+                             vgpu_edid_str(gvt->types[i].resolution));
         }
 
         gvt->num_types = i;
@@ -138,7 +152,7 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
 {
         int i;
         unsigned int low_gm_avail, high_gm_avail, fence_avail;
-        unsigned int low_gm_min, high_gm_min, fence_min, total_min;
+        unsigned int low_gm_min, high_gm_min, fence_min;
 
         /* Need to depend on maxium hw resource size but keep on
          * static config for now.
@@ -154,32 +168,45 @@ static void intel_gvt_update_vgpu_types(struct intel_gvt *gvt)
                 low_gm_min = low_gm_avail / gvt->types[i].low_gm_size;
                 high_gm_min = high_gm_avail / gvt->types[i].high_gm_size;
                 fence_min = fence_avail / gvt->types[i].fence;
-                total_min = min(min(low_gm_min, high_gm_min), fence_min);
-                gvt->types[i].avail_instance = min(gvt->types[i].max_instance,
-                                                   total_min);
+                gvt->types[i].avail_instance = min(min(low_gm_min, high_gm_min),
+                                                   fence_min);
 
-                gvt_dbg_core("update type[%d]: %s max %u avail %u low %u high %u fence %u\n",
-                       i, gvt->types[i].name, gvt->types[i].max_instance,
+                gvt_dbg_core("update type[%d]: %s avail %u low %u high %u fence %u\n",
+                       i, gvt->types[i].name,
                        gvt->types[i].avail_instance, gvt->types[i].low_gm_size,
                        gvt->types[i].high_gm_size, gvt->types[i].fence);
         }
 }
 
 /**
- * intel_gvt_destroy_vgpu - destroy a virtual GPU
+ * intel_gvt_active_vgpu - activate a virtual GPU
  * @vgpu: virtual GPU
  *
- * This function is called when user wants to destroy a virtual GPU.
+ * This function is called when user wants to activate a virtual GPU.
  *
  */
-void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+void intel_gvt_activate_vgpu(struct intel_vgpu *vgpu)
+{
+        mutex_lock(&vgpu->gvt->lock);
+        vgpu->active = true;
+        mutex_unlock(&vgpu->gvt->lock);
+}
+
+/**
+ * intel_gvt_deactive_vgpu - deactivate a virtual GPU
+ * @vgpu: virtual GPU
+ *
+ * This function is called when user wants to deactivate a virtual GPU.
+ * All virtual GPU runtime information will be destroyed.
+ *
+ */
+void intel_gvt_deactivate_vgpu(struct intel_vgpu *vgpu)
 {
         struct intel_gvt *gvt = vgpu->gvt;
 
         mutex_lock(&gvt->lock);
 
         vgpu->active = false;
-        idr_remove(&gvt->vgpu_idr, vgpu->id);
 
         if (atomic_read(&vgpu->running_workload_num)) {
                 mutex_unlock(&gvt->lock);
@@ -188,6 +215,26 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
         }
 
         intel_vgpu_stop_schedule(vgpu);
+
+        mutex_unlock(&gvt->lock);
+}
+
+/**
+ * intel_gvt_destroy_vgpu - destroy a virtual GPU
+ * @vgpu: virtual GPU
+ *
+ * This function is called when user wants to destroy a virtual GPU.
+ *
+ */
+void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu)
+{
+        struct intel_gvt *gvt = vgpu->gvt;
+
+        mutex_lock(&gvt->lock);
+
+        WARN(vgpu->active, "vGPU is still active!\n");
+
+        idr_remove(&gvt->vgpu_idr, vgpu->id);
         intel_vgpu_clean_sched_policy(vgpu);
         intel_vgpu_clean_gvt_context(vgpu);
         intel_vgpu_clean_execlist(vgpu);
@@ -248,7 +295,7 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         if (ret)
                 goto out_detach_hypervisor_vgpu;
 
-        ret = intel_vgpu_init_display(vgpu);
+        ret = intel_vgpu_init_display(vgpu, param->resolution);
         if (ret)
                 goto out_clean_gtt;
 
@@ -264,7 +311,6 @@ static struct intel_vgpu *__intel_gvt_create_vgpu(struct intel_gvt *gvt,
         if (ret)
                 goto out_clean_shadow_ctx;
 
-        vgpu->active = true;
         mutex_unlock(&gvt->lock);
 
         return vgpu;
@@ -312,6 +358,7 @@ struct intel_vgpu *intel_gvt_create_vgpu(struct intel_gvt *gvt,
         param.low_gm_sz = type->low_gm_size;
         param.high_gm_sz = type->high_gm_size;
         param.fence_sz = type->fence;
+        param.resolution = type->resolution;
 
         /* XXX current param based on MB */
         param.low_gm_sz = BYTES_TO_MB(param.low_gm_sz);
@@ -387,8 +434,12 @@ void intel_gvt_reset_vgpu_locked(struct intel_vgpu *vgpu, bool dmlr,
                 populate_pvinfo_page(vgpu);
                 intel_vgpu_reset_display(vgpu);
 
-                if (dmlr)
+                if (dmlr) {
                         intel_vgpu_reset_cfg_space(vgpu);
+                        /* only reset the failsafe mode when dmlr reset */
+                        vgpu->failsafe = false;
+                        vgpu->pv_notified = false;
+                }
         }
 
         vgpu->resetting = false;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index e703556eba99..5c089b3c2a7e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -248,6 +248,7 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_IRQ_ACTIVE:
         case I915_PARAM_ALLOW_BATCHBUFFER:
         case I915_PARAM_LAST_DISPATCH:
+        case I915_PARAM_HAS_EXEC_CONSTANTS:
                 /* Reject all old ums/dri params. */
                 return -ENODEV;
         case I915_PARAM_CHIPSET_ID:
@@ -274,9 +275,6 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_HAS_BSD2:
                 value = !!dev_priv->engine[VCS2];
                 break;
-        case I915_PARAM_HAS_EXEC_CONSTANTS:
-                value = INTEL_GEN(dev_priv) >= 4;
-                break;
         case I915_PARAM_HAS_LLC:
                 value = HAS_LLC(dev_priv);
                 break;
@@ -1436,8 +1434,6 @@ static int i915_drm_suspend(struct drm_device *dev)
                 goto out;
         }
 
-        intel_guc_suspend(dev_priv);
-
         intel_display_suspend(dev);
 
         intel_dp_mst_suspend(dev);
@@ -1788,7 +1784,7 @@ void i915_reset(struct drm_i915_private *dev_priv)
                 goto error;
         }
 
-        i915_gem_reset_finish(dev_priv);
+        i915_gem_reset(dev_priv);
         intel_overlay_reset(dev_priv);
 
         /* Ok, now get things going again... */
@@ -1814,6 +1810,7 @@ void i915_reset(struct drm_i915_private *dev_priv)
         i915_queue_hangcheck(dev_priv);
 
 wakeup:
+        i915_gem_reset_finish(dev_priv);
         enable_irq(dev_priv->drm.irq);
         wake_up_bit(&error->flags, I915_RESET_IN_PROGRESS);
         return;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 0a4b42d31391..46fcd8b7080a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -293,6 +293,7 @@ enum plane_id {
         PLANE_PRIMARY,
         PLANE_SPRITE0,
         PLANE_SPRITE1,
+        PLANE_SPRITE2,
         PLANE_CURSOR,
         I915_MAX_PLANES,
 };
@@ -805,6 +806,7 @@ struct intel_csr {
         func(has_resource_streamer); \
         func(has_runtime_pm); \
         func(has_snoop); \
+        func(unfenced_needs_alignment); \
         func(cursor_needs_physical); \
         func(hws_needs_physical); \
         func(overlay_needs_physical); \
@@ -1324,7 +1326,7 @@ struct intel_gen6_power_mgmt {
         unsigned boosts;
 
         /* manual wa residency calculations */
-        struct intel_rps_ei up_ei, down_ei;
+        struct intel_rps_ei ei;
 
         /*
          * Protects RPS/RC6 register access and PCU communication.
@@ -2063,8 +2065,6 @@ struct drm_i915_private {
 
         const struct intel_device_info info;
 
-        int relative_constants_mode;
-
         void __iomem *regs;
 
         struct intel_uncore uncore;
@@ -3341,6 +3341,7 @@ static inline u32 i915_reset_count(struct i915_gpu_error *error)
 }
 
 int i915_gem_reset_prepare(struct drm_i915_private *dev_priv);
+void i915_gem_reset(struct drm_i915_private *dev_priv);
 void i915_gem_reset_finish(struct drm_i915_private *dev_priv);
 void i915_gem_set_wedged(struct drm_i915_private *dev_priv);
 void i915_gem_clflush_object(struct drm_i915_gem_object *obj, bool force);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 6908123162d1..fe531f904062 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1434,6 +1434,12 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 
         trace_i915_gem_object_pwrite(obj, args->offset, args->size);
 
+        ret = -ENODEV;
+        if (obj->ops->pwrite)
+                ret = obj->ops->pwrite(obj, args);
+        if (ret != -ENODEV)
+                goto err;
+
         ret = i915_gem_object_wait(obj,
                                    I915_WAIT_INTERRUPTIBLE |
                                    I915_WAIT_ALL,
@@ -2119,6 +2125,7 @@ i915_gem_object_truncate(struct drm_i915_gem_object *obj)
          */
         shmem_truncate_range(file_inode(obj->base.filp), 0, (loff_t)-1);
         obj->mm.madv = __I915_MADV_PURGED;
+        obj->mm.pages = ERR_PTR(-EFAULT);
 }
 
 /* Try to discard unwanted pages */
@@ -2218,7 +2225,9 @@ void __i915_gem_object_put_pages(struct drm_i915_gem_object *obj,
 
         __i915_gem_object_reset_page_iter(obj);
 
-        obj->ops->put_pages(obj, pages);
+        if (!IS_ERR(pages))
+                obj->ops->put_pages(obj, pages);
+
 unlock:
         mutex_unlock(&obj->mm.lock);
 }
@@ -2437,7 +2446,7 @@ int __i915_gem_object_get_pages(struct drm_i915_gem_object *obj)
         if (err)
                 return err;
 
-        if (unlikely(!obj->mm.pages)) {
+        if (unlikely(IS_ERR_OR_NULL(obj->mm.pages))) {
                 err = ____i915_gem_object_get_pages(obj);
                 if (err)
                         goto unlock;
@@ -2515,7 +2524,7 @@ void *i915_gem_object_pin_map(struct drm_i915_gem_object *obj,
 
         pinned = true;
         if (!atomic_inc_not_zero(&obj->mm.pages_pin_count)) {
-                if (unlikely(!obj->mm.pages)) {
+                if (unlikely(IS_ERR_OR_NULL(obj->mm.pages))) {
                         ret = ____i915_gem_object_get_pages(obj);
                         if (ret)
                                 goto err_unlock;
@@ -2563,6 +2572,75 @@ err_unlock:
         goto out_unlock;
 }
 
+static int
+i915_gem_object_pwrite_gtt(struct drm_i915_gem_object *obj,
+                           const struct drm_i915_gem_pwrite *arg)
+{
+        struct address_space *mapping = obj->base.filp->f_mapping;
+        char __user *user_data = u64_to_user_ptr(arg->data_ptr);
+        u64 remain, offset;
+        unsigned int pg;
+
+        /* Before we instantiate/pin the backing store for our use, we
+         * can prepopulate the shmemfs filp efficiently using a write into
+         * the pagecache. We avoid the penalty of instantiating all the
+         * pages, important if the user is just writing to a few and never
+         * uses the object on the GPU, and using a direct write into shmemfs
+         * allows it to avoid the cost of retrieving a page (either swapin
+         * or clearing-before-use) before it is overwritten.
+         */
+        if (READ_ONCE(obj->mm.pages))
+                return -ENODEV;
+
+        /* Before the pages are instantiated the object is treated as being
+         * in the CPU domain. The pages will be clflushed as required before
+         * use, and we can freely write into the pages directly. If userspace
+         * races pwrite with any other operation; corruption will ensue -
+         * that is userspace's prerogative!
+         */
+
+        remain = arg->size;
+        offset = arg->offset;
+        pg = offset_in_page(offset);
+
+        do {
+                unsigned int len, unwritten;
+                struct page *page;
+                void *data, *vaddr;
+                int err;
+
+                len = PAGE_SIZE - pg;
+                if (len > remain)
+                        len = remain;
+
+                err = pagecache_write_begin(obj->base.filp, mapping,
+                                            offset, len, 0,
+                                            &page, &data);
+                if (err < 0)
+                        return err;
+
+                vaddr = kmap(page);
+                unwritten = copy_from_user(vaddr + pg, user_data, len);
+                kunmap(page);
+
+                err = pagecache_write_end(obj->base.filp, mapping,
+                                          offset, len, len - unwritten,
+                                          page, data);
+                if (err < 0)
+                        return err;
+
+                if (unwritten)
+                        return -EFAULT;
+
+                remain -= len;
+                user_data += len;
+                offset += len;
+                pg = 0;
+        } while (remain);
+
+        return 0;
+}
+
 static bool ban_context(const struct i915_gem_context *ctx)
 {
         return (i915_gem_context_is_bannable(ctx) &&
@@ -2641,7 +2719,16 @@ int i915_gem_reset_prepare(struct drm_i915_private *dev_priv)
         for_each_engine(engine, dev_priv, id) {
                 struct drm_i915_gem_request *request;
 
+                /* Prevent request submission to the hardware until we have
+                 * completed the reset in i915_gem_reset_finish(). If a request
+                 * is completed by one engine, it may then queue a request
+                 * to a second via its engine->irq_tasklet *just* as we are
+                 * calling engine->init_hw() and also writing the ELSP.
+                 * Turning off the engine->irq_tasklet until the reset is over
+                 * prevents the race.
+                 */
                 tasklet_kill(&engine->irq_tasklet);
+                tasklet_disable(&engine->irq_tasklet);
 
                 if (engine_stalled(engine)) {
                         request = i915_gem_find_active_request(engine);
@@ -2756,7 +2843,7 @@ static void i915_gem_reset_engine(struct intel_engine_cs *engine)
         engine->reset_hw(engine, request);
 }
 
-void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
+void i915_gem_reset(struct drm_i915_private *dev_priv)
 {
         struct intel_engine_cs *engine;
         enum intel_engine_id id;
@@ -2778,6 +2865,17 @@ void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
         }
 }
 
+void i915_gem_reset_finish(struct drm_i915_private *dev_priv)
+{
+        struct intel_engine_cs *engine;
+        enum intel_engine_id id;
+
+        lockdep_assert_held(&dev_priv->drm.struct_mutex);
+
+        for_each_engine(engine, dev_priv, id)
+                tasklet_enable(&engine->irq_tasklet);
+}
+
 static void nop_submit_request(struct drm_i915_gem_request *request)
 {
         dma_fence_set_error(&request->fence, -EIO);
@@ -3029,6 +3127,16 @@ i915_gem_wait_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
                 args->timeout_ns -= ktime_to_ns(ktime_sub(ktime_get(), start));
                 if (args->timeout_ns < 0)
                         args->timeout_ns = 0;
+
+                /*
+                 * Apparently ktime isn't accurate enough and occasionally has a
+                 * bit of mismatch in the jiffies<->nsecs<->ktime loop. So patch
+                 * things up to make the test happy. We allow up to 1 jiffy.
+                 *
+                 * This is a regression from the timespec->ktime conversion.
+                 */
+                if (ret == -ETIME && !nsecs_to_jiffies(args->timeout_ns))
+                        args->timeout_ns = 0;
         }
 
         i915_gem_object_put(obj);
@@ -3974,8 +4082,11 @@ void i915_gem_object_init(struct drm_i915_gem_object *obj,
 static const struct drm_i915_gem_object_ops i915_gem_object_ops = {
         .flags = I915_GEM_OBJECT_HAS_STRUCT_PAGE |
                  I915_GEM_OBJECT_IS_SHRINKABLE,
+
         .get_pages = i915_gem_object_get_pages_gtt,
         .put_pages = i915_gem_object_put_pages_gtt,
+
+        .pwrite = i915_gem_object_pwrite_gtt,
 };
 
 struct drm_i915_gem_object *
@@ -4237,6 +4348,8 @@ int i915_gem_suspend(struct drm_i915_private *dev_priv)
         i915_gem_context_lost(dev_priv);
         mutex_unlock(&dev->struct_mutex);
 
+        intel_guc_suspend(dev_priv);
+
         cancel_delayed_work_sync(&dev_priv->gpu_error.hangcheck_work);
         cancel_delayed_work_sync(&dev_priv->gt.retire_work);
 
@@ -4583,8 +4696,6 @@ i915_gem_load_init(struct drm_i915_private *dev_priv)
         init_waitqueue_head(&dev_priv->gpu_error.wait_queue);
         init_waitqueue_head(&dev_priv->gpu_error.reset_queue);
 
-        dev_priv->relative_constants_mode = I915_EXEC_CONSTANTS_REL_GENERAL;
-
         init_waitqueue_head(&dev_priv->pending_flip_queue);
 
         dev_priv->mm.interruptible = true;
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 17f90c618208..e2d83b6d376b 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -311,7 +311,6 @@ __create_hw_context(struct drm_i915_private *dev_priv,
         ctx->ring_size = 4 * PAGE_SIZE;
         ctx->desc_template = GEN8_CTX_ADDRESSING_MODE(dev_priv) <<
                              GEN8_CTX_ADDRESSING_MODE_SHIFT;
-        ATOMIC_INIT_NOTIFIER_HEAD(&ctx->status_notifier);
 
         /* GuC requires the ring to be placed above GUC_WOPCM_TOP. If GuC is not
          * present or not in use we still need a small bias as ring wraparound
diff --git a/drivers/gpu/drm/i915/i915_gem_context.h b/drivers/gpu/drm/i915/i915_gem_context.h
index 0ac750b90f3d..e9c008fe14b1 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.h
+++ b/drivers/gpu/drm/i915/i915_gem_context.h
@@ -160,9 +160,6 @@ struct i915_gem_context {
         /** desc_template: invariant fields for the HW context descriptor */
         u32 desc_template;
 
-        /** status_notifier: list of callbacks for context-switch changes */
-        struct atomic_notifier_head status_notifier;
-
         /** guilty_count: How many times this context has caused a GPU hang. */
         unsigned int guilty_count;
         /**
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index c181b1bb3d2c..3be2503aa042 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -293,12 +293,12 @@ int i915_gem_evict_for_node(struct i915_address_space *vm,
                  * those as well to make room for our guard pages.
                  */
                 if (check_color) {
-                        if (vma->node.start + vma->node.size == node->start) {
-                                if (vma->node.color == node->color)
+                        if (node->start + node->size == target->start) {
+                                if (node->color == target->color)
                                         continue;
                         }
-                        if (vma->node.start == node->start + node->size) {
-                                if (vma->node.color == node->color)
+                        if (node->start == target->start + target->size) {
+                                if (node->color == target->color)
                                         continue;
                         }
                 }
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d02cfaefe1c8..15a15d00a6bf 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -888,6 +888,7 @@ i915_gem_execbuffer_reserve(struct intel_engine_cs *engine,
         struct list_head ordered_vmas;
         struct list_head pinned_vmas;
         bool has_fenced_gpu_access = INTEL_GEN(engine->i915) < 4;
+        bool needs_unfenced_map = INTEL_INFO(engine->i915)->unfenced_needs_alignment;
         int retry;
 
         vm = list_first_entry(vmas, struct i915_vma, exec_list)->vm;
@@ -908,7 +909,8 @@ i915_gem_execbuffer_reserve(struct intel_engine_cs *engine,
                 if (!has_fenced_gpu_access)
                         entry->flags &= ~EXEC_OBJECT_NEEDS_FENCE;
                 need_fence =
-                        entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+                        (entry->flags & EXEC_OBJECT_NEEDS_FENCE ||
+                         needs_unfenced_map) &&
                         i915_gem_object_is_tiled(obj);
                 need_mappable = need_fence || need_reloc_mappable(vma);
 
@@ -1408,10 +1410,7 @@ execbuf_submit(struct i915_execbuffer_params *params,
                struct drm_i915_gem_execbuffer2 *args,
                struct list_head *vmas)
 {
-        struct drm_i915_private *dev_priv = params->request->i915;
         u64 exec_start, exec_len;
-        int instp_mode;
-        u32 instp_mask;
         int ret;
 
         ret = i915_gem_execbuffer_move_to_gpu(params->request, vmas);
@@ -1422,56 +1421,11 @@ execbuf_submit(struct i915_execbuffer_params *params,
         if (ret)
                 return ret;
 
-        instp_mode = args->flags & I915_EXEC_CONSTANTS_MASK;
-        instp_mask = I915_EXEC_CONSTANTS_MASK;
-        switch (instp_mode) {
-        case I915_EXEC_CONSTANTS_REL_GENERAL:
-        case I915_EXEC_CONSTANTS_ABSOLUTE:
-        case I915_EXEC_CONSTANTS_REL_SURFACE:
-                if (instp_mode != 0 && params->engine->id != RCS) {
-                        DRM_DEBUG("non-0 rel constants mode on non-RCS\n");
-                        return -EINVAL;
-                }
-
-                if (instp_mode != dev_priv->relative_constants_mode) {
-                        if (INTEL_INFO(dev_priv)->gen < 4) {
-                                DRM_DEBUG("no rel constants on pre-gen4\n");
-                                return -EINVAL;
-                        }
-
-                        if (INTEL_INFO(dev_priv)->gen > 5 &&
-                            instp_mode == I915_EXEC_CONSTANTS_REL_SURFACE) {
-                                DRM_DEBUG("rel surface constants mode invalid on gen5+\n");
-                                return -EINVAL;
-                        }
-
-                        /* The HW changed the meaning on this bit on gen6 */
-                        if (INTEL_INFO(dev_priv)->gen >= 6)
-                                instp_mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
-                }
-                break;
-        default:
-                DRM_DEBUG("execbuf with unknown constants: %d\n", instp_mode);
+        if (args->flags & I915_EXEC_CONSTANTS_MASK) {
+                DRM_DEBUG("I915_EXEC_CONSTANTS_* unsupported\n");
                 return -EINVAL;
         }
 
-        if (params->engine->id == RCS &&
-            instp_mode != dev_priv->relative_constants_mode) {
-                struct intel_ring *ring = params->request->ring;
-
-                ret = intel_ring_begin(params->request, 4);
-                if (ret)
-                        return ret;
-
-                intel_ring_emit(ring, MI_NOOP);
-                intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
-                intel_ring_emit_reg(ring, INSTPM);
-                intel_ring_emit(ring, instp_mask << 16 | instp_mode);
-                intel_ring_advance(ring);
-
-                dev_priv->relative_constants_mode = instp_mode;
-        }
-
         if (args->flags & I915_EXEC_GEN7_SOL_RESET) {
                 ret = i915_reset_gen7_sol_offsets(params->request);
                 if (ret)
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2801a4d56324..96e45a4d5441 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2704,7 +2704,7 @@ void i915_gem_gtt_finish_pages(struct drm_i915_gem_object *obj,
         struct i915_ggtt *ggtt = &dev_priv->ggtt;
 
         if (unlikely(ggtt->do_idle_maps)) {
-                if (i915_gem_wait_for_idle(dev_priv, I915_WAIT_LOCKED)) {
+                if (i915_gem_wait_for_idle(dev_priv, 0)) {
                         DRM_ERROR("Failed to wait for idle; VT'd may hang.\n");
                         /* Wait a bit, in hopes it avoids the hang */
                         udelay(10);
diff --git a/drivers/gpu/drm/i915/i915_gem_object.h b/drivers/gpu/drm/i915/i915_gem_object.h
index bf90b07163d1..76b80a0be797 100644
--- a/drivers/gpu/drm/i915/i915_gem_object.h
+++ b/drivers/gpu/drm/i915/i915_gem_object.h
@@ -54,6 +54,9 @@ struct drm_i915_gem_object_ops {
         struct sg_table *(*get_pages)(struct drm_i915_gem_object *);
         void (*put_pages)(struct drm_i915_gem_object *, struct sg_table *);
 
+        int (*pwrite)(struct drm_i915_gem_object *,
+                      const struct drm_i915_gem_pwrite *);
+
         int (*dmabuf_export)(struct drm_i915_gem_object *);
         void (*release)(struct drm_i915_gem_object *);
 };
diff --git a/drivers/gpu/drm/i915/i915_gem_request.c b/drivers/gpu/drm/i915/i915_gem_request.c
index e7c3c0318ff6..da70bfe97ec5 100644
--- a/drivers/gpu/drm/i915/i915_gem_request.c
+++ b/drivers/gpu/drm/i915/i915_gem_request.c
@@ -37,6 +37,17 @@ static const char *i915_fence_get_driver_name(struct dma_fence *fence)
 
 static const char *i915_fence_get_timeline_name(struct dma_fence *fence)
 {
+        /* The timeline struct (as part of the ppgtt underneath a context)
+         * may be freed when the request is no longer in use by the GPU.
+         * We could extend the life of a context to beyond that of all
+         * fences, possibly keeping the hw resource around indefinitely,
+         * or we just give them a false name. Since
+         * dma_fence_ops.get_timeline_name is a debug feature, the occasional
+         * lie seems justifiable.
+         */
+        if (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
+                return "signaled";
+
         return to_request(fence)->timeline->common->name;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
index 401006b4c6a3..70b3832a79dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -53,6 +53,17 @@ static bool i915_gem_shrinker_lock(struct drm_device *dev, bool *unlock)
         BUG();
 }
 
+static void i915_gem_shrinker_unlock(struct drm_device *dev, bool unlock)
+{
+        if (!unlock)
+                return;
+
+        mutex_unlock(&dev->struct_mutex);
+
+        /* expedite the RCU grace period to free some request slabs */
+        synchronize_rcu_expedited();
+}
+
 static bool any_vma_pinned(struct drm_i915_gem_object *obj)
 {
         struct i915_vma *vma;
@@ -232,11 +243,8 @@ i915_gem_shrink(struct drm_i915_private *dev_priv,
                 intel_runtime_pm_put(dev_priv);
 
         i915_gem_retire_requests(dev_priv);
-        if (unlock)
-                mutex_unlock(&dev_priv->drm.struct_mutex);
 
-        /* expedite the RCU grace period to free some request slabs */
-        synchronize_rcu_expedited();
+        i915_gem_shrinker_unlock(&dev_priv->drm, unlock);
 
         return count;
 }
@@ -263,7 +271,7 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
                                 I915_SHRINK_BOUND |
                                 I915_SHRINK_UNBOUND |
                                 I915_SHRINK_ACTIVE);
-        rcu_barrier(); /* wait until our RCU delayed slab frees are completed */
+        synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
 
         return freed;
 }
@@ -293,8 +301,7 @@ i915_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)
                         count += obj->base.size >> PAGE_SHIFT;
         }
 
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
+        i915_gem_shrinker_unlock(dev, unlock);
 
         return count;
 }
@@ -321,8 +328,8 @@ i915_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)
                                          sc->nr_to_scan - freed,
                                          I915_SHRINK_BOUND |
                                          I915_SHRINK_UNBOUND);
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
+
+        i915_gem_shrinker_unlock(dev, unlock);
 
         return freed;
 }
@@ -364,8 +371,7 @@ i915_gem_shrinker_unlock_uninterruptible(struct drm_i915_private *dev_priv,
                                          struct shrinker_lock_uninterruptible *slu)
 {
         dev_priv->mm.interruptible = slu->was_interruptible;
-        if (slu->unlock)
-                mutex_unlock(&dev_priv->drm.struct_mutex);
+        i915_gem_shrinker_unlock(&dev_priv->drm, slu->unlock);
 }
 
 static int
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e6ffef2f707a..b6c886ac901b 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1046,68 +1046,51 @@ static void vlv_c0_read(struct drm_i915_private *dev_priv,
         ei->media_c0 = I915_READ(VLV_MEDIA_C0_COUNT);
 }
 
-static bool vlv_c0_above(struct drm_i915_private *dev_priv,
-                         const struct intel_rps_ei *old,
-                         const struct intel_rps_ei *now,
-                         int threshold)
-{
-        u64 time, c0;
-        unsigned int mul = 100;
-
-        if (old->cz_clock == 0)
-                return false;
-
-        if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
-                mul <<= 8;
-
-        time = now->cz_clock - old->cz_clock;
-        time *= threshold * dev_priv->czclk_freq;
-
-        /* Workload can be split between render + media, e.g. SwapBuffers
-         * being blitted in X after being rendered in mesa. To account for
-         * this we need to combine both engines into our activity counter.
-         */
-        c0 = now->render_c0 - old->render_c0;
-        c0 += now->media_c0 - old->media_c0;
-        c0 *= mul * VLV_CZ_CLOCK_TO_MILLI_SEC;
-
-        return c0 >= time;
-}
-
 void gen6_rps_reset_ei(struct drm_i915_private *dev_priv)
 {
-        vlv_c0_read(dev_priv, &dev_priv->rps.down_ei);
-        dev_priv->rps.up_ei = dev_priv->rps.down_ei;
+        memset(&dev_priv->rps.ei, 0, sizeof(dev_priv->rps.ei));
 }
 
 static u32 vlv_wa_c0_ei(struct drm_i915_private *dev_priv, u32 pm_iir)
 {
+        const struct intel_rps_ei *prev = &dev_priv->rps.ei;
         struct intel_rps_ei now;
         u32 events = 0;
 
-        if ((pm_iir & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) == 0)
+        if ((pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) == 0)
                 return 0;
 
         vlv_c0_read(dev_priv, &now);
         if (now.cz_clock == 0)
                 return 0;
 
-        if (pm_iir & GEN6_PM_RP_DOWN_EI_EXPIRED) {
-                if (!vlv_c0_above(dev_priv,
-                                  &dev_priv->rps.down_ei, &now,
-                                  dev_priv->rps.down_threshold))
-                        events |= GEN6_PM_RP_DOWN_THRESHOLD;
-                dev_priv->rps.down_ei = now;
-        }
+        if (prev->cz_clock) {
+                u64 time, c0;
+                unsigned int mul;
+
+                mul = VLV_CZ_CLOCK_TO_MILLI_SEC * 100; /* scale to threshold% */
+                if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
+                        mul <<= 8;
 
-        if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) {
-                if (vlv_c0_above(dev_priv,
-                                 &dev_priv->rps.up_ei, &now,
-                                 dev_priv->rps.up_threshold))
-                        events |= GEN6_PM_RP_UP_THRESHOLD;
-                dev_priv->rps.up_ei = now;
+                time = now.cz_clock - prev->cz_clock;
+                time *= dev_priv->czclk_freq;
+
+                /* Workload can be split between render + media,
+                 * e.g. SwapBuffers being blitted in X after being rendered in
+                 * mesa. To account for this we need to combine both engines
+                 * into our activity counter.
+                 */
+                c0 = now.render_c0 - prev->render_c0;
+                c0 += now.media_c0 - prev->media_c0;
+                c0 *= mul;
+
+                if (c0 > time * dev_priv->rps.up_threshold)
+                        events = GEN6_PM_RP_UP_THRESHOLD;
+                else if (c0 < time * dev_priv->rps.down_threshold)
+                        events = GEN6_PM_RP_DOWN_THRESHOLD;
         }
 
+        dev_priv->rps.ei = now;
         return events;
 }
 
@@ -4228,7 +4211,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
         /* Let's track the enabled rps events */
         if (IS_VALLEYVIEW(dev_priv))
                 /* WaGsvRC0ResidencyMethod:vlv */
-                dev_priv->pm_rps_events = GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED;
+                dev_priv->pm_rps_events = GEN6_PM_RP_UP_EI_EXPIRED;
         else
                 dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS;
 
@@ -4266,6 +4249,16 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
         if (!IS_GEN2(dev_priv))
                 dev->vblank_disable_immediate = true;
 
+        /* Most platforms treat the display irq block as an always-on
+         * power domain. vlv/chv can disable it at runtime and need
+         * special care to avoid writing any of the display block registers
+         * outside of the power domain. We defer setting up the display irqs
+         * in this case to the runtime pm.
+         */
+        dev_priv->display_irqs_enabled = true;
+        if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
+                dev_priv->display_irqs_enabled = false;
+
         dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
         dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
 
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index ecb487b5356f..9bbbd4e83e3c 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -60,6 +60,7 @@
         .has_overlay = 1, .overlay_needs_physical = 1, \
         .has_gmch_display = 1, \
         .hws_needs_physical = 1, \
+        .unfenced_needs_alignment = 1, \
         .ring_mask = RENDER_RING, \
         GEN_DEFAULT_PIPEOFFSETS, \
         CURSOR_OFFSETS
@@ -101,6 +102,7 @@ static const struct intel_device_info intel_i915g_info = {
         .platform = INTEL_I915G, .cursor_needs_physical = 1,
         .has_overlay = 1, .overlay_needs_physical = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_i915gm_info = {
@@ -112,6 +114,7 @@ static const struct intel_device_info intel_i915gm_info = {
         .supports_tv = 1,
         .has_fbc = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_i945g_info = {
@@ -120,6 +123,7 @@ static const struct intel_device_info intel_i945g_info = {
         .has_hotplug = 1, .cursor_needs_physical = 1,
         .has_overlay = 1, .overlay_needs_physical = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_i945gm_info = {
@@ -130,6 +134,7 @@ static const struct intel_device_info intel_i945gm_info = {
         .supports_tv = 1,
         .has_fbc = 1,
         .hws_needs_physical = 1,
+        .unfenced_needs_alignment = 1,
 };
 
 static const struct intel_device_info intel_g33_info = {
diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index a1b7eec58be2..70964ca9251e 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -1705,7 +1705,7 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
          */
         if (WARN_ON(stream->sample_flags != props->sample_flags)) {
                 ret = -ENODEV;
-                goto err_alloc;
+                goto err_flags;
         }
 
         list_add(&stream->link, &dev_priv->perf.streams);
@@ -1728,6 +1728,7 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
 
 err_open:
         list_del(&stream->link);
+err_flags:
         if (stream->ops->destroy)
                 stream->ops->destroy(stream);
 err_alloc:
@@ -1793,6 +1794,11 @@ static int read_properties_unlocked(struct drm_i915_private *dev_priv,
                 if (ret)
                         return ret;
 
+                if (id == 0 || id >= DRM_I915_PERF_PROP_MAX) {
+                        DRM_DEBUG("Unknown i915 perf property ID\n");
+                        return -EINVAL;
+                }
+
                 switch ((enum drm_i915_perf_property_id)id) {
                 case DRM_I915_PERF_PROP_CTX_HANDLE:
                         props->single_context = 1;
@@ -1862,9 +1868,8 @@ static int read_properties_unlocked(struct drm_i915_private *dev_priv,
                         props->oa_periodic = true;
                         props->oa_period_exponent = value;
                         break;
-                default:
+                case DRM_I915_PERF_PROP_MAX:
                         MISSING_CASE(id);
-                        DRM_DEBUG("Unknown i915 perf property ID\n");
                         return -EINVAL;
                 }
 
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index 155906e84812..df20e9bc1c0f 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -512,10 +512,36 @@ err_unpin:
         return ret;
 }
 
+static void
+i915_vma_remove(struct i915_vma *vma)
+{
+        struct drm_i915_gem_object *obj = vma->obj;
+
+        GEM_BUG_ON(!drm_mm_node_allocated(&vma->node));
+        GEM_BUG_ON(vma->flags & (I915_VMA_GLOBAL_BIND | I915_VMA_LOCAL_BIND));
+
+        drm_mm_remove_node(&vma->node);
+        list_move_tail(&vma->vm_link, &vma->vm->unbound_list);
+
+        /* Since the unbound list is global, only move to that list if
+         * no more VMAs exist.
+         */
+        if (--obj->bind_count == 0)
+                list_move_tail(&obj->global_link,
+                               &to_i915(obj->base.dev)->mm.unbound_list);
+
+        /* And finally now the object is completely decoupled from this vma,
+         * we can drop its hold on the backing storage and allow it to be
+         * reaped by the shrinker.
+         */
+        i915_gem_object_unpin_pages(obj);
+        GEM_BUG_ON(atomic_read(&obj->mm.pages_pin_count) < obj->bind_count);
+}
+
 int __i915_vma_do_pin(struct i915_vma *vma,
                       u64 size, u64 alignment, u64 flags)
 {
-        unsigned int bound = vma->flags;
+        const unsigned int bound = vma->flags;
         int ret;
 
         lockdep_assert_held(&vma->vm->i915->drm.struct_mutex);
@@ -524,18 +550,18 @@ int __i915_vma_do_pin(struct i915_vma *vma,
 
         if (WARN_ON(bound & I915_VMA_PIN_OVERFLOW)) {
                 ret = -EBUSY;
-                goto err;
+                goto err_unpin;
         }
 
         if ((bound & I915_VMA_BIND_MASK) == 0) {
                 ret = i915_vma_insert(vma, size, alignment, flags);
                 if (ret)
-                        goto err;
+                        goto err_unpin;
         }
 
         ret = i915_vma_bind(vma, vma->obj->cache_level, flags);
         if (ret)
-                goto err;
+                goto err_remove;
 
         if ((bound ^ vma->flags) & I915_VMA_GLOBAL_BIND)
                 __i915_vma_set_map_and_fenceable(vma);
@@ -544,7 +570,12 @@ int __i915_vma_do_pin(struct i915_vma *vma,
         GEM_BUG_ON(i915_vma_misplaced(vma, size, alignment, flags));
         return 0;
 
-err:
+err_remove:
+        if ((bound & I915_VMA_BIND_MASK) == 0) {
+                GEM_BUG_ON(vma->pages);
+                i915_vma_remove(vma);
+        }
+err_unpin:
         __i915_vma_unpin(vma);
         return ret;
 }
@@ -657,9 +688,6 @@ int i915_vma_unbind(struct i915_vma *vma)
         }
         vma->flags &= ~(I915_VMA_GLOBAL_BIND | I915_VMA_LOCAL_BIND);
 
-        drm_mm_remove_node(&vma->node);
-        list_move_tail(&vma->vm_link, &vma->vm->unbound_list);
-
         if (vma->pages != obj->mm.pages) {
                 GEM_BUG_ON(!vma->pages);
                 sg_free_table(vma->pages);
@@ -667,18 +695,7 @@ int i915_vma_unbind(struct i915_vma *vma)
         }
         vma->pages = NULL;
 
-        /* Since the unbound list is global, only move to that list if
-         * no more VMAs exist. */
-        if (--obj->bind_count == 0)
-                list_move_tail(&obj->global_link,
-                               &to_i915(obj->base.dev)->mm.unbound_list);
-
-        /* And finally now the object is completely decoupled from this vma,
-         * we can drop its hold on the backing storage and allow it to be
-         * reaped by the shrinker.
-         */
-        i915_gem_object_unpin_pages(obj);
-        GEM_BUG_ON(atomic_read(&obj->mm.pages_pin_count) < obj->bind_count);
+        i915_vma_remove(vma);
 
 destroy:
         if (unlikely(i915_vma_is_closed(vma)))
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 0085bc745f6a..de219b71fb76 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -35,7 +35,6 @@
  */
 
 #define I915_CSR_GLK "i915/glk_dmc_ver1_01.bin"
-MODULE_FIRMWARE(I915_CSR_GLK);
 #define GLK_CSR_VERSION_REQUIRED        CSR_VERSION(1, 1)
 
 #define I915_CSR_KBL "i915/kbl_dmc_ver1_01.bin"
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 01341670738f..ed1f4f272b4f 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3669,10 +3669,6 @@ static void intel_update_pipe_config(struct intel_crtc *crtc,
         /* drm_atomic_helper_update_legacy_modeset_state might not be called. */
         crtc->base.mode = crtc->base.state->mode;
 
-        DRM_DEBUG_KMS("Updating pipe size %ix%i -> %ix%i\n",
-                      old_crtc_state->pipe_src_w, old_crtc_state->pipe_src_h,
-                      pipe_config->pipe_src_w, pipe_config->pipe_src_h);
-
         /*
          * Update pipe size and adjust fitter if needed: the reason for this is
          * that in compute_mode_changes we check the native mode (not the pfit
@@ -4796,23 +4792,17 @@ static void skylake_pfit_enable(struct intel_crtc *crtc)
         struct intel_crtc_scaler_state *scaler_state =
                 &crtc->config->scaler_state;
 
-        DRM_DEBUG_KMS("for crtc_state = %p\n", crtc->config);
-
         if (crtc->config->pch_pfit.enabled) {
                 int id;
 
-                if (WARN_ON(crtc->config->scaler_state.scaler_id < 0)) {
-                        DRM_ERROR("Requesting pfit without getting a scaler first\n");
+                if (WARN_ON(crtc->config->scaler_state.scaler_id < 0))
                         return;
-                }
 
                 id = scaler_state->scaler_id;
                 I915_WRITE(SKL_PS_CTRL(pipe, id), PS_SCALER_EN |
                         PS_FILTER_MEDIUM | scaler_state->scalers[id].mode);
                 I915_WRITE(SKL_PS_WIN_POS(pipe, id), crtc->config->pch_pfit.pos);
                 I915_WRITE(SKL_PS_WIN_SZ(pipe, id), crtc->config->pch_pfit.size);
-
-                DRM_DEBUG_KMS("for crtc_state = %p scaler_id = %d\n", crtc->config, id);
         }
 }
 
@@ -14379,6 +14369,24 @@ static void skl_update_crtcs(struct drm_atomic_state *state,
         } while (progress);
 }
 
+static void intel_atomic_helper_free_state(struct drm_i915_private *dev_priv)
+{
+        struct intel_atomic_state *state, *next;
+        struct llist_node *freed;
+
+        freed = llist_del_all(&dev_priv->atomic_helper.free_list);
+        llist_for_each_entry_safe(state, next, freed, freed)
+                drm_atomic_state_put(&state->base);
+}
+
+static void intel_atomic_helper_free_state_worker(struct work_struct *work)
+{
+        struct drm_i915_private *dev_priv =
+                container_of(work, typeof(*dev_priv), atomic_helper.free_work);
+
+        intel_atomic_helper_free_state(dev_priv);
+}
+
 static void intel_atomic_commit_tail(struct drm_atomic_state *state)
 {
         struct drm_device *dev = state->dev;
@@ -14545,6 +14553,8 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
          * can happen also when the device is completely off.
          */
         intel_uncore_arm_unclaimed_mmio_detection(dev_priv);
+
+        intel_atomic_helper_free_state(dev_priv);
 }
 
 static void intel_atomic_commit_work(struct work_struct *work)
@@ -14946,17 +14956,19 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc,
                 to_intel_atomic_state(old_crtc_state->state);
         bool modeset = needs_modeset(crtc->state);
 
+        if (!modeset &&
+            (intel_cstate->base.color_mgmt_changed ||
+             intel_cstate->update_pipe)) {
+                intel_color_set_csc(crtc->state);
+                intel_color_load_luts(crtc->state);
+        }
+
         /* Perform vblank evasion around commit operation */
         intel_pipe_update_start(intel_crtc);
 
         if (modeset)
                 goto out;
 
-        if (crtc->state->color_mgmt_changed || to_intel_crtc_state(crtc->state)->update_pipe) {
-                intel_color_set_csc(crtc->state);
-                intel_color_load_luts(crtc->state);
-        }
-
         if (intel_cstate->update_pipe)
                 intel_update_pipe_config(intel_crtc, old_intel_cstate);
         else if (INTEL_GEN(dev_priv) >= 9)
@@ -16599,18 +16611,6 @@ fail:
         drm_modeset_acquire_fini(&ctx);
 }
 
-static void intel_atomic_helper_free_state(struct work_struct *work)
-{
-        struct drm_i915_private *dev_priv =
-                container_of(work, typeof(*dev_priv), atomic_helper.free_work);
-        struct intel_atomic_state *state, *next;
-        struct llist_node *freed;
-
-        freed = llist_del_all(&dev_priv->atomic_helper.free_list);
-        llist_for_each_entry_safe(state, next, freed, freed)
-                drm_atomic_state_put(&state->base);
-}
-
 int intel_modeset_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -16631,7 +16631,7 @@ int intel_modeset_init(struct drm_device *dev)
         dev->mode_config.funcs = &intel_mode_funcs;
 
         INIT_WORK(&dev_priv->atomic_helper.free_work,
-                  intel_atomic_helper_free_state);
+                  intel_atomic_helper_free_state_worker);
 
         intel_init_quirks(dev);
 
@@ -16696,12 +16696,11 @@ int intel_modeset_init(struct drm_device *dev)
                 }
         }
 
-        intel_update_czclk(dev_priv);
-        intel_update_cdclk(dev_priv);
-        dev_priv->atomic_cdclk_freq = dev_priv->cdclk_freq;
-
         intel_shared_dpll_init(dev);
 
+        intel_update_czclk(dev_priv);
+        intel_modeset_init_hw(dev);
+
         if (dev_priv->max_cdclk_freq == 0)
                 intel_update_max_cdclk(dev_priv);
 
@@ -17258,8 +17257,6 @@ void intel_modeset_gem_init(struct drm_device *dev)
 
         intel_init_gt_powersave(dev_priv);
 
-        intel_modeset_init_hw(dev);
-
         intel_setup_overlay(dev_priv);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 371acf109e34..ab1be5c80ea5 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -105,6 +105,8 @@ intel_engine_setup(struct drm_i915_private *dev_priv,
         /* Nothing to do here, execute in order of dependencies */
         engine->schedule = NULL;
 
+        ATOMIC_INIT_NOTIFIER_HEAD(&engine->context_status_notifier);
+
         dev_priv->engine[id] = engine;
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 1b8ba2e77539..2d449fb5d1d2 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -357,14 +357,13 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
                                     bool *enabled, int width, int height)
 {
         struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
-        unsigned long conn_configured, mask;
+        unsigned long conn_configured, conn_seq, mask;
         unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
         int i, j;
         bool *save_enabled;
         bool fallback = true;
         int num_connectors_enabled = 0;
         int num_connectors_detected = 0;
-        int pass = 0;
 
         save_enabled = kcalloc(count, sizeof(bool), GFP_KERNEL);
         if (!save_enabled)
@@ -374,6 +373,7 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
         mask = BIT(count) - 1;
         conn_configured = 0;
 retry:
+        conn_seq = conn_configured;
         for (i = 0; i < count; i++) {
                 struct drm_fb_helper_connector *fb_conn;
                 struct drm_connector *connector;
@@ -387,7 +387,7 @@ retry:
                 if (conn_configured & BIT(i))
                         continue;
 
-                if (pass == 0 && !connector->has_tile)
+                if (conn_seq == 0 && !connector->has_tile)
                         continue;
 
                 if (connector->status == connector_status_connected)
@@ -498,10 +498,8 @@ retry:
                 conn_configured |= BIT(i);
         }
 
-        if ((conn_configured & mask) != mask) {
-                pass++;
+        if ((conn_configured & mask) != mask && conn_configured != conn_seq)
                 goto retry;
-        }
 
         /*
          * If the BIOS didn't enable everything it could, fall back to have the
diff --git a/drivers/gpu/drm/i915/intel_gvt.c b/drivers/gpu/drm/i915/intel_gvt.c
index d23c0fcff751..8c04eca84351 100644
--- a/drivers/gpu/drm/i915/intel_gvt.c
+++ b/drivers/gpu/drm/i915/intel_gvt.c
@@ -77,6 +77,11 @@ int intel_gvt_init(struct drm_i915_private *dev_priv)
                 goto bail;
         }
 
+        if (!i915.enable_execlists) {
+                DRM_INFO("GPU guest virtualisation [GVT-g] disabled due to disabled execlist submission [i915.enable_execlists module parameter]\n");
+                goto bail;
+        }
+
         /*
          * We're not in host or fail to find a MPT module, disable GVT-g
          */
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index ebae2bd83918..24b2fa5b6282 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -1298,16 +1298,34 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
 
 static bool hdmi_12bpc_possible(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc_state->base.crtc->dev;
+        struct drm_i915_private *dev_priv =
+                to_i915(crtc_state->base.crtc->dev);
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
+        struct drm_connector *connector;
+        int i;
 
-        if (HAS_GMCH_DISPLAY(to_i915(dev)))
+        if (HAS_GMCH_DISPLAY(dev_priv))
                 return false;
 
         /*
          * HDMI 12bpc affects the clocks, so it's only possible
          * when not cloning with other encoder types.
          */
-        return crtc_state->output_types == 1 << INTEL_OUTPUT_HDMI;
+        if (crtc_state->output_types != 1 << INTEL_OUTPUT_HDMI)
+                return false;
+
+        for_each_connector_in_state(state, connector, connector_state, i) {
+                const struct drm_display_info *info = &connector->display_info;
+
+                if (connector_state->crtc != crtc_state->base.crtc)
+                        continue;
+
+                if ((info->edid_hdmi_dc_modes & DRM_EDID_HDMI_DC_36) == 0)
+                        return false;
+        }
+
+        return true;
 }
 
 bool intel_hdmi_compute_config(struct intel_encoder *encoder,
diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
index b62e3f8ad415..54208bef7a83 100644
--- a/drivers/gpu/drm/i915/intel_hotplug.c
+++ b/drivers/gpu/drm/i915/intel_hotplug.c
@@ -219,7 +219,7 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
                         }
                 }
         }
-        if (dev_priv->display.hpd_irq_setup)
+        if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup)
                 dev_priv->display.hpd_irq_setup(dev_priv);
         spin_unlock_irq(&dev_priv->irq_lock);
 
@@ -425,7 +425,7 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
                 }
         }
 
-        if (storm_detected)
+        if (storm_detected && dev_priv->display_irqs_enabled)
                 dev_priv->display.hpd_irq_setup(dev_priv);
         spin_unlock(&dev_priv->irq_lock);
 
@@ -471,10 +471,12 @@ void intel_hpd_init(struct drm_i915_private *dev_priv)
          * Interrupt setup is already guaranteed to be single-threaded, this is
          * just to make the assert_spin_locked checks happy.
          */
-        spin_lock_irq(&dev_priv->irq_lock);
-        if (dev_priv->display.hpd_irq_setup)
-                dev_priv->display.hpd_irq_setup(dev_priv);
-        spin_unlock_irq(&dev_priv->irq_lock);
+        if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup) {
+                spin_lock_irq(&dev_priv->irq_lock);
+                if (dev_priv->display_irqs_enabled)
+                        dev_priv->display.hpd_irq_setup(dev_priv);
+                spin_unlock_irq(&dev_priv->irq_lock);
+        }
 }
 
 static void i915_hpd_poll_init_work(struct work_struct *work)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index ebf8023d21e6..47517a02f0a4 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -345,7 +345,8 @@ execlists_context_status_change(struct drm_i915_gem_request *rq,
         if (!IS_ENABLED(CONFIG_DRM_I915_GVT))
                 return;
 
-        atomic_notifier_call_chain(&rq->ctx->status_notifier, status, rq);
+        atomic_notifier_call_chain(&rq->engine->context_status_notifier,
+                                   status, rq);
 }
 
 static void
@@ -669,15 +670,14 @@ static void execlists_submit_request(struct drm_i915_gem_request *request)
 static struct intel_engine_cs *
 pt_lock_engine(struct i915_priotree *pt, struct intel_engine_cs *locked)
 {
-        struct intel_engine_cs *engine;
+        struct intel_engine_cs *engine =
+                container_of(pt, struct drm_i915_gem_request, priotree)->engine;
+
+        GEM_BUG_ON(!locked);
 
-        engine = container_of(pt,
-                              struct drm_i915_gem_request,
-                              priotree)->engine;
         if (engine != locked) {
-                if (locked)
-                        spin_unlock_irq(&locked->timeline->lock);
-                spin_lock_irq(&engine->timeline->lock);
+                spin_unlock(&locked->timeline->lock);
+                spin_lock(&engine->timeline->lock);
         }
 
         return engine;
@@ -685,7 +685,7 @@ pt_lock_engine(struct i915_priotree *pt, struct intel_engine_cs *locked)
 
 static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
 {
-        struct intel_engine_cs *engine = NULL;
+        struct intel_engine_cs *engine;
         struct i915_dependency *dep, *p;
         struct i915_dependency stack;
         LIST_HEAD(dfs);
@@ -719,26 +719,23 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
         list_for_each_entry_safe(dep, p, &dfs, dfs_link) {
                 struct i915_priotree *pt = dep->signaler;
 
-                list_for_each_entry(p, &pt->signalers_list, signal_link)
+                /* Within an engine, there can be no cycle, but we may
+                 * refer to the same dependency chain multiple times
+                 * (redundant dependencies are not eliminated) and across
+                 * engines.
+                 */
+                list_for_each_entry(p, &pt->signalers_list, signal_link) {
+                        GEM_BUG_ON(p->signaler->priority < pt->priority);
                         if (prio > READ_ONCE(p->signaler->priority))
                                 list_move_tail(&p->dfs_link, &dfs);
+                }
 
                 list_safe_reset_next(dep, p, dfs_link);
-                if (!RB_EMPTY_NODE(&pt->node))
-                        continue;
-
-                engine = pt_lock_engine(pt, engine);
-
-                /* If it is not already in the rbtree, we can update the
-                 * priority inplace and skip over it (and its dependencies)
-                 * if it is referenced *again* as we descend the dfs.
-                 */
-                if (prio > pt->priority && RB_EMPTY_NODE(&pt->node)) {
-                        pt->priority = prio;
-                        list_del_init(&dep->dfs_link);
-                }
         }
 
+        engine = request->engine;
+        spin_lock_irq(&engine->timeline->lock);
+
         /* Fifo and depth-first replacement ensure our deps execute before us */
         list_for_each_entry_safe_reverse(dep, p, &dfs, dfs_link) {
                 struct i915_priotree *pt = dep->signaler;
@@ -750,16 +747,15 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
                 if (prio <= pt->priority)
                         continue;
 
-                GEM_BUG_ON(RB_EMPTY_NODE(&pt->node));
-
                 pt->priority = prio;
-                rb_erase(&pt->node, &engine->execlist_queue);
-                if (insert_request(pt, &engine->execlist_queue))
-                        engine->execlist_first = &pt->node;
+                if (!RB_EMPTY_NODE(&pt->node)) {
+                        rb_erase(&pt->node, &engine->execlist_queue);
+                        if (insert_request(pt, &engine->execlist_queue))
+                                engine->execlist_first = &pt->node;
+                }
         }
 
-        if (engine)
-                spin_unlock_irq(&engine->timeline->lock);
+        spin_unlock_irq(&engine->timeline->lock);
 
         /* XXX Do we need to preempt to make room for us and our deps? */
 }
@@ -1439,7 +1435,9 @@ static void reset_common_ring(struct intel_engine_cs *engine,
         GEM_BUG_ON(request->ctx != port[0].request->ctx);
 
         /* Reset WaIdleLiteRestore:bdw,skl as well */
-        request->tail = request->wa_tail - WA_TAIL_DWORDS * sizeof(u32);
+        request->tail =
+                intel_ring_wrap(request->ring,
+                                request->wa_tail - WA_TAIL_DWORDS*sizeof(u32));
 }
 
 static int intel_logical_ring_emit_pdps(struct drm_i915_gem_request *req)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 249623d45be0..6a29784d2b41 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4891,6 +4891,12 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
                 break;
         }
 
+        /* When byt can survive without system hang with dynamic
+         * sw freq adjustments, this restriction can be lifted.
+         */
+        if (IS_VALLEYVIEW(dev_priv))
+                goto skip_hw_write;
+
         I915_WRITE(GEN6_RP_UP_EI,
                    GT_INTERVAL_FROM_US(dev_priv, ei_up));
         I915_WRITE(GEN6_RP_UP_THRESHOLD,
@@ -4911,6 +4917,7 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
                    GEN6_RP_UP_BUSY_AVG |
                    GEN6_RP_DOWN_IDLE_AVG);
 
+skip_hw_write:
         dev_priv->rps.power = new_power;
         dev_priv->rps.up_threshold = threshold_up;
         dev_priv->rps.down_threshold = threshold_down;
@@ -4921,8 +4928,9 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
 {
         u32 mask = 0;
 
+        /* We use UP_EI_EXPIRED interupts for both up/down in manual mode */
         if (val > dev_priv->rps.min_freq_softlimit)
-                mask |= GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
+                mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
         if (val < dev_priv->rps.max_freq_softlimit)
                 mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_UP_THRESHOLD;
 
@@ -5032,7 +5040,7 @@ void gen6_rps_busy(struct drm_i915_private *dev_priv)
 {
         mutex_lock(&dev_priv->rps.hw_lock);
         if (dev_priv->rps.enabled) {
-                if (dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED))
+                if (dev_priv->pm_rps_events & GEN6_PM_RP_UP_EI_EXPIRED)
                         gen6_rps_reset_ei(dev_priv);
                 I915_WRITE(GEN6_PMINTRMSK,
                            gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
@@ -7916,10 +7924,10 @@ static bool skl_pcode_try_request(struct drm_i915_private *dev_priv, u32 mbox,
  * @timeout_base_ms: timeout for polling with preemption enabled
  *
  * Keep resending the @request to @mbox until PCODE acknowledges it, PCODE
- * reports an error or an overall timeout of @timeout_base_ms+10 ms expires.
+ * reports an error or an overall timeout of @timeout_base_ms+50 ms expires.
  * The request is acknowledged once the PCODE reply dword equals @reply after
  * applying @reply_mask. Polling is first attempted with preemption enabled
- * for @timeout_base_ms and if this times out for another 10 ms with
+ * for @timeout_base_ms and if this times out for another 50 ms with
  * preemption disabled.
  *
  * Returns 0 on success, %-ETIMEDOUT in case of a timeout, <0 in case of some
@@ -7955,14 +7963,15 @@ int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request,
          * worst case) _and_ PCODE was busy for some reason even after a
          * (queued) request and @timeout_base_ms delay. As a workaround retry
          * the poll with preemption disabled to maximize the number of
-         * requests. Increase the timeout from @timeout_base_ms to 10ms to
+         * requests. Increase the timeout from @timeout_base_ms to 50ms to
          * account for interrupts that could reduce the number of these
-         * requests.
+         * requests, and for any quirks of the PCODE firmware that delays
+         * the request completion.
          */
         DRM_DEBUG_KMS("PCODE timeout, retrying with preemption disabled\n");
         WARN_ON_ONCE(timeout_base_ms > 3);
         preempt_disable();
-        ret = wait_for_atomic(COND, 10);
+        ret = wait_for_atomic(COND, 50);
         preempt_enable();
 
 out:
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 91bc4abf5d3e..6c5f9958197d 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -2024,6 +2024,8 @@ static int intel_ring_context_pin(struct intel_engine_cs *engine,
                 ret = context_pin(ctx, flags);
                 if (ret)
                         goto error;
+
+                ce->state->obj->mm.dirty = true;
         }
 
         /* The kernel context is only used as a placeholder for flushing the
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 79c2b8d72322..8cb2078c5bfc 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -403,6 +403,9 @@ struct intel_engine_cs {
          */
         struct i915_gem_context *legacy_active_context;
 
+        /* status_notifier: list of callbacks for context-switch changes */
+        struct atomic_notifier_head context_status_notifier;
+
         struct intel_engine_hangcheck hangcheck;
 
         bool needs_cmd_parser;
@@ -518,11 +521,17 @@ static inline void intel_ring_advance(struct intel_ring *ring)
          */
 }
 
+static inline u32
+intel_ring_wrap(const struct intel_ring *ring, u32 pos)
+{
+        return pos & (ring->size - 1);
+}
+
 static inline u32 intel_ring_offset(struct intel_ring *ring, void *addr)
 {
         /* Don't write ring->size (equivalent to 0) as that hangs some GPUs. */
         u32 offset = addr - ring->vaddr;
-        return offset & (ring->size - 1);
+        return intel_ring_wrap(ring, offset);
 }
 
 int __intel_ring_space(int head, int tail, int size);
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 9ef54688872a..9481ca9a3ae7 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -254,9 +254,6 @@ skl_update_plane(struct drm_plane *drm_plane,
                 int scaler_id = plane_state->scaler_id;
                 const struct intel_scaler *scaler;
 
-                DRM_DEBUG_KMS("plane = %d PS_PLANE_SEL(plane) = 0x%x\n",
-                              plane_id, PS_PLANE_SEL(plane_id));
-
                 scaler = &crtc_state->scaler_state.scalers[scaler_id];
 
                 I915_WRITE(SKL_PS_CTRL(pipe, scaler_id),
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index abe08885a5ba..b7ff592b14f5 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -119,6 +119,8 @@ fw_domains_get(struct drm_i915_private *dev_priv, enum forcewake_domains fw_doma
 
         for_each_fw_domain_masked(d, fw_domains, dev_priv)
                 fw_domain_wait_ack(d);
+
+        dev_priv->uncore.fw_domains_active |= fw_domains;
 }
 
 static void
@@ -130,6 +132,8 @@ fw_domains_put(struct drm_i915_private *dev_priv, enum forcewake_domains fw_doma
                 fw_domain_put(d);
                 fw_domain_posting_read(d);
         }
+
+        dev_priv->uncore.fw_domains_active &= ~fw_domains;
 }
 
 static void
@@ -240,10 +244,8 @@ intel_uncore_fw_release_timer(struct hrtimer *timer)
         if (WARN_ON(domain->wake_count == 0))
                 domain->wake_count++;
 
-        if (--domain->wake_count == 0) {
+        if (--domain->wake_count == 0)
                 dev_priv->uncore.funcs.force_wake_put(dev_priv, domain->mask);
-                dev_priv->uncore.fw_domains_active &= ~domain->mask;
-        }
 
         spin_unlock_irqrestore(&dev_priv->uncore.lock, irqflags);
 
@@ -454,10 +456,8 @@ static void __intel_uncore_forcewake_get(struct drm_i915_private *dev_priv,
                         fw_domains &= ~domain->mask;
         }
 
-        if (fw_domains) {
+        if (fw_domains)
                 dev_priv->uncore.funcs.force_wake_get(dev_priv, fw_domains);
-                dev_priv->uncore.fw_domains_active |= fw_domains;
-        }
 }
 
 /**
@@ -968,7 +968,6 @@ static noinline void ___force_wake_auto(struct drm_i915_private *dev_priv,
                 fw_domain_arm_timer(domain);
 
         dev_priv->uncore.funcs.force_wake_get(dev_priv, fw_domains);
-        dev_priv->uncore.fw_domains_active |= fw_domains;
 }
 
 static inline void __force_wake_auto(struct drm_i915_private *dev_priv,
diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index 4414cf73735d..36602ac7e248 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -534,7 +534,7 @@ static void a5xx_destroy(struct msm_gpu *gpu)
         }
 
         if (a5xx_gpu->gpmu_bo) {
-                if (a5xx_gpu->gpmu_bo)
+                if (a5xx_gpu->gpmu_iova)
                         msm_gem_put_iova(a5xx_gpu->gpmu_bo, gpu->id);
                 drm_gem_object_unreference_unlocked(a5xx_gpu->gpmu_bo);
         }
@@ -860,7 +860,9 @@ static const struct adreno_gpu_funcs funcs = {
                 .idle = a5xx_idle,
                 .irq = a5xx_irq,
                 .destroy = a5xx_destroy,
+#ifdef CONFIG_DEBUG_FS
                 .show = a5xx_show,
+#endif
         },
         .get_timestamp = a5xx_get_timestamp,
 };
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index c9bd1e6225f4..5ae65426b4e5 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -418,18 +418,27 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         return 0;
 }
 
-void adreno_gpu_cleanup(struct adreno_gpu *gpu)
+void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)
 {
-        if (gpu->memptrs_bo) {
-                if (gpu->memptrs)
-                        msm_gem_put_vaddr(gpu->memptrs_bo);
+        struct msm_gpu *gpu = &adreno_gpu->base;
+
+        if (adreno_gpu->memptrs_bo) {
+                if (adreno_gpu->memptrs)
+                        msm_gem_put_vaddr(adreno_gpu->memptrs_bo);
+
+                if (adreno_gpu->memptrs_iova)
+                        msm_gem_put_iova(adreno_gpu->memptrs_bo, gpu->id);
+
+                drm_gem_object_unreference_unlocked(adreno_gpu->memptrs_bo);
+        }
+        release_firmware(adreno_gpu->pm4);
+        release_firmware(adreno_gpu->pfp);
 
-                if (gpu->memptrs_iova)
-                        msm_gem_put_iova(gpu->memptrs_bo, gpu->base.id);
+        msm_gpu_cleanup(gpu);
 
-                drm_gem_object_unreference_unlocked(gpu->memptrs_bo);
+        if (gpu->aspace) {
+                gpu->aspace->mmu->funcs->detach(gpu->aspace->mmu,
+                        iommu_ports, ARRAY_SIZE(iommu_ports));
+                msm_gem_address_space_destroy(gpu->aspace);
         }
-        release_firmware(gpu->pm4);
-        release_firmware(gpu->pfp);
-        msm_gpu_cleanup(&gpu->base);
 }
diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c
index 921270ea6059..a879ffa534b4 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c
@@ -171,7 +171,7 @@ dsi_mgr_phy_enable(int id,
                         }
                 }
         } else {
-                msm_dsi_host_reset_phy(mdsi->host);
+                msm_dsi_host_reset_phy(msm_dsi->host);
                 ret = enable_phy(msm_dsi, src_pll_id, &shared_timings[id]);
                 if (ret)
                         return ret;
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_audio.c b/drivers/gpu/drm/msm/hdmi/hdmi_audio.c
index a54d3bb5baad..8177e8511afd 100644
--- a/drivers/gpu/drm/msm/hdmi/hdmi_audio.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_audio.c
@@ -18,13 +18,6 @@
 #include <linux/hdmi.h>
 #include "hdmi.h"
 
-
-/* Supported HDMI Audio channels */
-#define MSM_HDMI_AUDIO_CHANNEL_2                0
-#define MSM_HDMI_AUDIO_CHANNEL_4                1
-#define MSM_HDMI_AUDIO_CHANNEL_6                2
-#define MSM_HDMI_AUDIO_CHANNEL_8                3
-
 /* maps MSM_HDMI_AUDIO_CHANNEL_n consts used by audio driver to # of channels: */
 static int nchannels[] = { 2, 4, 6, 8 };
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h
index 611da7a660c9..238901987e00 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_pipe.h
@@ -18,7 +18,8 @@
 #ifndef __MDP5_PIPE_H__
 #define __MDP5_PIPE_H__
 
-#define SSPP_MAX        (SSPP_RGB3 + 1) /* TODO: Add SSPP_MAX in mdp5.xml.h */
+/* TODO: Add SSPP_MAX in mdp5.xml.h */
+#define SSPP_MAX        (SSPP_CURSOR1 + 1)
 
 /* represents a hw pipe, which is dynamically assigned to a plane */
 struct mdp5_hw_pipe {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 59811f29607d..68e509b3b9e4 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -812,6 +812,12 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev,
 
         size = PAGE_ALIGN(size);
 
+        /* Disallow zero sized objects as they make the underlying
+         * infrastructure grumpy
+         */
+        if (size == 0)
+                return ERR_PTR(-EINVAL);
+
         ret = msm_gem_new_impl(dev, size, flags, NULL, &obj);
         if (ret)
                 goto fail;
diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 99e05aacbee1..af5b6ba4095b 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -706,9 +706,6 @@ void msm_gpu_cleanup(struct msm_gpu *gpu)
                 msm_ringbuffer_destroy(gpu->rb);
         }
 
-        if (gpu->aspace)
-                msm_gem_address_space_destroy(gpu->aspace);
-
         if (gpu->fctx)
                 msm_fence_context_free(gpu->fctx);
 }
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
index e10a4eda4078..1144e0c9e894 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_crtc.c
@@ -65,13 +65,11 @@ static int mxsfb_set_pixel_fmt(struct mxsfb_drm_private *mxsfb)
         switch (format) {
         case DRM_FORMAT_RGB565:
                 dev_dbg(drm->dev, "Setting up RGB565 mode\n");
-                ctrl |= CTRL_SET_BUS_WIDTH(STMLCDIF_16BIT);
                 ctrl |= CTRL_SET_WORD_LENGTH(0);
                 ctrl1 |= CTRL1_SET_BYTE_PACKAGING(0xf);
                 break;
         case DRM_FORMAT_XRGB8888:
                 dev_dbg(drm->dev, "Setting up XRGB8888 mode\n");
-                ctrl |= CTRL_SET_BUS_WIDTH(STMLCDIF_24BIT);
                 ctrl |= CTRL_SET_WORD_LENGTH(3);
                 /* Do not use packed pixels = one pixel per word instead. */
                 ctrl1 |= CTRL1_SET_BYTE_PACKAGING(0x7);
@@ -87,6 +85,36 @@ static int mxsfb_set_pixel_fmt(struct mxsfb_drm_private *mxsfb)
         return 0;
 }
 
+static void mxsfb_set_bus_fmt(struct mxsfb_drm_private *mxsfb)
+{
+        struct drm_crtc *crtc = &mxsfb->pipe.crtc;
+        struct drm_device *drm = crtc->dev;
+        u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24;
+        u32 reg;
+
+        reg = readl(mxsfb->base + LCDC_CTRL);
+
+        if (mxsfb->connector.display_info.num_bus_formats)
+                bus_format = mxsfb->connector.display_info.bus_formats[0];
+
+        reg &= ~CTRL_BUS_WIDTH_MASK;
+        switch (bus_format) {
+        case MEDIA_BUS_FMT_RGB565_1X16:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_16BIT);
+                break;
+        case MEDIA_BUS_FMT_RGB666_1X18:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_18BIT);
+                break;
+        case MEDIA_BUS_FMT_RGB888_1X24:
+                reg |= CTRL_SET_BUS_WIDTH(STMLCDIF_24BIT);
+                break;
+        default:
+                dev_err(drm->dev, "Unknown media bus format %d\n", bus_format);
+                break;
+        }
+        writel(reg, mxsfb->base + LCDC_CTRL);
+}
+
 static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
 {
         u32 reg;
@@ -168,13 +196,22 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
                 vdctrl0 |= VDCTRL0_HSYNC_ACT_HIGH;
         if (m->flags & DRM_MODE_FLAG_PVSYNC)
                 vdctrl0 |= VDCTRL0_VSYNC_ACT_HIGH;
-        if (bus_flags & DRM_BUS_FLAG_DE_HIGH)
+        /* Make sure Data Enable is high active by default */
+        if (!(bus_flags & DRM_BUS_FLAG_DE_LOW))
                 vdctrl0 |= VDCTRL0_ENABLE_ACT_HIGH;
-        if (bus_flags & DRM_BUS_FLAG_PIXDATA_NEGEDGE)
+        /*
+         * DRM_BUS_FLAG_PIXDATA_ defines are controller centric,
+         * controllers VDCTRL0_DOTCLK is display centric.
+         * Drive on positive edge       -> display samples on falling edge
+         * DRM_BUS_FLAG_PIXDATA_POSEDGE -> VDCTRL0_DOTCLK_ACT_FALLING
+         */
+        if (bus_flags & DRM_BUS_FLAG_PIXDATA_POSEDGE)
                 vdctrl0 |= VDCTRL0_DOTCLK_ACT_FALLING;
 
         writel(vdctrl0, mxsfb->base + LCDC_VDCTRL0);
 
+        mxsfb_set_bus_fmt(mxsfb);
+
         /* Frame length in lines. */
         writel(m->crtc_vtotal, mxsfb->base + LCDC_VDCTRL1);
 
@@ -184,8 +221,8 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
                VDCTRL2_SET_HSYNC_PERIOD(m->crtc_htotal),
                mxsfb->base + LCDC_VDCTRL2);
 
-        writel(SET_HOR_WAIT_CNT(m->crtc_hblank_end - m->crtc_hsync_end) |
-               SET_VERT_WAIT_CNT(m->crtc_vblank_end - m->crtc_vsync_end),
+        writel(SET_HOR_WAIT_CNT(m->crtc_htotal - m->crtc_hsync_start) |
+               SET_VERT_WAIT_CNT(m->crtc_vtotal - m->crtc_vsync_start),
                mxsfb->base + LCDC_VDCTRL3);
 
         writel(SET_DOTCLK_H_VALID_DATA_CNT(m->hdisplay),
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index cdfbe0284635..ff6d6a6f842e 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -102,14 +102,18 @@ static void mxsfb_pipe_enable(struct drm_simple_display_pipe *pipe,
 {
         struct mxsfb_drm_private *mxsfb = drm_pipe_to_mxsfb_drm_private(pipe);
 
+        drm_panel_prepare(mxsfb->panel);
         mxsfb_crtc_enable(mxsfb);
+        drm_panel_enable(mxsfb->panel);
 }
 
 static void mxsfb_pipe_disable(struct drm_simple_display_pipe *pipe)
 {
         struct mxsfb_drm_private *mxsfb = drm_pipe_to_mxsfb_drm_private(pipe);
 
+        drm_panel_disable(mxsfb->panel);
         mxsfb_crtc_disable(mxsfb);
+        drm_panel_unprepare(mxsfb->panel);
 }
 
 static void mxsfb_pipe_update(struct drm_simple_display_pipe *pipe,
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_out.c b/drivers/gpu/drm/mxsfb/mxsfb_out.c
index fa8d17399407..b8e81422d4e2 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_out.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_out.c
@@ -112,6 +112,7 @@ static int mxsfb_attach_endpoint(struct drm_device *drm,
 
 int mxsfb_create_output(struct drm_device *drm)
 {
+        struct mxsfb_drm_private *mxsfb = drm->dev_private;
         struct device_node *ep_np = NULL;
         struct of_endpoint ep;
         int ret;
@@ -127,5 +128,8 @@ int mxsfb_create_output(struct drm_device *drm)
                 }
         }
 
+        if (!mxsfb->panel)
+                return -EPROBE_DEFER;
+
         return 0;
 }
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
index 31d62cd0d3d7..66a6ba9ec533 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
@@ -44,6 +44,7 @@
 #define CTRL_DATA_SELECT                (1 << 16)
 #define CTRL_SET_BUS_WIDTH(x)           (((x) & 0x3) << 10)
 #define CTRL_GET_BUS_WIDTH(x)           (((x) >> 10) & 0x3)
+#define CTRL_BUS_WIDTH_MASK             (0x3 << 10)
 #define CTRL_SET_WORD_LENGTH(x)         (((x) & 0x3) << 8)
 #define CTRL_GET_WORD_LENGTH(x)         (((x) >> 8) & 0x3)
 #define CTRL_MASTER                     (1 << 5)
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 0b4440ffbeae..a9182d5e6011 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -995,7 +995,6 @@ nv50_wndw_atomic_destroy_state(struct drm_plane *plane,
 {
         struct nv50_wndw_atom *asyw = nv50_wndw_atom(state);
         __drm_atomic_helper_plane_destroy_state(&asyw->state);
-        dma_fence_put(asyw->state.fence);
         kfree(asyw);
 }
 
@@ -1007,7 +1006,6 @@ nv50_wndw_atomic_duplicate_state(struct drm_plane *plane)
         if (!(asyw = kmalloc(sizeof(*asyw), GFP_KERNEL)))
                 return NULL;
         __drm_atomic_helper_plane_duplicate_state(plane, &asyw->state);
-        asyw->state.fence = NULL;
         asyw->interval = 1;
         asyw->sema = armw->sema;
         asyw->ntfy = armw->ntfy;
@@ -2036,6 +2034,7 @@ nv50_head_atomic_check_mode(struct nv50_head *head, struct nv50_head_atom *asyh)
         u32 vbackp  = (mode->vtotal - mode->vsync_end) * vscan / ilace;
         u32 hfrontp =  mode->hsync_start - mode->hdisplay;
         u32 vfrontp = (mode->vsync_start - mode->vdisplay) * vscan / ilace;
+        u32 blankus;
         struct nv50_head_mode *m = &asyh->mode;
 
         m->h.active = mode->htotal;
@@ -2049,9 +2048,10 @@ nv50_head_atomic_check_mode(struct nv50_head *head, struct nv50_head_atom *asyh)
         m->v.blanks = m->v.active - vfrontp - 1;
 
         /*XXX: Safe underestimate, even "0" works */
-        m->v.blankus = (m->v.active - mode->vdisplay - 2) * m->h.active;
-        m->v.blankus *= 1000;
-        m->v.blankus /= mode->clock;
+        blankus = (m->v.active - mode->vdisplay - 2) * m->h.active;
+        blankus *= 1000;
+        blankus /= mode->clock;
+        m->v.blankus = blankus;
 
         if (mode->flags & DRM_MODE_FLAG_INTERLACE) {
                 m->v.blank2e =  m->v.active + m->v.synce + vbackp;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 273562dd6bbd..3b86a7399567 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -714,7 +714,7 @@ nv4a_chipset = {
         .i2c = nv04_i2c_new,
         .imem = nv40_instmem_new,
         .mc = nv44_mc_new,
-        .mmu = nv44_mmu_new,
+        .mmu = nv04_mmu_new,
         .pci = nv40_pci_new,
         .therm = nv40_therm_new,
         .timer = nv41_timer_new,
@@ -2271,6 +2271,35 @@ nv136_chipset = {
         .fifo = gp100_fifo_new,
 };
 
+static const struct nvkm_device_chip
+nv137_chipset = {
+        .name = "GP107",
+        .bar = gf100_bar_new,
+        .bios = nvkm_bios_new,
+        .bus = gf100_bus_new,
+        .devinit = gm200_devinit_new,
+        .fb = gp102_fb_new,
+        .fuse = gm107_fuse_new,
+        .gpio = gk104_gpio_new,
+        .i2c = gm200_i2c_new,
+        .ibus = gm200_ibus_new,
+        .imem = nv50_instmem_new,
+        .ltc = gp100_ltc_new,
+        .mc = gp100_mc_new,
+        .mmu = gf100_mmu_new,
+        .pci = gp100_pci_new,
+        .pmu = gp102_pmu_new,
+        .timer = gk20a_timer_new,
+        .top = gk104_top_new,
+        .ce[0] = gp102_ce_new,
+        .ce[1] = gp102_ce_new,
+        .ce[2] = gp102_ce_new,
+        .ce[3] = gp102_ce_new,
+        .disp = gp102_disp_new,
+        .dma = gf119_dma_new,
+        .fifo = gp100_fifo_new,
+};
+
 static int
 nvkm_device_event_ctor(struct nvkm_object *object, void *data, u32 size,
                        struct nvkm_notify *notify)
@@ -2708,6 +2737,7 @@ nvkm_device_ctor(const struct nvkm_device_func *func,
                 case 0x132: device->chip = &nv132_chipset; break;
                 case 0x134: device->chip = &nv134_chipset; break;
                 case 0x136: device->chip = &nv136_chipset; break;
+                case 0x137: device->chip = &nv137_chipset; break;
                 default:
                         nvdev_error(device, "unknown chipset (%08x)\n", boot0);
                         goto done;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
index 003ac915eaad..8a8895246d26 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
@@ -198,7 +198,7 @@ nv31_mpeg_intr(struct nvkm_engine *engine)
                 }
 
                 if (type == 0x00000010) {
-                        if (!nv31_mpeg_mthd(mpeg, mthd, data))
+                        if (nv31_mpeg_mthd(mpeg, mthd, data))
                                 show &= ~0x01000000;
                 }
         }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
index e536f37e24b0..c3cf02ed468e 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
@@ -172,7 +172,7 @@ nv44_mpeg_intr(struct nvkm_engine *engine)
                 }
 
                 if (type == 0x00000010) {
-                        if (!nv44_mpeg_mthd(subdev->device, mthd, data))
+                        if (nv44_mpeg_mthd(subdev->device, mthd, data))
                                 show &= ~0x01000000;
                 }
         }
diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
index af267c35d813..ee5883f59be5 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c
@@ -147,9 +147,6 @@ static int omap_gem_dmabuf_mmap(struct dma_buf *buffer,
         struct drm_gem_object *obj = buffer->priv;
         int ret = 0;
 
-        if (WARN_ON(!obj->filp))
-                return -EINVAL;
-
         ret = drm_gem_mmap_obj(obj, omap_gem_mmap_size(obj), vma);
         if (ret < 0)
                 return ret;
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 684f1703aa5c..aaa3e80fecb4 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -213,8 +213,8 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
                         rbo->placement.num_busy_placement = 0;
                         for (i = 0; i < rbo->placement.num_placement; i++) {
                                 if (rbo->placements[i].flags & TTM_PL_FLAG_VRAM) {
-                                        if (rbo->placements[0].fpfn < fpfn)
-                                                rbo->placements[0].fpfn = fpfn;
+                                        if (rbo->placements[i].fpfn < fpfn)
+                                                rbo->placements[i].fpfn = fpfn;
                                 } else {
                                         rbo->placement.busy_placement =
                                                 &rbo->placements[i];
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index d12b8978142f..c7af9fdd20c7 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2984,6 +2984,16 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
                     (rdev->pdev->device == 0x6667)) {
                         max_sclk = 75000;
                 }
+        } else if (rdev->family == CHIP_OLAND) {
+                if ((rdev->pdev->revision == 0xC7) ||
+                    (rdev->pdev->revision == 0x80) ||
+                    (rdev->pdev->revision == 0x81) ||
+                    (rdev->pdev->revision == 0x83) ||
+                    (rdev->pdev->revision == 0x87) ||
+                    (rdev->pdev->device == 0x6604) ||
+                    (rdev->pdev->device == 0x6605)) {
+                        max_sclk = 75000;
+                }
         }
 
         if (rps->vce_active) {
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
index b5bfbe50bd87..b0ff304ce3dc 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c
@@ -32,6 +32,10 @@ void rcar_du_vsp_enable(struct rcar_du_crtc *crtc)
 {
         const struct drm_display_mode *mode = &crtc->crtc.state->adjusted_mode;
         struct rcar_du_device *rcdu = crtc->group->dev;
+        struct vsp1_du_lif_config cfg = {
+                .width = mode->hdisplay,
+                .height = mode->vdisplay,
+        };
         struct rcar_du_plane_state state = {
                 .state = {
                         .crtc = &crtc->crtc,
@@ -66,12 +70,12 @@ void rcar_du_vsp_enable(struct rcar_du_crtc *crtc)
          */
         crtc->group->need_restart = true;
 
-        vsp1_du_setup_lif(crtc->vsp->vsp, mode->hdisplay, mode->vdisplay);
+        vsp1_du_setup_lif(crtc->vsp->vsp, &cfg);
 }
 
 void rcar_du_vsp_disable(struct rcar_du_crtc *crtc)
 {
-        vsp1_du_setup_lif(crtc->vsp->vsp, 0, 0);
+        vsp1_du_setup_lif(crtc->vsp->vsp, NULL);
 }
 
 void rcar_du_vsp_atomic_begin(struct rcar_du_crtc *crtc)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
index f80bf9385e41..d745e8b50fb8 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c
@@ -464,6 +464,7 @@ static void tilcdc_crtc_enable(struct drm_crtc *crtc)
 {
         struct drm_device *dev = crtc->dev;
         struct tilcdc_crtc *tilcdc_crtc = to_tilcdc_crtc(crtc);
+        unsigned long flags;
 
         WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
         mutex_lock(&tilcdc_crtc->enable_lock);
@@ -484,7 +485,17 @@ static void tilcdc_crtc_enable(struct drm_crtc *crtc)
         tilcdc_write_mask(dev, LCDC_RASTER_CTRL_REG,
                           LCDC_PALETTE_LOAD_MODE(DATA_ONLY),
                           LCDC_PALETTE_LOAD_MODE_MASK);
+
+        /* There is no real chance for a race here as the time stamp
+         * is taken before the raster DMA is started. The spin-lock is
+         * taken to have a memory barrier after taking the time-stamp
+         * and to avoid a context switch between taking the stamp and
+         * enabling the raster.
+         */
+        spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
+        tilcdc_crtc->last_vblank = ktime_get();
         tilcdc_set(dev, LCDC_RASTER_CTRL_REG, LCDC_RASTER_ENABLE);
+        spin_unlock_irqrestore(&tilcdc_crtc->irq_lock, flags);
 
         drm_crtc_vblank_on(crtc);
 
@@ -539,7 +550,6 @@ static void tilcdc_crtc_off(struct drm_crtc *crtc, bool shutdown)
         }
 
         drm_flip_work_commit(&tilcdc_crtc->unref_work, priv->wq);
-        tilcdc_crtc->last_vblank = 0;
 
         tilcdc_crtc->enabled = false;
         mutex_unlock(&tilcdc_crtc->enable_lock);
@@ -602,7 +612,6 @@ int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
 {
         struct tilcdc_crtc *tilcdc_crtc = to_tilcdc_crtc(crtc);
         struct drm_device *dev = crtc->dev;
-        unsigned long flags;
 
         WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
 
@@ -614,28 +623,30 @@ int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
         drm_framebuffer_reference(fb);
 
         crtc->primary->fb = fb;
+        tilcdc_crtc->event = event;
 
-        spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
+        mutex_lock(&tilcdc_crtc->enable_lock);
 
-        if (crtc->hwmode.vrefresh && ktime_to_ns(tilcdc_crtc->last_vblank)) {
+        if (tilcdc_crtc->enabled) {
+                unsigned long flags;
                 ktime_t next_vblank;
                 s64 tdiff;
 
-                next_vblank = ktime_add_us(tilcdc_crtc->last_vblank,
-                        1000000 / crtc->hwmode.vrefresh);
+                spin_lock_irqsave(&tilcdc_crtc->irq_lock, flags);
 
+                next_vblank = ktime_add_us(tilcdc_crtc->last_vblank,
+                                           1000000 / crtc->hwmode.vrefresh);
                 tdiff = ktime_to_us(ktime_sub(next_vblank, ktime_get()));
 
                 if (tdiff < TILCDC_VBLANK_SAFETY_THRESHOLD_US)
                         tilcdc_crtc->next_fb = fb;
-        }
-
-        if (tilcdc_crtc->next_fb != fb)
-                set_scanout(crtc, fb);
+                else
+                        set_scanout(crtc, fb);
 
-        tilcdc_crtc->event = event;
+                spin_unlock_irqrestore(&tilcdc_crtc->irq_lock, flags);
+        }
 
-        spin_unlock_irqrestore(&tilcdc_crtc->irq_lock, flags);
+        mutex_unlock(&tilcdc_crtc->enable_lock);
 
         return 0;
 }
@@ -1036,5 +1047,5 @@ int tilcdc_crtc_create(struct drm_device *dev)
 
 fail:
         tilcdc_crtc_destroy(crtc);
-        return -ENOMEM;
+        return ret;
 }
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index fdb451e3ec01..26a7ad0f4789 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -179,7 +179,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile,
         if (unlikely(ret != 0))
                 goto out_err0;
 
-        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
         if (unlikely(ret != 0))
                 goto out_err1;
 
@@ -318,7 +318,8 @@ EXPORT_SYMBOL(ttm_ref_object_exists);
 
 int ttm_ref_object_add(struct ttm_object_file *tfile,
                        struct ttm_base_object *base,
-                       enum ttm_ref_type ref_type, bool *existed)
+                       enum ttm_ref_type ref_type, bool *existed,
+                       bool require_existed)
 {
         struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
         struct ttm_ref_object *ref;
@@ -345,6 +346,9 @@ int ttm_ref_object_add(struct ttm_object_file *tfile,
                 }
 
                 rcu_read_unlock();
+                if (require_existed)
+                        return -EPERM;
+
                 ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
                                            false, false);
                 if (unlikely(ret != 0))
@@ -449,10 +453,10 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile)
                 ttm_ref_object_release(&ref->kref);
         }
 
+        spin_unlock(&tfile->lock);
         for (i = 0; i < TTM_REF_NUM; ++i)
                 drm_ht_remove(&tfile->ref_hash[i]);
 
-        spin_unlock(&tfile->lock);
         ttm_object_file_unref(&tfile);
 }
 EXPORT_SYMBOL(ttm_object_file_release);
@@ -529,9 +533,7 @@ void ttm_object_device_release(struct ttm_object_device **p_tdev)
 
         *p_tdev = NULL;
 
-        spin_lock(&tdev->object_lock);
         drm_ht_remove(&tdev->object_hash);
-        spin_unlock(&tdev->object_lock);
 
         kfree(tdev);
 }
@@ -635,7 +637,7 @@ int ttm_prime_fd_to_handle(struct ttm_object_file *tfile,
         prime = (struct ttm_prime_object *) dma_buf->priv;
         base = &prime->base;
         *handle = base->hash.key;
-        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+        ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 
         dma_buf_put(dma_buf);
 
diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index 917dcb978c2c..0c87b1ac6b68 100644
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/prefetch.h>
+#include <asm/unaligned.h>
 
 #include <drm/drmP.h>
 #include "udl_drv.h"
@@ -163,7 +164,7 @@ static void udl_compress_hline16(
                         const u8 *const start = pixel;
                         const uint16_t repeating_pixel_val16 = pixel_val16;
 
-                        *(uint16_t *)cmd = cpu_to_be16(pixel_val16);
+                        put_unaligned_be16(pixel_val16, cmd);
 
                         cmd += 2;
                         pixel += bpp;
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 0c06844af445..9fcf05ca492b 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -846,6 +846,17 @@ static void vc4_crtc_destroy_state(struct drm_crtc *crtc,
         drm_atomic_helper_crtc_destroy_state(crtc, state);
 }
 
+static void
+vc4_crtc_reset(struct drm_crtc *crtc)
+{
+        if (crtc->state)
+                __drm_atomic_helper_crtc_destroy_state(crtc->state);
+
+        crtc->state = kzalloc(sizeof(struct vc4_crtc_state), GFP_KERNEL);
+        if (crtc->state)
+                crtc->state->crtc = crtc;
+}
+
 static const struct drm_crtc_funcs vc4_crtc_funcs = {
         .set_config = drm_atomic_helper_set_config,
         .destroy = vc4_crtc_destroy,
@@ -853,7 +864,7 @@ static const struct drm_crtc_funcs vc4_crtc_funcs = {
         .set_property = NULL,
         .cursor_set = NULL, /* handled by drm_mode_cursor_universal */
         .cursor_move = NULL, /* handled by drm_mode_cursor_universal */
-        .reset = drm_atomic_helper_crtc_reset,
+        .reset = vc4_crtc_reset,
         .atomic_duplicate_state = vc4_crtc_duplicate_state,
         .atomic_destroy_state = vc4_crtc_destroy_state,
         .gamma_set = vc4_crtc_gamma_set,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index 6541dd8b82dc..6b2708b4eafe 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -538,7 +538,7 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
                      struct vmw_fence_obj **p_fence)
 {
         struct vmw_fence_obj *fence;
-        int ret;
+        int ret;
 
         fence = kzalloc(sizeof(*fence), GFP_KERNEL);
         if (unlikely(fence == NULL))
@@ -701,6 +701,41 @@ void vmw_fence_fifo_up(struct vmw_fence_manager *fman)
 }
 
 
+/**
+ * vmw_fence_obj_lookup - Look up a user-space fence object
+ *
+ * @tfile: A struct ttm_object_file identifying the caller.
+ * @handle: A handle identifying the fence object.
+ * @return: A struct vmw_user_fence base ttm object on success or
+ * an error pointer on failure.
+ *
+ * The fence object is looked up and type-checked. The caller needs
+ * to have opened the fence object first, but since that happens on
+ * creation and fence objects aren't shareable, that's not an
+ * issue currently.
+ */
+static struct ttm_base_object *
+vmw_fence_obj_lookup(struct ttm_object_file *tfile, u32 handle)
+{
+        struct ttm_base_object *base = ttm_base_object_lookup(tfile, handle);
+
+        if (!base) {
+                pr_err("Invalid fence object handle 0x%08lx.\n",
+                       (unsigned long)handle);
+                return ERR_PTR(-EINVAL);
+        }
+
+        if (base->refcount_release != vmw_user_fence_base_release) {
+                pr_err("Invalid fence object handle 0x%08lx.\n",
+                       (unsigned long)handle);
+                ttm_base_object_unref(&base);
+                return ERR_PTR(-EINVAL);
+        }
+
+        return base;
+}
+
+
 int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
                              struct drm_file *file_priv)
 {
@@ -726,13 +761,9 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data,
                 arg->kernel_cookie = jiffies + wait_timeout;
         }
 
-        base = ttm_base_object_lookup(tfile, arg->handle);
-        if (unlikely(base == NULL)) {
-                printk(KERN_ERR "Wait invalid fence object handle "
-                       "0x%08lx.\n",
-                       (unsigned long)arg->handle);
-                return -EINVAL;
-        }
+        base = vmw_fence_obj_lookup(tfile, arg->handle);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
 
         fence = &(container_of(base, struct vmw_user_fence, base)->fence);
 
@@ -771,13 +802,9 @@ int vmw_fence_obj_signaled_ioctl(struct drm_device *dev, void *data,
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
         struct vmw_private *dev_priv = vmw_priv(dev);
 
-        base = ttm_base_object_lookup(tfile, arg->handle);
-        if (unlikely(base == NULL)) {
-                printk(KERN_ERR "Fence signaled invalid fence object handle "
-                       "0x%08lx.\n",
-                       (unsigned long)arg->handle);
-                return -EINVAL;
-        }
+        base = vmw_fence_obj_lookup(tfile, arg->handle);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
 
         fence = &(container_of(base, struct vmw_user_fence, base)->fence);
         fman = fman_from_fence(fence);
@@ -1024,6 +1051,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
                 (struct drm_vmw_fence_event_arg *) data;
         struct vmw_fence_obj *fence = NULL;
         struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
+        struct ttm_object_file *tfile = vmw_fp->tfile;
         struct drm_vmw_fence_rep __user *user_fence_rep =
                 (struct drm_vmw_fence_rep __user *)(unsigned long)
                 arg->fence_rep;
@@ -1037,24 +1065,18 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
          */
         if (arg->handle) {
                 struct ttm_base_object *base =
-                        ttm_base_object_lookup_for_ref(dev_priv->tdev,
-                                                       arg->handle);
-
-                if (unlikely(base == NULL)) {
-                        DRM_ERROR("Fence event invalid fence object handle "
-                                  "0x%08lx.\n",
-                                  (unsigned long)arg->handle);
-                        return -EINVAL;
-                }
+                        vmw_fence_obj_lookup(tfile, arg->handle);
+
+                if (IS_ERR(base))
+                        return PTR_ERR(base);
+
                 fence = &(container_of(base, struct vmw_user_fence,
                                        base)->fence);
                 (void) vmw_fence_obj_reference(fence);
 
                 if (user_fence_rep != NULL) {
-                        bool existed;
-
                         ret = ttm_ref_object_add(vmw_fp->tfile, base,
-                                                 TTM_REF_USAGE, &existed);
+                                                 TTM_REF_USAGE, NULL, false);
                         if (unlikely(ret != 0)) {
                                 DRM_ERROR("Failed to reference a fence "
                                           "object.\n");
@@ -1097,8 +1119,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
         return 0;
 out_no_create:
         if (user_fence_rep != NULL)
-                ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
-                                          handle, TTM_REF_USAGE);
+                ttm_ref_object_base_unref(tfile, handle, TTM_REF_USAGE);
 out_no_ref_obj:
         vmw_fence_obj_unreference(&fence);
         return ret;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index b8c6a03c8c54..5ec24fd801cd 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -114,8 +114,6 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                 param->value = dev_priv->has_dx;
                 break;
         default:
-                DRM_ERROR("Illegal vmwgfx get param request: %d\n",
-                          param->param);
                 return -EINVAL;
         }
 
@@ -186,7 +184,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
         bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS);
         struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
 
-        if (unlikely(arg->pad64 != 0)) {
+        if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
                 DRM_ERROR("Illegal GET_3D_CAP argument.\n");
                 return -EINVAL;
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 65b3f0369636..bf23153d4f55 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -589,7 +589,7 @@ static int vmw_user_dmabuf_synccpu_grab(struct vmw_user_dma_buffer *user_bo,
                 return ret;
 
         ret = ttm_ref_object_add(tfile, &user_bo->prime.base,
-                                 TTM_REF_SYNCCPU_WRITE, &existed);
+                                 TTM_REF_SYNCCPU_WRITE, &existed, false);
         if (ret != 0 || existed)
                 ttm_bo_synccpu_write_release(&user_bo->dma.base);
 
@@ -773,7 +773,7 @@ int vmw_user_dmabuf_reference(struct ttm_object_file *tfile,
 
         *handle = user_bo->prime.base.hash.key;
         return ttm_ref_object_add(tfile, &user_bo->prime.base,
-                                  TTM_REF_USAGE, NULL);
+                                  TTM_REF_USAGE, NULL, false);
 }
 
 /*
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b445ce9b9757..05fa092c942b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -713,11 +713,14 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
                         128;
 
         num_sizes = 0;
-        for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
+        for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
+                if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
+                        return -EINVAL;
                 num_sizes += req->mip_levels[i];
+        }
 
-        if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
-            DRM_VMW_MAX_MIP_LEVELS)
+        if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
+            num_sizes == 0)
                 return -EINVAL;
 
         size = vmw_user_surface_size + 128 +
@@ -891,17 +894,16 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv,
         uint32_t handle;
         struct ttm_base_object *base;
         int ret;
+        bool require_exist = false;
 
         if (handle_type == DRM_VMW_HANDLE_PRIME) {
                 ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
                 if (unlikely(ret != 0))
                         return ret;
         } else {
-                if (unlikely(drm_is_render_client(file_priv))) {
-                        DRM_ERROR("Render client refused legacy "
-                                  "surface reference.\n");
-                        return -EACCES;
-                }
+                if (unlikely(drm_is_render_client(file_priv)))
+                        require_exist = true;
+
                 if (ACCESS_ONCE(vmw_fpriv(file_priv)->locked_master)) {
                         DRM_ERROR("Locked master refused legacy "
                                   "surface reference.\n");
@@ -929,17 +931,14 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv,
 
                 /*
                  * Make sure the surface creator has the same
-                 * authenticating master.
+                 * authenticating master, or is already registered with us.
                  */
                 if (drm_is_primary_client(file_priv) &&
-                    user_srf->master != file_priv->master) {
-                        DRM_ERROR("Trying to reference surface outside of"
-                                  " master domain.\n");
-                        ret = -EACCES;
-                        goto out_bad_resource;
-                }
+                    user_srf->master != file_priv->master)
+                        require_exist = true;
 
-                ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+                ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL,
+                                         require_exist);
                 if (unlikely(ret != 0)) {
                         DRM_ERROR("Could not add a reference to a surface.\n");
                         goto out_bad_resource;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 1aeb80e52424..8c54cb8f5d6d 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -175,11 +175,11 @@ config HID_CHERRY
         Support for Cherry Cymotion keyboard.
 
 config HID_CHICONY
-        tristate "Chicony Tactical pad"
+        tristate "Chicony devices"
         depends on HID
         default !EXPERT
         ---help---
-        Support for Chicony Tactical pad.
+        Support for Chicony Tactical pad and special keys on Chicony keyboards.
 
 config HID_CORSAIR
         tristate "Corsair devices"
@@ -190,6 +190,7 @@ config HID_CORSAIR
 
         Supported devices:
         - Vengeance K90
+        - Scimitar PRO RGB
 
 config HID_PRODIKEYS
         tristate "Prodikeys PC-MIDI Keyboard support"
diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c
index bc3cec199fee..f04ed9aabc3f 100644
--- a/drivers/hid/hid-chicony.c
+++ b/drivers/hid/hid-chicony.c
@@ -86,6 +86,7 @@ static const struct hid_device_id ch_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index e9e87d337446..d162f0dc76e3 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -819,8 +819,7 @@ static int hid_scan_report(struct hid_device *hid)
                 hid->group = HID_GROUP_WACOM;
                 break;
         case USB_VENDOR_ID_SYNAPTICS:
-                if (hid->group == HID_GROUP_GENERIC ||
-                    hid->group == HID_GROUP_MULTITOUCH_WIN_8)
+                if (hid->group == HID_GROUP_GENERIC)
                         if ((parser->scan_flags & HID_SCAN_FLAG_VENDOR_SPECIFIC)
                             && (parser->scan_flags & HID_SCAN_FLAG_GD_POINTER))
                                 /*
@@ -1870,6 +1869,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYGNAL, USB_DEVICE_ID_CYGNAL_CP2112) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
@@ -1910,6 +1910,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
         { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
@@ -2094,6 +2095,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SMARTJOY_PLUS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_SUPER_JOY_BOX_3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD) },
@@ -2110,6 +2112,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) },
diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
index c0303f61c26a..9ba5d98a1180 100644
--- a/drivers/hid/hid-corsair.c
+++ b/drivers/hid/hid-corsair.c
@@ -3,8 +3,10 @@
  *
  * Supported devices:
  *  - Vengeance K90 Keyboard
+ *  - Scimitar PRO RGB Gaming Mouse
  *
  * Copyright (c) 2015 Clement Vuchener
+ * Copyright (c) 2017 Oscar Campos
  */
 
 /*
@@ -670,10 +672,51 @@ static int corsair_input_mapping(struct hid_device *dev,
         return 0;
 }
 
+/*
+ * The report descriptor of Corsair Scimitar RGB Pro gaming mouse is
+ * non parseable as they define two consecutive Logical Minimum for
+ * the Usage Page (Consumer) in rdescs bytes 75 and 77 being 77 0x16
+ * that should be obviousy 0x26 for Logical Magimum of 16 bits. This
+ * prevents poper parsing of the report descriptor due Logical
+ * Minimum being larger than Logical Maximum.
+ *
+ * This driver fixes the report descriptor for:
+ * - USB ID b1c:1b3e, sold as Scimitar RGB Pro Gaming mouse
+ */
+
+static __u8 *corsair_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+        unsigned int *rsize)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+
+        if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+                /*
+                 * Corsair Scimitar RGB Pro report descriptor is broken and
+                 * defines two different Logical Minimum for the Consumer
+                 * Application. The byte 77 should be a 0x26 defining a 16
+                 * bits integer for the Logical Maximum but it is a 0x16
+                 * instead (Logical Minimum)
+                 */
+                switch (hdev->product) {
+                case USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB:
+                        if (*rsize >= 172 && rdesc[75] == 0x15 && rdesc[77] == 0x16
+                        && rdesc[78] == 0xff && rdesc[79] == 0x0f) {
+                                hid_info(hdev, "Fixing up report descriptor\n");
+                                rdesc[77] = 0x26;
+                        }
+                        break;
+                }
+
+        }
+        return rdesc;
+}
+
 static const struct hid_device_id corsair_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K90),
                 .driver_data = CORSAIR_USE_K90_MACRO |
                                CORSAIR_USE_K90_BACKLIGHT },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR,
+            USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB) },
         {}
 };
 
@@ -686,10 +729,14 @@ static struct hid_driver corsair_driver = {
         .event = corsair_event,
         .remove = corsair_remove,
         .input_mapping = corsair_input_mapping,
+        .report_fixup = corsair_mouse_report_fixup,
 };
 
 module_hid_driver(corsair_driver);
 
 MODULE_LICENSE("GPL");
+/* Original K90 driver author */
 MODULE_AUTHOR("Clement Vuchener");
+/* Scimitar PRO RGB driver author */
+MODULE_AUTHOR("Oscar Campos");
 MODULE_DESCRIPTION("HID driver for Corsair devices");
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 86c95d30ac80..b26c030926c1 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -278,6 +278,9 @@
 #define USB_DEVICE_ID_CORSAIR_K70RGB    0x1b13
 #define USB_DEVICE_ID_CORSAIR_STRAFE    0x1b15
 #define USB_DEVICE_ID_CORSAIR_K65RGB    0x1b17
+#define USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE  0x1b38
+#define USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE  0x1b39
+#define USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB  0x1b3e
 
 #define USB_VENDOR_ID_CREATIVELABS      0x041e
 #define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51      0x322c
@@ -557,6 +560,7 @@
 
 #define USB_VENDOR_ID_JESS              0x0c45
 #define USB_DEVICE_ID_JESS_YUREX        0x1010
+#define USB_DEVICE_ID_JESS_ZEN_AIO_KBD  0x5112
 
 #define USB_VENDOR_ID_JESS2             0x0f30
 #define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111
@@ -1024,6 +1028,9 @@
 #define USB_DEVICE_ID_UGEE_TABLET_45            0x0045
 #define USB_DEVICE_ID_YIYNOVA_TABLET            0x004d
 
+#define USB_VENDOR_ID_UGEE              0x28bd
+#define USB_DEVICE_ID_UGEE_TABLET_EX07S         0x0071
+
 #define USB_VENDOR_ID_UNITEC    0x227d
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0709     0x0709
 #define USB_DEVICE_ID_UNITEC_USB_TOUCH_0A19     0x0a19
@@ -1078,6 +1085,7 @@
 
 #define USB_VENDOR_ID_XIN_MO                    0x16c0
 #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE        0x05e1
+#define USB_DEVICE_ID_THT_2P_ARCADE             0x75e1
 
 #define USB_VENDOR_ID_XIROKU            0x1477
 #define USB_DEVICE_ID_XIROKU_SPX        0x1006
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index f405b07d0381..740996f9bdd4 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -2632,6 +2632,8 @@ err_stop:
                 sony_leds_remove(sc);
         if (sc->quirks & SONY_BATTERY_SUPPORT)
                 sony_battery_remove(sc);
+        if (sc->touchpad)
+                sony_unregister_touchpad(sc);
         sony_cancel_work_sync(sc);
         kfree(sc->output_report_dmabuf);
         sony_remove_dev_list(sc);
diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c
index 1509d7287ff3..e3e6e5c893cc 100644
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -977,6 +977,7 @@ static int uclogic_probe(struct hid_device *hdev,
                 }
                 break;
         case USB_DEVICE_ID_UGTIZER_TABLET_GP0610:
+        case USB_DEVICE_ID_UGEE_TABLET_EX07S:
                 /* If this is the pen interface */
                 if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
                         rc = uclogic_tablet_enable(hdev);
@@ -1069,6 +1070,7 @@ static const struct hid_device_id uclogic_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UGEE_TABLET_45) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_DRAWIMAGE_G3) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_GP0610) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_TABLET_EX07S) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, uclogic_devices);
diff --git a/drivers/hid/hid-xinmo.c b/drivers/hid/hid-xinmo.c
index 7df5227a7e61..9ad7731d2e10 100644
--- a/drivers/hid/hid-xinmo.c
+++ b/drivers/hid/hid-xinmo.c
@@ -46,6 +46,7 @@ static int xinmo_event(struct hid_device *hdev, struct hid_field *field,
 
 static const struct hid_device_id xinmo_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) },
         { }
 };
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index d6847a664446..a69a3c88ab29 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -80,6 +80,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index be8f7e2a026f..e2666ef84dc1 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2165,6 +2165,14 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
 
         wacom_update_name(wacom, wireless ? " (WL)" : "");
 
+        /* pen only Bamboo neither support touch nor pad */
+        if ((features->type == BAMBOO_PEN) &&
+            ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
+            (features->device_type & WACOM_DEVICETYPE_PAD))) {
+                error = -ENODEV;
+                goto fail;
+        }
+
         error = wacom_add_shared_data(hdev);
         if (error)
                 goto fail;
@@ -2208,14 +2216,8 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
         /* touch only Bamboo doesn't support pen */
         if ((features->type == BAMBOO_TOUCH) &&
             (features->device_type & WACOM_DEVICETYPE_PEN)) {
-                error = -ENODEV;
-                goto fail_quirks;
-        }
-
-        /* pen only Bamboo neither support touch nor pad */
-        if ((features->type == BAMBOO_PEN) &&
-            ((features->device_type & WACOM_DEVICETYPE_TOUCH) ||
-            (features->device_type & WACOM_DEVICETYPE_PAD))) {
+                cancel_delayed_work_sync(&wacom->init_work);
+                _wacom_query_tablet_data(wacom);
                 error = -ENODEV;
                 goto fail_quirks;
         }
@@ -2579,7 +2581,9 @@ static void wacom_remove(struct hid_device *hdev)
 
         /* make sure we don't trigger the LEDs */
         wacom_led_groups_release(wacom);
-        wacom_release_resources(wacom);
+
+        if (wacom->wacom_wac.features.type != REMOTE)
+                wacom_release_resources(wacom);
 
         hid_set_drvdata(hdev, NULL);
 }
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4aa3de9f1163..c68ac65db7ff 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1959,8 +1959,10 @@ static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
                 input_set_capability(input, EV_KEY, BTN_TOOL_BRUSH);
                 input_set_capability(input, EV_KEY, BTN_TOOL_PENCIL);
                 input_set_capability(input, EV_KEY, BTN_TOOL_AIRBRUSH);
-                input_set_capability(input, EV_KEY, BTN_TOOL_MOUSE);
-                input_set_capability(input, EV_KEY, BTN_TOOL_LENS);
+                if (!(features->device_type & WACOM_DEVICETYPE_DIRECT)) {
+                        input_set_capability(input, EV_KEY, BTN_TOOL_MOUSE);
+                        input_set_capability(input, EV_KEY, BTN_TOOL_LENS);
+                }
                 break;
         case WACOM_HID_WD_FINGERWHEEL:
                 wacom_map_usage(input, usage, field, EV_ABS, ABS_WHEEL, 0);
@@ -2004,7 +2006,7 @@ static void wacom_wac_pen_event(struct hid_device *hdev, struct hid_field *field
                 return;
         case HID_DG_TOOLSERIALNUMBER:
                 wacom_wac->serial[0] = (wacom_wac->serial[0] & ~0xFFFFFFFFULL);
-                wacom_wac->serial[0] |= value;
+                wacom_wac->serial[0] |= (__u32)value;
                 return;
         case WACOM_HID_WD_SENSE:
                 wacom_wac->hid_data.sense_state = value;
@@ -2174,6 +2176,16 @@ static void wacom_wac_finger_usage_mapping(struct hid_device *hdev,
                 wacom_wac->hid_data.cc_index = field->index;
                 wacom_wac->hid_data.cc_value_index = usage->usage_index;
                 break;
+        case HID_DG_CONTACTID:
+                if ((field->logical_maximum - field->logical_minimum) < touch_max) {
+                        /*
+                         * The HID descriptor for G11 sensors leaves logical
+                         * maximum set to '1' despite it being a multitouch
+                         * device. Override to a sensible number.
+                         */
+                        field->logical_maximum = 255;
+                }
+                break;
         }
 }
 
@@ -4197,10 +4209,10 @@ static const struct wacom_features wacom_features_0x343 =
           WACOM_DTU_OFFSET, WACOM_DTU_OFFSET };
 static const struct wacom_features wacom_features_0x360 =
         { "Wacom Intuos Pro M", 44800, 29600, 8191, 63,
-          INTUOSP2_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 9, .touch_max = 10 };
+          INTUOSP2_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 9, .touch_max = 10 };
 static const struct wacom_features wacom_features_0x361 =
         { "Wacom Intuos Pro L", 62200, 43200, 8191, 63,
-          INTUOSP2_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 9, .touch_max = 10 };
+          INTUOSP2_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 9, .touch_max = 10 };
 
 static const struct wacom_features wacom_features_HID_ANY_ID =
         { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 81a80c82f1bd..321b8833fa6f 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -502,12 +502,15 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
 
         wait_for_completion(&info->waitevent);
 
-        if (channel->rescind) {
-                ret = -ENODEV;
-                goto post_msg_err;
-        }
-
 post_msg_err:
+        /*
+         * If the channel has been rescinded;
+         * we will be awakened by the rescind
+         * handler; set the error code to zero so we don't leak memory.
+         */
+        if (channel->rescind)
+                ret = 0;
+
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
@@ -530,20 +533,18 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
         int ret;
 
         /*
-         * vmbus_on_event(), running in the tasklet, can race
+         * vmbus_on_event(), running in the per-channel tasklet, can race
          * with vmbus_close_internal() in the case of SMP guest, e.g., when
          * the former is accessing channel->inbound.ring_buffer, the latter
-         * could be freeing the ring_buffer pages.
-         *
-         * To resolve the race, we can serialize them by disabling the
-         * tasklet when the latter is running here.
+         * could be freeing the ring_buffer pages, so here we must stop it
+         * first.
          */
-        hv_event_tasklet_disable(channel);
+        tasklet_disable(&channel->callback_event);
 
         /*
          * In case a device driver's probe() fails (e.g.,
          * util_probe() -> vmbus_open() returns -ENOMEM) and the device is
-         * rescinded later (e.g., we dynamically disble an Integrated Service
+         * rescinded later (e.g., we dynamically disable an Integrated Service
          * in Hyper-V Manager), the driver's remove() invokes vmbus_close():
          * here we should skip most of the below cleanup work.
          */
@@ -605,8 +606,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
                 get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
 
 out:
-        hv_event_tasklet_enable(channel);
-
         return ret;
 }
 
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index f33465d78a02..fbcb06352308 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -350,7 +350,8 @@ static struct vmbus_channel *alloc_channel(void)
 static void free_channel(struct vmbus_channel *channel)
 {
         tasklet_kill(&channel->callback_event);
-        kfree(channel);
+
+        kfree_rcu(channel, rcu);
 }
 
 static void percpu_channel_enq(void *arg)
@@ -359,14 +360,14 @@ static void percpu_channel_enq(void *arg)
         struct hv_per_cpu_context *hv_cpu
                 = this_cpu_ptr(hv_context.cpu_context);
 
-        list_add_tail(&channel->percpu_list, &hv_cpu->chan_list);
+        list_add_tail_rcu(&channel->percpu_list, &hv_cpu->chan_list);
 }
 
 static void percpu_channel_deq(void *arg)
 {
         struct vmbus_channel *channel = arg;
 
-        list_del(&channel->percpu_list);
+        list_del_rcu(&channel->percpu_list);
 }
 
 
@@ -381,19 +382,6 @@ static void vmbus_release_relid(u32 relid)
                        true);
 }
 
-void hv_event_tasklet_disable(struct vmbus_channel *channel)
-{
-        tasklet_disable(&channel->callback_event);
-}
-
-void hv_event_tasklet_enable(struct vmbus_channel *channel)
-{
-        tasklet_enable(&channel->callback_event);
-
-        /* In case there is any pending event */
-        tasklet_schedule(&channel->callback_event);
-}
-
 void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
 {
         unsigned long flags;
@@ -402,7 +390,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
         BUG_ON(!channel->rescind);
         BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
 
-        hv_event_tasklet_disable(channel);
         if (channel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(channel->target_cpu,
@@ -411,7 +398,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
                 percpu_channel_deq(channel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(channel);
 
         if (channel->primary_channel == NULL) {
                 list_del(&channel->listentry);
@@ -505,7 +491,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
 
         init_vp_index(newchannel, dev_type);
 
-        hv_event_tasklet_disable(newchannel);
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
@@ -515,7 +500,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
                 percpu_channel_enq(newchannel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(newchannel);
 
         /*
          * This state is used to indicate a successful open
@@ -565,7 +549,6 @@ err_deq_chan:
         list_del(&newchannel->listentry);
         mutex_unlock(&vmbus_connection.channel_mutex);
 
-        hv_event_tasklet_disable(newchannel);
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(newchannel->target_cpu,
@@ -574,7 +557,6 @@ err_deq_chan:
                 percpu_channel_deq(newchannel);
                 put_cpu();
         }
-        hv_event_tasklet_enable(newchannel);
 
         vmbus_release_relid(newchannel->offermsg.child_relid);
 
@@ -814,6 +796,7 @@ static void vmbus_onoffer(struct vmbus_channel_message_header *hdr)
         /* Allocate the channel object and save this offer. */
         newchannel = alloc_channel();
         if (!newchannel) {
+                vmbus_release_relid(offer->child_relid);
                 pr_err("Unable to allocate channel object\n");
                 return;
         }
diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c
index 9aee6014339d..a5596a642ed0 100644
--- a/drivers/hv/hv_fcopy.c
+++ b/drivers/hv/hv_fcopy.c
@@ -71,7 +71,6 @@ static DECLARE_WORK(fcopy_send_work, fcopy_send_data);
 static const char fcopy_devname[] = "vmbus/hv_fcopy";
 static u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 /*
  * This state maintains the version number registered by the daemon.
  */
@@ -331,7 +330,6 @@ static void fcopy_on_reset(void)
 
         if (cancel_delayed_work_sync(&fcopy_timeout_work))
                 fcopy_respond_to_host(HV_E_FAIL);
-        complete(&release_event);
 }
 
 int hv_fcopy_init(struct hv_util_service *srv)
@@ -339,7 +337,6 @@ int hv_fcopy_init(struct hv_util_service *srv)
         recv_buffer = srv->recv_buffer;
         fcopy_transaction.recv_channel = srv->channel;
 
-        init_completion(&release_event);
         /*
          * When this driver loads, the user level daemon that
          * processes the host requests may not yet be running.
@@ -361,5 +358,4 @@ void hv_fcopy_deinit(void)
         fcopy_transaction.state = HVUTIL_DEVICE_DYING;
         cancel_delayed_work_sync(&fcopy_timeout_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index de263712e247..a1adfe2cfb34 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -101,7 +101,6 @@ static DECLARE_WORK(kvp_sendkey_work, kvp_send_key);
 static const char kvp_devname[] = "vmbus/hv_kvp";
 static u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 /*
  * Register the kernel component with the user-level daemon.
  * As part of this registration, pass the LIC version number.
@@ -714,7 +713,6 @@ static void kvp_on_reset(void)
         if (cancel_delayed_work_sync(&kvp_timeout_work))
                 kvp_respond_to_host(NULL, HV_E_FAIL);
         kvp_transaction.state = HVUTIL_DEVICE_INIT;
-        complete(&release_event);
 }
 
 int
@@ -723,7 +721,6 @@ hv_kvp_init(struct hv_util_service *srv)
         recv_buffer = srv->recv_buffer;
         kvp_transaction.recv_channel = srv->channel;
 
-        init_completion(&release_event);
         /*
          * When this driver loads, the user level daemon that
          * processes the host requests may not yet be running.
@@ -747,5 +744,4 @@ void hv_kvp_deinit(void)
         cancel_delayed_work_sync(&kvp_timeout_work);
         cancel_work_sync(&kvp_sendkey_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index bcc03f0748d6..e659d1b94a57 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -79,7 +79,6 @@ static int dm_reg_value;
 static const char vss_devname[] = "vmbus/hv_vss";
 static __u8 *recv_buffer;
 static struct hvutil_transport *hvt;
-static struct completion release_event;
 
 static void vss_timeout_func(struct work_struct *dummy);
 static void vss_handle_request(struct work_struct *dummy);
@@ -361,13 +360,11 @@ static void vss_on_reset(void)
         if (cancel_delayed_work_sync(&vss_timeout_work))
                 vss_respond_to_host(HV_E_FAIL);
         vss_transaction.state = HVUTIL_DEVICE_INIT;
-        complete(&release_event);
 }
 
 int
 hv_vss_init(struct hv_util_service *srv)
 {
-        init_completion(&release_event);
         if (vmbus_proto_version < VERSION_WIN8_1) {
                 pr_warn("Integration service 'Backup (volume snapshot)'"
                         " not supported on this host version.\n");
@@ -400,5 +397,4 @@ void hv_vss_deinit(void)
         cancel_delayed_work_sync(&vss_timeout_work);
         cancel_work_sync(&vss_handle_request_work);
         hvutil_transport_destroy(hvt);
-        wait_for_completion(&release_event);
 }
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 3042eaa13062..186b10083c55 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -590,6 +590,8 @@ static int hv_timesync_init(struct hv_util_service *srv)
         if (!hyperv_cs)
                 return -ENODEV;
 
+        spin_lock_init(&host_ts.lock);
+
         INIT_WORK(&wrk.work, hv_set_host_time);
 
         /*
diff --git a/drivers/hv/hv_utils_transport.c b/drivers/hv/hv_utils_transport.c
index c235a9515267..4402a71e23f7 100644
--- a/drivers/hv/hv_utils_transport.c
+++ b/drivers/hv/hv_utils_transport.c
@@ -182,10 +182,11 @@ static int hvt_op_release(struct inode *inode, struct file *file)
          * connects back.
          */
         hvt_reset(hvt);
-        mutex_unlock(&hvt->lock);
 
         if (mode_old == HVUTIL_TRANSPORT_DESTROY)
-                hvt_transport_free(hvt);
+                complete(&hvt->release);
+
+        mutex_unlock(&hvt->lock);
 
         return 0;
 }
@@ -304,6 +305,7 @@ struct hvutil_transport *hvutil_transport_init(const char *name,
 
         init_waitqueue_head(&hvt->outmsg_q);
         mutex_init(&hvt->lock);
+        init_completion(&hvt->release);
 
         spin_lock(&hvt_list_lock);
         list_add(&hvt->list, &hvt_list);
@@ -351,6 +353,8 @@ void hvutil_transport_destroy(struct hvutil_transport *hvt)
         if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0)
                 cn_del_callback(&hvt->cn_id);
 
-        if (mode_old != HVUTIL_TRANSPORT_CHARDEV)
-                hvt_transport_free(hvt);
+        if (mode_old == HVUTIL_TRANSPORT_CHARDEV)
+                wait_for_completion(&hvt->release);
+
+        hvt_transport_free(hvt);
 }
diff --git a/drivers/hv/hv_utils_transport.h b/drivers/hv/hv_utils_transport.h
index d98f5225c3e6..79afb626e166 100644
--- a/drivers/hv/hv_utils_transport.h
+++ b/drivers/hv/hv_utils_transport.h
@@ -41,6 +41,7 @@ struct hvutil_transport {
         int outmsg_len;                     /* its length */
         wait_queue_head_t outmsg_q;         /* poll/read wait queue */
         struct mutex lock;                  /* protects struct members */
+        struct completion release;          /* synchronize with fd release */
 };
 
 struct hvutil_transport *hvutil_transport_init(const char *name,
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index da6b59ba5940..8370b9dc6037 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -939,8 +939,10 @@ static void vmbus_chan_sched(struct hv_per_cpu_context *hv_cpu)
                 if (relid == 0)
                         continue;
 
+                rcu_read_lock();
+
                 /* Find channel based on relid */
-                list_for_each_entry(channel, &hv_cpu->chan_list, percpu_list) {
+                list_for_each_entry_rcu(channel, &hv_cpu->chan_list, percpu_list) {
                         if (channel->offermsg.child_relid != relid)
                                 continue;
 
@@ -956,6 +958,8 @@ static void vmbus_chan_sched(struct hv_per_cpu_context *hv_cpu)
                                 tasklet_schedule(&channel->callback_event);
                         }
                 }
+
+                rcu_read_unlock();
         }
 }
 
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index cccef87963e0..975c43d446f8 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -646,6 +646,9 @@ static int atk_read_value(struct atk_sensor_data *sensor, u64 *value)
                 else
                         err = atk_read_value_new(sensor, value);
 
+                if (err)
+                        return err;
+
                 sensor->is_valid = true;
                 sensor->last_updated = jiffies;
                 sensor->cached_value = *value;
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index efb01c247e2d..4dfc7238313e 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -3198,7 +3198,7 @@ static int __init sm_it87_init(void)
 {
         int sioaddr[2] = { REG_2E, REG_4E };
         struct it87_sio_data sio_data;
-        unsigned short isa_address;
+        unsigned short isa_address[2];
         bool found = false;
         int i, err;
 
@@ -3208,15 +3208,29 @@ static int __init sm_it87_init(void)
 
         for (i = 0; i < ARRAY_SIZE(sioaddr); i++) {
                 memset(&sio_data, 0, sizeof(struct it87_sio_data));
-                isa_address = 0;
-                err = it87_find(sioaddr[i], &isa_address, &sio_data);
-                if (err || isa_address == 0)
+                isa_address[i] = 0;
+                err = it87_find(sioaddr[i], &isa_address[i], &sio_data);
+                if (err || isa_address[i] == 0)
                         continue;
+                /*
+                 * Don't register second chip if its ISA address matches
+                 * the first chip's ISA address.
+                 */
+                if (i && isa_address[i] == isa_address[0])
+                        break;
 
-                err = it87_device_add(i, isa_address, &sio_data);
+                err = it87_device_add(i, isa_address[i], &sio_data);
                 if (err)
                         goto exit_dev_unregister;
+
                 found = true;
+
+                /*
+                 * IT8705F may respond on both SIO addresses.
+                 * Stop probing after finding one.
+                 */
+                if (sio_data.type == it87)
+                        break;
         }
 
         if (!found) {
diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c
index c1b9275978f9..281491cca510 100644
--- a/drivers/hwmon/max31790.c
+++ b/drivers/hwmon/max31790.c
@@ -311,7 +311,7 @@ static int max31790_write_pwm(struct device *dev, u32 attr, int channel,
                 data->pwm[channel] = val << 8;
                 err = i2c_smbus_write_word_swapped(client,
                                                    MAX31790_REG_PWMOUT(channel),
-                                                   val);
+                                                   data->pwm[channel]);
                 break;
         case hwmon_pwm_enable:
                 fan_config = data->fan_config[channel];
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index cdd9b3b26195..7563eceeaaea 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -221,8 +221,10 @@ static int intel_th_output_activate(struct intel_th_device *thdev)
         else
                 intel_th_trace_enable(thdev);
 
-        if (ret)
+        if (ret) {
                 pm_runtime_put(&thdev->dev);
+                module_put(thdrv->driver.owner);
+        }
 
         return ret;
 }
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 0bba3842336e..590cf90dd21a 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -85,6 +85,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa2a6),
                 .driver_data = (kernel_ulong_t)0,
         },
+        {
+                /* Denverton */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x19e1),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
+                /* Gemini Lake */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
+                .driver_data = (kernel_ulong_t)0,
+        },
         { 0 },
 };
 
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 0652281662a8..78792b4d6437 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -465,6 +465,7 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
         u8 *tmp_buf;
         int len = 0;
         int xfersz = brcmstb_i2c_get_xfersz(dev);
+        u32 cond, cond_per_msg;
 
         if (dev->is_suspended)
                 return -EBUSY;
@@ -481,10 +482,11 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
                         pmsg->buf ? pmsg->buf[0] : '0', pmsg->len);
 
                 if (i < (num - 1) && (msgs[i + 1].flags & I2C_M_NOSTART))
-                        brcmstb_set_i2c_start_stop(dev, ~(COND_START_STOP));
+                        cond = ~COND_START_STOP;
                 else
-                        brcmstb_set_i2c_start_stop(dev,
-                                                   COND_RESTART | COND_NOSTOP);
+                        cond = COND_RESTART | COND_NOSTOP;
+
+                brcmstb_set_i2c_start_stop(dev, cond);
 
                 /* Send slave address */
                 if (!(pmsg->flags & I2C_M_NOSTART)) {
@@ -497,13 +499,24 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
                         }
                 }
 
+                cond_per_msg = cond;
+
                 /* Perform data transfer */
                 while (len) {
                         bytes_to_xfer = min(len, xfersz);
 
-                        if (len <= xfersz && i == (num - 1))
-                                brcmstb_set_i2c_start_stop(dev,
-                                                           ~(COND_START_STOP));
+                        if (len <= xfersz) {
+                                if (i == (num - 1))
+                                        cond_per_msg = cond_per_msg &
+                                                ~(COND_RESTART | COND_NOSTOP);
+                                else
+                                        cond_per_msg = cond;
+                        } else {
+                                cond_per_msg = (cond_per_msg & ~COND_RESTART) |
+                                        COND_NOSTOP;
+                        }
+
+                        brcmstb_set_i2c_start_stop(dev, cond_per_msg);
 
                         rc = brcmstb_i2c_xfer_bsc_data(dev, tmp_buf,
                                                        bytes_to_xfer, pmsg);
@@ -512,6 +525,8 @@ static int brcmstb_i2c_xfer(struct i2c_adapter *adapter,
 
                         len -=  bytes_to_xfer;
                         tmp_buf += bytes_to_xfer;
+
+                        cond_per_msg = COND_NOSTART | COND_NOSTOP;
                 }
         }
 
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index c1db3a5a340f..d9aaf1790e0e 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -88,6 +88,7 @@ struct dw_i2c_dev {
         void __iomem            *base;
         struct completion       cmd_complete;
         struct clk              *clk;
+        struct reset_control    *rst;
         u32                     (*get_clk_rate_khz) (struct dw_i2c_dev *dev);
         struct dw_pci_controller *controller;
         int                     cmd_err;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 6ce431323125..79c4b4ea0539 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -38,6 +38,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/property.h>
 #include <linux/io.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
 #include <linux/platform_data/i2c-designware.h>
@@ -199,6 +200,14 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         dev->irq = irq;
         platform_set_drvdata(pdev, dev);
 
+        dev->rst = devm_reset_control_get_optional_exclusive(&pdev->dev, NULL);
+        if (IS_ERR(dev->rst)) {
+                if (PTR_ERR(dev->rst) == -EPROBE_DEFER)
+                        return -EPROBE_DEFER;
+        } else {
+                reset_control_deassert(dev->rst);
+        }
+
         if (pdata) {
                 dev->clk_freq = pdata->i2c_scl_freq;
         } else {
@@ -235,12 +244,13 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
             && dev->clk_freq != 1000000 && dev->clk_freq != 3400000) {
                 dev_err(&pdev->dev,
                         "Only 100kHz, 400kHz, 1MHz and 3.4MHz supported");
-                return -EINVAL;
+                r = -EINVAL;
+                goto exit_reset;
         }
 
         r = i2c_dw_eval_lock_support(dev);
         if (r)
-                return r;
+                goto exit_reset;
 
         dev->functionality = I2C_FUNC_10BIT_ADDR | DW_IC_DEFAULT_FUNCTIONALITY;
 
@@ -286,10 +296,18 @@ static int dw_i2c_plat_probe(struct platform_device *pdev)
         }
 
         r = i2c_dw_probe(dev);
-        if (r && !dev->pm_runtime_disabled)
-                pm_runtime_disable(&pdev->dev);
+        if (r)
+                goto exit_probe;
 
         return r;
+
+exit_probe:
+        if (!dev->pm_runtime_disabled)
+                pm_runtime_disable(&pdev->dev);
+exit_reset:
+        if (!IS_ERR_OR_NULL(dev->rst))
+                reset_control_assert(dev->rst);
+        return r;
 }
 
 static int dw_i2c_plat_remove(struct platform_device *pdev)
@@ -306,6 +324,8 @@ static int dw_i2c_plat_remove(struct platform_device *pdev)
         pm_runtime_put_sync(&pdev->dev);
         if (!dev->pm_runtime_disabled)
                 pm_runtime_disable(&pdev->dev);
+        if (!IS_ERR_OR_NULL(dev->rst))
+                reset_control_assert(dev->rst);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
index cbd93ce0661f..736a82472101 100644
--- a/drivers/i2c/busses/i2c-exynos5.c
+++ b/drivers/i2c/busses/i2c-exynos5.c
@@ -457,7 +457,6 @@ static irqreturn_t exynos5_i2c_irq(int irqno, void *dev_id)
 
         int_status = readl(i2c->regs + HSI2C_INT_STATUS);
         writel(int_status, i2c->regs + HSI2C_INT_STATUS);
-        trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
 
         /* handle interrupt related to the transfer status */
         if (i2c->variant->hw == HSI2C_EXYNOS7) {
@@ -482,11 +481,13 @@ static irqreturn_t exynos5_i2c_irq(int irqno, void *dev_id)
                         goto stop;
                 }
 
+                trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
                 if ((trans_status & HSI2C_MASTER_ST_MASK) == HSI2C_MASTER_ST_LOSE) {
                         i2c->state = -EAGAIN;
                         goto stop;
                 }
         } else if (int_status & HSI2C_INT_I2C) {
+                trans_status = readl(i2c->regs + HSI2C_TRANS_STATUS);
                 if (trans_status & HSI2C_NO_DEV_ACK) {
                         dev_dbg(i2c->dev, "No ACK from device\n");
                         i2c->state = -ENXIO;
diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 2aa61bbbd307..73b97c71a484 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char *buf, int len)
                 wdata1 |= *buf++ << ((i - 4) * 8);
 
         writel(wdata0, i2c->regs + REG_TOK_WDATA0);
-        writel(wdata0, i2c->regs + REG_TOK_WDATA1);
+        writel(wdata1, i2c->regs + REG_TOK_WDATA1);
 
         dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__,
                 wdata0, wdata1, len);
diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 4a7d9bc2142b..45d61714c81b 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -172,14 +172,6 @@ static const struct i2c_adapter_quirks mt6577_i2c_quirks = {
         .max_comb_2nd_msg_len = 31,
 };
 
-static const struct i2c_adapter_quirks mt8173_i2c_quirks = {
-        .max_num_msgs = 65535,
-        .max_write_len = 65535,
-        .max_read_len = 65535,
-        .max_comb_1st_msg_len = 65535,
-        .max_comb_2nd_msg_len = 65535,
-};
-
 static const struct mtk_i2c_compatible mt6577_compat = {
         .quirks = &mt6577_i2c_quirks,
         .pmic_i2c = 0,
@@ -199,7 +191,6 @@ static const struct mtk_i2c_compatible mt6589_compat = {
 };
 
 static const struct mtk_i2c_compatible mt8173_compat = {
-        .quirks = &mt8173_i2c_quirks,
         .pmic_i2c = 0,
         .dcm = 1,
         .auto_restart = 1,
diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c
index 8f11d347b3ec..c811af4c8d81 100644
--- a/drivers/i2c/busses/i2c-riic.c
+++ b/drivers/i2c/busses/i2c-riic.c
@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq, void *data)
         }
 
         if (riic->is_last || riic->err) {
-                riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
+                riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER);
                 writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
+        } else {
+                /* Transfer is complete, but do not send STOP */
+                riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER);
+                complete(&riic->msg_done);
         }
 
         return IRQ_HANDLED;
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 83768e85a919..2178266bca79 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -429,6 +429,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
         while (muxc->num_adapters) {
                 struct i2c_adapter *adap = muxc->adapter[--muxc->num_adapters];
                 struct i2c_mux_priv *priv = adap->algo_data;
+                struct device_node *np = adap->dev.of_node;
 
                 muxc->adapter[muxc->num_adapters] = NULL;
 
@@ -438,6 +439,7 @@ void i2c_mux_del_adapters(struct i2c_mux_core *muxc)
 
                 sysfs_remove_link(&priv->adap.dev.kobj, "mux_device");
                 i2c_del_adapter(adap);
+                of_node_put(np);
                 kfree(priv);
         }
 }
diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index dfc1c0e37c40..ad31d21da316 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -35,7 +35,6 @@
  * warranty of any kind, whether express or implied.
  */
 
-#include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/gpio/consumer.h>
 #include <linux/i2c.h>
@@ -117,6 +116,10 @@ static const struct chip_desc chips[] = {
                 .has_irq = 1,
                 .muxtype = pca954x_isswi,
         },
+        [pca_9546] = {
+                .nchans = 4,
+                .muxtype = pca954x_isswi,
+        },
         [pca_9547] = {
                 .nchans = 8,
                 .enable = 0x8,
@@ -134,28 +137,13 @@ static const struct i2c_device_id pca954x_id[] = {
         { "pca9543", pca_9543 },
         { "pca9544", pca_9544 },
         { "pca9545", pca_9545 },
-        { "pca9546", pca_9545 },
+        { "pca9546", pca_9546 },
         { "pca9547", pca_9547 },
         { "pca9548", pca_9548 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, pca954x_id);
 
-#ifdef CONFIG_ACPI
-static const struct acpi_device_id pca954x_acpi_ids[] = {
-        { .id = "PCA9540", .driver_data = pca_9540 },
-        { .id = "PCA9542", .driver_data = pca_9542 },
-        { .id = "PCA9543", .driver_data = pca_9543 },
-        { .id = "PCA9544", .driver_data = pca_9544 },
-        { .id = "PCA9545", .driver_data = pca_9545 },
-        { .id = "PCA9546", .driver_data = pca_9545 },
-        { .id = "PCA9547", .driver_data = pca_9547 },
-        { .id = "PCA9548", .driver_data = pca_9548 },
-        { }
-};
-MODULE_DEVICE_TABLE(acpi, pca954x_acpi_ids);
-#endif
-
 #ifdef CONFIG_OF
 static const struct of_device_id pca954x_of_match[] = {
         { .compatible = "nxp,pca9540", .data = &chips[pca_9540] },
@@ -393,17 +381,8 @@ static int pca954x_probe(struct i2c_client *client,
         match = of_match_device(of_match_ptr(pca954x_of_match), &client->dev);
         if (match)
                 data->chip = of_device_get_match_data(&client->dev);
-        else if (id)
+        else
                 data->chip = &chips[id->driver_data];
-        else {
-                const struct acpi_device_id *acpi_id;
-
-                acpi_id = acpi_match_device(ACPI_PTR(pca954x_acpi_ids),
-                                                &client->dev);
-                if (!acpi_id)
-                        return -ENODEV;
-                data->chip = &chips[acpi_id->driver_data];
-        }
 
         data->last_chan = 0;               /* force the first selection */
 
@@ -492,7 +471,6 @@ static struct i2c_driver pca954x_driver = {
                 .name   = "pca954x",
                 .pm     = &pca954x_pm,
                 .of_match_table = of_match_ptr(pca954x_of_match),
-                .acpi_match_table = ACPI_PTR(pca954x_acpi_ids),
         },
         .probe          = pca954x_probe,
         .remove         = pca954x_remove,
diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index ca5759c0c318..43a6cb078193 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -370,10 +370,12 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
                 name = "accel_3d";
                 channel_spec = accel_3d_channels;
                 channel_size = sizeof(accel_3d_channels);
+                indio_dev->num_channels = ARRAY_SIZE(accel_3d_channels);
         } else {
                 name = "gravity";
                 channel_spec = gravity_channels;
                 channel_size = sizeof(gravity_channels);
+                indio_dev->num_channels = ARRAY_SIZE(gravity_channels);
         }
         ret = hid_sensor_parse_common_attributes(hsdev, hsdev->usage,
                                         &accel_state->common_attributes);
@@ -395,7 +397,6 @@ static int hid_accel_3d_probe(struct platform_device *pdev)
                 goto error_free_dev_mem;
         }
 
-        indio_dev->num_channels = ARRAY_SIZE(accel_3d_channels);
         indio_dev->dev.parent = &pdev->dev;
         indio_dev->info = &accel_3d_info;
         indio_dev->name = name;
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index ad9dec30bb30..4282ceca3d8f 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -169,7 +169,9 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
 {
         struct iio_dev *indio_dev = private;
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
-        unsigned int status, config;
+        unsigned int status, config, adc_fsm;
+        unsigned short count = 0;
+
         status = tiadc_readl(adc_dev, REG_IRQSTATUS);
 
         /*
@@ -183,6 +185,15 @@ static irqreturn_t tiadc_irq_h(int irq, void *private)
                 tiadc_writel(adc_dev, REG_CTRL, config);
                 tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN
                                 | IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES);
+
+                /* wait for idle state.
+                 * ADC needs to finish the current conversion
+                 * before disabling the module
+                 */
+                do {
+                        adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM);
+                } while (adc_fsm != 0x10 && count++ < 100);
+
                 tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB));
                 return IRQ_HANDLED;
         } else if (status & IRQENB_FIFO1THRES) {
diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
index d6c372bb433b..c17596f7ed2c 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors.c
@@ -61,7 +61,7 @@ static int cros_ec_sensors_read(struct iio_dev *indio_dev,
                 ret = st->core.read_ec_sensors_data(indio_dev, 1 << idx, &data);
                 if (ret < 0)
                         break;
-
+                ret = IIO_VAL_INT;
                 *val = data;
                 break;
         case IIO_CHAN_INFO_CALIBBIAS:
@@ -76,7 +76,7 @@ static int cros_ec_sensors_read(struct iio_dev *indio_dev,
                 for (i = CROS_EC_SENSOR_X; i < CROS_EC_SENSOR_MAX_AXIS; i++)
                         st->core.calib[i] =
                                 st->core.resp->sensor_offset.offset[i];
-
+                ret = IIO_VAL_INT;
                 *val = st->core.calib[idx];
                 break;
         case IIO_CHAN_INFO_SCALE:
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index 7afdac42ed42..01e02b9926d4 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -379,6 +379,8 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
 {
 
         struct hid_sensor_hub_attribute_info timestamp;
+        s32 value;
+        int ret;
 
         hid_sensor_get_reporting_interval(hsdev, usage_id, st);
 
@@ -417,6 +419,14 @@ int hid_sensor_parse_common_attributes(struct hid_sensor_hub_device *hsdev,
                 st->sensitivity.index, st->sensitivity.report_id,
                 timestamp.index, timestamp.report_id);
 
+        ret = sensor_hub_get_feature(hsdev,
+                                st->power_state.report_id,
+                                st->power_state.index, sizeof(value), &value);
+        if (ret < 0)
+                return ret;
+        if (value < 0)
+                return -EINVAL;
+
         return 0;
 }
 EXPORT_SYMBOL(hid_sensor_parse_common_attributes);
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index a3cce3a38300..ecf592d69043 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -51,8 +51,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
                         st->report_state.report_id,
                         st->report_state.index,
                         HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM);
-
-                poll_value = hid_sensor_read_poll_value(st);
         } else {
                 int val;
 
@@ -89,7 +87,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
         sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
                                st->power_state.index,
                                sizeof(state_val), &state_val);
-        if (state && poll_value)
+        if (state)
+                poll_value = hid_sensor_read_poll_value(st);
+        if (poll_value > 0)
                 msleep_interruptible(poll_value * 2);
 
         return 0;
diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
index f7fcfa886f72..821919dd245b 100644
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -27,6 +27,7 @@
 #include <linux/iio/trigger_consumer.h>
 #include <linux/iio/triggered_buffer.h>
 #include <linux/regmap.h>
+#include <linux/delay.h>
 #include "bmg160.h"
 
 #define BMG160_IRQ_NAME         "bmg160_event"
@@ -52,6 +53,9 @@
 #define BMG160_DEF_BW                   100
 #define BMG160_REG_PMU_BW_RES           BIT(7)
 
+#define BMG160_GYRO_REG_RESET           0x14
+#define BMG160_GYRO_RESET_VAL           0xb6
+
 #define BMG160_REG_INT_MAP_0            0x17
 #define BMG160_INT_MAP_0_BIT_ANY        BIT(1)
 
@@ -236,6 +240,14 @@ static int bmg160_chip_init(struct bmg160_data *data)
         int ret;
         unsigned int val;
 
+        /*
+         * Reset chip to get it in a known good state. A delay of 30ms after
+         * reset is required according to the datasheet.
+         */
+        regmap_write(data->regmap, BMG160_GYRO_REG_RESET,
+                     BMG160_GYRO_RESET_VAL);
+        usleep_range(30000, 30700);
+
         ret = regmap_read(data->regmap, BMG160_REG_CHIP_ID, &val);
         if (ret < 0) {
                 dev_err(dev, "Error reading reg_chip_id\n");
diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
index 78532ce07449..81b572d7699a 100644
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c
@@ -193,8 +193,8 @@ int st_lsm6dsx_update_watermark(struct st_lsm6dsx_sensor *sensor, u16 watermark)
         if (err < 0)
                 goto out;
 
-        fifo_watermark = ((data & ~ST_LSM6DSX_FIFO_TH_MASK) << 8) |
-                          (fifo_watermark & ST_LSM6DSX_FIFO_TH_MASK);
+        fifo_watermark = ((data << 8) & ~ST_LSM6DSX_FIFO_TH_MASK) |
+                         (fifo_watermark & ST_LSM6DSX_FIFO_TH_MASK);
 
         wdata = cpu_to_le16(fifo_watermark);
         err = hw->tf->write(hw->dev, ST_LSM6DSX_REG_FIFO_THL_ADDR,
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index d18ded45bedd..3ff91e02fee3 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -610,10 +610,9 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
                 tmp0 = (int)div_s64_rem(tmp, 1000000000, &tmp1);
                 return snprintf(buf, len, "%d.%09u", tmp0, abs(tmp1));
         case IIO_VAL_FRACTIONAL_LOG2:
-                tmp = (s64)vals[0] * 1000000000LL >> vals[1];
-                tmp1 = do_div(tmp, 1000000000LL);
-                tmp0 = tmp;
-                return snprintf(buf, len, "%d.%09u", tmp0, tmp1);
+                tmp = shift_right((s64)vals[0] * 1000000000LL, vals[1]);
+                tmp0 = (int)div_s64_rem(tmp, 1000000000LL, &tmp1);
+                return snprintf(buf, len, "%d.%09u", tmp0, abs(tmp1));
         case IIO_VAL_INT_MULTIPLE:
         {
                 int i;
diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
index 6dd8cbd7ce95..e13370dc9b1c 100644
--- a/drivers/iio/magnetometer/ak8974.c
+++ b/drivers/iio/magnetometer/ak8974.c
@@ -763,7 +763,7 @@ power_off:
         return ret;
 }
 
-static int __exit ak8974_remove(struct i2c_client *i2c)
+static int ak8974_remove(struct i2c_client *i2c)
 {
         struct iio_dev *indio_dev = i2c_get_clientdata(i2c);
         struct ak8974 *ak8974 = iio_priv(indio_dev);
@@ -845,7 +845,7 @@ static struct i2c_driver ak8974_driver = {
                 .of_match_table = of_match_ptr(ak8974_of_match),
         },
         .probe    = ak8974_probe,
-        .remove   = __exit_p(ak8974_remove),
+        .remove   = ak8974_remove,
         .id_table = ak8974_id,
 };
 module_i2c_driver(ak8974_driver);
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 5f2680855552..fd0edca0e656 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -457,6 +457,7 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .addr_stat_drdy = ST_SENSORS_DEFAULT_STAT_ADDR,
                 },
                 .multi_read_bit = true,
+                .bootime = 2,
         },
 };
 
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index e95510117a6d..f2ae75fa3128 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -29,7 +29,13 @@ static int __ib_process_cq(struct ib_cq *cq, int budget)
 {
         int i, n, completed = 0;
 
-        while ((n = ib_poll_cq(cq, IB_POLL_BATCH, cq->wc)) > 0) {
+        /*
+         * budget might be (-1) if the caller does not
+         * want to bound this call, thus we need unsigned
+         * minimum here.
+         */
+        while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
+                        budget - completed), cq->wc)) > 0) {
                 for (i = 0; i < n; i++) {
                         struct ib_wc *wc = &cq->wc[i];
 
@@ -196,7 +202,7 @@ void ib_free_cq(struct ib_cq *cq)
                 irq_poll_disable(&cq->iop);
                 break;
         case IB_POLL_WORKQUEUE:
-                flush_work(&cq->work);
+                cancel_work_sync(&cq->work);
                 break;
         default:
                 WARN_ON_ONCE(1);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 593d2ce6ec7c..7c9e34d679d3 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -336,12 +336,26 @@ int ib_register_device(struct ib_device *device,
         struct device *parent = device->dev.parent;
 
         WARN_ON_ONCE(!parent);
-        if (!device->dev.dma_ops)
-                device->dev.dma_ops = parent->dma_ops;
-        if (!device->dev.dma_mask)
-                device->dev.dma_mask = parent->dma_mask;
-        if (!device->dev.coherent_dma_mask)
-                device->dev.coherent_dma_mask = parent->coherent_dma_mask;
+        WARN_ON_ONCE(device->dma_device);
+        if (device->dev.dma_ops) {
+                /*
+                 * The caller provided custom DMA operations. Copy the
+                 * DMA-related fields that are used by e.g. dma_alloc_coherent()
+                 * into device->dev.
+                 */
+                device->dma_device = &device->dev;
+                if (!device->dev.dma_mask)
+                        device->dev.dma_mask = parent->dma_mask;
+                if (!device->dev.coherent_dma_mask)
+                        device->dev.coherent_dma_mask =
+                                parent->coherent_dma_mask;
+        } else {
+                /*
+                 * The caller did not provide custom DMA operations. Use the
+                 * DMA mapping operations of the parent device.
+                 */
+                device->dma_device = parent;
+        }
 
         mutex_lock(&device_mutex);
 
@@ -1015,8 +1029,7 @@ static int __init ib_core_init(void)
                 return -ENOMEM;
 
         ib_comp_wq = alloc_workqueue("ib-comp-wq",
-                        WQ_UNBOUND | WQ_HIGHPRI | WQ_MEM_RECLAIM,
-                        WQ_UNBOUND_MAX_ACTIVE);
+                        WQ_HIGHPRI | WQ_MEM_RECLAIM | WQ_SYSFS, 0);
         if (!ib_comp_wq) {
                 ret = -ENOMEM;
                 goto err;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 0f5d43d1f5fc..70c3e9e79508 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -160,6 +160,9 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
+        if (iwdev->init_state < INET_NOTIFIER)
+                return NOTIFY_DONE;
+
         netdev = iwdev->ldev->netdev;
         upper_dev = netdev_master_upper_dev_get(netdev);
         if (netdev != event_netdev)
@@ -214,6 +217,9 @@ int i40iw_inet6addr_event(struct notifier_block *notifier,
                 return NOTIFY_DONE;
 
         iwdev = &hdl->device;
+        if (iwdev->init_state < INET_NOTIFIER)
+                return NOTIFY_DONE;
+
         netdev = iwdev->ldev->netdev;
         if (netdev != event_netdev)
                 return NOTIFY_DONE;
@@ -260,6 +266,8 @@ int i40iw_net_event(struct notifier_block *notifier, unsigned long event, void *
                 if (!iwhdl)
                         return NOTIFY_DONE;
                 iwdev = &iwhdl->device;
+                if (iwdev->init_state < INET_NOTIFIER)
+                        return NOTIFY_DONE;
                 p = (__be32 *)neigh->primary_key;
                 i40iw_copy_ip_ntohl(local_ipaddr, p);
                 if (neigh->nud_state & NUD_VALID) {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index bc9fb144e57b..c52edeafd616 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -372,7 +372,7 @@ static int _ocrdma_pd_mgr_put_bitmap(struct ocrdma_dev *dev, u16 pd_id,
         return 0;
 }
 
-static u8 ocrdma_put_pd_num(struct ocrdma_dev *dev, u16 pd_id,
+static int ocrdma_put_pd_num(struct ocrdma_dev *dev, u16 pd_id,
                                    bool dpp_pool)
 {
         int status;
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 12c4208fd701..af9f596bb68b 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -7068,7 +7068,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start,
         unsigned long flags;
 
         while (wait) {
-                unsigned long shadow;
+                unsigned long shadow = 0;
                 int cstart, previ = -1;
 
                 /*
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
index 3cd96c1b9502..9fbe22d3467b 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
@@ -69,6 +69,9 @@
  */
 #define PCI_DEVICE_ID_VMWARE_PVRDMA     0x0820
 
+#define PVRDMA_NUM_RING_PAGES           4
+#define PVRDMA_QP_NUM_HEADER_PAGES      1
+
 struct pvrdma_dev;
 
 struct pvrdma_page_dir {
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
index e69d6f3cae32..09078ccfaec7 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
@@ -132,7 +132,7 @@ enum pvrdma_pci_resource {
 
 enum pvrdma_device_ctl {
         PVRDMA_DEVICE_CTL_ACTIVATE,     /* Activate device. */
-        PVRDMA_DEVICE_CTL_QUIESCE,      /* Quiesce device. */
+        PVRDMA_DEVICE_CTL_UNQUIESCE,    /* Unquiesce device. */
         PVRDMA_DEVICE_CTL_RESET,        /* Reset device. */
 };
 
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 100bea5c42ff..34ebc7615411 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -56,7 +56,7 @@
 #include "pvrdma.h"
 
 #define DRV_NAME        "vmw_pvrdma"
-#define DRV_VERSION     "1.0.0.0-k"
+#define DRV_VERSION     "1.0.1.0-k"
 
 static DEFINE_MUTEX(pvrdma_device_list_lock);
 static LIST_HEAD(pvrdma_device_list);
@@ -660,7 +660,16 @@ static void pvrdma_netdevice_event_handle(struct pvrdma_dev *dev,
                 pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ERR);
                 break;
         case NETDEV_UP:
-                pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
+                pvrdma_write_reg(dev, PVRDMA_REG_CTL,
+                                 PVRDMA_DEVICE_CTL_UNQUIESCE);
+
+                mb();
+
+                if (pvrdma_read_reg(dev, PVRDMA_REG_ERR))
+                        dev_err(&dev->pdev->dev,
+                                "failed to activate device during link up\n");
+                else
+                        pvrdma_dispatch_event(dev, 1, IB_EVENT_PORT_ACTIVE);
                 break;
         default:
                 dev_dbg(&dev->pdev->dev, "ignore netdevice event %ld on %s\n",
@@ -858,7 +867,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev->dsr->resp_slot_dma = (u64)slot_dma;
 
         /* Async event ring */
-        dev->dsr->async_ring_pages.num_pages = 4;
+        dev->dsr->async_ring_pages.num_pages = PVRDMA_NUM_RING_PAGES;
         ret = pvrdma_page_dir_init(dev, &dev->async_pdir,
                                    dev->dsr->async_ring_pages.num_pages, true);
         if (ret)
@@ -867,7 +876,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
         dev->dsr->async_ring_pages.pdir_dma = dev->async_pdir.dir_dma;
 
         /* CQ notification ring */
-        dev->dsr->cq_ring_pages.num_pages = 4;
+        dev->dsr->cq_ring_pages.num_pages = PVRDMA_NUM_RING_PAGES;
         ret = pvrdma_page_dir_init(dev, &dev->cq_pdir,
                                    dev->dsr->cq_ring_pages.num_pages, true);
         if (ret)
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index dbbfd35e7da7..30062aad3af1 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -170,8 +170,9 @@ static int pvrdma_set_sq_size(struct pvrdma_dev *dev, struct ib_qp_cap *req_cap,
                                              sizeof(struct pvrdma_sge) *
                                              qp->sq.max_sg);
         /* Note: one extra page for the header. */
-        qp->npages_send = 1 + (qp->sq.wqe_cnt * qp->sq.wqe_size +
-                               PAGE_SIZE - 1) / PAGE_SIZE;
+        qp->npages_send = PVRDMA_QP_NUM_HEADER_PAGES +
+                          (qp->sq.wqe_cnt * qp->sq.wqe_size + PAGE_SIZE - 1) /
+                                                                PAGE_SIZE;
 
         return 0;
 }
@@ -288,7 +289,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
                         qp->npages = qp->npages_send + qp->npages_recv;
 
                         /* Skip header page. */
-                        qp->sq.offset = PAGE_SIZE;
+                        qp->sq.offset = PVRDMA_QP_NUM_HEADER_PAGES * PAGE_SIZE;
 
                         /* Recv queue pages are after send pages. */
                         qp->rq.offset = qp->npages_send * PAGE_SIZE;
@@ -341,7 +342,7 @@ struct ib_qp *pvrdma_create_qp(struct ib_pd *pd,
         cmd->qp_type = ib_qp_type_to_pvrdma(init_attr->qp_type);
         cmd->access_flags = IB_ACCESS_LOCAL_WRITE;
         cmd->total_chunks = qp->npages;
-        cmd->send_chunks = qp->npages_send - 1;
+        cmd->send_chunks = qp->npages_send - PVRDMA_QP_NUM_HEADER_PAGES;
         cmd->pdir_dma = qp->pdir.dir_dma;
 
         dev_dbg(&dev->pdev->dev, "create queuepair with %d, %d, %d, %d\n",
@@ -554,13 +555,13 @@ out:
         return ret;
 }
 
-static inline void *get_sq_wqe(struct pvrdma_qp *qp, int n)
+static inline void *get_sq_wqe(struct pvrdma_qp *qp, unsigned int n)
 {
         return pvrdma_page_dir_get_ptr(&qp->pdir,
                                        qp->sq.offset + n * qp->sq.wqe_size);
 }
 
-static inline void *get_rq_wqe(struct pvrdma_qp *qp, int n)
+static inline void *get_rq_wqe(struct pvrdma_qp *qp, unsigned int n)
 {
         return pvrdma_page_dir_get_ptr(&qp->pdir,
                                        qp->rq.offset + n * qp->rq.wqe_size);
@@ -598,9 +599,7 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
         unsigned long flags;
         struct pvrdma_sq_wqe_hdr *wqe_hdr;
         struct pvrdma_sge *sge;
-        int i, index;
-        int nreq;
-        int ret;
+        int i, ret;
 
         /*
          * In states lower than RTS, we can fail immediately. In other states,
@@ -613,9 +612,8 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
         spin_lock_irqsave(&qp->sq.lock, flags);
 
-        index = pvrdma_idx(&qp->sq.ring->prod_tail, qp->sq.wqe_cnt);
-        for (nreq = 0; wr; nreq++, wr = wr->next) {
-                unsigned int tail;
+        while (wr) {
+                unsigned int tail = 0;
 
                 if (unlikely(!pvrdma_idx_ring_has_space(
                                 qp->sq.ring, qp->sq.wqe_cnt, &tail))) {
@@ -680,7 +678,7 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                         }
                 }
 
-                wqe_hdr = (struct pvrdma_sq_wqe_hdr *)get_sq_wqe(qp, index);
+                wqe_hdr = (struct pvrdma_sq_wqe_hdr *)get_sq_wqe(qp, tail);
                 memset(wqe_hdr, 0, sizeof(*wqe_hdr));
                 wqe_hdr->wr_id = wr->wr_id;
                 wqe_hdr->num_sge = wr->num_sge;
@@ -771,12 +769,11 @@ int pvrdma_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 /* Make sure wqe is written before index update */
                 smp_wmb();
 
-                index++;
-                if (unlikely(index >= qp->sq.wqe_cnt))
-                        index = 0;
                 /* Update shared sq ring */
                 pvrdma_idx_ring_inc(&qp->sq.ring->prod_tail,
                                     qp->sq.wqe_cnt);
+
+                wr = wr->next;
         }
 
         ret = 0;
@@ -806,7 +803,6 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
         struct pvrdma_qp *qp = to_vqp(ibqp);
         struct pvrdma_rq_wqe_hdr *wqe_hdr;
         struct pvrdma_sge *sge;
-        int index, nreq;
         int ret = 0;
         int i;
 
@@ -821,9 +817,8 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 
         spin_lock_irqsave(&qp->rq.lock, flags);
 
-        index = pvrdma_idx(&qp->rq.ring->prod_tail, qp->rq.wqe_cnt);
-        for (nreq = 0; wr; nreq++, wr = wr->next) {
-                unsigned int tail;
+        while (wr) {
+                unsigned int tail = 0;
 
                 if (unlikely(wr->num_sge > qp->rq.max_sg ||
                              wr->num_sge < 0)) {
@@ -843,7 +838,7 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                         goto out;
                 }
 
-                wqe_hdr = (struct pvrdma_rq_wqe_hdr *)get_rq_wqe(qp, index);
+                wqe_hdr = (struct pvrdma_rq_wqe_hdr *)get_rq_wqe(qp, tail);
                 wqe_hdr->wr_id = wr->wr_id;
                 wqe_hdr->num_sge = wr->num_sge;
                 wqe_hdr->total_len = 0;
@@ -859,12 +854,11 @@ int pvrdma_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                 /* Make sure wqe is written before index update */
                 smp_wmb();
 
-                index++;
-                if (unlikely(index >= qp->rq.wqe_cnt))
-                        index = 0;
                 /* Update shared rq ring */
                 pvrdma_idx_ring_inc(&qp->rq.ring->prod_tail,
                                     qp->rq.wqe_cnt);
+
+                wr = wr->next;
         }
 
         spin_unlock_irqrestore(&qp->rq.lock, flags);
diff --git a/drivers/infiniband/sw/rdmavt/mmap.c b/drivers/infiniband/sw/rdmavt/mmap.c
index e202b8142759..6b712eecbd37 100644
--- a/drivers/infiniband/sw/rdmavt/mmap.c
+++ b/drivers/infiniband/sw/rdmavt/mmap.c
@@ -170,9 +170,9 @@ struct rvt_mmap_info *rvt_create_mmap_info(struct rvt_dev_info *rdi,
 
         spin_lock_irq(&rdi->mmap_offset_lock);
         if (rdi->mmap_offset == 0)
-                rdi->mmap_offset = PAGE_SIZE;
+                rdi->mmap_offset = ALIGN(PAGE_SIZE, SHMLBA);
         ip->offset = rdi->mmap_offset;
-        rdi->mmap_offset += size;
+        rdi->mmap_offset += ALIGN(size, SHMLBA);
         spin_unlock_irq(&rdi->mmap_offset_lock);
 
         INIT_LIST_HEAD(&ip->pending_mmaps);
diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
index 7d1ac27ed251..6332dedc11e8 100644
--- a/drivers/infiniband/sw/rxe/Kconfig
+++ b/drivers/infiniband/sw/rxe/Kconfig
@@ -22,4 +22,4 @@ config RDMA_RXE
         To configure and work with soft-RoCE driver please use the
         following wiki page under "configure Soft-RoCE (RXE)" section:
 
-        https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
+        https://github.com/linux-rdma/rdma-core/blob/master/Documentation/rxe.md
diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
index c572a4c09359..bd812e00988e 100644
--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
+++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
@@ -156,10 +156,10 @@ struct rxe_mmap_info *rxe_create_mmap_info(struct rxe_dev *rxe,
         spin_lock_bh(&rxe->mmap_offset_lock);
 
         if (rxe->mmap_offset == 0)
-                rxe->mmap_offset = PAGE_SIZE;
+                rxe->mmap_offset = ALIGN(PAGE_SIZE, SHMLBA);
 
         ip->info.offset = rxe->mmap_offset;
-        rxe->mmap_offset += size;
+        rxe->mmap_offset += ALIGN(size, SHMLBA);
 
         spin_unlock_bh(&rxe->mmap_offset_lock);
 
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index dbfde0dc6ff7..9f95f50b2909 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -729,11 +729,11 @@ next_wqe:
         ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
         if (ret) {
                 qp->need_req_skb = 1;
-                kfree_skb(skb);
 
                 rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
 
                 if (ret == -EAGAIN) {
+                        kfree_skb(skb);
                         rxe_run_task(&qp->req.task, 1);
                         goto exit;
                 }
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index d404a8aba7af..c9dd385ce62e 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -813,18 +813,17 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
                 WARN_ON_ONCE(1);
         }
 
-        /* We successfully processed this new request. */
-        qp->resp.msn++;
-
         /* next expected psn, read handles this separately */
         qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
 
         qp->resp.opcode = pkt->opcode;
         qp->resp.status = IB_WC_SUCCESS;
 
-        if (pkt->mask & RXE_COMP_MASK)
+        if (pkt->mask & RXE_COMP_MASK) {
+                /* We successfully processed this new request. */
+                qp->resp.msn++;
                 return RESPST_COMPLETE;
-        else if (qp_type(qp) == IB_QPT_RC)
+        } else if (qp_type(qp) == IB_QPT_RC)
                 return RESPST_ACKNOWLEDGE;
         else
                 return RESPST_CLEANUP;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 9d0b22ad58c1..c1ae4aeae2f9 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -430,6 +430,7 @@ struct iser_fr_desc {
         struct list_head                  list;
         struct iser_reg_resources         rsc;
         struct iser_pi_context           *pi_ctx;
+        struct list_head                  all_list;
 };
 
 /**
@@ -443,6 +444,7 @@ struct iser_fr_pool {
         struct list_head        list;
         spinlock_t              lock;
         int                     size;
+        struct list_head        all_list;
 };
 
 /**
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index 30b622f2ab73..c538a38c91ce 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -362,6 +362,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn,
         int i, ret;
 
         INIT_LIST_HEAD(&fr_pool->list);
+        INIT_LIST_HEAD(&fr_pool->all_list);
         spin_lock_init(&fr_pool->lock);
         fr_pool->size = 0;
         for (i = 0; i < cmds_max; i++) {
@@ -373,6 +374,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn,
                 }
 
                 list_add_tail(&desc->list, &fr_pool->list);
+                list_add_tail(&desc->all_list, &fr_pool->all_list);
                 fr_pool->size++;
         }
 
@@ -392,13 +394,13 @@ void iser_free_fastreg_pool(struct ib_conn *ib_conn)
         struct iser_fr_desc *desc, *tmp;
         int i = 0;
 
-        if (list_empty(&fr_pool->list))
+        if (list_empty(&fr_pool->all_list))
                 return;
 
         iser_info("freeing conn %p fr pool\n", ib_conn);
 
-        list_for_each_entry_safe(desc, tmp, &fr_pool->list, list) {
-                list_del(&desc->list);
+        list_for_each_entry_safe(desc, tmp, &fr_pool->all_list, all_list) {
+                list_del(&desc->all_list);
                 iser_free_reg_res(&desc->rsc);
                 if (desc->pi_ctx)
                         iser_free_pi_ctx(desc->pi_ctx);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 91cbe86b25c8..fcbed35e95a8 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -817,6 +817,7 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count)
                 rx_wr->sg_list = &rx_desc->rx_sg;
                 rx_wr->num_sge = 1;
                 rx_wr->next = rx_wr + 1;
+                rx_desc->in_use = false;
         }
         rx_wr--;
         rx_wr->next = NULL; /* mark end of work requests list */
@@ -835,6 +836,15 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc)
         struct ib_recv_wr *rx_wr_failed, rx_wr;
         int ret;
 
+        if (!rx_desc->in_use) {
+                /*
+                 * if the descriptor is not in-use we already reposted it
+                 * for recv, so just silently return
+                 */
+                return 0;
+        }
+
+        rx_desc->in_use = false;
         rx_wr.wr_cqe = &rx_desc->rx_cqe;
         rx_wr.sg_list = &rx_desc->rx_sg;
         rx_wr.num_sge = 1;
@@ -1397,6 +1407,8 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
                 return;
         }
 
+        rx_desc->in_use = true;
+
         ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr,
                         ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
 
@@ -1659,10 +1671,23 @@ isert_rdma_write_done(struct ib_cq *cq, struct ib_wc *wc)
         ret = isert_check_pi_status(cmd, isert_cmd->rw.sig->sig_mr);
         isert_rdma_rw_ctx_destroy(isert_cmd, isert_conn);
 
-        if (ret)
-                transport_send_check_condition_and_sense(cmd, cmd->pi_err, 0);
-        else
-                isert_put_response(isert_conn->conn, isert_cmd->iscsi_cmd);
+        if (ret) {
+                /*
+                 * transport_generic_request_failure() expects to have
+                 * plus two references to handle queue-full, so re-add
+                 * one here as target-core will have already dropped
+                 * it after the first isert_put_datain() callback.
+                 */
+                kref_get(&cmd->cmd_kref);
+                transport_generic_request_failure(cmd, cmd->pi_err);
+        } else {
+                /*
+                 * XXX: isert_put_response() failure is not retried.
+                 */
+                ret = isert_put_response(isert_conn->conn, isert_cmd->iscsi_cmd);
+                if (ret)
+                        pr_warn_ratelimited("isert_put_response() ret: %d\n", ret);
+        }
 }
 
 static void
@@ -1699,13 +1724,15 @@ isert_rdma_read_done(struct ib_cq *cq, struct ib_wc *wc)
         cmd->i_state = ISTATE_RECEIVED_LAST_DATAOUT;
         spin_unlock_bh(&cmd->istate_lock);
 
-        if (ret) {
-                target_put_sess_cmd(se_cmd);
-                transport_send_check_condition_and_sense(se_cmd,
-                                                         se_cmd->pi_err, 0);
-        } else {
+        /*
+         * transport_generic_request_failure() will drop the extra
+         * se_cmd->cmd_kref reference after T10-PI error, and handle
+         * any non-zero ->queue_status() callback error retries.
+         */
+        if (ret)
+                transport_generic_request_failure(se_cmd, se_cmd->pi_err);
+        else
                 target_execute_cmd(se_cmd);
-        }
 }
 
 static void
@@ -2171,26 +2198,28 @@ isert_put_datain(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
                 chain_wr = &isert_cmd->tx_desc.send_wr;
         }
 
-        isert_rdma_rw_ctx_post(isert_cmd, isert_conn, cqe, chain_wr);
-        isert_dbg("Cmd: %p posted RDMA_WRITE for iSER Data READ\n", isert_cmd);
-        return 1;
+        rc = isert_rdma_rw_ctx_post(isert_cmd, isert_conn, cqe, chain_wr);
+        isert_dbg("Cmd: %p posted RDMA_WRITE for iSER Data READ rc: %d\n",
+                  isert_cmd, rc);
+        return rc;
 }
 
 static int
 isert_get_dataout(struct iscsi_conn *conn, struct iscsi_cmd *cmd, bool recovery)
 {
         struct isert_cmd *isert_cmd = iscsit_priv_cmd(cmd);
+        int ret;
 
         isert_dbg("Cmd: %p RDMA_READ data_length: %u write_data_done: %u\n",
                  isert_cmd, cmd->se_cmd.data_length, cmd->write_data_done);
 
         isert_cmd->tx_desc.tx_cqe.done = isert_rdma_read_done;
-        isert_rdma_rw_ctx_post(isert_cmd, conn->context,
-                        &isert_cmd->tx_desc.tx_cqe, NULL);
+        ret = isert_rdma_rw_ctx_post(isert_cmd, conn->context,
+                                     &isert_cmd->tx_desc.tx_cqe, NULL);
 
-        isert_dbg("Cmd: %p posted RDMA_READ memory for ISER Data WRITE\n",
-                 isert_cmd);
-        return 0;
+        isert_dbg("Cmd: %p posted RDMA_READ memory for ISER Data WRITE rc: %d\n",
+                 isert_cmd, ret);
+        return ret;
 }
 
 static int
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index c02ada57d7f5..87d994de8c91 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -60,7 +60,7 @@
 
 #define ISER_RX_PAD_SIZE        (ISCSI_DEF_MAX_RECV_SEG_LEN + 4096 - \
                 (ISER_RX_PAYLOAD_SIZE + sizeof(u64) + sizeof(struct ib_sge) + \
-                 sizeof(struct ib_cqe)))
+                 sizeof(struct ib_cqe) + sizeof(bool)))
 
 #define ISCSI_ISER_SG_TABLESIZE         256
 
@@ -85,6 +85,7 @@ struct iser_rx_desc {
         u64             dma_addr;
         struct ib_sge   rx_sg;
         struct ib_cqe   rx_cqe;
+        bool            in_use;
         char            pad[ISER_RX_PAD_SIZE];
 } __packed;
 
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index d96aa27dfcdc..db64adfbe1af 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf,
 
         interface = intf->cur_altsetting;
 
+        if (interface->desc.bNumEndpoints < 2)
+                return -ENODEV;
+
         epirq = &interface->endpoint[0].desc;
         epout = &interface->endpoint[1].desc;
 
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 155fcb3b6230..153b1ee13e03 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -202,6 +202,7 @@ static const struct xpad_device {
         { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
         { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
         { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
+        { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
         { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
         { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
         { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
@@ -326,6 +327,7 @@ static struct usb_device_id xpad_table[] = {
         XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x146b),            /* BigBen Interactive Controllers */
         XPAD_XBOX360_VENDOR(0x1532),            /* Razer Sabertooth */
+        XPAD_XBOXONE_VENDOR(0x1532),            /* Razer Wildcat */
         XPAD_XBOX360_VENDOR(0x15e4),            /* Numark X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x162e),            /* Joytech X-Box 360 controllers */
         XPAD_XBOX360_VENDOR(0x1689),            /* Razer Onza */
diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 9cc6d057c302..23c191a2a071 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -700,6 +700,10 @@ static int cm109_usb_probe(struct usb_interface *intf,
         int error = -ENOMEM;
 
         interface = intf->cur_altsetting;
+
+        if (interface->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &interface->endpoint[0].desc;
 
         if (!usb_endpoint_is_int_in(endpoint))
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 9c0ea36913b4..f4e8fbec6a94 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc
                 return -EINVAL;
 
         alt = pcu->ctrl_intf->cur_altsetting;
+
+        if (alt->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         pcu->ep_ctrl = &alt->endpoint[0].desc;
         pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
 
diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c
index 79c964c075f1..6e7ff9561d92 100644
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -875,6 +875,10 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
         int ret, pipe, i;
 
         interface = intf->cur_altsetting;
+
+        if (interface->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &interface->endpoint[0].desc;
         if (!usb_endpoint_is_int_in(endpoint))
                 return -ENODEV;
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 72b28ebfe360..f210e19ddba6 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1282,10 +1282,8 @@ static int alps_decode_ss4_v2(struct alps_fields *f,
         /* handle buttons */
         if (pkt_id == SS4_PACKET_ID_STICK) {
                 f->ts_left = !!(SS4_BTN_V2(p) & 0x01);
-                if (!(priv->flags & ALPS_BUTTONPAD)) {
-                        f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
-                        f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
-                }
+                f->ts_right = !!(SS4_BTN_V2(p) & 0x02);
+                f->ts_middle = !!(SS4_BTN_V2(p) & 0x04);
         } else {
                 f->left = !!(SS4_BTN_V2(p) & 0x01);
                 if (!(priv->flags & ALPS_BUTTONPAD)) {
@@ -2462,14 +2460,34 @@ static int alps_update_device_area_ss4_v2(unsigned char otp[][4],
         int num_y_electrode;
         int x_pitch, y_pitch, x_phys, y_phys;
 
-        num_x_electrode = SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
-        num_y_electrode = SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
+        if (IS_SS4PLUS_DEV(priv->dev_id)) {
+                num_x_electrode =
+                        SS4PLUS_NUMSENSOR_XOFFSET + (otp[0][2] & 0x0F);
+                num_y_electrode =
+                        SS4PLUS_NUMSENSOR_YOFFSET + ((otp[0][2] >> 4) & 0x0F);
+
+                priv->x_max =
+                        (num_x_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
+                priv->y_max =
+                        (num_y_electrode - 1) * SS4PLUS_COUNT_PER_ELECTRODE;
 
-        priv->x_max = (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
-        priv->y_max = (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+                x_pitch = (otp[0][1] & 0x0F) + SS4PLUS_MIN_PITCH_MM;
+                y_pitch = ((otp[0][1] >> 4) & 0x0F) + SS4PLUS_MIN_PITCH_MM;
 
-        x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
-        y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
+        } else {
+                num_x_electrode =
+                        SS4_NUMSENSOR_XOFFSET + (otp[1][0] & 0x0F);
+                num_y_electrode =
+                        SS4_NUMSENSOR_YOFFSET + ((otp[1][0] >> 4) & 0x0F);
+
+                priv->x_max =
+                        (num_x_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+                priv->y_max =
+                        (num_y_electrode - 1) * SS4_COUNT_PER_ELECTRODE;
+
+                x_pitch = ((otp[1][2] >> 2) & 0x07) + SS4_MIN_PITCH_MM;
+                y_pitch = ((otp[1][2] >> 5) & 0x07) + SS4_MIN_PITCH_MM;
+        }
 
         x_phys = x_pitch * (num_x_electrode - 1); /* In 0.1 mm units */
         y_phys = y_pitch * (num_y_electrode - 1); /* In 0.1 mm units */
@@ -2485,7 +2503,10 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
 {
         unsigned char is_btnless;
 
-        is_btnless = (otp[1][1] >> 3) & 0x01;
+        if (IS_SS4PLUS_DEV(priv->dev_id))
+                is_btnless = (otp[1][0] >> 1) & 0x01;
+        else
+                is_btnless = (otp[1][1] >> 3) & 0x01;
 
         if (is_btnless)
                 priv->flags |= ALPS_BUTTONPAD;
@@ -2493,6 +2514,21 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
         return 0;
 }
 
+static int alps_update_dual_info_ss4_v2(unsigned char otp[][4],
+                                       struct alps_data *priv)
+{
+        bool is_dual = false;
+
+        if (IS_SS4PLUS_DEV(priv->dev_id))
+                is_dual = (otp[0][0] >> 4) & 0x01;
+
+        if (is_dual)
+                priv->flags |= ALPS_DUALPOINT |
+                                        ALPS_DUALPOINT_WITH_PRESSURE;
+
+        return 0;
+}
+
 static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
                                     struct alps_data *priv)
 {
@@ -2508,6 +2544,8 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
 
         alps_update_btn_info_ss4_v2(otp, priv);
 
+        alps_update_dual_info_ss4_v2(otp, priv);
+
         return 0;
 }
 
@@ -2753,10 +2791,6 @@ static int alps_set_protocol(struct psmouse *psmouse,
                 if (alps_set_defaults_ss4_v2(psmouse, priv))
                         return -EIO;
 
-                if (priv->fw_ver[1] == 0x1)
-                        priv->flags |= ALPS_DUALPOINT |
-                                        ALPS_DUALPOINT_WITH_PRESSURE;
-
                 break;
         }
 
@@ -2827,10 +2861,7 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
                            ec[2] >= 0x90 && ec[2] <= 0x9d) {
                         protocol = &alps_v3_protocol_data;
                 } else if (e7[0] == 0x73 && e7[1] == 0x03 &&
-                           e7[2] == 0x14 && ec[1] == 0x02) {
-                        protocol = &alps_v8_protocol_data;
-                } else if (e7[0] == 0x73 && e7[1] == 0x03 &&
-                           e7[2] == 0x28 && ec[1] == 0x01) {
+                           (e7[2] == 0x14 || e7[2] == 0x28)) {
                         protocol = &alps_v8_protocol_data;
                 } else {
                         psmouse_dbg(psmouse,
@@ -2840,7 +2871,8 @@ static int alps_identify(struct psmouse *psmouse, struct alps_data *priv)
         }
 
         if (priv) {
-                /* Save the Firmware version */
+                /* Save Device ID and Firmware version */
+                memcpy(priv->dev_id, e7, 3);
                 memcpy(priv->fw_ver, ec, 3);
                 error = alps_set_protocol(psmouse, priv, protocol);
                 if (error)
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index 6d279aa27cb9..4334f2805d93 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -54,6 +54,16 @@ enum SS4_PACKET_ID {
 
 #define SS4_MASK_NORMAL_BUTTONS         0x07
 
+#define SS4PLUS_COUNT_PER_ELECTRODE     128
+#define SS4PLUS_NUMSENSOR_XOFFSET       16
+#define SS4PLUS_NUMSENSOR_YOFFSET       5
+#define SS4PLUS_MIN_PITCH_MM            37
+
+#define IS_SS4PLUS_DEV(_b)      (((_b[0]) == 0x73) &&   \
+                                 ((_b[1]) == 0x03) &&   \
+                                 ((_b[2]) == 0x28)              \
+                                )
+
 #define SS4_IS_IDLE_V2(_b)      (((_b[0]) == 0x18) &&           \
                                  ((_b[1]) == 0x10) &&           \
                                  ((_b[2]) == 0x00) &&           \
@@ -283,6 +293,7 @@ struct alps_data {
         int addr_command;
         u16 proto_version;
         u8 byte0, mask0;
+        u8 dev_id[3];
         u8 fw_ver[3];
         int flags;
         int x_max;
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 352050e9031d..d5ab9ddef3e3 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -218,17 +218,19 @@ static int elan_query_product(struct elan_tp_data *data)
 
 static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
 {
-        if (data->ic_type != 0x0E)
-                return false;
-
-        switch (data->product_id) {
-        case 0x05 ... 0x07:
-        case 0x09:
-        case 0x13:
+        if (data->ic_type == 0x0E) {
+                switch (data->product_id) {
+                case 0x05 ... 0x07:
+                case 0x09:
+                case 0x13:
+                        return true;
+                }
+        } else if (data->ic_type == 0x08 && data->product_id == 0x26) {
+                /* ASUS EeeBook X205TA */
                 return true;
-        default:
-                return false;
         }
+
+        return false;
 }
 
 static int __elan_initialize(struct elan_tp_data *data)
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index efc8ec342351..e73d968023f7 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,6 +1118,7 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
  * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
  * Avatar AVIU-145A2       0x361f00        ?               clickpad
  * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
  * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
  * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
  * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
@@ -1524,6 +1525,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                 },
         },
         {
+                /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E547"),
+                },
+        },
+        {
                 /* Fujitsu LIFEBOOK E554  does not work with crc_enabled == 0 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/input/rmi4/rmi_f30.c b/drivers/input/rmi4/rmi_f30.c
index 198678613382..34dfee555b20 100644
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -170,6 +170,10 @@ static int rmi_f30_config(struct rmi_function *fn)
                                 rmi_get_platform_data(fn->rmi_dev);
         int error;
 
+        /* can happen if f30_data.disable is set */
+        if (!f30)
+                return 0;
+
         if (pdata->f30_data.trackstick_buttons) {
                 /* Try [re-]establish link to F03. */
                 f30->f03 = rmi_find_function(fn->rmi_dev, 0x03);
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 05afd16ea9c9..312bd6ca9198 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -120,6 +120,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
                 },
         },
         {
+                /* Dell Embedded Box PC 3000 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"),
+                },
+        },
+        {
                 /* OQO Model 01 */
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
@@ -513,6 +520,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
                 },
         },
+        {
+                /* TUXEDO BU1406 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c
index cd852059b99e..df4bea96d7ed 100644
--- a/drivers/input/tablet/hanwang.c
+++ b/drivers/input/tablet/hanwang.c
@@ -340,6 +340,9 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id
         int error;
         int i;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!hanwang || !input_dev) {
diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c
index e850d7e8afbc..4d9d64908b59 100644
--- a/drivers/input/tablet/kbtab.c
+++ b/drivers/input/tablet/kbtab.c
@@ -122,6 +122,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i
         struct input_dev *input_dev;
         int error = -ENOMEM;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!kbtab || !input_dev)
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index aefb6e11f88a..4c0eecae065c 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -527,6 +527,9 @@ static int sur40_probe(struct usb_interface *interface,
         if (iface_desc->desc.bInterfaceClass != 0xFF)
                 return -ENODEV;
 
+        if (iface_desc->desc.bNumEndpoints < 5)
+                return -ENODEV;
+
         /* Use endpoint #4 (0x86). */
         endpoint = &iface_desc->endpoint[4].desc;
         if (endpoint->bEndpointAddress != TOUCH_ENDPOINT)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 98940d1392cb..b17536d6e69b 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3202,7 +3202,7 @@ static void amd_iommu_get_resv_regions(struct device *dev,
 
         region = iommu_alloc_resv_region(MSI_RANGE_START,
                                          MSI_RANGE_END - MSI_RANGE_START + 1,
-                                         0, IOMMU_RESV_RESERVED);
+                                         0, IOMMU_RESV_MSI);
         if (!region)
                 return;
         list_add_tail(&region->list, head);
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 5806a6acc94e..591bb96047c9 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1888,7 +1888,7 @@ static void arm_smmu_get_resv_regions(struct device *dev,
         int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO;
 
         region = iommu_alloc_resv_region(MSI_IOVA_BASE, MSI_IOVA_LENGTH,
-                                         prot, IOMMU_RESV_MSI);
+                                         prot, IOMMU_RESV_SW_MSI);
         if (!region)
                 return;
 
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index abf6496843a6..b493c99e17f7 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -1608,7 +1608,7 @@ static void arm_smmu_get_resv_regions(struct device *dev,
         int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO;
 
         region = iommu_alloc_resv_region(MSI_IOVA_BASE, MSI_IOVA_LENGTH,
-                                         prot, IOMMU_RESV_MSI);
+                                         prot, IOMMU_RESV_SW_MSI);
         if (!region)
                 return;
 
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
index a7e0821c9967..c01bfcdb2383 100644
--- a/drivers/iommu/exynos-iommu.c
+++ b/drivers/iommu/exynos-iommu.c
@@ -512,7 +512,13 @@ static void sysmmu_tlb_invalidate_flpdcache(struct sysmmu_drvdata *data,
         spin_lock_irqsave(&data->lock, flags);
         if (data->active && data->version >= MAKE_MMU_VER(3, 3)) {
                 clk_enable(data->clk_master);
-                __sysmmu_tlb_invalidate_entry(data, iova, 1);
+                if (sysmmu_block(data)) {
+                        if (data->version >= MAKE_MMU_VER(5, 0))
+                                __sysmmu_tlb_invalidate(data);
+                        else
+                                __sysmmu_tlb_invalidate_entry(data, iova, 1);
+                        sysmmu_unblock(data);
+                }
                 clk_disable(data->clk_master);
         }
         spin_unlock_irqrestore(&data->lock, flags);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 238ad3447712..d412a313a372 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -916,7 +916,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
                                  * which we used for the IOMMU lookup. Strictly speaking
                                  * we could do this for all PCI devices; we only need to
                                  * get the BDF# from the scope table for ACPI matches. */
-                                if (pdev->is_virtfn)
+                                if (pdev && pdev->is_virtfn)
                                         goto got_pdev;
 
                                 *bus = drhd->devices[i].bus;
@@ -5249,7 +5249,7 @@ static void intel_iommu_get_resv_regions(struct device *device,
 
         reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
                                       IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
-                                      0, IOMMU_RESV_RESERVED);
+                                      0, IOMMU_RESV_MSI);
         if (!reg)
                 return;
         list_add_tail(&reg->list, head);
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index 1c049e2e12bf..8d6ca28c3e1f 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -422,8 +422,12 @@ static int __arm_v7s_map(struct arm_v7s_io_pgtable *data, unsigned long iova,
                         pte |= ARM_V7S_ATTR_NS_TABLE;
 
                 __arm_v7s_set_pte(ptep, pte, 1, cfg);
-        } else {
+        } else if (ARM_V7S_PTE_IS_TABLE(pte, lvl)) {
                 cptep = iopte_deref(pte, lvl);
+        } else {
+                /* We require an unmap first */
+                WARN_ON(!selftest_running);
+                return -EEXIST;
         }
 
         /* Rinse, repeat */
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index feacc54bec68..f9bc6ebb8140 100644
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -335,8 +335,12 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova,
                 if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
                         pte |= ARM_LPAE_PTE_NSTABLE;
                 __arm_lpae_set_pte(ptep, pte, cfg);
-        } else {
+        } else if (!iopte_leaf(pte, lvl)) {
                 cptep = iopte_deref(pte, data);
+        } else {
+                /* We require an unmap first */
+                WARN_ON(!selftest_running);
+                return -EEXIST;
         }
 
         /* Rinse, repeat */
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 8ea14f41a979..3b67144dead2 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -72,6 +72,7 @@ static const char * const iommu_group_resv_type_string[] = {
         [IOMMU_RESV_DIRECT]     = "direct",
         [IOMMU_RESV_RESERVED]   = "reserved",
         [IOMMU_RESV_MSI]        = "msi",
+        [IOMMU_RESV_SW_MSI]     = "msi",
 };
 
 #define IOMMU_GROUP_ATTR(_name, _mode, _show, _store)           \
@@ -1743,8 +1744,8 @@ void iommu_put_resv_regions(struct device *dev, struct list_head *list)
 }
 
 struct iommu_resv_region *iommu_alloc_resv_region(phys_addr_t start,
-                                                  size_t length,
-                                                  int prot, int type)
+                                                  size_t length, int prot,
+                                                  enum iommu_resv_type type)
 {
         struct iommu_resv_region *region;
 
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 125528f39e92..8162121bb1bc 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -262,6 +262,7 @@ config IRQ_MXS
 
 config MVEBU_ODMI
         bool
+        select GENERIC_MSI_IRQ_DOMAIN
 
 config MVEBU_PIC
         bool
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index 1eef56a89b1f..f96601268f71 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -198,7 +198,8 @@ static const struct irq_domain_ops crossbar_domain_ops = {
 
 static int __init crossbar_of_init(struct device_node *node)
 {
-        int i, size, max = 0, reserved = 0, entry;
+        u32 max = 0, entry, reg_size;
+        int i, size, reserved = 0;
         const __be32 *irqsr;
         int ret = -ENOMEM;
 
@@ -275,9 +276,9 @@ static int __init crossbar_of_init(struct device_node *node)
         if (!cb->register_offsets)
                 goto err_irq_map;
 
-        of_property_read_u32(node, "ti,reg-size", &size);
+        of_property_read_u32(node, "ti,reg-size", &reg_size);
 
-        switch (size) {
+        switch (reg_size) {
         case 1:
                 cb->write = crossbar_writeb;
                 break;
@@ -303,7 +304,7 @@ static int __init crossbar_of_init(struct device_node *node)
                         continue;
 
                 cb->register_offsets[i] = reserved;
-                reserved += size;
+                reserved += reg_size;
         }
 
         of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 23201004fd7a..f77f840d2b5f 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1601,6 +1601,14 @@ static void __maybe_unused its_enable_quirk_cavium_23144(void *data)
         its->flags |= ITS_FLAGS_WORKAROUND_CAVIUM_23144;
 }
 
+static void __maybe_unused its_enable_quirk_qdf2400_e0065(void *data)
+{
+        struct its_node *its = data;
+
+        /* On QDF2400, the size of the ITE is 16Bytes */
+        its->ite_size = 16;
+}
+
 static const struct gic_quirk its_quirks[] = {
 #ifdef CONFIG_CAVIUM_ERRATUM_22375
         {
@@ -1618,6 +1626,14 @@ static const struct gic_quirk its_quirks[] = {
                 .init   = its_enable_quirk_cavium_23144,
         },
 #endif
+#ifdef CONFIG_QCOM_QDF2400_ERRATUM_0065
+        {
+                .desc   = "ITS: QDF2400 erratum 0065",
+                .iidr   = 0x00001070, /* QDF2400 ITS rev 1.x */
+                .mask   = 0xffffffff,
+                .init   = its_enable_quirk_qdf2400_e0065,
+        },
+#endif
         {
         }
 };
diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
index 15af9a9753e5..2d203b422129 100644
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -230,6 +230,8 @@ static int __init imx_gpcv2_irqchip_init(struct device_node *node,
                 return -ENOMEM;
         }
 
+        raw_spin_lock_init(&cd->rlock);
+
         cd->gpc_base = of_iomap(node, 0);
         if (!cd->gpc_base) {
                 pr_err("fsl-gpcv2: unable to map gpc registers\n");
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 11d12bccc4e7..cd20df12d63d 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -991,8 +991,12 @@ static void __init gic_map_single_int(struct device_node *node,
 
 static void __init gic_map_interrupts(struct device_node *node)
 {
+        gic_map_single_int(node, GIC_LOCAL_INT_WD);
+        gic_map_single_int(node, GIC_LOCAL_INT_COMPARE);
         gic_map_single_int(node, GIC_LOCAL_INT_TIMER);
         gic_map_single_int(node, GIC_LOCAL_INT_PERFCTR);
+        gic_map_single_int(node, GIC_LOCAL_INT_SWINT0);
+        gic_map_single_int(node, GIC_LOCAL_INT_SWINT1);
         gic_map_single_int(node, GIC_LOCAL_INT_FDC);
 }
 
diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index 1dfd1085a04f..9ca691d6c13b 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -1032,6 +1032,7 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
                                                      sizeof(avmb1_carddef))))
                                 return -EFAULT;
                         cdef.cardtype = AVM_CARDTYPE_B1;
+                        cdef.cardnr = 0;
                 } else {
                         if ((retval = copy_from_user(&cdef, data,
                                                      sizeof(avmb1_extcarddef))))
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 11e13c56126f..2da3ff650e1d 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -2317,6 +2317,9 @@ static int gigaset_probe(struct usb_interface *interface,
                 return -ENODEV;
         }
 
+        if (hostif->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         dev_info(&udev->dev,
                  "%s: Device matched (Vendor: 0x%x, Product: 0x%x)\n",
                  __func__, le16_to_cpu(udev->descriptor.idVendor),
diff --git a/drivers/isdn/hisax/st5481_b.c b/drivers/isdn/hisax/st5481_b.c
index 409849165838..f64a36007800 100644
--- a/drivers/isdn/hisax/st5481_b.c
+++ b/drivers/isdn/hisax/st5481_b.c
@@ -239,7 +239,7 @@ static void st5481B_mode(struct st5481_bcs *bcs, int mode)
                         }
                 }
         } else {
-                // Disble B channel interrupts
+                // Disable B channel interrupts
                 st5481_usb_device_ctrl_msg(adapter, FFMSK_B1+(bcs->channel * 2), 0, NULL, NULL);
 
                 // Disable B channel FIFOs
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 3f041b187033..f757cef293f8 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -392,6 +392,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
          * To get all the fields, copy all archdata
          */
         dev->ofdev.dev.archdata = chip->lbus.pdev->dev.archdata;
+        dev->ofdev.dev.dma_ops = chip->lbus.pdev->dev.dma_ops;
 #endif /* CONFIG_PCI */
 
 #ifdef DEBUG
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index a126919ed102..5d13930f0f22 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -4,7 +4,6 @@
 
 #include <linux/blkdev.h>
 #include <linux/errno.h>
-#include <linux/blkdev.h>
 #include <linux/kernel.h>
 #include <linux/sched/clock.h>
 #include <linux/llist.h>
diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
index e4c2c1a1e993..6735c8d6a445 100644
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -932,7 +932,7 @@ static int blocks_are_clean_separate_dirty(struct dm_cache_metadata *cmd,
         *result = true;
 
         r = dm_bitset_cursor_begin(&cmd->dirty_info, cmd->dirty_root,
-                                   from_cblock(begin), &cmd->dirty_cursor);
+                                   from_cblock(cmd->cache_blocks), &cmd->dirty_cursor);
         if (r) {
                 DMERR("%s: dm_bitset_cursor_begin for dirty failed", __func__);
                 return r;
@@ -959,14 +959,16 @@ static int blocks_are_clean_separate_dirty(struct dm_cache_metadata *cmd,
                         return 0;
                 }
 
+                begin = to_cblock(from_cblock(begin) + 1);
+                if (begin == end)
+                        break;
+
                 r = dm_bitset_cursor_next(&cmd->dirty_cursor);
                 if (r) {
                         DMERR("%s: dm_bitset_cursor_next for dirty failed", __func__);
                         dm_bitset_cursor_end(&cmd->dirty_cursor);
                         return r;
                 }
-
-                begin = to_cblock(from_cblock(begin) + 1);
         }
 
         dm_bitset_cursor_end(&cmd->dirty_cursor);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index f8564d63982f..1e217ba84d09 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3726,7 +3726,7 @@ static int raid_preresume(struct dm_target *ti)
                 return r;
 
         /* Resize bitmap to adjust to changed region size (aka MD bitmap chunksize) */
-        if (test_bit(RT_FLAG_RS_BITMAP_LOADED, &rs->runtime_flags) &&
+        if (test_bit(RT_FLAG_RS_BITMAP_LOADED, &rs->runtime_flags) && mddev->bitmap &&
             mddev->bitmap_info.chunksize != to_bytes(rs->requested_bitmap_chunk_sectors)) {
                 r = bitmap_resize(mddev->bitmap, mddev->dev_sectors,
                                   to_bytes(rs->requested_bitmap_chunk_sectors), 0);
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 28955b94d2b2..0b081d170087 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -755,6 +755,7 @@ static int dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx,
                 /* Undo dm_start_request() before requeuing */
                 rq_end_stats(md, rq);
                 rq_completed(md, rq_data_dir(rq), false);
+                blk_mq_delay_run_hw_queue(hctx, 100/*ms*/);
                 return BLK_MQ_RQ_QUEUE_BUSY;
         }
 
diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
index 0f0eb8a3d922..78f36012eaca 100644
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -146,8 +146,6 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio,
                 block = fec_buffer_rs_block(v, fio, n, i);
                 res = fec_decode_rs8(v, fio, block, &par[offset], neras);
                 if (res < 0) {
-                        dm_bufio_release(buf);
-
                         r = res;
                         goto error;
                 }
@@ -172,6 +170,8 @@ static int fec_decode_bufs(struct dm_verity *v, struct dm_verity_fec_io *fio,
 done:
         r = corrected;
 error:
+        dm_bufio_release(buf);
+
         if (r < 0 && neras)
                 DMERR_LIMIT("%s: FEC %llu: failed to correct: %d",
                             v->data_dev->name, (unsigned long long)rsb, r);
@@ -269,7 +269,7 @@ static int fec_read_bufs(struct dm_verity *v, struct dm_verity_io *io,
                                           &is_zero) == 0) {
                         /* skip known zero blocks entirely */
                         if (is_zero)
-                                continue;
+                                goto done;
 
                         /*
                          * skip if we have already found the theoretical
@@ -439,6 +439,13 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
         if (!verity_fec_is_enabled(v))
                 return -EOPNOTSUPP;
 
+        if (fio->level >= DM_VERITY_FEC_MAX_RECURSION) {
+                DMWARN_LIMIT("%s: FEC: recursion too deep", v->data_dev->name);
+                return -EIO;
+        }
+
+        fio->level++;
+
         if (type == DM_VERITY_BLOCK_TYPE_METADATA)
                 block += v->data_blocks;
 
@@ -470,7 +477,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
         if (r < 0) {
                 r = fec_decode_rsb(v, io, fio, rsb, offset, true);
                 if (r < 0)
-                        return r;
+                        goto done;
         }
 
         if (dest)
@@ -480,6 +487,8 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
                 r = verity_for_bv_block(v, io, iter, fec_bv_copy);
         }
 
+done:
+        fio->level--;
         return r;
 }
 
@@ -520,6 +529,7 @@ void verity_fec_init_io(struct dm_verity_io *io)
         memset(fio->bufs, 0, sizeof(fio->bufs));
         fio->nbufs = 0;
         fio->output = NULL;
+        fio->level = 0;
 }
 
 /*
diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h
index 7fa0298b995e..bb31ce87a933 100644
--- a/drivers/md/dm-verity-fec.h
+++ b/drivers/md/dm-verity-fec.h
@@ -27,6 +27,9 @@
 #define DM_VERITY_FEC_BUF_MAX \
         (1 << (PAGE_SHIFT - DM_VERITY_FEC_BUF_RS_BITS))
 
+/* maximum recursion level for verity_fec_decode */
+#define DM_VERITY_FEC_MAX_RECURSION     4
+
 #define DM_VERITY_OPT_FEC_DEV           "use_fec_from_device"
 #define DM_VERITY_OPT_FEC_BLOCKS        "fec_blocks"
 #define DM_VERITY_OPT_FEC_START         "fec_start"
@@ -58,6 +61,7 @@ struct dm_verity_fec_io {
         unsigned nbufs;         /* number of buffers allocated */
         u8 *output;             /* buffer for corrected output */
         size_t output_pos;
+        unsigned level;         /* recursion level */
 };
 
 #ifdef CONFIG_DM_VERITY_FEC
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index f4ffd1eb8f44..dfb75979e455 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -989,26 +989,29 @@ static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule)
         struct dm_offload *o = container_of(cb, struct dm_offload, cb);
         struct bio_list list;
         struct bio *bio;
+        int i;
 
         INIT_LIST_HEAD(&o->cb.list);
 
         if (unlikely(!current->bio_list))
                 return;
 
-        list = *current->bio_list;
-        bio_list_init(current->bio_list);
-
-        while ((bio = bio_list_pop(&list))) {
-                struct bio_set *bs = bio->bi_pool;
-                if (unlikely(!bs) || bs == fs_bio_set) {
-                        bio_list_add(current->bio_list, bio);
-                        continue;
+        for (i = 0; i < 2; i++) {
+                list = current->bio_list[i];
+                bio_list_init(&current->bio_list[i]);
+
+                while ((bio = bio_list_pop(&list))) {
+                        struct bio_set *bs = bio->bi_pool;
+                        if (unlikely(!bs) || bs == fs_bio_set) {
+                                bio_list_add(&current->bio_list[i], bio);
+                                continue;
+                        }
+
+                        spin_lock(&bs->rescue_lock);
+                        bio_list_add(&bs->rescue_list, bio);
+                        queue_work(bs->rescue_workqueue, &bs->rescue_work);
+                        spin_unlock(&bs->rescue_lock);
                 }
-
-                spin_lock(&bs->rescue_lock);
-                bio_list_add(&bs->rescue_list, bio);
-                queue_work(bs->rescue_workqueue, &bs->rescue_work);
-                spin_unlock(&bs->rescue_lock);
         }
 }
 
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 2b13117fb918..321ecac23027 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -777,7 +777,6 @@ static int gather_all_resync_info(struct mddev *mddev, int total_slots)
                 bm_lockres->flags |= DLM_LKF_NOQUEUE;
                 ret = dlm_lock_sync(bm_lockres, DLM_LOCK_PW);
                 if (ret == -EAGAIN) {
-                        memset(bm_lockres->lksb.sb_lvbptr, '\0', LVB_SIZE);
                         s = read_resync_info(mddev, bm_lockres);
                         if (s) {
                                 pr_info("%s:%d Resync[%llu..%llu] in progress on %d\n",
@@ -974,6 +973,7 @@ static int leave(struct mddev *mddev)
         lockres_free(cinfo->bitmap_lockres);
         unlock_all_bitmaps(mddev);
         dlm_release_lockspace(cinfo->lockspace, 2);
+        kfree(cinfo);
         return 0;
 }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 548d1b8014f8..f6ae1d67bcd0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -440,14 +440,6 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
 }
 EXPORT_SYMBOL(md_flush_request);
 
-void md_unplug(struct blk_plug_cb *cb, bool from_schedule)
-{
-        struct mddev *mddev = cb->data;
-        md_wakeup_thread(mddev->thread);
-        kfree(cb);
-}
-EXPORT_SYMBOL(md_unplug);
-
 static inline struct mddev *mddev_get(struct mddev *mddev)
 {
         atomic_inc(&mddev->active);
@@ -1887,7 +1879,7 @@ super_1_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors)
         }
         sb = page_address(rdev->sb_page);
         sb->data_size = cpu_to_le64(num_sectors);
-        sb->super_offset = rdev->sb_start;
+        sb->super_offset = cpu_to_le64(rdev->sb_start);
         sb->sb_csum = calc_sb_1_csum(sb);
         do {
                 md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
@@ -2295,7 +2287,7 @@ static bool does_sb_need_changing(struct mddev *mddev)
         /* Check if any mddev parameters have changed */
         if ((mddev->dev_sectors != le64_to_cpu(sb->size)) ||
             (mddev->reshape_position != le64_to_cpu(sb->reshape_position)) ||
-            (mddev->layout != le64_to_cpu(sb->layout)) ||
+            (mddev->layout != le32_to_cpu(sb->layout)) ||
             (mddev->raid_disks != le32_to_cpu(sb->raid_disks)) ||
             (mddev->chunk_sectors != le32_to_cpu(sb->chunksize)))
                 return true;
@@ -6458,11 +6450,10 @@ static int set_array_info(struct mddev *mddev, mdu_array_info_t *info)
         mddev->layout        = info->layout;
         mddev->chunk_sectors = info->chunk_size >> 9;
 
-        mddev->max_disks     = MD_SB_DISKS;
-
         if (mddev->persistent) {
-                mddev->flags         = 0;
-                mddev->sb_flags         = 0;
+                mddev->max_disks = MD_SB_DISKS;
+                mddev->flags = 0;
+                mddev->sb_flags = 0;
         }
         set_bit(MD_SB_CHANGE_DEVS, &mddev->sb_flags);
 
@@ -6533,8 +6524,12 @@ static int update_size(struct mddev *mddev, sector_t num_sectors)
                         return -ENOSPC;
         }
         rv = mddev->pers->resize(mddev, num_sectors);
-        if (!rv)
-                revalidate_disk(mddev->gendisk);
+        if (!rv) {
+                if (mddev->queue) {
+                        set_capacity(mddev->gendisk, mddev->array_sectors);
+                        revalidate_disk(mddev->gendisk);
+                }
+        }
         return rv;
 }
 
diff --git a/drivers/md/md.h b/drivers/md/md.h
index b8859cbf84b6..dde8ecb760c8 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -676,16 +676,10 @@ extern void mddev_resume(struct mddev *mddev);
 extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs,
                                    struct mddev *mddev);
 
-extern void md_unplug(struct blk_plug_cb *cb, bool from_schedule);
 extern void md_reload_sb(struct mddev *mddev, int raid_disk);
 extern void md_update_sb(struct mddev *mddev, int force);
 extern void md_kick_rdev_from_array(struct md_rdev * rdev);
 struct md_rdev *md_find_rdev_nr_rcu(struct mddev *mddev, int nr);
-static inline int mddev_check_plugged(struct mddev *mddev)
-{
-        return !!blk_check_plugged(md_unplug, mddev,
-                                   sizeof(struct blk_plug_cb));
-}
 
 static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev)
 {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index fbc2d7851b49..a34f58772022 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1027,7 +1027,7 @@ static int get_unqueued_pending(struct r1conf *conf)
 static void freeze_array(struct r1conf *conf, int extra)
 {
         /* Stop sync I/O and normal I/O and wait for everything to
-         * go quite.
+         * go quiet.
          * This is called in two situations:
          * 1) management command handlers (reshape, remove disk, quiesce).
          * 2) one normal I/O request failed.
@@ -1587,9 +1587,30 @@ static void raid1_make_request(struct mddev *mddev, struct bio *bio)
                         split = bio;
                 }
 
-                if (bio_data_dir(split) == READ)
+                if (bio_data_dir(split) == READ) {
                         raid1_read_request(mddev, split);
-                else
+
+                        /*
+                         * If a bio is splitted, the first part of bio will
+                         * pass barrier but the bio is queued in
+                         * current->bio_list (see generic_make_request). If
+                         * there is a raise_barrier() called here, the second
+                         * part of bio can't pass barrier. But since the first
+                         * part bio isn't dispatched to underlaying disks yet,
+                         * the barrier is never released, hence raise_barrier
+                         * will alays wait. We have a deadlock.
+                         * Note, this only happens in read path. For write
+                         * path, the first part of bio is dispatched in a
+                         * schedule() call (because of blk plug) or offloaded
+                         * to raid10d.
+                         * Quitting from the function immediately can change
+                         * the bio order queued in bio_list and avoid the deadlock.
+                         */
+                        if (split != bio) {
+                                generic_make_request(bio);
+                                break;
+                        }
+                } else
                         raid1_write_request(mddev, split);
         } while (split != bio);
 }
@@ -3246,8 +3267,6 @@ static int raid1_resize(struct mddev *mddev, sector_t sectors)
                         return ret;
         }
         md_set_array_sectors(mddev, newsize);
-        set_capacity(mddev->gendisk, mddev->array_sectors);
-        revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp > mddev->dev_sectors) {
                 mddev->recovery_cp = mddev->dev_sectors;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 063c43d83b72..e89a8d78a9ed 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -974,7 +974,8 @@ static void wait_barrier(struct r10conf *conf)
                                     !conf->barrier ||
                                     (atomic_read(&conf->nr_pending) &&
                                      current->bio_list &&
-                                     !bio_list_empty(current->bio_list)),
+                                     (!bio_list_empty(&current->bio_list[0]) ||
+                                      !bio_list_empty(&current->bio_list[1]))),
                                     conf->resync_lock);
                 conf->nr_waiting--;
                 if (!conf->nr_waiting)
@@ -1477,11 +1478,24 @@ retry_write:
                         mbio->bi_bdev = (void*)rdev;
 
                         atomic_inc(&r10_bio->remaining);
+
+                        cb = blk_check_plugged(raid10_unplug, mddev,
+                                               sizeof(*plug));
+                        if (cb)
+                                plug = container_of(cb, struct raid10_plug_cb,
+                                                    cb);
+                        else
+                                plug = NULL;
                         spin_lock_irqsave(&conf->device_lock, flags);
-                        bio_list_add(&conf->pending_bio_list, mbio);
-                        conf->pending_count++;
+                        if (plug) {
+                                bio_list_add(&plug->pending, mbio);
+                                plug->pending_cnt++;
+                        } else {
+                                bio_list_add(&conf->pending_bio_list, mbio);
+                                conf->pending_count++;
+                        }
                         spin_unlock_irqrestore(&conf->device_lock, flags);
-                        if (!mddev_check_plugged(mddev))
+                        if (!plug)
                                 md_wakeup_thread(mddev->thread);
                 }
         }
@@ -1571,7 +1585,25 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
                         split = bio;
                 }
 
+                /*
+                 * If a bio is splitted, the first part of bio will pass
+                 * barrier but the bio is queued in current->bio_list (see
+                 * generic_make_request). If there is a raise_barrier() called
+                 * here, the second part of bio can't pass barrier. But since
+                 * the first part bio isn't dispatched to underlaying disks
+                 * yet, the barrier is never released, hence raise_barrier will
+                 * alays wait. We have a deadlock.
+                 * Note, this only happens in read path. For write path, the
+                 * first part of bio is dispatched in a schedule() call
+                 * (because of blk plug) or offloaded to raid10d.
+                 * Quitting from the function immediately can change the bio
+                 * order queued in bio_list and avoid the deadlock.
+                 */
                 __make_request(mddev, split);
+                if (split != bio && bio_data_dir(bio) == READ) {
+                        generic_make_request(bio);
+                        break;
+                }
         } while (split != bio);
 
         /* In case raid10d snuck in to freeze_array */
@@ -3943,10 +3975,6 @@ static int raid10_resize(struct mddev *mddev, sector_t sectors)
                         return ret;
         }
         md_set_array_sectors(mddev, size);
-        if (mddev->queue) {
-                set_capacity(mddev->gendisk, mddev->array_sectors);
-                revalidate_disk(mddev->gendisk);
-        }
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp > oldsize) {
                 mddev->recovery_cp = oldsize;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4fb09b3fcb41..ed5cd705b985 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1401,7 +1401,8 @@ static int set_syndrome_sources(struct page **srcs,
                      (test_bit(R5_Wantdrain, &dev->flags) ||
                       test_bit(R5_InJournal, &dev->flags))) ||
                     (srctype == SYNDROME_SRC_WRITTEN &&
-                     dev->written)) {
+                     (dev->written ||
+                      test_bit(R5_InJournal, &dev->flags)))) {
                         if (test_bit(R5_InJournal, &dev->flags))
                                 srcs[slot] = sh->dev[i].orig_page;
                         else
@@ -7605,8 +7606,6 @@ static int raid5_resize(struct mddev *mddev, sector_t sectors)
                         return ret;
         }
         md_set_array_sectors(mddev, newsize);
-        set_capacity(mddev->gendisk, mddev->array_sectors);
-        revalidate_disk(mddev->gendisk);
         if (sectors > mddev->dev_sectors &&
             mddev->recovery_cp > mddev->dev_sectors) {
                 mddev->recovery_cp = mddev->dev_sectors;
diff --git a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
index 7a681d8202c7..4442e478db72 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
+++ b/drivers/media/dvb-frontends/drx39xyj/drx_driver.h
@@ -256,8 +256,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * The actual DAP implementation may be restricted to only one of the modes.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the mode defined below.
-*
+* overrides or cannot handle the mode defined below.
 */
 #ifndef DRXDAP_SINGLE_MASTER
 #define DRXDAP_SINGLE_MASTER 1
@@ -272,7 +271,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * This maximum size may be restricted by the actual DAP implementation.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the chunksize defined below.
+* overrides or cannot handle the chunksize defined below.
 *
 * Beware that the DAP uses  DRXDAP_MAX_WCHUNKSIZE to create a temporary data
 * buffer. Do not undefine or choose too large, unless your system is able to
@@ -292,8 +291,7 @@ int drxbsp_tuner_default_i2c_write_read(struct tuner_instance *tuner,
 *
 * This maximum size may be restricted by the actual DAP implementation.
 * A compiler warning or error will be generated if the DAP implementation
-* overides or cannot handle the chunksize defined below.
-*
+* overrides or cannot handle the chunksize defined below.
 */
 #ifndef DRXDAP_MAX_RCHUNKSIZE
 #define  DRXDAP_MAX_RCHUNKSIZE 60
diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platform/coda/imx-vdoa.c
index 67fd8ffa60a4..669a4c82f1ff 100644
--- a/drivers/media/platform/coda/imx-vdoa.c
+++ b/drivers/media/platform/coda/imx-vdoa.c
@@ -321,7 +321,7 @@ static const struct of_device_id vdoa_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, vdoa_dt_ids);
 
-static const struct platform_driver vdoa_driver = {
+static struct platform_driver vdoa_driver = {
         .probe          = vdoa_probe,
         .remove         = vdoa_remove,
         .driver         = {
diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
index cbb03768f5d7..0f0c389f8897 100644
--- a/drivers/media/platform/exynos-gsc/gsc-core.c
+++ b/drivers/media/platform/exynos-gsc/gsc-core.c
@@ -861,9 +861,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer *vb,
 
         if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) ||
-                (frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) ||
-                (frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) ||
                 (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M))
                 swap(addr->cb, addr->cr);
 
diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
index 823608112d89..7918b928f058 100644
--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
@@ -632,8 +632,8 @@ static int bdisp_open(struct file *file)
 
 error_ctrls:
         bdisp_ctrls_delete(ctx);
-error_fh:
         v4l2_fh_del(&ctx->fh);
+error_fh:
         v4l2_fh_exit(&ctx->fh);
         bdisp_hw_free_nodes(ctx);
 mem_ctx:
diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c
index b4b583f7137a..b4c0f10fc3b0 100644
--- a/drivers/media/platform/vsp1/vsp1_drm.c
+++ b/drivers/media/platform/vsp1/vsp1_drm.c
@@ -54,12 +54,11 @@ EXPORT_SYMBOL_GPL(vsp1_du_init);
 /**
  * vsp1_du_setup_lif - Setup the output part of the VSP pipeline
  * @dev: the VSP device
- * @width: output frame width in pixels
- * @height: output frame height in pixels
+ * @cfg: the LIF configuration
  *
- * Configure the output part of VSP DRM pipeline for the given frame @width and
- * @height. This sets up formats on the BRU source pad, the WPF0 sink and source
- * pads, and the LIF sink pad.
+ * Configure the output part of VSP DRM pipeline for the given frame @cfg.width
+ * and @cfg.height. This sets up formats on the BRU source pad, the WPF0 sink
+ * and source pads, and the LIF sink pad.
  *
  * As the media bus code on the BRU source pad is conditioned by the
  * configuration of the BRU sink 0 pad, we also set up the formats on all BRU
@@ -69,8 +68,7 @@ EXPORT_SYMBOL_GPL(vsp1_du_init);
  *
  * Return 0 on success or a negative error code on failure.
  */
-int vsp1_du_setup_lif(struct device *dev, unsigned int width,
-                      unsigned int height)
+int vsp1_du_setup_lif(struct device *dev, const struct vsp1_du_lif_config *cfg)
 {
         struct vsp1_device *vsp1 = dev_get_drvdata(dev);
         struct vsp1_pipeline *pipe = &vsp1->drm->pipe;
@@ -79,11 +77,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         unsigned int i;
         int ret;
 
-        dev_dbg(vsp1->dev, "%s: configuring LIF with format %ux%u\n",
-                __func__, width, height);
-
-        if (width == 0 || height == 0) {
-                /* Zero width or height means the CRTC is being disabled, stop
+        if (!cfg) {
+                /* NULL configuration means the CRTC is being disabled, stop
                  * the pipeline and turn the light off.
                  */
                 ret = vsp1_pipeline_stop(pipe);
@@ -108,6 +103,9 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
                 return 0;
         }
 
+        dev_dbg(vsp1->dev, "%s: configuring LIF with format %ux%u\n",
+                __func__, cfg->width, cfg->height);
+
         /* Configure the format at the BRU sinks and propagate it through the
          * pipeline.
          */
@@ -117,8 +115,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         for (i = 0; i < bru->entity.source_pad; ++i) {
                 format.pad = i;
 
-                format.format.width = width;
-                format.format.height = height;
+                format.format.width = cfg->width;
+                format.format.height = cfg->height;
                 format.format.code = MEDIA_BUS_FMT_ARGB8888_1X32;
                 format.format.field = V4L2_FIELD_NONE;
 
@@ -133,8 +131,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         }
 
         format.pad = bru->entity.source_pad;
-        format.format.width = width;
-        format.format.height = height;
+        format.format.width = cfg->width;
+        format.format.height = cfg->height;
         format.format.code = MEDIA_BUS_FMT_ARGB8888_1X32;
         format.format.field = V4L2_FIELD_NONE;
 
@@ -180,7 +178,8 @@ int vsp1_du_setup_lif(struct device *dev, unsigned int width,
         /* Verify that the format at the output of the pipeline matches the
          * requested frame size and media bus code.
          */
-        if (format.format.width != width || format.format.height != height ||
+        if (format.format.width != cfg->width ||
+            format.format.height != cfg->height ||
             format.format.code != MEDIA_BUS_FMT_ARGB8888_1X32) {
                 dev_dbg(vsp1->dev, "%s: format mismatch\n", __func__);
                 return -EPIPE;
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index 393dccaabdd0..1688893a65bb 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -436,6 +436,8 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file)
                 return -ERESTARTSYS;
 
         ir = irctls[iminor(inode)];
+        mutex_unlock(&lirc_dev_lock);
+
         if (!ir) {
                 retval = -ENODEV;
                 goto error;
@@ -476,8 +478,6 @@ int lirc_dev_fop_open(struct inode *inode, struct file *file)
         }
 
 error:
-        mutex_unlock(&lirc_dev_lock);
-
         nonseekable_open(inode, file);
 
         return retval;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index b109f8246b96..ec4b25bd2ec2 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -176,12 +176,13 @@ static void nvt_write_wakeup_codes(struct rc_dev *dev,
 {
         u8 tolerance, config;
         struct nvt_dev *nvt = dev->priv;
+        unsigned long flags;
         int i;
 
         /* hardcode the tolerance to 10% */
         tolerance = DIV_ROUND_UP(count, 10);
 
-        spin_lock(&nvt->lock);
+        spin_lock_irqsave(&nvt->lock, flags);
 
         nvt_clear_cir_wake_fifo(nvt);
         nvt_cir_wake_reg_write(nvt, count, CIR_WAKE_FIFO_CMP_DEEP);
@@ -203,7 +204,7 @@ static void nvt_write_wakeup_codes(struct rc_dev *dev,
 
         nvt_cir_wake_reg_write(nvt, config, CIR_WAKE_IRCON);
 
-        spin_unlock(&nvt->lock);
+        spin_unlock_irqrestore(&nvt->lock, flags);
 }
 
 static ssize_t wakeup_data_show(struct device *dev,
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 2424946740e6..d84533699668 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1663,6 +1663,7 @@ static int rc_setup_rx_device(struct rc_dev *dev)
 {
         int rc;
         struct rc_map *rc_map;
+        u64 rc_type;
 
         if (!dev->map_name)
                 return -EINVAL;
@@ -1677,15 +1678,18 @@ static int rc_setup_rx_device(struct rc_dev *dev)
         if (rc)
                 return rc;
 
-        if (dev->change_protocol) {
-                u64 rc_type = (1ll << rc_map->rc_type);
+        rc_type = BIT_ULL(rc_map->rc_type);
 
+        if (dev->change_protocol) {
                 rc = dev->change_protocol(dev, &rc_type);
                 if (rc < 0)
                         goto out_table;
                 dev->enabled_protocols = rc_type;
         }
 
+        if (dev->driver_type == RC_DRIVER_IR_RAW)
+                ir_raw_load_modules(&rc_type);
+
         set_bit(EV_KEY, dev->input_dev->evbit);
         set_bit(EV_REP, dev->input_dev->evbit);
         set_bit(EV_MSC, dev->input_dev->evbit);
@@ -1777,12 +1781,6 @@ int rc_register_device(struct rc_dev *dev)
                 dev->input_name ?: "Unspecified device", path ?: "N/A");
         kfree(path);
 
-        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                rc = rc_setup_rx_device(dev);
-                if (rc)
-                        goto out_dev;
-        }
-
         if (dev->driver_type == RC_DRIVER_IR_RAW ||
             dev->driver_type == RC_DRIVER_IR_RAW_TX) {
                 if (!raw_init) {
@@ -1791,7 +1789,13 @@ int rc_register_device(struct rc_dev *dev)
                 }
                 rc = ir_raw_event_register(dev);
                 if (rc < 0)
-                        goto out_rx;
+                        goto out_dev;
+        }
+
+        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
+                rc = rc_setup_rx_device(dev);
+                if (rc)
+                        goto out_raw;
         }
 
         /* Allow the RC sysfs nodes to be accessible */
@@ -1803,8 +1807,8 @@ int rc_register_device(struct rc_dev *dev)
 
         return 0;
 
-out_rx:
-        rc_free_rx_device(dev);
+out_raw:
+        ir_raw_event_unregister(dev);
 out_dev:
         device_del(&dev->dev);
 out_unlock:
diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 923fb2299553..41b54e40176c 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -487,10 +487,69 @@ static void serial_ir_timeout(unsigned long arg)
         ir_raw_event_handle(serial_ir.rcdev);
 }
 
+/* Needed by serial_ir_probe() */
+static int serial_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+                        unsigned int count);
+static int serial_ir_tx_duty_cycle(struct rc_dev *dev, u32 cycle);
+static int serial_ir_tx_carrier(struct rc_dev *dev, u32 carrier);
+static int serial_ir_open(struct rc_dev *rcdev);
+static void serial_ir_close(struct rc_dev *rcdev);
+
 static int serial_ir_probe(struct platform_device *dev)
 {
+        struct rc_dev *rcdev;
         int i, nlow, nhigh, result;
 
+        rcdev = devm_rc_allocate_device(&dev->dev, RC_DRIVER_IR_RAW);
+        if (!rcdev)
+                return -ENOMEM;
+
+        if (hardware[type].send_pulse && hardware[type].send_space)
+                rcdev->tx_ir = serial_ir_tx;
+        if (hardware[type].set_send_carrier)
+                rcdev->s_tx_carrier = serial_ir_tx_carrier;
+        if (hardware[type].set_duty_cycle)
+                rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
+
+        switch (type) {
+        case IR_HOMEBREW:
+                rcdev->input_name = "Serial IR type home-brew";
+                break;
+        case IR_IRDEO:
+                rcdev->input_name = "Serial IR type IRdeo";
+                break;
+        case IR_IRDEO_REMOTE:
+                rcdev->input_name = "Serial IR type IRdeo remote";
+                break;
+        case IR_ANIMAX:
+                rcdev->input_name = "Serial IR type AnimaX";
+                break;
+        case IR_IGOR:
+                rcdev->input_name = "Serial IR type IgorPlug";
+                break;
+        }
+
+        rcdev->input_phys = KBUILD_MODNAME "/input0";
+        rcdev->input_id.bustype = BUS_HOST;
+        rcdev->input_id.vendor = 0x0001;
+        rcdev->input_id.product = 0x0001;
+        rcdev->input_id.version = 0x0100;
+        rcdev->open = serial_ir_open;
+        rcdev->close = serial_ir_close;
+        rcdev->dev.parent = &serial_ir.pdev->dev;
+        rcdev->allowed_protocols = RC_BIT_ALL_IR_DECODER;
+        rcdev->driver_name = KBUILD_MODNAME;
+        rcdev->map_name = RC_MAP_RC6_MCE;
+        rcdev->min_timeout = 1;
+        rcdev->timeout = IR_DEFAULT_TIMEOUT;
+        rcdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
+        rcdev->rx_resolution = 250000;
+
+        serial_ir.rcdev = rcdev;
+
+        setup_timer(&serial_ir.timeout_timer, serial_ir_timeout,
+                    (unsigned long)&serial_ir);
+
         result = devm_request_irq(&dev->dev, irq, serial_ir_irq_handler,
                                   share_irq ? IRQF_SHARED : 0,
                                   KBUILD_MODNAME, &hardware);
@@ -516,9 +575,6 @@ static int serial_ir_probe(struct platform_device *dev)
                 return -EBUSY;
         }
 
-        setup_timer(&serial_ir.timeout_timer, serial_ir_timeout,
-                    (unsigned long)&serial_ir);
-
         result = hardware_init_port();
         if (result < 0)
                 return result;
@@ -552,7 +608,8 @@ static int serial_ir_probe(struct platform_device *dev)
                          sense ? "low" : "high");
 
         dev_dbg(&dev->dev, "Interrupt %d, port %04x obtained\n", irq, io);
-        return 0;
+
+        return devm_rc_register_device(&dev->dev, rcdev);
 }
 
 static int serial_ir_open(struct rc_dev *rcdev)
@@ -723,7 +780,6 @@ static void serial_ir_exit(void)
 
 static int __init serial_ir_init_module(void)
 {
-        struct rc_dev *rcdev;
         int result;
 
         switch (type) {
@@ -754,63 +810,9 @@ static int __init serial_ir_init_module(void)
                 sense = !!sense;
 
         result = serial_ir_init();
-        if (result)
-                return result;
-
-        rcdev = devm_rc_allocate_device(&serial_ir.pdev->dev, RC_DRIVER_IR_RAW);
-        if (!rcdev) {
-                result = -ENOMEM;
-                goto serial_cleanup;
-        }
-
-        if (hardware[type].send_pulse && hardware[type].send_space)
-                rcdev->tx_ir = serial_ir_tx;
-        if (hardware[type].set_send_carrier)
-                rcdev->s_tx_carrier = serial_ir_tx_carrier;
-        if (hardware[type].set_duty_cycle)
-                rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
-
-        switch (type) {
-        case IR_HOMEBREW:
-                rcdev->input_name = "Serial IR type home-brew";
-                break;
-        case IR_IRDEO:
-                rcdev->input_name = "Serial IR type IRdeo";
-                break;
-        case IR_IRDEO_REMOTE:
-                rcdev->input_name = "Serial IR type IRdeo remote";
-                break;
-        case IR_ANIMAX:
-                rcdev->input_name = "Serial IR type AnimaX";
-                break;
-        case IR_IGOR:
-                rcdev->input_name = "Serial IR type IgorPlug";
-                break;
-        }
-
-        rcdev->input_phys = KBUILD_MODNAME "/input0";
-        rcdev->input_id.bustype = BUS_HOST;
-        rcdev->input_id.vendor = 0x0001;
-        rcdev->input_id.product = 0x0001;
-        rcdev->input_id.version = 0x0100;
-        rcdev->open = serial_ir_open;
-        rcdev->close = serial_ir_close;
-        rcdev->dev.parent = &serial_ir.pdev->dev;
-        rcdev->allowed_protocols = RC_BIT_ALL_IR_DECODER;
-        rcdev->driver_name = KBUILD_MODNAME;
-        rcdev->map_name = RC_MAP_RC6_MCE;
-        rcdev->min_timeout = 1;
-        rcdev->timeout = IR_DEFAULT_TIMEOUT;
-        rcdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
-        rcdev->rx_resolution = 250000;
-
-        serial_ir.rcdev = rcdev;
-
-        result = rc_register_device(rcdev);
-
         if (!result)
                 return 0;
-serial_cleanup:
+
         serial_ir_exit();
         return result;
 }
@@ -818,7 +820,6 @@ serial_cleanup:
 static void __exit serial_ir_exit_module(void)
 {
         del_timer_sync(&serial_ir.timeout_timer);
-        rc_unregister_device(serial_ir.rcdev);
         serial_ir_exit();
 }
 
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
index ab9866024ec7..04033efe7ad5 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
 int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
 {
         struct hexline *hx;
-        u8 reset;
-        int ret,pos=0;
+        u8 *buf;
+        int ret, pos = 0;
+        u16 cpu_cs_register = cypress[type].cpu_cs_register;
 
-        hx = kmalloc(sizeof(*hx), GFP_KERNEL);
-        if (!hx)
+        buf = kmalloc(sizeof(*hx), GFP_KERNEL);
+        if (!buf)
                 return -ENOMEM;
+        hx = (struct hexline *)buf;
 
         /* stop the CPU */
-        reset = 1;
-        if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
+        buf[0] = 1;
+        if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
                 err("could not stop the USB controller CPU.");
 
         while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
@@ -61,21 +63,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw
         }
         if (ret < 0) {
                 err("firmware download failed at %d with %d",pos,ret);
-                kfree(hx);
+                kfree(buf);
                 return ret;
         }
 
         if (ret == 0) {
                 /* restart the CPU */
-                reset = 0;
-                if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
+                buf[0] = 0;
+                if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
                         err("could not restart the USB controller CPU.");
                         ret = -EINVAL;
                 }
         } else
                 ret = -EIO;
 
-        kfree(hx);
+        kfree(buf);
 
         return ret;
 }
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 6ca502d834b4..4f42d57f81d9 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -68,6 +68,7 @@
 struct dw2102_state {
         u8 initialized;
         u8 last_lock;
+        u8 data[MAX_XFER_SIZE + 4];
         struct i2c_client *i2c_client_demod;
         struct i2c_client *i2c_client_tuner;
 
@@ -661,62 +662,72 @@ static int su3000_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                                                 int num)
 {
         struct dvb_usb_device *d = i2c_get_adapdata(adap);
-        u8 obuf[0x40], ibuf[0x40];
+        struct dw2102_state *state;
 
         if (!d)
                 return -ENODEV;
+
+        state = d->priv;
+
         if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
                 return -EAGAIN;
+        if (mutex_lock_interruptible(&d->data_mutex) < 0) {
+                mutex_unlock(&d->i2c_mutex);
+                return -EAGAIN;
+        }
 
         switch (num) {
         case 1:
                 switch (msg[0].addr) {
                 case SU3000_STREAM_CTRL:
-                        obuf[0] = msg[0].buf[0] + 0x36;
-                        obuf[1] = 3;
-                        obuf[2] = 0;
-                        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 0, 0) < 0)
+                        state->data[0] = msg[0].buf[0] + 0x36;
+                        state->data[1] = 3;
+                        state->data[2] = 0;
+                        if (dvb_usb_generic_rw(d, state->data, 3,
+                                        state->data, 0, 0) < 0)
                                 err("i2c transfer failed.");
                         break;
                 case DW2102_RC_QUERY:
-                        obuf[0] = 0x10;
-                        if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 2, 0) < 0)
+                        state->data[0] = 0x10;
+                        if (dvb_usb_generic_rw(d, state->data, 1,
+                                        state->data, 2, 0) < 0)
                                 err("i2c transfer failed.");
-                        msg[0].buf[1] = ibuf[0];
-                        msg[0].buf[0] = ibuf[1];
+                        msg[0].buf[1] = state->data[0];
+                        msg[0].buf[0] = state->data[1];
                         break;
                 default:
                         /* always i2c write*/
-                        obuf[0] = 0x08;
-                        obuf[1] = msg[0].addr;
-                        obuf[2] = msg[0].len;
+                        state->data[0] = 0x08;
+                        state->data[1] = msg[0].addr;
+                        state->data[2] = msg[0].len;
 
-                        memcpy(&obuf[3], msg[0].buf, msg[0].len);
+                        memcpy(&state->data[3], msg[0].buf, msg[0].len);
 
-                        if (dvb_usb_generic_rw(d, obuf, msg[0].len + 3,
-                                                ibuf, 1, 0) < 0)
+                        if (dvb_usb_generic_rw(d, state->data, msg[0].len + 3,
+                                                state->data, 1, 0) < 0)
                                 err("i2c transfer failed.");
 
                 }
                 break;
         case 2:
                 /* always i2c read */
-                obuf[0] = 0x09;
-                obuf[1] = msg[0].len;
-                obuf[2] = msg[1].len;
-                obuf[3] = msg[0].addr;
-                memcpy(&obuf[4], msg[0].buf, msg[0].len);
-
-                if (dvb_usb_generic_rw(d, obuf, msg[0].len + 4,
-                                        ibuf, msg[1].len + 1, 0) < 0)
+                state->data[0] = 0x09;
+                state->data[1] = msg[0].len;
+                state->data[2] = msg[1].len;
+                state->data[3] = msg[0].addr;
+                memcpy(&state->data[4], msg[0].buf, msg[0].len);
+
+                if (dvb_usb_generic_rw(d, state->data, msg[0].len + 4,
+                                        state->data, msg[1].len + 1, 0) < 0)
                         err("i2c transfer failed.");
 
-                memcpy(msg[1].buf, &ibuf[1], msg[1].len);
+                memcpy(msg[1].buf, &state->data[1], msg[1].len);
                 break;
         default:
                 warn("more than 2 i2c messages at a time is not handled yet.");
                 break;
         }
+        mutex_unlock(&d->data_mutex);
         mutex_unlock(&d->i2c_mutex);
         return num;
 }
@@ -844,17 +855,23 @@ static int su3000_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 static int su3000_power_ctrl(struct dvb_usb_device *d, int i)
 {
         struct dw2102_state *state = (struct dw2102_state *)d->priv;
-        u8 obuf[] = {0xde, 0};
+        int ret = 0;
 
         info("%s: %d, initialized %d", __func__, i, state->initialized);
 
         if (i && !state->initialized) {
+                mutex_lock(&d->data_mutex);
+
+                state->data[0] = 0xde;
+                state->data[1] = 0;
+
                 state->initialized = 1;
                 /* reset board */
-                return dvb_usb_generic_rw(d, obuf, 2, NULL, 0, 0);
+                ret = dvb_usb_generic_rw(d, state->data, 2, NULL, 0, 0);
+                mutex_unlock(&d->data_mutex);
         }
 
-        return 0;
+        return ret;
 }
 
 static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
@@ -1309,49 +1326,57 @@ static int prof_7500_frontend_attach(struct dvb_usb_adapter *d)
         return 0;
 }
 
-static int su3000_frontend_attach(struct dvb_usb_adapter *d)
+static int su3000_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[3] = { 0xe, 0x80, 0 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
+
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x02;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x02;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
         msleep(300);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config,
-                                        &d->dev->i2c_adap);
-        if (d->fe_adap[0].fe == NULL)
+        mutex_unlock(&d->data_mutex);
+
+        adap->fe_adap[0].fe = dvb_attach(ds3000_attach, &su3000_ds3000_config,
+                                        &d->i2c_adap);
+        if (adap->fe_adap[0].fe == NULL)
                 return -EIO;
 
-        if (dvb_attach(ts2020_attach, d->fe_adap[0].fe,
+        if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe,
                                 &dw2104_ts2020_config,
-                                &d->dev->i2c_adap)) {
+                                &d->i2c_adap)) {
                 info("Attached DS3000/TS2020!");
                 return 0;
         }
@@ -1360,47 +1385,55 @@ static int su3000_frontend_attach(struct dvb_usb_adapter *d)
         return -EIO;
 }
 
-static int t220_frontend_attach(struct dvb_usb_adapter *d)
+static int t220_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[3] = { 0xe, 0x87, 0 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        state->data[0] = 0xe;
+        state->data[1] = 0x87;
+        state->data[2] = 0x0;
+
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x86;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x86;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x80;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
         msleep(50);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x80;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config,
-                                        &d->dev->i2c_adap, NULL);
-        if (d->fe_adap[0].fe != NULL) {
-                if (dvb_attach(tda18271_attach, d->fe_adap[0].fe, 0x60,
-                                        &d->dev->i2c_adap, &tda18271_config)) {
+        mutex_unlock(&d->data_mutex);
+
+        adap->fe_adap[0].fe = dvb_attach(cxd2820r_attach, &cxd2820r_config,
+                                        &d->i2c_adap, NULL);
+        if (adap->fe_adap[0].fe != NULL) {
+                if (dvb_attach(tda18271_attach, adap->fe_adap[0].fe, 0x60,
+                                        &d->i2c_adap, &tda18271_config)) {
                         info("Attached TDA18271HD/CXD2820R!");
                         return 0;
                 }
@@ -1410,23 +1443,30 @@ static int t220_frontend_attach(struct dvb_usb_adapter *d)
         return -EIO;
 }
 
-static int m88rs2000_frontend_attach(struct dvb_usb_adapter *d)
+static int m88rs2000_frontend_attach(struct dvb_usb_adapter *adap)
 {
-        u8 obuf[] = { 0x51 };
-        u8 ibuf[] = { 0 };
+        struct dvb_usb_device *d = adap->dev;
+        struct dw2102_state *state = d->priv;
+
+        mutex_lock(&d->data_mutex);
 
-        if (dvb_usb_generic_rw(d->dev, obuf, 1, ibuf, 1, 0) < 0)
+        state->data[0] = 0x51;
+
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
-        d->fe_adap[0].fe = dvb_attach(m88rs2000_attach, &s421_m88rs2000_config,
-                                        &d->dev->i2c_adap);
+        mutex_unlock(&d->data_mutex);
 
-        if (d->fe_adap[0].fe == NULL)
+        adap->fe_adap[0].fe = dvb_attach(m88rs2000_attach,
+                                        &s421_m88rs2000_config,
+                                        &d->i2c_adap);
+
+        if (adap->fe_adap[0].fe == NULL)
                 return -EIO;
 
-        if (dvb_attach(ts2020_attach, d->fe_adap[0].fe,
+        if (dvb_attach(ts2020_attach, adap->fe_adap[0].fe,
                                 &dw2104_ts2020_config,
-                                &d->dev->i2c_adap)) {
+                                &d->i2c_adap)) {
                 info("Attached RS2000/TS2020!");
                 return 0;
         }
@@ -1439,44 +1479,50 @@ static int tt_s2_4600_frontend_attach(struct dvb_usb_adapter *adap)
 {
         struct dvb_usb_device *d = adap->dev;
         struct dw2102_state *state = d->priv;
-        u8 obuf[3] = { 0xe, 0x80, 0 };
-        u8 ibuf[] = { 0 };
         struct i2c_adapter *i2c_adapter;
         struct i2c_client *client;
         struct i2c_board_info board_info;
         struct m88ds3103_platform_data m88ds3103_pdata = {};
         struct ts2020_config ts2020_config = {};
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        mutex_lock(&d->data_mutex);
+
+        state->data[0] = 0xe;
+        state->data[1] = 0x80;
+        state->data[2] = 0x0;
+
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x02;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x02;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
         msleep(300);
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 0;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 0;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0xe;
-        obuf[1] = 0x83;
-        obuf[2] = 1;
+        state->data[0] = 0xe;
+        state->data[1] = 0x83;
+        state->data[2] = 1;
 
-        if (dvb_usb_generic_rw(d, obuf, 3, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 3, state->data, 1, 0) < 0)
                 err("command 0x0e transfer failed.");
 
-        obuf[0] = 0x51;
+        state->data[0] = 0x51;
 
-        if (dvb_usb_generic_rw(d, obuf, 1, ibuf, 1, 0) < 0)
+        if (dvb_usb_generic_rw(d, state->data, 1, state->data, 1, 0) < 0)
                 err("command 0x51 transfer failed.");
 
+        mutex_unlock(&d->data_mutex);
+
         /* attach demod */
         m88ds3103_pdata.clk = 27000000;
         m88ds3103_pdata.i2c_wr_max = 33;
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 5457c361ad58..bf0fe0137dfe 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -1947,9 +1947,7 @@ static int gpmc_probe_onenand_child(struct platform_device *pdev,
         if (!of_property_read_u32(child, "dma-channel", &val))
                 gpmc_onenand_data->dma_channel = val;
 
-        gpmc_onenand_init(gpmc_onenand_data);
-
-        return 0;
+        return gpmc_onenand_init(gpmc_onenand_data);
 }
 #else
 static int gpmc_probe_onenand_child(struct platform_device *pdev,
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 91f645992c94..b27ea98b781f 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1792,15 +1792,14 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
 
         /* If we're permanently dead, give up. */
         if (state == pci_channel_io_perm_failure) {
-                /* Tell the AFU drivers; but we don't care what they
-                 * say, we're going away.
-                 */
                 for (i = 0; i < adapter->slices; i++) {
                         afu = adapter->afu[i];
-                        /* Only participate in EEH if we are on a virtual PHB */
-                        if (afu->phb == NULL)
-                                return PCI_ERS_RESULT_NONE;
-                        cxl_vphb_error_detected(afu, state);
+                        /*
+                         * Tell the AFU drivers; but we don't care what they
+                         * say, we're going away.
+                         */
+                        if (afu->phb != NULL)
+                                cxl_vphb_error_detected(afu, state);
                 }
                 return PCI_ERS_RESULT_DISCONNECT;
         }
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index 3600c9993a98..29f2daed37e0 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -112,11 +112,9 @@ struct mkhi_msg {
 
 static int mei_osver(struct mei_cl_device *cldev)
 {
-        int ret;
         const size_t size = sizeof(struct mkhi_msg_hdr) +
                             sizeof(struct mkhi_fwcaps) +
                             sizeof(struct mei_os_ver);
-        size_t length = 8;
         char buf[size];
         struct mkhi_msg *req;
         struct mkhi_fwcaps *fwcaps;
@@ -137,15 +135,7 @@ static int mei_osver(struct mei_cl_device *cldev)
         os_ver = (struct mei_os_ver *)fwcaps->data;
         os_ver->os_type = OSTYPE_LINUX;
 
-        ret = __mei_cl_send(cldev->cl, buf, size, mode);
-        if (ret < 0)
-                return ret;
-
-        ret = __mei_cl_recv(cldev->cl, buf, length, 0);
-        if (ret < 0)
-                return ret;
-
-        return 0;
+        return __mei_cl_send(cldev->cl, buf, size, mode);
 }
 
 static void mei_mkhi_fix(struct mei_cl_device *cldev)
@@ -160,7 +150,7 @@ static void mei_mkhi_fix(struct mei_cl_device *cldev)
                 return;
 
         ret = mei_osver(cldev);
-        if (ret)
+        if (ret < 0)
                 dev_err(&cldev->dev, "OS version command failed %d\n", ret);
 
         mei_cldev_disable(cldev);
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index cfb1cdf176fa..13c55b8f9261 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -124,8 +124,6 @@ int mei_reset(struct mei_device *dev)
 
         mei_clear_interrupts(dev);
 
-        mei_synchronize_irq(dev);
-
         /* we're already in reset, cancel the init timer
          * if the reset was called due the hbm protocol error
          * we need to call it before hw start
@@ -304,6 +302,9 @@ static void mei_reset_work(struct work_struct *work)
                 container_of(work, struct mei_device,  reset_work);
         int ret;
 
+        mei_clear_interrupts(dev);
+        mei_synchronize_irq(dev);
+
         mutex_lock(&dev->device_lock);
 
         ret = mei_reset(dev);
@@ -328,6 +329,9 @@ void mei_stop(struct mei_device *dev)
 
         mei_cancel_work(dev);
 
+        mei_clear_interrupts(dev);
+        mei_synchronize_irq(dev);
+
         mutex_lock(&dev->device_lock);
 
         dev->dev_state = MEI_DEV_POWER_DOWN;
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 6fb773dbcd0c..93be82fc338a 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -219,15 +219,20 @@ static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
         int write, unsigned long *paddr, int *pageshift)
 {
         pgd_t *pgdp;
-        pmd_t *pmdp;
+        p4d_t *p4dp;
         pud_t *pudp;
+        pmd_t *pmdp;
         pte_t pte;
 
         pgdp = pgd_offset(vma->vm_mm, vaddr);
         if (unlikely(pgd_none(*pgdp)))
                 goto err;
 
-        pudp = pud_offset(pgdp, vaddr);
+        p4dp = p4d_offset(pgdp, vaddr);
+        if (unlikely(p4d_none(*p4dp)))
+                goto err;
+
+        pudp = pud_offset(p4dp, vaddr);
         if (unlikely(pud_none(*pudp)))
                 goto err;
 
diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index 9d659542a335..dad5abee656e 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -566,10 +566,10 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
          */
         error = pci_alloc_irq_vectors(pdev, VMCI_MAX_INTRS, VMCI_MAX_INTRS,
                         PCI_IRQ_MSIX);
-        if (error) {
+        if (error < 0) {
                 error = pci_alloc_irq_vectors(pdev, 1, 1,
                                 PCI_IRQ_MSIX | PCI_IRQ_MSI | PCI_IRQ_LEGACY);
-                if (error)
+                if (error < 0)
                         goto err_remove_bitmap;
         } else {
                 vmci_dev->exclusive_vectors = true;
diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 1621fa08e206..ff3da960c473 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -1560,11 +1560,8 @@ static bool mmc_blk_rw_cmd_err(struct mmc_blk_data *md, struct mmc_card *card,
                                struct mmc_blk_request *brq, struct request *req,
                                bool old_req_pending)
 {
-        struct mmc_queue_req *mq_rq;
         bool req_pending;
 
-        mq_rq = container_of(brq, struct mmc_queue_req, brq);
-
         /*
          * If this is an SD card and we're writing, we can first
          * mark the known good sectors as ok.
@@ -1701,7 +1698,8 @@ static void mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *new_req)
                 case MMC_BLK_CMD_ERR:
                         req_pending = mmc_blk_rw_cmd_err(md, card, brq, old_req, req_pending);
                         if (mmc_blk_reset(md, card->host, type)) {
-                                mmc_blk_rw_cmd_abort(card, old_req);
+                                if (req_pending)
+                                        mmc_blk_rw_cmd_abort(card, old_req);
                                 mmc_blk_rw_try_restart(mq, new_req);
                                 return;
                         }
@@ -1817,6 +1815,7 @@ void mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 mmc_blk_issue_flush(mq, req);
         } else {
                 mmc_blk_issue_rw_rq(mq, req);
+                card->host->context_info.is_waiting_last_req = false;
         }
 
 out:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 7fd722868875..b502601df228 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1730,7 +1730,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                 err = mmc_select_hs400(card);
                 if (err)
                         goto free_card;
-        } else {
+        } else if (!mmc_card_hs400es(card)) {
                 /* Select the desired bus width optionally */
                 err = mmc_select_bus_width(card);
                 if (err > 0 && mmc_card_hs(card)) {
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index e992a7f8a16f..2b32b88949ba 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -267,7 +267,7 @@ static void sdio_release_func(struct device *dev)
         sdio_free_func_cis(func);
 
         kfree(func->info);
-
+        kfree(func->tmpbuf);
         kfree(func);
 }
 
@@ -282,6 +282,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
         if (!func)
                 return ERR_PTR(-ENOMEM);
 
+        /*
+         * allocate buffer separately to make sure it's properly aligned for
+         * DMA usage (incl. 64 bit DMA)
+         */
+        func->tmpbuf = kmalloc(4, GFP_KERNEL);
+        if (!func->tmpbuf) {
+                kfree(func);
+                return ERR_PTR(-ENOMEM);
+        }
+
         func->card = card;
 
         device_initialize(&func->dev);
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index a9ac0b457313..8718432751c5 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -22,6 +22,7 @@
 #include <linux/ioport.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/stat.h>
@@ -1621,10 +1622,16 @@ static void dw_mci_init_card(struct mmc_host *mmc, struct mmc_card *card)
 
                 if (card->type == MMC_TYPE_SDIO ||
                     card->type == MMC_TYPE_SD_COMBO) {
-                        set_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        if (!test_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags)) {
+                                pm_runtime_get_noresume(mmc->parent);
+                                set_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        }
                         clk_en_a = clk_en_a_old & ~clken_low_pwr;
                 } else {
-                        clear_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        if (test_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags)) {
+                                pm_runtime_put_noidle(mmc->parent);
+                                clear_bit(DW_MMC_CARD_NO_LOW_PWR, &slot->flags);
+                        }
                         clk_en_a = clk_en_a_old | clken_low_pwr;
                 }
 
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 8e32580c12b5..b235d8da0602 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -580,7 +580,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz)
                 }
         }
         sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD | MSDC_CFG_CKDIV,
-                        (mode << 8) | (div % 0xff));
+                      (mode << 8) | div);
         sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN);
         while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB))
                 cpu_relax();
@@ -1559,7 +1559,7 @@ static int msdc_drv_probe(struct platform_device *pdev)
         host->src_clk_freq = clk_get_rate(host->src_clk);
         /* Set host parameters to mmc */
         mmc->ops = &mt_msdc_ops;
-        mmc->f_min = host->src_clk_freq / (4 * 255);
+        mmc->f_min = DIV_ROUND_UP(host->src_clk_freq, 4 * 255);
 
         mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23;
         /* MMC core transfer sizes tunable parameters */
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index 7123ef96ed18..445fc47dc3e7 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -830,6 +830,7 @@ static int esdhc_change_pinstate(struct sdhci_host *host,
 
         switch (uhs) {
         case MMC_TIMING_UHS_SDR50:
+        case MMC_TIMING_UHS_DDR50:
                 pinctrl = imx_data->pins_100mhz;
                 break;
         case MMC_TIMING_UHS_SDR104:
diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index 410a55b1c25f..1cfd7f900339 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -28,13 +28,9 @@
 #include "sdhci-pltfm.h"
 #include <linux/of.h>
 
-#define SDHCI_ARASAN_CLK_CTRL_OFFSET    0x2c
 #define SDHCI_ARASAN_VENDOR_REGISTER    0x78
 
 #define VENDOR_ENHANCED_STROBE          BIT(0)
-#define CLK_CTRL_TIMEOUT_SHIFT          16
-#define CLK_CTRL_TIMEOUT_MASK           (0xf << CLK_CTRL_TIMEOUT_SHIFT)
-#define CLK_CTRL_TIMEOUT_MIN_EXP        13
 
 #define PHY_CLK_TOO_SLOW_HZ             400000
 
@@ -163,15 +159,15 @@ static int sdhci_arasan_syscon_write(struct sdhci_host *host,
 
 static unsigned int sdhci_arasan_get_timeout_clock(struct sdhci_host *host)
 {
-        u32 div;
         unsigned long freq;
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        div = readl(host->ioaddr + SDHCI_ARASAN_CLK_CTRL_OFFSET);
-        div = (div & CLK_CTRL_TIMEOUT_MASK) >> CLK_CTRL_TIMEOUT_SHIFT;
+        /* SDHCI timeout clock is in kHz */
+        freq = DIV_ROUND_UP(clk_get_rate(pltfm_host->clk), 1000);
 
-        freq = clk_get_rate(pltfm_host->clk);
-        freq /= 1 << (CLK_CTRL_TIMEOUT_MIN_EXP + div);
+        /* or in MHz */
+        if (host->caps & SDHCI_TIMEOUT_CLK_UNIT)
+                freq = DIV_ROUND_UP(freq, 1000);
 
         return freq;
 }
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 2f9ad213377a..d5430ed02a67 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -29,6 +29,8 @@
 
 #include "sdhci-pltfm.h"
 
+#define SDMMC_MC1R      0x204
+#define         SDMMC_MC1R_DDR          BIT(3)
 #define SDMMC_CACR      0x230
 #define         SDMMC_CACR_CAPWREN      BIT(0)
 #define         SDMMC_CACR_KEY          (0x46 << 8)
@@ -85,11 +87,37 @@ static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
         sdhci_writew(host, clk, SDHCI_CLOCK_CONTROL);
 }
 
+/*
+ * In this specific implementation of the SDHCI controller, the power register
+ * needs to have a valid voltage set even when the power supply is managed by
+ * an external regulator.
+ */
+static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode,
+                     unsigned short vdd)
+{
+        if (!IS_ERR(host->mmc->supply.vmmc)) {
+                struct mmc_host *mmc = host->mmc;
+
+                spin_unlock_irq(&host->lock);
+                mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+                spin_lock_irq(&host->lock);
+        }
+        sdhci_set_power_noreg(host, mode, vdd);
+}
+
+void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int timing)
+{
+        if (timing == MMC_TIMING_MMC_DDR52)
+                sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R);
+        sdhci_set_uhs_signaling(host, timing);
+}
+
 static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
         .set_clock              = sdhci_at91_set_clock,
         .set_bus_width          = sdhci_set_bus_width,
         .reset                  = sdhci_reset,
-        .set_uhs_signaling      = sdhci_set_uhs_signaling,
+        .set_uhs_signaling      = sdhci_at91_set_uhs_signaling,
+        .set_power              = sdhci_at91_set_power,
 };
 
 static const struct sdhci_pltfm_data soc_data_sama5d2 = {
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 982b3e349426..86560d590786 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -451,6 +451,8 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
         if (mode == MMC_POWER_OFF)
                 return;
 
+        spin_unlock_irq(&host->lock);
+
         /*
          * Bus power might not enable after D3 -> D0 transition due to the
          * present state not yet having propagated. Retry for up to 2ms.
@@ -463,6 +465,8 @@ static void sdhci_intel_set_power(struct sdhci_host *host, unsigned char mode,
                 reg |= SDHCI_POWER_ON;
                 sdhci_writeb(host, reg, SDHCI_POWER_CONTROL);
         }
+
+        spin_lock_irq(&host->lock);
 }
 
 static const struct sdhci_ops sdhci_intel_byt_ops = {
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6fdd7a70f229..63bc33a54d0d 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1362,7 +1362,9 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
                         return;
                 }
                 timeout--;
-                mdelay(1);
+                spin_unlock_irq(&host->lock);
+                usleep_range(900, 1100);
+                spin_lock_irq(&host->lock);
         }
 
         clk |= SDHCI_CLOCK_CARD_EN;
@@ -1828,6 +1830,9 @@ static void sdhci_enable_sdio_irq(struct mmc_host *mmc, int enable)
         struct sdhci_host *host = mmc_priv(mmc);
         unsigned long flags;
 
+        if (enable)
+                pm_runtime_get_noresume(host->mmc->parent);
+
         spin_lock_irqsave(&host->lock, flags);
         if (enable)
                 host->flags |= SDHCI_SDIO_IRQ_ENABLED;
@@ -1836,6 +1841,9 @@ static void sdhci_enable_sdio_irq(struct mmc_host *mmc, int enable)
 
         sdhci_enable_sdio_irq_nolock(host, enable);
         spin_unlock_irqrestore(&host->lock, flags);
+
+        if (!enable)
+                pm_runtime_put_noidle(host->mmc->parent);
 }
 
 static int sdhci_start_signal_voltage_switch(struct mmc_host *mmc,
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index d2c386f09d69..1d843357422e 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -426,6 +426,9 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct ushc_data *ushc;
         int ret;
 
+        if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev);
         if (mmc == NULL)
                 return -ENOMEM;
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 1ae872bfc3ba..747645c74134 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -186,7 +186,7 @@ static inline int write_enable(struct spi_nor *nor)
 }
 
 /*
- * Send write disble instruction to the chip.
+ * Send write disable instruction to the chip.
  */
 static inline int write_disable(struct spi_nor *nor)
 {
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 0134ba32a057..39712560b4c1 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -148,11 +148,11 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
                         return err;
         }
 
-        if (bytes == 0) {
-                err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL);
-                if (err)
-                        return err;
+        err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL);
+        if (err)
+                return err;
 
+        if (bytes == 0) {
                 err = clear_update_marker(ubi, vol, 0);
                 if (err)
                         return err;
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 138f5ae75c0b..4d1fe8d95042 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -557,7 +557,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
         int work_done = 0;
 
         u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
-        u32 rxstcmd = readl(priv->base + IFI_CANFD_STCMD);
+        u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
         u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
 
         /* Handle bus state changes */
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index caed4e6960f8..11662f479e76 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -826,8 +826,7 @@ static int rcar_can_probe(struct platform_device *pdev)
 
         devm_can_led_init(ndev);
 
-        dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
-                 priv->regs, ndev->irq);
+        dev_info(&pdev->dev, "device registered (IRQ%d)\n", ndev->irq);
 
         return 0;
 fail_candev:
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index 8a280e7d66bd..127adbeefb10 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -984,29 +984,29 @@
 #define XP_ECC_CNT1_DESC_DED_WIDTH              8
 #define XP_ECC_CNT1_DESC_SEC_INDEX              0
 #define XP_ECC_CNT1_DESC_SEC_WIDTH              8
-#define XP_ECC_IER_DESC_DED_INDEX               0
+#define XP_ECC_IER_DESC_DED_INDEX               5
 #define XP_ECC_IER_DESC_DED_WIDTH               1
-#define XP_ECC_IER_DESC_SEC_INDEX               1
+#define XP_ECC_IER_DESC_SEC_INDEX               4
 #define XP_ECC_IER_DESC_SEC_WIDTH               1
-#define XP_ECC_IER_RX_DED_INDEX                 2
+#define XP_ECC_IER_RX_DED_INDEX                 3
 #define XP_ECC_IER_RX_DED_WIDTH                 1
-#define XP_ECC_IER_RX_SEC_INDEX                 3
+#define XP_ECC_IER_RX_SEC_INDEX                 2
 #define XP_ECC_IER_RX_SEC_WIDTH                 1
-#define XP_ECC_IER_TX_DED_INDEX                 4
+#define XP_ECC_IER_TX_DED_INDEX                 1
 #define XP_ECC_IER_TX_DED_WIDTH                 1
-#define XP_ECC_IER_TX_SEC_INDEX                 5
+#define XP_ECC_IER_TX_SEC_INDEX                 0
 #define XP_ECC_IER_TX_SEC_WIDTH                 1
-#define XP_ECC_ISR_DESC_DED_INDEX               0
+#define XP_ECC_ISR_DESC_DED_INDEX               5
 #define XP_ECC_ISR_DESC_DED_WIDTH               1
-#define XP_ECC_ISR_DESC_SEC_INDEX               1
+#define XP_ECC_ISR_DESC_SEC_INDEX               4
 #define XP_ECC_ISR_DESC_SEC_WIDTH               1
-#define XP_ECC_ISR_RX_DED_INDEX                 2
+#define XP_ECC_ISR_RX_DED_INDEX                 3
 #define XP_ECC_ISR_RX_DED_WIDTH                 1
-#define XP_ECC_ISR_RX_SEC_INDEX                 3
+#define XP_ECC_ISR_RX_SEC_INDEX                 2
 #define XP_ECC_ISR_RX_SEC_WIDTH                 1
-#define XP_ECC_ISR_TX_DED_INDEX                 4
+#define XP_ECC_ISR_TX_DED_INDEX                 1
 #define XP_ECC_ISR_TX_DED_WIDTH                 1
-#define XP_ECC_ISR_TX_SEC_INDEX                 5
+#define XP_ECC_ISR_TX_SEC_INDEX                 0
 #define XP_ECC_ISR_TX_SEC_WIDTH                 1
 #define XP_I2C_MUTEX_BUSY_INDEX                 31
 #define XP_I2C_MUTEX_BUSY_WIDTH                 1
@@ -1148,8 +1148,8 @@
 #define RX_PACKET_ATTRIBUTES_CSUM_DONE_WIDTH    1
 #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_INDEX    1
 #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_WIDTH    1
-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_INDEX   2
-#define RX_PACKET_ATTRIBUTES_INCOMPLETE_WIDTH   1
+#define RX_PACKET_ATTRIBUTES_LAST_INDEX         2
+#define RX_PACKET_ATTRIBUTES_LAST_WIDTH         1
 #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_INDEX 3
 #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_WIDTH 1
 #define RX_PACKET_ATTRIBUTES_CONTEXT_INDEX      4
@@ -1158,6 +1158,8 @@
 #define RX_PACKET_ATTRIBUTES_RX_TSTAMP_WIDTH    1
 #define RX_PACKET_ATTRIBUTES_RSS_HASH_INDEX     6
 #define RX_PACKET_ATTRIBUTES_RSS_HASH_WIDTH     1
+#define RX_PACKET_ATTRIBUTES_FIRST_INDEX        7
+#define RX_PACKET_ATTRIBUTES_FIRST_WIDTH        1
 
 #define RX_NORMAL_DESC0_OVT_INDEX               0
 #define RX_NORMAL_DESC0_OVT_WIDTH               16
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 937f37a5dcb2..24a687ce4388 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1896,10 +1896,15 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
 
         /* Get the header length */
         if (XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, FD)) {
+                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                               FIRST, 1);
                 rdata->rx.hdr_len = XGMAC_GET_BITS_LE(rdesc->desc2,
                                                       RX_NORMAL_DESC2, HL);
                 if (rdata->rx.hdr_len)
                         pdata->ext_stats.rx_split_header_packets++;
+        } else {
+                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                               FIRST, 0);
         }
 
         /* Get the RSS hash */
@@ -1922,19 +1927,16 @@ static int xgbe_dev_read(struct xgbe_channel *channel)
                 }
         }
 
-        /* Get the packet length */
-        rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
-
-        if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD)) {
-                /* Not all the data has been transferred for this packet */
-                XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
-                               INCOMPLETE, 1);
+        /* Not all the data has been transferred for this packet */
+        if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD))
                 return 0;
-        }
 
         /* This is the last of the data for this packet */
         XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
-                       INCOMPLETE, 0);
+                       LAST, 1);
+
+        /* Get the packet length */
+        rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL);
 
         /* Set checksum done indicator as appropriate */
         if (netdev->features & NETIF_F_RXCSUM)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 248f60d171a5..a713abd9d03e 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1971,13 +1971,12 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
 {
         struct sk_buff *skb;
         u8 *packet;
-        unsigned int copy_len;
 
         skb = napi_alloc_skb(napi, rdata->rx.hdr.dma_len);
         if (!skb)
                 return NULL;
 
-        /* Start with the header buffer which may contain just the header
+        /* Pull in the header buffer which may contain just the header
          * or the header plus data
          */
         dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base,
@@ -1986,30 +1985,49 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
 
         packet = page_address(rdata->rx.hdr.pa.pages) +
                  rdata->rx.hdr.pa.pages_offset;
-        copy_len = (rdata->rx.hdr_len) ? rdata->rx.hdr_len : len;
-        copy_len = min(rdata->rx.hdr.dma_len, copy_len);
-        skb_copy_to_linear_data(skb, packet, copy_len);
-        skb_put(skb, copy_len);
-
-        len -= copy_len;
-        if (len) {
-                /* Add the remaining data as a frag */
-                dma_sync_single_range_for_cpu(pdata->dev,
-                                              rdata->rx.buf.dma_base,
-                                              rdata->rx.buf.dma_off,
-                                              rdata->rx.buf.dma_len,
-                                              DMA_FROM_DEVICE);
-
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-                                rdata->rx.buf.pa.pages,
-                                rdata->rx.buf.pa.pages_offset,
-                                len, rdata->rx.buf.dma_len);
-                rdata->rx.buf.pa.pages = NULL;
-        }
+        skb_copy_to_linear_data(skb, packet, len);
+        skb_put(skb, len);
 
         return skb;
 }
 
+static unsigned int xgbe_rx_buf1_len(struct xgbe_ring_data *rdata,
+                                     struct xgbe_packet_data *packet)
+{
+        /* Always zero if not the first descriptor */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, FIRST))
+                return 0;
+
+        /* First descriptor with split header, return header length */
+        if (rdata->rx.hdr_len)
+                return rdata->rx.hdr_len;
+
+        /* First descriptor but not the last descriptor and no split header,
+         * so the full buffer was used
+         */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
+                return rdata->rx.hdr.dma_len;
+
+        /* First descriptor and last descriptor and no split header, so
+         * calculate how much of the buffer was used
+         */
+        return min_t(unsigned int, rdata->rx.hdr.dma_len, rdata->rx.len);
+}
+
+static unsigned int xgbe_rx_buf2_len(struct xgbe_ring_data *rdata,
+                                     struct xgbe_packet_data *packet,
+                                     unsigned int len)
+{
+        /* Always the full buffer if not the last descriptor */
+        if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST))
+                return rdata->rx.buf.dma_len;
+
+        /* Last descriptor so calculate how much of the buffer was used
+         * for the last bit of data
+         */
+        return rdata->rx.len - len;
+}
+
 static int xgbe_tx_poll(struct xgbe_channel *channel)
 {
         struct xgbe_prv_data *pdata = channel->pdata;
@@ -2092,8 +2110,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         struct napi_struct *napi;
         struct sk_buff *skb;
         struct skb_shared_hwtstamps *hwtstamps;
-        unsigned int incomplete, error, context_next, context;
-        unsigned int len, rdesc_len, max_len;
+        unsigned int last, error, context_next, context;
+        unsigned int len, buf1_len, buf2_len, max_len;
         unsigned int received = 0;
         int packet_count = 0;
 
@@ -2103,7 +2121,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         if (!ring)
                 return 0;
 
-        incomplete = 0;
+        last = 0;
         context_next = 0;
 
         napi = (pdata->per_channel_irq) ? &channel->napi : &pdata->napi;
@@ -2137,9 +2155,8 @@ read_again:
                 received++;
                 ring->cur++;
 
-                incomplete = XGMAC_GET_BITS(packet->attributes,
-                                            RX_PACKET_ATTRIBUTES,
-                                            INCOMPLETE);
+                last = XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES,
+                                      LAST);
                 context_next = XGMAC_GET_BITS(packet->attributes,
                                               RX_PACKET_ATTRIBUTES,
                                               CONTEXT_NEXT);
@@ -2148,7 +2165,7 @@ read_again:
                                          CONTEXT);
 
                 /* Earlier error, just drain the remaining data */
-                if ((incomplete || context_next) && error)
+                if ((!last || context_next) && error)
                         goto read_again;
 
                 if (error || packet->errors) {
@@ -2160,16 +2177,22 @@ read_again:
                 }
 
                 if (!context) {
-                        /* Length is cumulative, get this descriptor's length */
-                        rdesc_len = rdata->rx.len - len;
-                        len += rdesc_len;
+                        /* Get the data length in the descriptor buffers */
+                        buf1_len = xgbe_rx_buf1_len(rdata, packet);
+                        len += buf1_len;
+                        buf2_len = xgbe_rx_buf2_len(rdata, packet, len);
+                        len += buf2_len;
 
-                        if (rdesc_len && !skb) {
+                        if (!skb) {
                                 skb = xgbe_create_skb(pdata, napi, rdata,
-                                                      rdesc_len);
-                                if (!skb)
+                                                      buf1_len);
+                                if (!skb) {
                                         error = 1;
-                        } else if (rdesc_len) {
+                                        goto skip_data;
+                                }
+                        }
+
+                        if (buf2_len) {
                                 dma_sync_single_range_for_cpu(pdata->dev,
                                                         rdata->rx.buf.dma_base,
                                                         rdata->rx.buf.dma_off,
@@ -2179,13 +2202,14 @@ read_again:
                                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                                 rdata->rx.buf.pa.pages,
                                                 rdata->rx.buf.pa.pages_offset,
-                                                rdesc_len,
+                                                buf2_len,
                                                 rdata->rx.buf.dma_len);
                                 rdata->rx.buf.pa.pages = NULL;
                         }
                 }
 
-                if (incomplete || context_next)
+skip_data:
+                if (!last || context_next)
                         goto read_again;
 
                 if (!skb)
@@ -2243,7 +2267,7 @@ next_packet:
         }
 
         /* Check if we need to save state before leaving */
-        if (received && (incomplete || context_next)) {
+        if (received && (!last || context_next)) {
                 rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
                 rdata->state_saved = 1;
                 rdata->state.skb = skb;
@@ -2272,10 +2296,7 @@ static int xgbe_one_poll(struct napi_struct *napi, int budget)
         processed = xgbe_rx_poll(channel, budget);
 
         /* If we processed everything, we are done */
-        if (processed < budget) {
-                /* Turn off polling */
-                napi_complete_done(napi, processed);
-
+        if ((processed < budget) && napi_complete_done(napi, processed)) {
                 /* Enable Tx and Rx interrupts */
                 if (pdata->channel_irq_mode)
                         xgbe_enable_rx_tx_int(pdata, channel);
@@ -2317,10 +2338,7 @@ static int xgbe_all_poll(struct napi_struct *napi, int budget)
         } while ((processed < budget) && (processed != last_processed));
 
         /* If we processed everything, we are done */
-        if (processed < budget) {
-                /* Turn off polling */
-                napi_complete_done(napi, processed);
-
+        if ((processed < budget) && napi_complete_done(napi, processed)) {
                 /* Enable Tx and Rx interrupts */
                 xgbe_enable_rx_tx_ints(pdata);
         }
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
index dad63623be6a..5d6c40d86775 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
@@ -98,11 +98,7 @@ static int aq_ndev_change_mtu(struct net_device *ndev, int new_mtu)
 
         if (err < 0)
                 goto err_exit;
-
-        if (netif_running(ndev)) {
-                aq_ndev_close(ndev);
-                aq_ndev_open(ndev);
-        }
+        ndev->mtu = new_mtu;
 
 err_exit:
         return err;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index ee78444bfb88..cdb02991f249 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -487,6 +487,9 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
                 dx_buff->mss = skb_shinfo(skb)->gso_size;
                 dx_buff->is_txc = 1U;
 
+                dx_buff->is_ipv6 =
+                        (ip_hdr(skb)->version == 6) ? 1U : 0U;
+
                 dx = aq_ring_next_dx(ring, dx);
                 dx_buff = &ring->buff_ring[dx];
                 ++ret;
@@ -510,10 +513,22 @@ static unsigned int aq_nic_map_skb(struct aq_nic_s *self,
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 dx_buff->is_ip_cso = (htons(ETH_P_IP) == skb->protocol) ?
                         1U : 0U;
-                dx_buff->is_tcp_cso =
-                        (ip_hdr(skb)->protocol == IPPROTO_TCP) ? 1U : 0U;
-                dx_buff->is_udp_cso =
-                        (ip_hdr(skb)->protocol == IPPROTO_UDP) ? 1U : 0U;
+
+                if (ip_hdr(skb)->version == 4) {
+                        dx_buff->is_tcp_cso =
+                                (ip_hdr(skb)->protocol == IPPROTO_TCP) ?
+                                        1U : 0U;
+                        dx_buff->is_udp_cso =
+                                (ip_hdr(skb)->protocol == IPPROTO_UDP) ?
+                                        1U : 0U;
+                } else if (ip_hdr(skb)->version == 6) {
+                        dx_buff->is_tcp_cso =
+                                (ipv6_hdr(skb)->nexthdr == NEXTHDR_TCP) ?
+                                        1U : 0U;
+                        dx_buff->is_udp_cso =
+                                (ipv6_hdr(skb)->nexthdr == NEXTHDR_UDP) ?
+                                        1U : 0U;
+                }
         }
 
         for (; nr_frags--; ++frag_count) {
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 581de71a958a..4c6c882c6a1c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -213,9 +213,9 @@ void aq_pci_func_free_irqs(struct aq_pci_func_s *self)
                 if (!((1U << i) & self->msix_entry_mask))
                         continue;
 
-                free_irq(pci_irq_vector(pdev, i), self->aq_vec[i]);
                 if (pdev->msix_enabled)
                         irq_set_affinity_hint(pci_irq_vector(pdev, i), NULL);
+                free_irq(pci_irq_vector(pdev, i), self->aq_vec[i]);
                 self->msix_entry_mask &= ~(1U << i);
         }
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 0358e6072d45..3a8a4aa13687 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -101,6 +101,7 @@ int aq_ring_init(struct aq_ring_s *self)
         self->hw_head = 0;
         self->sw_head = 0;
         self->sw_tail = 0;
+        spin_lock_init(&self->header.lock);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
index 257254645068..eecd6d1c4d73 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
@@ -58,7 +58,8 @@ struct __packed aq_ring_buff_s {
                         u8 len_l2;
                         u8 len_l3;
                         u8 len_l4;
-                        u8 rsvd2;
+                        u8 is_ipv6:1;
+                        u8 rsvd2:7;
                         u32 len_pkt;
                 };
         };
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index a2b746a2dd50..4ee15ff06a44 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -433,6 +433,9 @@ static int hw_atl_a0_hw_ring_tx_xmit(struct aq_hw_s *self,
                                     buff->len_l3 +
                                     buff->len_l2);
                         is_gso = true;
+
+                        if (buff->is_ipv6)
+                                txd->ctl |= HW_ATL_A0_TXD_CTL_CMD_IPV6;
                 } else {
                         buff_pa_len = buff->len;
 
@@ -458,6 +461,7 @@ static int hw_atl_a0_hw_ring_tx_xmit(struct aq_hw_s *self,
                         if (unlikely(buff->is_eop)) {
                                 txd->ctl |= HW_ATL_A0_TXD_CTL_EOP;
                                 txd->ctl |= HW_ATL_A0_TXD_CTL_CMD_WB;
+                                is_gso = false;
                         }
                 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
index 1093ea18823a..0592a0330cf0 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0_internal.h
@@ -137,6 +137,7 @@ static struct aq_hw_caps_s hw_atl_a0_hw_caps_ = {
         .tx_rings = HW_ATL_A0_TX_RINGS,
         .rx_rings = HW_ATL_A0_RX_RINGS,
         .hw_features = NETIF_F_HW_CSUM |
+                        NETIF_F_RXCSUM |
                         NETIF_F_RXHASH |
                         NETIF_F_SG |
                         NETIF_F_TSO,
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index cab2931dab9a..42150708191d 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -471,6 +471,9 @@ static int hw_atl_b0_hw_ring_tx_xmit(struct aq_hw_s *self,
                                     buff->len_l3 +
                                     buff->len_l2);
                         is_gso = true;
+
+                        if (buff->is_ipv6)
+                                txd->ctl |= HW_ATL_B0_TXD_CTL_CMD_IPV6;
                 } else {
                         buff_pa_len = buff->len;
 
@@ -496,6 +499,7 @@ static int hw_atl_b0_hw_ring_tx_xmit(struct aq_hw_s *self,
                         if (unlikely(buff->is_eop)) {
                                 txd->ctl |= HW_ATL_B0_TXD_CTL_EOP;
                                 txd->ctl |= HW_ATL_B0_TXD_CTL_CMD_WB;
+                                is_gso = false;
                         }
                 }
 
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
index 8bdee3ddd5a0..f3957e930340 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0_internal.h
@@ -188,6 +188,7 @@ static struct aq_hw_caps_s hw_atl_b0_hw_caps_ = {
         .tx_rings = HW_ATL_B0_TX_RINGS,
         .rx_rings = HW_ATL_B0_RX_RINGS,
         .hw_features = NETIF_F_HW_CSUM |
+                        NETIF_F_RXCSUM |
                         NETIF_F_RXHASH |
                         NETIF_F_SG |
                         NETIF_F_TSO |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 0a23034bbe3f..352beff796ae 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -2277,7 +2277,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
                                  GENERAL_ATTEN_OFFSET(LATCHED_ATTN_RBCP) | \
                                  GENERAL_ATTEN_OFFSET(LATCHED_ATTN_RSVD_GRC))
 
-#define HW_INTERRUT_ASSERT_SET_0 \
+#define HW_INTERRUPT_ASSERT_SET_0 \
                                 (AEU_INPUTS_ATTN_BITS_TSDM_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_TCM_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_TSEMI_HW_INTERRUPT | \
@@ -2290,7 +2290,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
                                  AEU_INPUTS_ATTN_BITS_TSEMI_PARITY_ERROR |\
                                  AEU_INPUTS_ATTN_BITS_TCM_PARITY_ERROR |\
                                  AEU_INPUTS_ATTN_BITS_PBCLIENT_PARITY_ERROR)
-#define HW_INTERRUT_ASSERT_SET_1 \
+#define HW_INTERRUPT_ASSERT_SET_1 \
                                 (AEU_INPUTS_ATTN_BITS_QM_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_TIMERS_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_XSDM_HW_INTERRUPT | \
@@ -2318,7 +2318,7 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
                                  AEU_INPUTS_ATTN_BITS_UPB_PARITY_ERROR | \
                                  AEU_INPUTS_ATTN_BITS_CSDM_PARITY_ERROR |\
                                  AEU_INPUTS_ATTN_BITS_CCM_PARITY_ERROR)
-#define HW_INTERRUT_ASSERT_SET_2 \
+#define HW_INTERRUPT_ASSERT_SET_2 \
                                 (AEU_INPUTS_ATTN_BITS_CSEMI_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_CDU_HW_INTERRUPT | \
                                  AEU_INPUTS_ATTN_BITS_DMAE_HW_INTERRUPT | \
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index d8d06fdfc42b..a851f95c307a 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4166,14 +4166,14 @@ static void bnx2x_attn_int_deasserted0(struct bnx2x *bp, u32 attn)
                 bnx2x_release_phy_lock(bp);
         }
 
-        if (attn & HW_INTERRUT_ASSERT_SET_0) {
+        if (attn & HW_INTERRUPT_ASSERT_SET_0) {
 
                 val = REG_RD(bp, reg_offset);
-                val &= ~(attn & HW_INTERRUT_ASSERT_SET_0);
+                val &= ~(attn & HW_INTERRUPT_ASSERT_SET_0);
                 REG_WR(bp, reg_offset, val);
 
                 BNX2X_ERR("FATAL HW block attention set0 0x%x\n",
-                          (u32)(attn & HW_INTERRUT_ASSERT_SET_0));
+                          (u32)(attn & HW_INTERRUPT_ASSERT_SET_0));
                 bnx2x_panic();
         }
 }
@@ -4191,7 +4191,7 @@ static void bnx2x_attn_int_deasserted1(struct bnx2x *bp, u32 attn)
                         BNX2X_ERR("FATAL error from DORQ\n");
         }
 
-        if (attn & HW_INTERRUT_ASSERT_SET_1) {
+        if (attn & HW_INTERRUPT_ASSERT_SET_1) {
 
                 int port = BP_PORT(bp);
                 int reg_offset;
@@ -4200,11 +4200,11 @@ static void bnx2x_attn_int_deasserted1(struct bnx2x *bp, u32 attn)
                                      MISC_REG_AEU_ENABLE1_FUNC_0_OUT_1);
 
                 val = REG_RD(bp, reg_offset);
-                val &= ~(attn & HW_INTERRUT_ASSERT_SET_1);
+                val &= ~(attn & HW_INTERRUPT_ASSERT_SET_1);
                 REG_WR(bp, reg_offset, val);
 
                 BNX2X_ERR("FATAL HW block attention set1 0x%x\n",
-                          (u32)(attn & HW_INTERRUT_ASSERT_SET_1));
+                          (u32)(attn & HW_INTERRUPT_ASSERT_SET_1));
                 bnx2x_panic();
         }
 }
@@ -4235,7 +4235,7 @@ static void bnx2x_attn_int_deasserted2(struct bnx2x *bp, u32 attn)
                 }
         }
 
-        if (attn & HW_INTERRUT_ASSERT_SET_2) {
+        if (attn & HW_INTERRUPT_ASSERT_SET_2) {
 
                 int port = BP_PORT(bp);
                 int reg_offset;
@@ -4244,11 +4244,11 @@ static void bnx2x_attn_int_deasserted2(struct bnx2x *bp, u32 attn)
                                      MISC_REG_AEU_ENABLE1_FUNC_0_OUT_2);
 
                 val = REG_RD(bp, reg_offset);
-                val &= ~(attn & HW_INTERRUT_ASSERT_SET_2);
+                val &= ~(attn & HW_INTERRUPT_ASSERT_SET_2);
                 REG_WR(bp, reg_offset, val);
 
                 BNX2X_ERR("FATAL HW block attention set2 0x%x\n",
-                          (u32)(attn & HW_INTERRUT_ASSERT_SET_2));
+                          (u32)(attn & HW_INTERRUPT_ASSERT_SET_2));
                 bnx2x_panic();
         }
 }
@@ -13292,17 +13292,15 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
         dev->vlan_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
                 NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_HIGHDMA;
 
-        /* VF with OLD Hypervisor or old PF do not support filtering */
         if (IS_PF(bp)) {
                 if (chip_is_e1x)
                         bp->accept_any_vlan = true;
                 else
                         dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
-#ifdef CONFIG_BNX2X_SRIOV
-        } else if (bp->acquire_resp.pfdev_info.pf_cap & PFVF_CAP_VLAN_FILTER) {
-                dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
-#endif
         }
+        /* For VF we'll know whether to enable VLAN filtering after
+         * getting a response to CHANNEL_TLV_ACQUIRE from PF.
+         */
 
         dev->features |= dev->hw_features | NETIF_F_HW_VLAN_CTAG_RX;
         dev->features |= NETIF_F_HIGHDMA;
@@ -13738,7 +13736,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb)
         if (!netif_running(bp->dev)) {
                 DP(BNX2X_MSG_PTP,
                    "PTP adjfreq called while the interface is down\n");
-                return -EFAULT;
+                return -ENETDOWN;
         }
 
         if (ppb < 0) {
@@ -13797,6 +13795,12 @@ static int bnx2x_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta)
 {
         struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
 
+        if (!netif_running(bp->dev)) {
+                DP(BNX2X_MSG_PTP,
+                   "PTP adjtime called while the interface is down\n");
+                return -ENETDOWN;
+        }
+
         DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta);
 
         timecounter_adjtime(&bp->timecounter, delta);
@@ -13809,6 +13813,12 @@ static int bnx2x_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
         struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
         u64 ns;
 
+        if (!netif_running(bp->dev)) {
+                DP(BNX2X_MSG_PTP,
+                   "PTP gettime called while the interface is down\n");
+                return -ENETDOWN;
+        }
+
         ns = timecounter_read(&bp->timecounter);
 
         DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns);
@@ -13824,6 +13834,12 @@ static int bnx2x_ptp_settime(struct ptp_clock_info *ptp,
         struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
         u64 ns;
 
+        if (!netif_running(bp->dev)) {
+                DP(BNX2X_MSG_PTP,
+                   "PTP settime called while the interface is down\n");
+                return -ENETDOWN;
+        }
+
         ns = timespec64_to_ns(ts);
 
         DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns);
@@ -13991,6 +14007,14 @@ static int bnx2x_init_one(struct pci_dev *pdev,
                 rc = bnx2x_vfpf_acquire(bp, tx_count, rx_count);
                 if (rc)
                         goto init_one_freemem;
+
+#ifdef CONFIG_BNX2X_SRIOV
+                /* VF with OLD Hypervisor or old PF do not support filtering */
+                if (bp->acquire_resp.pfdev_info.pf_cap & PFVF_CAP_VLAN_FILTER) {
+                        dev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+                        dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+                }
+#endif
         }
 
         /* Enable SRIOV if capability found in configuration space */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 6fad22adbbb9..bdfd53b46bc5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -434,7 +434,9 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp,
 
         /* Add/Remove the filter */
         rc = bnx2x_config_vlan_mac(bp, &ramrod);
-        if (rc && rc != -EEXIST) {
+        if (rc == -EEXIST)
+                return 0;
+        if (rc) {
                 BNX2X_ERR("Failed to %s %s\n",
                           filter->add ? "add" : "delete",
                           (filter->type == BNX2X_VF_FILTER_VLAN_MAC) ?
@@ -444,6 +446,8 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp,
                 return rc;
         }
 
+        filter->applied = true;
+
         return 0;
 }
 
@@ -469,8 +473,10 @@ int bnx2x_vf_mac_vlan_config_list(struct bnx2x *bp, struct bnx2x_virtf *vf,
         /* Rollback if needed */
         if (i != filters->count) {
                 BNX2X_ERR("Managed only %d/%d filters - rolling back\n",
-                          i, filters->count + 1);
+                          i, filters->count);
                 while (--i >= 0) {
+                        if (!filters->filters[i].applied)
+                                continue;
                         filters->filters[i].add = !filters->filters[i].add;
                         bnx2x_vf_mac_vlan_config(bp, vf, qid,
                                                  &filters->filters[i],
@@ -1899,7 +1905,8 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                         continue;
                 }
 
-                DP(BNX2X_MSG_IOV, "add addresses for vf %d\n", vf->abs_vfid);
+                DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                       "add addresses for vf %d\n", vf->abs_vfid);
                 for_each_vfq(vf, j) {
                         struct bnx2x_vf_queue *rxq = vfq_get(vf, j);
 
@@ -1920,11 +1927,12 @@ void bnx2x_iov_adjust_stats_req(struct bnx2x *bp)
                                 cpu_to_le32(U64_HI(q_stats_addr));
                         cur_query_entry->address.lo =
                                 cpu_to_le32(U64_LO(q_stats_addr));
-                        DP(BNX2X_MSG_IOV,
-                           "added address %x %x for vf %d queue %d client %d\n",
-                           cur_query_entry->address.hi,
-                           cur_query_entry->address.lo, cur_query_entry->funcID,
-                           j, cur_query_entry->index);
+                        DP_AND((BNX2X_MSG_IOV | BNX2X_MSG_STATS),
+                               "added address %x %x for vf %d queue %d client %d\n",
+                               cur_query_entry->address.hi,
+                               cur_query_entry->address.lo,
+                               cur_query_entry->funcID,
+                               j, cur_query_entry->index);
                         cur_query_entry++;
                         cur_data_offset += sizeof(struct per_queue_stats);
                         stats_count++;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 7a6d406f4c11..888d0b6632e8 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -114,6 +114,7 @@ struct bnx2x_vf_mac_vlan_filter {
         (BNX2X_VF_FILTER_MAC | BNX2X_VF_FILTER_VLAN) /*shortcut*/
 
         bool add;
+        bool applied;
         u8 *mac;
         u16 vid;
 };
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index bfae300cf25f..76a4668c50fe 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -868,7 +868,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
         struct bnx2x *bp = netdev_priv(dev);
         struct vfpf_set_q_filters_tlv *req = &bp->vf2pf_mbox->req.set_q_filters;
         struct pfvf_general_resp_tlv *resp = &bp->vf2pf_mbox->resp.general_resp;
-        int rc, i = 0;
+        int rc = 0, i = 0;
         struct netdev_hw_addr *ha;
 
         if (bp->state != BNX2X_STATE_OPEN) {
@@ -883,6 +883,15 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
         /* Get Rx mode requested */
         DP(NETIF_MSG_IFUP, "dev->flags = %x\n", dev->flags);
 
+        /* We support PFVF_MAX_MULTICAST_PER_VF mcast addresses tops */
+        if (netdev_mc_count(dev) > PFVF_MAX_MULTICAST_PER_VF) {
+                DP(NETIF_MSG_IFUP,
+                   "VF supports not more than %d multicast MAC addresses\n",
+                   PFVF_MAX_MULTICAST_PER_VF);
+                rc = -EINVAL;
+                goto out;
+        }
+
         netdev_for_each_mc_addr(ha, dev) {
                 DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n",
                    bnx2x_mc_addr(ha));
@@ -890,16 +899,6 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
                 i++;
         }
 
-        /* We support four PFVF_MAX_MULTICAST_PER_VF mcast
-          * addresses tops
-          */
-        if (i >= PFVF_MAX_MULTICAST_PER_VF) {
-                DP(NETIF_MSG_IFUP,
-                   "VF supports not more than %d multicast MAC addresses\n",
-                   PFVF_MAX_MULTICAST_PER_VF);
-                return -EINVAL;
-        }
-
         req->n_multicast = i;
         req->flags |= VFPF_SET_Q_FILTERS_MULTICAST_CHANGED;
         req->vf_qid = 0;
@@ -924,7 +923,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev)
 out:
         bnx2x_vfpf_finalize(bp, &req->first_tlv);
 
-        return 0;
+        return rc;
 }
 
 /* request pf to add a vlan for the vf */
@@ -1778,6 +1777,23 @@ static int bnx2x_vf_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                                 goto op_err;
                 }
 
+                /* build vlan list */
+                fl = NULL;
+
+                rc = bnx2x_vf_mbx_macvlan_list(bp, vf, msg, &fl,
+                                               VFPF_VLAN_FILTER);
+                if (rc)
+                        goto op_err;
+
+                if (fl) {
+                        /* set vlan list */
+                        rc = bnx2x_vf_mac_vlan_config_list(bp, vf, fl,
+                                                           msg->vf_qid,
+                                                           false);
+                        if (rc)
+                                goto op_err;
+                }
+
         }
 
         if (msg->flags & VFPF_SET_Q_FILTERS_RX_MASK_CHANGED) {
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 235733e91c79..1f1e54ba0ecb 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1983,20 +1983,25 @@ static void bnxt_free_rx_skbs(struct bnxt *bp)
 
                 for (j = 0; j < max_idx; j++) {
                         struct bnxt_sw_rx_bd *rx_buf = &rxr->rx_buf_ring[j];
+                        dma_addr_t mapping = rx_buf->mapping;
                         void *data = rx_buf->data;
 
                         if (!data)
                                 continue;
 
-                        dma_unmap_single(&pdev->dev, rx_buf->mapping,
-                                         bp->rx_buf_use_size, bp->rx_dir);
-
                         rx_buf->data = NULL;
 
-                        if (BNXT_RX_PAGE_MODE(bp))
+                        if (BNXT_RX_PAGE_MODE(bp)) {
+                                mapping -= bp->rx_dma_offset;
+                                dma_unmap_page(&pdev->dev, mapping,
+                                               PAGE_SIZE, bp->rx_dir);
                                 __free_page(data);
-                        else
+                        } else {
+                                dma_unmap_single(&pdev->dev, mapping,
+                                                 bp->rx_buf_use_size,
+                                                 bp->rx_dir);
                                 kfree(data);
+                        }
                 }
 
                 for (j = 0; j < max_agg_idx; j++) {
@@ -2455,6 +2460,18 @@ static int bnxt_init_one_rx_ring(struct bnxt *bp, int ring_nr)
         return 0;
 }
 
+static void bnxt_init_cp_rings(struct bnxt *bp)
+{
+        int i;
+
+        for (i = 0; i < bp->cp_nr_rings; i++) {
+                struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring;
+                struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
+
+                ring->fw_ring_id = INVALID_HW_RING_ID;
+        }
+}
+
 static int bnxt_init_rx_rings(struct bnxt *bp)
 {
         int i, rc = 0;
@@ -4465,6 +4482,10 @@ static int bnxt_hwrm_func_qcfg(struct bnxt *bp)
                 vf->vlan = le16_to_cpu(resp->vlan) & VLAN_VID_MASK;
         }
 #endif
+        if (BNXT_PF(bp) && (le16_to_cpu(resp->flags) &
+                            FUNC_QCFG_RESP_FLAGS_FW_DCBX_AGENT_ENABLED))
+                bp->flags |= BNXT_FLAG_FW_LLDP_AGENT;
+
         switch (resp->port_partition_type) {
         case FUNC_QCFG_RESP_PORT_PARTITION_TYPE_NPAR1_0:
         case FUNC_QCFG_RESP_PORT_PARTITION_TYPE_NPAR1_5:
@@ -4728,7 +4749,7 @@ static int bnxt_set_tpa(struct bnxt *bp, bool set_tpa)
                 rc = bnxt_hwrm_vnic_set_tpa(bp, i, tpa_flags);
                 if (rc) {
                         netdev_err(bp->dev, "hwrm vnic set tpa failure rc for vnic %d: %x\n",
-                                   rc, i);
+                                   i, rc);
                         return rc;
                 }
         }
@@ -5002,6 +5023,7 @@ static int bnxt_shutdown_nic(struct bnxt *bp, bool irq_re_init)
 
 static int bnxt_init_nic(struct bnxt *bp, bool irq_re_init)
 {
+        bnxt_init_cp_rings(bp);
         bnxt_init_rx_rings(bp);
         bnxt_init_tx_rings(bp);
         bnxt_init_ring_grps(bp, irq_re_init);
@@ -5507,8 +5529,9 @@ static int bnxt_hwrm_phy_qcaps(struct bnxt *bp)
                 bp->lpi_tmr_hi = le32_to_cpu(resp->valid_tx_lpi_timer_high) &
                                  PORT_PHY_QCAPS_RESP_TX_LPI_TIMER_HIGH_MASK;
         }
-        link_info->support_auto_speeds =
-                le16_to_cpu(resp->supported_speeds_auto_mode);
+        if (resp->supported_speeds_auto_mode)
+                link_info->support_auto_speeds =
+                        le16_to_cpu(resp->supported_speeds_auto_mode);
 
 hwrm_phy_qcaps_exit:
         mutex_unlock(&bp->hwrm_cmd_lock);
@@ -6495,8 +6518,14 @@ static void bnxt_reset_task(struct bnxt *bp, bool silent)
         if (!silent)
                 bnxt_dbg_dump_states(bp);
         if (netif_running(bp->dev)) {
+                int rc;
+
+                if (!silent)
+                        bnxt_ulp_stop(bp);
                 bnxt_close_nic(bp, false, false);
-                bnxt_open_nic(bp, false, false);
+                rc = bnxt_open_nic(bp, false, false);
+                if (!silent && !rc)
+                        bnxt_ulp_start(bp);
         }
 }
 
@@ -7444,6 +7473,10 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto init_err_pci_clean;
 
+        rc = bnxt_hwrm_func_reset(bp);
+        if (rc)
+                goto init_err_pci_clean;
+
         bnxt_hwrm_fw_set_time(bp);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | NETIF_F_SG |
@@ -7554,10 +7587,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto init_err_pci_clean;
 
-        rc = bnxt_hwrm_func_reset(bp);
-        if (rc)
-                goto init_err_pci_clean;
-
         rc = bnxt_init_int_mode(bp);
         if (rc)
                 goto init_err_pci_clean;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index faf26a2f726b..c7a5b84a5cb2 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -993,6 +993,7 @@ struct bnxt {
                                          BNXT_FLAG_ROCEV2_CAP)
         #define BNXT_FLAG_NO_AGG_RINGS  0x20000
         #define BNXT_FLAG_RX_PAGE_MODE  0x40000
+        #define BNXT_FLAG_FW_LLDP_AGENT 0x80000
         #define BNXT_FLAG_CHIP_NITRO_A0 0x1000000
 
         #define BNXT_FLAG_ALL_CONFIG_FEATS (BNXT_FLAG_TPA |             \
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index fdf2d8caf7bf..03532061d211 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -474,7 +474,7 @@ void bnxt_dcb_init(struct bnxt *bp)
                 return;
 
         bp->dcbx_cap = DCB_CAP_DCBX_VER_IEEE;
-        if (BNXT_PF(bp))
+        if (BNXT_PF(bp) && !(bp->flags & BNXT_FLAG_FW_LLDP_AGENT))
                 bp->dcbx_cap |= DCB_CAP_DCBX_HOST;
         else
                 bp->dcbx_cap |= DCB_CAP_DCBX_LLD_MANAGED;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index f92896835d2a..365895ed3c3e 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1,7 +1,7 @@
 /*
  * Broadcom GENET (Gigabit Ethernet) controller driver
  *
- * Copyright (c) 2014 Broadcom Corporation
+ * Copyright (c) 2014-2017 Broadcom
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -450,6 +450,22 @@ static inline void bcmgenet_rdma_ring_writel(struct bcmgenet_priv *priv,
                         genet_dma_ring_regs[r]);
 }
 
+static int bcmgenet_begin(struct net_device *dev)
+{
+        struct bcmgenet_priv *priv = netdev_priv(dev);
+
+        /* Turn on the clock */
+        return clk_prepare_enable(priv->clk);
+}
+
+static void bcmgenet_complete(struct net_device *dev)
+{
+        struct bcmgenet_priv *priv = netdev_priv(dev);
+
+        /* Turn off the clock */
+        clk_disable_unprepare(priv->clk);
+}
+
 static int bcmgenet_get_link_ksettings(struct net_device *dev,
                                        struct ethtool_link_ksettings *cmd)
 {
@@ -778,8 +794,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = {
         STAT_GENET_RUNT("rx_runt_bytes", mib.rx_runt_bytes),
         /* Misc UniMAC counters */
         STAT_GENET_MISC("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt,
-                        UMAC_RBUF_OVFL_CNT),
-        STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT),
+                        UMAC_RBUF_OVFL_CNT_V1),
+        STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt,
+                        UMAC_RBUF_ERR_CNT_V1),
         STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT),
         STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed),
         STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed),
@@ -821,6 +838,45 @@ static void bcmgenet_get_strings(struct net_device *dev, u32 stringset,
         }
 }
 
+static u32 bcmgenet_update_stat_misc(struct bcmgenet_priv *priv, u16 offset)
+{
+        u16 new_offset;
+        u32 val;
+
+        switch (offset) {
+        case UMAC_RBUF_OVFL_CNT_V1:
+                if (GENET_IS_V2(priv))
+                        new_offset = RBUF_OVFL_CNT_V2;
+                else
+                        new_offset = RBUF_OVFL_CNT_V3PLUS;
+
+                val = bcmgenet_rbuf_readl(priv, new_offset);
+                /* clear if overflowed */
+                if (val == ~0)
+                        bcmgenet_rbuf_writel(priv, 0, new_offset);
+                break;
+        case UMAC_RBUF_ERR_CNT_V1:
+                if (GENET_IS_V2(priv))
+                        new_offset = RBUF_ERR_CNT_V2;
+                else
+                        new_offset = RBUF_ERR_CNT_V3PLUS;
+
+                val = bcmgenet_rbuf_readl(priv, new_offset);
+                /* clear if overflowed */
+                if (val == ~0)
+                        bcmgenet_rbuf_writel(priv, 0, new_offset);
+                break;
+        default:
+                val = bcmgenet_umac_readl(priv, offset);
+                /* clear if overflowed */
+                if (val == ~0)
+                        bcmgenet_umac_writel(priv, 0, offset);
+                break;
+        }
+
+        return val;
+}
+
 static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
 {
         int i, j = 0;
@@ -836,19 +892,28 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv)
                 case BCMGENET_STAT_NETDEV:
                 case BCMGENET_STAT_SOFT:
                         continue;
-                case BCMGENET_STAT_MIB_RX:
-                case BCMGENET_STAT_MIB_TX:
                 case BCMGENET_STAT_RUNT:
-                        if (s->type != BCMGENET_STAT_MIB_RX)
-                                offset = BCMGENET_STAT_OFFSET;
+                        offset += BCMGENET_STAT_OFFSET;
+                        /* fall through */
+                case BCMGENET_STAT_MIB_TX:
+                        offset += BCMGENET_STAT_OFFSET;
+                        /* fall through */
+                case BCMGENET_STAT_MIB_RX:
                         val = bcmgenet_umac_readl(priv,
                                                   UMAC_MIB_START + j + offset);
+                        offset = 0;     /* Reset Offset */
                         break;
                 case BCMGENET_STAT_MISC:
-                        val = bcmgenet_umac_readl(priv, s->reg_offset);
-                        /* clear if overflowed */
-                        if (val == ~0)
-                                bcmgenet_umac_writel(priv, 0, s->reg_offset);
+                        if (GENET_IS_V1(priv)) {
+                                val = bcmgenet_umac_readl(priv, s->reg_offset);
+                                /* clear if overflowed */
+                                if (val == ~0)
+                                        bcmgenet_umac_writel(priv, 0,
+                                                             s->reg_offset);
+                        } else {
+                                val = bcmgenet_update_stat_misc(priv,
+                                                                s->reg_offset);
+                        }
                         break;
                 }
 
@@ -973,6 +1038,8 @@ static int bcmgenet_set_eee(struct net_device *dev, struct ethtool_eee *e)
 
 /* standard ethtool support functions. */
 static const struct ethtool_ops bcmgenet_ethtool_ops = {
+        .begin                  = bcmgenet_begin,
+        .complete               = bcmgenet_complete,
         .get_strings            = bcmgenet_get_strings,
         .get_sset_count         = bcmgenet_get_sset_count,
         .get_ethtool_stats      = bcmgenet_get_ethtool_stats,
@@ -1167,7 +1234,6 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct device *kdev = &priv->pdev->dev;
         struct enet_cb *tx_cb_ptr;
-        struct netdev_queue *txq;
         unsigned int pkts_compl = 0;
         unsigned int bytes_compl = 0;
         unsigned int c_index;
@@ -1219,13 +1285,8 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
         dev->stats.tx_packets += pkts_compl;
         dev->stats.tx_bytes += bytes_compl;
 
-        txq = netdev_get_tx_queue(dev, ring->queue);
-        netdev_tx_completed_queue(txq, pkts_compl, bytes_compl);
-
-        if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
-                if (netif_tx_queue_stopped(txq))
-                        netif_tx_wake_queue(txq);
-        }
+        netdev_tx_completed_queue(netdev_get_tx_queue(dev, ring->queue),
+                                  pkts_compl, bytes_compl);
 
         return pkts_compl;
 }
@@ -1248,8 +1309,16 @@ static int bcmgenet_tx_poll(struct napi_struct *napi, int budget)
         struct bcmgenet_tx_ring *ring =
                 container_of(napi, struct bcmgenet_tx_ring, napi);
         unsigned int work_done = 0;
+        struct netdev_queue *txq;
+        unsigned long flags;
 
-        work_done = bcmgenet_tx_reclaim(ring->priv->dev, ring);
+        spin_lock_irqsave(&ring->lock, flags);
+        work_done = __bcmgenet_tx_reclaim(ring->priv->dev, ring);
+        if (ring->free_bds > (MAX_SKB_FRAGS + 1)) {
+                txq = netdev_get_tx_queue(ring->priv->dev, ring->queue);
+                netif_tx_wake_queue(txq);
+        }
+        spin_unlock_irqrestore(&ring->lock, flags);
 
         if (work_done == 0) {
                 napi_complete(napi);
@@ -2457,24 +2526,28 @@ static int bcmgenet_init_dma(struct bcmgenet_priv *priv)
 /* Interrupt bottom half */
 static void bcmgenet_irq_task(struct work_struct *work)
 {
+        unsigned long flags;
+        unsigned int status;
         struct bcmgenet_priv *priv = container_of(
                         work, struct bcmgenet_priv, bcmgenet_irq_work);
 
         netif_dbg(priv, intr, priv->dev, "%s\n", __func__);
 
-        if (priv->irq0_stat & UMAC_IRQ_MPD_R) {
-                priv->irq0_stat &= ~UMAC_IRQ_MPD_R;
+        spin_lock_irqsave(&priv->lock, flags);
+        status = priv->irq0_stat;
+        priv->irq0_stat = 0;
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        if (status & UMAC_IRQ_MPD_R) {
                 netif_dbg(priv, wol, priv->dev,
                           "magic packet detected, waking up\n");
                 bcmgenet_power_up(priv, GENET_POWER_WOL_MAGIC);
         }
 
         /* Link UP/DOWN event */
-        if (priv->irq0_stat & UMAC_IRQ_LINK_EVENT) {
+        if (status & UMAC_IRQ_LINK_EVENT)
                 phy_mac_interrupt(priv->phydev,
-                                  !!(priv->irq0_stat & UMAC_IRQ_LINK_UP));
-                priv->irq0_stat &= ~UMAC_IRQ_LINK_EVENT;
-        }
+                                  !!(status & UMAC_IRQ_LINK_UP));
 }
 
 /* bcmgenet_isr1: handle Rx and Tx priority queues */
@@ -2483,22 +2556,21 @@ static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
         struct bcmgenet_priv *priv = dev_id;
         struct bcmgenet_rx_ring *rx_ring;
         struct bcmgenet_tx_ring *tx_ring;
-        unsigned int index;
+        unsigned int index, status;
 
-        /* Save irq status for bottom-half processing. */
-        priv->irq1_stat =
-                bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
+        /* Read irq status */
+        status = bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_STAT) &
                 ~bcmgenet_intrl2_1_readl(priv, INTRL2_CPU_MASK_STATUS);
 
         /* clear interrupts */
-        bcmgenet_intrl2_1_writel(priv, priv->irq1_stat, INTRL2_CPU_CLEAR);
+        bcmgenet_intrl2_1_writel(priv, status, INTRL2_CPU_CLEAR);
 
         netif_dbg(priv, intr, priv->dev,
-                  "%s: IRQ=0x%x\n", __func__, priv->irq1_stat);
+                  "%s: IRQ=0x%x\n", __func__, status);
 
         /* Check Rx priority queue interrupts */
         for (index = 0; index < priv->hw_params->rx_queues; index++) {
-                if (!(priv->irq1_stat & BIT(UMAC_IRQ1_RX_INTR_SHIFT + index)))
+                if (!(status & BIT(UMAC_IRQ1_RX_INTR_SHIFT + index)))
                         continue;
 
                 rx_ring = &priv->rx_rings[index];
@@ -2511,7 +2583,7 @@ static irqreturn_t bcmgenet_isr1(int irq, void *dev_id)
 
         /* Check Tx priority queue interrupts */
         for (index = 0; index < priv->hw_params->tx_queues; index++) {
-                if (!(priv->irq1_stat & BIT(index)))
+                if (!(status & BIT(index)))
                         continue;
 
                 tx_ring = &priv->tx_rings[index];
@@ -2531,19 +2603,20 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
         struct bcmgenet_priv *priv = dev_id;
         struct bcmgenet_rx_ring *rx_ring;
         struct bcmgenet_tx_ring *tx_ring;
+        unsigned int status;
+        unsigned long flags;
 
-        /* Save irq status for bottom-half processing. */
-        priv->irq0_stat =
-                bcmgenet_intrl2_0_readl(priv, INTRL2_CPU_STAT) &
+        /* Read irq status */
+        status = bcmgenet_intrl2_0_readl(priv, INTRL2_CPU_STAT) &
                 ~bcmgenet_intrl2_0_readl(priv, INTRL2_CPU_MASK_STATUS);
 
         /* clear interrupts */
-        bcmgenet_intrl2_0_writel(priv, priv->irq0_stat, INTRL2_CPU_CLEAR);
+        bcmgenet_intrl2_0_writel(priv, status, INTRL2_CPU_CLEAR);
 
         netif_dbg(priv, intr, priv->dev,
-                  "IRQ=0x%x\n", priv->irq0_stat);
+                  "IRQ=0x%x\n", status);
 
-        if (priv->irq0_stat & UMAC_IRQ_RXDMA_DONE) {
+        if (status & UMAC_IRQ_RXDMA_DONE) {
                 rx_ring = &priv->rx_rings[DESC_INDEX];
 
                 if (likely(napi_schedule_prep(&rx_ring->napi))) {
@@ -2552,7 +2625,7 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
                 }
         }
 
-        if (priv->irq0_stat & UMAC_IRQ_TXDMA_DONE) {
+        if (status & UMAC_IRQ_TXDMA_DONE) {
                 tx_ring = &priv->tx_rings[DESC_INDEX];
 
                 if (likely(napi_schedule_prep(&tx_ring->napi))) {
@@ -2561,22 +2634,23 @@ static irqreturn_t bcmgenet_isr0(int irq, void *dev_id)
                 }
         }
 
-        if (priv->irq0_stat & (UMAC_IRQ_PHY_DET_R |
-                                UMAC_IRQ_PHY_DET_F |
-                                UMAC_IRQ_LINK_EVENT |
-                                UMAC_IRQ_HFB_SM |
-                                UMAC_IRQ_HFB_MM |
-                                UMAC_IRQ_MPD_R)) {
-                /* all other interested interrupts handled in bottom half */
-                schedule_work(&priv->bcmgenet_irq_work);
-        }
-
         if ((priv->hw_params->flags & GENET_HAS_MDIO_INTR) &&
-            priv->irq0_stat & (UMAC_IRQ_MDIO_DONE | UMAC_IRQ_MDIO_ERROR)) {
-                priv->irq0_stat &= ~(UMAC_IRQ_MDIO_DONE | UMAC_IRQ_MDIO_ERROR);
+                status & (UMAC_IRQ_MDIO_DONE | UMAC_IRQ_MDIO_ERROR)) {
                 wake_up(&priv->wq);
         }
 
+        /* all other interested interrupts handled in bottom half */
+        status &= (UMAC_IRQ_LINK_EVENT |
+                   UMAC_IRQ_MPD_R);
+        if (status) {
+                /* Save irq status for bottom-half processing. */
+                spin_lock_irqsave(&priv->lock, flags);
+                priv->irq0_stat |= status;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                schedule_work(&priv->bcmgenet_irq_work);
+        }
+
         return IRQ_HANDLED;
 }
 
@@ -2801,6 +2875,8 @@ err_irq0:
 err_fini_dma:
         bcmgenet_fini_dma(priv);
 err_clk_disable:
+        if (priv->internal_phy)
+                bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
         clk_disable_unprepare(priv->clk);
         return ret;
 }
@@ -3177,6 +3253,12 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv)
          */
         gphy_rev = reg & 0xffff;
 
+        /* This is reserved so should require special treatment */
+        if (gphy_rev == 0 || gphy_rev == 0x01ff) {
+                pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev);
+                return;
+        }
+
         /* This is the good old scheme, just GPHY major, no minor nor patch */
         if ((gphy_rev & 0xf0) != 0)
                 priv->gphy_rev = gphy_rev << 8;
@@ -3185,12 +3267,6 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv)
         else if ((gphy_rev & 0xff00) != 0)
                 priv->gphy_rev = gphy_rev;
 
-        /* This is reserved so should require special treatment */
-        else if (gphy_rev == 0 || gphy_rev == 0x01ff) {
-                pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev);
-                return;
-        }
-
 #ifdef CONFIG_PHYS_ADDR_T_64BIT
         if (!(params->flags & GENET_HAS_40BITS))
                 pr_warn("GENET does not support 40-bits PA\n");
@@ -3233,6 +3309,7 @@ static int bcmgenet_probe(struct platform_device *pdev)
         const void *macaddr;
         struct resource *r;
         int err = -EIO;
+        const char *phy_mode_str;
 
         /* Up to GENET_MAX_MQ_CNT + 1 TX queues and RX queues */
         dev = alloc_etherdev_mqs(sizeof(*priv), GENET_MAX_MQ_CNT + 1,
@@ -3276,6 +3353,8 @@ static int bcmgenet_probe(struct platform_device *pdev)
                 goto err;
         }
 
+        spin_lock_init(&priv->lock);
+
         SET_NETDEV_DEV(dev, &pdev->dev);
         dev_set_drvdata(&pdev->dev, dev);
         ether_addr_copy(dev->dev_addr, macaddr);
@@ -3338,6 +3417,13 @@ static int bcmgenet_probe(struct platform_device *pdev)
                 priv->clk_eee = NULL;
         }
 
+        /* If this is an internal GPHY, power it on now, before UniMAC is
+         * brought out of reset as absolutely no UniMAC activity is allowed
+         */
+        if (dn && !of_property_read_string(dn, "phy-mode", &phy_mode_str) &&
+            !strcasecmp(phy_mode_str, "internal"))
+                bcmgenet_power_up(priv, GENET_POWER_PASSIVE);
+
         err = reset_umac(priv);
         if (err)
                 goto err_clk_disable;
@@ -3395,7 +3481,8 @@ static int bcmgenet_suspend(struct device *d)
 
         bcmgenet_netif_stop(dev);
 
-        phy_suspend(priv->phydev);
+        if (!device_may_wakeup(d))
+                phy_suspend(priv->phydev);
 
         netif_device_detach(dev);
 
@@ -3492,7 +3579,8 @@ static int bcmgenet_resume(struct device *d)
 
         netif_device_attach(dev);
 
-        phy_resume(priv->phydev);
+        if (!device_may_wakeup(d))
+                phy_resume(priv->phydev);
 
         if (priv->eee.eee_enabled)
                 bcmgenet_eee_enable_set(dev, true);
@@ -3502,6 +3590,8 @@ static int bcmgenet_resume(struct device *d)
         return 0;
 
 out_clk_disable:
+        if (priv->internal_phy)
+                bcmgenet_power_down(priv, GENET_POWER_PASSIVE);
         clk_disable_unprepare(priv->clk);
         return ret;
 }
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index 1e2dc34d331a..db7f289d65ae 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 Broadcom Corporation
+ * Copyright (c) 2014-2017 Broadcom
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -214,7 +214,9 @@ struct bcmgenet_mib_counters {
 #define  MDIO_REG_SHIFT                 16
 #define  MDIO_REG_MASK                  0x1F
 
-#define UMAC_RBUF_OVFL_CNT              0x61C
+#define UMAC_RBUF_OVFL_CNT_V1           0x61C
+#define RBUF_OVFL_CNT_V2                0x80
+#define RBUF_OVFL_CNT_V3PLUS            0x94
 
 #define UMAC_MPD_CTRL                   0x620
 #define  MPD_EN                         (1 << 0)
@@ -224,7 +226,9 @@ struct bcmgenet_mib_counters {
 
 #define UMAC_MPD_PW_MS                  0x624
 #define UMAC_MPD_PW_LS                  0x628
-#define UMAC_RBUF_ERR_CNT               0x634
+#define UMAC_RBUF_ERR_CNT_V1            0x634
+#define RBUF_ERR_CNT_V2                 0x84
+#define RBUF_ERR_CNT_V3PLUS             0x98
 #define UMAC_MDF_ERR_CNT                0x638
 #define UMAC_MDF_CTRL                   0x650
 #define UMAC_MDF_ADDR                   0x654
@@ -619,11 +623,13 @@ struct bcmgenet_priv {
         struct work_struct bcmgenet_irq_work;
         int irq0;
         int irq1;
-        unsigned int irq0_stat;
-        unsigned int irq1_stat;
         int wol_irq;
         bool wol_irq_disabled;
 
+        /* shared status */
+        spinlock_t lock;
+        unsigned int irq0_stat;
+
         /* HW descriptors/checksum variables */
         bool desc_64b_en;
         bool desc_rxchk_en;
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index e87607621e62..2f9281936f0e 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -220,20 +220,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
         udelay(60);
 }
 
-static void bcmgenet_internal_phy_setup(struct net_device *dev)
-{
-        struct bcmgenet_priv *priv = netdev_priv(dev);
-        u32 reg;
-
-        /* Power up PHY */
-        bcmgenet_phy_power_set(dev, true);
-        /* enable APD */
-        reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT);
-        reg |= EXT_PWR_DN_EN_LD;
-        bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT);
-        bcmgenet_mii_reset(dev);
-}
-
 static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
 {
         u32 reg;
@@ -281,7 +267,6 @@ int bcmgenet_mii_config(struct net_device *dev)
 
                 if (priv->internal_phy) {
                         phy_name = "internal PHY";
-                        bcmgenet_internal_phy_setup(dev);
                 } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
                         phy_name = "MoCA";
                         bcmgenet_moca_phy_setup(priv);
diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
index 9e59663a6ead..0f6811860ad5 100644
--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
@@ -1930,13 +1930,13 @@ static void
 bfa_ioc_send_enable(struct bfa_ioc *ioc)
 {
         struct bfi_ioc_ctrl_req enable_req;
-        struct timeval tv;
 
         bfi_h2i_set(enable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_ENABLE_REQ,
                     bfa_ioc_portid(ioc));
         enable_req.clscode = htons(ioc->clscode);
-        do_gettimeofday(&tv);
-        enable_req.tv_sec = ntohl(tv.tv_sec);
+        enable_req.rsvd = htons(0);
+        /* overflow in 2106 */
+        enable_req.tv_sec = ntohl(ktime_get_real_seconds());
         bfa_ioc_mbox_send(ioc, &enable_req, sizeof(struct bfi_ioc_ctrl_req));
 }
 
@@ -1947,6 +1947,10 @@ bfa_ioc_send_disable(struct bfa_ioc *ioc)
 
         bfi_h2i_set(disable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_DISABLE_REQ,
                     bfa_ioc_portid(ioc));
+        disable_req.clscode = htons(ioc->clscode);
+        disable_req.rsvd = htons(0);
+        /* overflow in 2106 */
+        disable_req.tv_sec = ntohl(ktime_get_real_seconds());
         bfa_ioc_mbox_send(ioc, &disable_req, sizeof(struct bfi_ioc_ctrl_req));
 }
 
diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
index 05c1c1dd7751..cebfe3bd086e 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
@@ -325,7 +325,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,
                 return PTR_ERR(kern_buf);
 
         rc = sscanf(kern_buf, "%x:%x", &addr, &len);
-        if (rc < 2) {
+        if (rc < 2 || len > UINT_MAX >> 2) {
                 netdev_warn(bnad->netdev, "failed to read user buffer\n");
                 kfree(kern_buf);
                 return -EINVAL;
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index be9c0e3f5ade..92f46b1375c3 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -152,7 +152,7 @@ struct octnic_gather {
          */
         struct octeon_sg_entry *sg;
 
-        u64 sg_dma_ptr;
+        dma_addr_t sg_dma_ptr;
 };
 
 struct handshake {
@@ -734,6 +734,9 @@ static void delete_glists(struct lio *lio)
         struct octnic_gather *g;
         int i;
 
+        kfree(lio->glist_lock);
+        lio->glist_lock = NULL;
+
         if (!lio->glist)
                 return;
 
@@ -741,23 +744,26 @@ static void delete_glists(struct lio *lio)
                 do {
                         g = (struct octnic_gather *)
                                 list_delete_head(&lio->glist[i]);
-                        if (g) {
-                                if (g->sg) {
-                                        dma_unmap_single(&lio->oct_dev->
-                                                         pci_dev->dev,
-                                                         g->sg_dma_ptr,
-                                                         g->sg_size,
-                                                         DMA_TO_DEVICE);
-                                        kfree((void *)((unsigned long)g->sg -
-                                                       g->adjust));
-                                }
+                        if (g)
                                 kfree(g);
-                        }
                 } while (g);
+
+                if (lio->glists_virt_base && lio->glists_virt_base[i]) {
+                        lio_dma_free(lio->oct_dev,
+                                     lio->glist_entry_size * lio->tx_qsize,
+                                     lio->glists_virt_base[i],
+                                     lio->glists_dma_base[i]);
+                }
         }
 
-        kfree((void *)lio->glist);
-        kfree((void *)lio->glist_lock);
+        kfree(lio->glists_virt_base);
+        lio->glists_virt_base = NULL;
+
+        kfree(lio->glists_dma_base);
+        lio->glists_dma_base = NULL;
+
+        kfree(lio->glist);
+        lio->glist = NULL;
 }
 
 /**
@@ -772,13 +778,30 @@ static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
         lio->glist_lock = kcalloc(num_iqs, sizeof(*lio->glist_lock),
                                   GFP_KERNEL);
         if (!lio->glist_lock)
-                return 1;
+                return -ENOMEM;
 
         lio->glist = kcalloc(num_iqs, sizeof(*lio->glist),
                              GFP_KERNEL);
         if (!lio->glist) {
-                kfree((void *)lio->glist_lock);
-                return 1;
+                kfree(lio->glist_lock);
+                lio->glist_lock = NULL;
+                return -ENOMEM;
+        }
+
+        lio->glist_entry_size =
+                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
+
+        /* allocate memory to store virtual and dma base address of
+         * per glist consistent memory
+         */
+        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
+                                        GFP_KERNEL);
+        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
+                                       GFP_KERNEL);
+
+        if (!lio->glists_virt_base || !lio->glists_dma_base) {
+                delete_glists(lio);
+                return -ENOMEM;
         }
 
         for (i = 0; i < num_iqs; i++) {
@@ -788,6 +811,16 @@ static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
 
                 INIT_LIST_HEAD(&lio->glist[i]);
 
+                lio->glists_virt_base[i] =
+                        lio_dma_alloc(oct,
+                                      lio->glist_entry_size * lio->tx_qsize,
+                                      &lio->glists_dma_base[i]);
+
+                if (!lio->glists_virt_base[i]) {
+                        delete_glists(lio);
+                        return -ENOMEM;
+                }
+
                 for (j = 0; j < lio->tx_qsize; j++) {
                         g = kzalloc_node(sizeof(*g), GFP_KERNEL,
                                          numa_node);
@@ -796,43 +829,18 @@ static int setup_glists(struct octeon_device *oct, struct lio *lio, int num_iqs)
                         if (!g)
                                 break;
 
-                        g->sg_size = ((ROUNDUP4(OCTNIC_MAX_SG) >> 2) *
-                                      OCT_SG_ENTRY_SIZE);
+                        g->sg = lio->glists_virt_base[i] +
+                                (j * lio->glist_entry_size);
 
-                        g->sg = kmalloc_node(g->sg_size + 8,
-                                             GFP_KERNEL, numa_node);
-                        if (!g->sg)
-                                g->sg = kmalloc(g->sg_size + 8, GFP_KERNEL);
-                        if (!g->sg) {
-                                kfree(g);
-                                break;
-                        }
-
-                        /* The gather component should be aligned on 64-bit
-                         * boundary
-                         */
-                        if (((unsigned long)g->sg) & 7) {
-                                g->adjust = 8 - (((unsigned long)g->sg) & 7);
-                                g->sg = (struct octeon_sg_entry *)
-                                        ((unsigned long)g->sg + g->adjust);
-                        }
-                        g->sg_dma_ptr = dma_map_single(&oct->pci_dev->dev,
-                                                       g->sg, g->sg_size,
-                                                       DMA_TO_DEVICE);
-                        if (dma_mapping_error(&oct->pci_dev->dev,
-                                              g->sg_dma_ptr)) {
-                                kfree((void *)((unsigned long)g->sg -
-                                               g->adjust));
-                                kfree(g);
-                                break;
-                        }
+                        g->sg_dma_ptr = lio->glists_dma_base[i] +
+                                        (j * lio->glist_entry_size);
 
                         list_add_tail(&g->list, &lio->glist[i]);
                 }
 
                 if (j != lio->tx_qsize) {
                         delete_glists(lio);
-                        return 1;
+                        return -ENOMEM;
                 }
         }
 
@@ -1885,9 +1893,6 @@ static void free_netsgbuf(void *buf)
                 i++;
         }
 
-        dma_sync_single_for_cpu(&lio->oct_dev->pci_dev->dev,
-                                g->sg_dma_ptr, g->sg_size, DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
         spin_lock(&lio->glist_lock[iq]);
         list_add_tail(&g->list, &lio->glist[iq]);
@@ -1933,9 +1938,6 @@ static void free_netsgbuf_with_resp(void *buf)
                 i++;
         }
 
-        dma_sync_single_for_cpu(&lio->oct_dev->pci_dev->dev,
-                                g->sg_dma_ptr, g->sg_size, DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
 
         spin_lock(&lio->glist_lock[iq]);
@@ -3273,8 +3275,6 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
                         i++;
                 }
 
-                dma_sync_single_for_device(&oct->pci_dev->dev, g->sg_dma_ptr,
-                                           g->sg_size, DMA_TO_DEVICE);
                 dptr = g->sg_dma_ptr;
 
                 if (OCTEON_CN23XX_PF(oct))
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
index 9d5e03502c76..7b83be4ce1fe 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c
@@ -108,6 +108,8 @@ struct octnic_gather {
          * received from the IP layer.
          */
         struct octeon_sg_entry *sg;
+
+        dma_addr_t sg_dma_ptr;
 };
 
 struct octeon_device_priv {
@@ -490,6 +492,9 @@ static void delete_glists(struct lio *lio)
         struct octnic_gather *g;
         int i;
 
+        kfree(lio->glist_lock);
+        lio->glist_lock = NULL;
+
         if (!lio->glist)
                 return;
 
@@ -497,17 +502,26 @@ static void delete_glists(struct lio *lio)
                 do {
                         g = (struct octnic_gather *)
                             list_delete_head(&lio->glist[i]);
-                        if (g) {
-                                if (g->sg)
-                                        kfree((void *)((unsigned long)g->sg -
-                                                        g->adjust));
+                        if (g)
                                 kfree(g);
-                        }
                 } while (g);
+
+                if (lio->glists_virt_base && lio->glists_virt_base[i]) {
+                        lio_dma_free(lio->oct_dev,
+                                     lio->glist_entry_size * lio->tx_qsize,
+                                     lio->glists_virt_base[i],
+                                     lio->glists_dma_base[i]);
+                }
         }
 
+        kfree(lio->glists_virt_base);
+        lio->glists_virt_base = NULL;
+
+        kfree(lio->glists_dma_base);
+        lio->glists_dma_base = NULL;
+
         kfree(lio->glist);
-        kfree(lio->glist_lock);
+        lio->glist = NULL;
 }
 
 /**
@@ -522,13 +536,30 @@ static int setup_glists(struct lio *lio, int num_iqs)
         lio->glist_lock =
             kzalloc(sizeof(*lio->glist_lock) * num_iqs, GFP_KERNEL);
         if (!lio->glist_lock)
-                return 1;
+                return -ENOMEM;
 
         lio->glist =
             kzalloc(sizeof(*lio->glist) * num_iqs, GFP_KERNEL);
         if (!lio->glist) {
                 kfree(lio->glist_lock);
-                return 1;
+                lio->glist_lock = NULL;
+                return -ENOMEM;
+        }
+
+        lio->glist_entry_size =
+                ROUNDUP8((ROUNDUP4(OCTNIC_MAX_SG) >> 2) * OCT_SG_ENTRY_SIZE);
+
+        /* allocate memory to store virtual and dma base address of
+         * per glist consistent memory
+         */
+        lio->glists_virt_base = kcalloc(num_iqs, sizeof(*lio->glists_virt_base),
+                                        GFP_KERNEL);
+        lio->glists_dma_base = kcalloc(num_iqs, sizeof(*lio->glists_dma_base),
+                                       GFP_KERNEL);
+
+        if (!lio->glists_virt_base || !lio->glists_dma_base) {
+                delete_glists(lio);
+                return -ENOMEM;
         }
 
         for (i = 0; i < num_iqs; i++) {
@@ -536,34 +567,33 @@ static int setup_glists(struct lio *lio, int num_iqs)
 
                 INIT_LIST_HEAD(&lio->glist[i]);
 
+                lio->glists_virt_base[i] =
+                        lio_dma_alloc(lio->oct_dev,
+                                      lio->glist_entry_size * lio->tx_qsize,
+                                      &lio->glists_dma_base[i]);
+
+                if (!lio->glists_virt_base[i]) {
+                        delete_glists(lio);
+                        return -ENOMEM;
+                }
+
                 for (j = 0; j < lio->tx_qsize; j++) {
                         g = kzalloc(sizeof(*g), GFP_KERNEL);
                         if (!g)
                                 break;
 
-                        g->sg_size = ((ROUNDUP4(OCTNIC_MAX_SG) >> 2) *
-                                      OCT_SG_ENTRY_SIZE);
+                        g->sg = lio->glists_virt_base[i] +
+                                (j * lio->glist_entry_size);
 
-                        g->sg = kmalloc(g->sg_size + 8, GFP_KERNEL);
-                        if (!g->sg) {
-                                kfree(g);
-                                break;
-                        }
+                        g->sg_dma_ptr = lio->glists_dma_base[i] +
+                                        (j * lio->glist_entry_size);
 
-                        /* The gather component should be aligned on 64-bit
-                         * boundary
-                         */
-                        if (((unsigned long)g->sg) & 7) {
-                                g->adjust = 8 - (((unsigned long)g->sg) & 7);
-                                g->sg = (struct octeon_sg_entry *)
-                                        ((unsigned long)g->sg + g->adjust);
-                        }
                         list_add_tail(&g->list, &lio->glist[i]);
                 }
 
                 if (j != lio->tx_qsize) {
                         delete_glists(lio);
-                        return 1;
+                        return -ENOMEM;
                 }
         }
 
@@ -1324,10 +1354,6 @@ static void free_netsgbuf(void *buf)
                 i++;
         }
 
-        dma_unmap_single(&lio->oct_dev->pci_dev->dev,
-                         finfo->dptr, g->sg_size,
-                         DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
 
         spin_lock(&lio->glist_lock[iq]);
@@ -1374,10 +1400,6 @@ static void free_netsgbuf_with_resp(void *buf)
                 i++;
         }
 
-        dma_unmap_single(&lio->oct_dev->pci_dev->dev,
-                         finfo->dptr, g->sg_size,
-                         DMA_TO_DEVICE);
-
         iq = skb_iq(lio, skb);
 
         spin_lock(&lio->glist_lock[iq]);
@@ -2382,23 +2404,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev)
                         i++;
                 }
 
-                dptr = dma_map_single(&oct->pci_dev->dev,
-                                      g->sg, g->sg_size,
-                                      DMA_TO_DEVICE);
-                if (dma_mapping_error(&oct->pci_dev->dev, dptr)) {
-                        dev_err(&oct->pci_dev->dev, "%s DMA mapping error 4\n",
-                                __func__);
-                        dma_unmap_single(&oct->pci_dev->dev, g->sg[0].ptr[0],
-                                         skb->len - skb->data_len,
-                                         DMA_TO_DEVICE);
-                        for (j = 1; j <= frags; j++) {
-                                frag = &skb_shinfo(skb)->frags[j - 1];
-                                dma_unmap_page(&oct->pci_dev->dev,
-                                               g->sg[j >> 2].ptr[j & 3],
-                                               frag->size, DMA_TO_DEVICE);
-                        }
-                        return NETDEV_TX_BUSY;
-                }
+                dptr = g->sg_dma_ptr;
 
                 ndata.cmd.cmd3.dptr = dptr;
                 finfo->dptr = dptr;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_config.h b/drivers/net/ethernet/cavium/liquidio/octeon_config.h
index b3dc2e9651a8..d29ebc531151 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_config.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_config.h
@@ -71,17 +71,17 @@
 #define   CN23XX_MAX_RINGS_PER_VF          8
 
 #define   CN23XX_MAX_INPUT_QUEUES       CN23XX_MAX_RINGS_PER_PF
-#define   CN23XX_MAX_IQ_DESCRIPTORS     2048
+#define   CN23XX_MAX_IQ_DESCRIPTORS     512
 #define   CN23XX_DB_MIN                 1
 #define   CN23XX_DB_MAX                 8
 #define   CN23XX_DB_TIMEOUT             1
 
 #define   CN23XX_MAX_OUTPUT_QUEUES      CN23XX_MAX_RINGS_PER_PF
-#define   CN23XX_MAX_OQ_DESCRIPTORS     2048
+#define   CN23XX_MAX_OQ_DESCRIPTORS     512
 #define   CN23XX_OQ_BUF_SIZE            1536
 #define   CN23XX_OQ_PKTSPER_INTR        128
 /*#define CAVIUM_ONLY_CN23XX_RX_PERF*/
-#define   CN23XX_OQ_REFIL_THRESHOLD     128
+#define   CN23XX_OQ_REFIL_THRESHOLD     16
 
 #define   CN23XX_OQ_INTR_PKT            64
 #define   CN23XX_OQ_INTR_TIME           100
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
index 0be87d119a97..79f809479af6 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.c
@@ -155,11 +155,6 @@ octeon_droq_destroy_ring_buffers(struct octeon_device *oct,
                         recv_buffer_destroy(droq->recv_buf_list[i].buffer,
                                             pg_info);
 
-                if (droq->desc_ring && droq->desc_ring[i].info_ptr)
-                        lio_unmap_ring_info(oct->pci_dev,
-                                            (u64)droq->
-                                            desc_ring[i].info_ptr,
-                                            OCT_DROQ_INFO_SIZE);
                 droq->recv_buf_list[i].buffer = NULL;
         }
 
@@ -211,10 +206,7 @@ int octeon_delete_droq(struct octeon_device *oct, u32 q_no)
         vfree(droq->recv_buf_list);
 
         if (droq->info_base_addr)
-                cnnic_free_aligned_dma(oct->pci_dev, droq->info_list,
-                                       droq->info_alloc_size,
-                                       droq->info_base_addr,
-                                       droq->info_list_dma);
+                lio_free_info_buffer(oct, droq);
 
         if (droq->desc_ring)
                 lio_dma_free(oct, (droq->max_count * OCT_DROQ_DESC_SIZE),
@@ -294,12 +286,7 @@ int octeon_init_droq(struct octeon_device *oct,
         dev_dbg(&oct->pci_dev->dev, "droq[%d]: num_desc: %d\n", q_no,
                 droq->max_count);
 
-        droq->info_list =
-                cnnic_numa_alloc_aligned_dma((droq->max_count *
-                                              OCT_DROQ_INFO_SIZE),
-                                             &droq->info_alloc_size,
-                                             &droq->info_base_addr,
-                                             numa_node);
+        droq->info_list = lio_alloc_info_buffer(oct, droq);
         if (!droq->info_list) {
                 dev_err(&oct->pci_dev->dev, "Cannot allocate memory for info list.\n");
                 lio_dma_free(oct, (droq->max_count * OCT_DROQ_DESC_SIZE),
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_droq.h b/drivers/net/ethernet/cavium/liquidio/octeon_droq.h
index e62074090681..6982c0af5ecc 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_droq.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_droq.h
@@ -325,10 +325,10 @@ struct octeon_droq {
         size_t desc_ring_dma;
 
         /** Info ptr list are allocated at this virtual address. */
-        size_t info_base_addr;
+        void *info_base_addr;
 
         /** DMA mapped address of the info list */
-        size_t info_list_dma;
+        dma_addr_t info_list_dma;
 
         /** Allocated size of info list. */
         u32 info_alloc_size;
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_main.h b/drivers/net/ethernet/cavium/liquidio/octeon_main.h
index aa36e9ae7676..bed9ef17bc26 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_main.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_main.h
@@ -140,48 +140,6 @@ err_release_region:
         return 1;
 }
 
-static inline void *
-cnnic_numa_alloc_aligned_dma(u32 size,
-                             u32 *alloc_size,
-                             size_t *orig_ptr,
-                             int numa_node)
-{
-        int retries = 0;
-        void *ptr = NULL;
-
-#define OCTEON_MAX_ALLOC_RETRIES     1
-        do {
-                struct page *page = NULL;
-
-                page = alloc_pages_node(numa_node,
-                                        GFP_KERNEL,
-                                        get_order(size));
-                if (!page)
-                        page = alloc_pages(GFP_KERNEL,
-                                           get_order(size));
-                ptr = (void *)page_address(page);
-                if ((unsigned long)ptr & 0x07) {
-                        __free_pages(page, get_order(size));
-                        ptr = NULL;
-                        /* Increment the size required if the first
-                         * attempt failed.
-                         */
-                        if (!retries)
-                                size += 7;
-                }
-                retries++;
-        } while ((retries <= OCTEON_MAX_ALLOC_RETRIES) && !ptr);
-
-        *alloc_size = size;
-        *orig_ptr = (unsigned long)ptr;
-        if ((unsigned long)ptr & 0x07)
-                ptr = (void *)(((unsigned long)ptr + 7) & ~(7UL));
-        return ptr;
-}
-
-#define cnnic_free_aligned_dma(pci_dev, ptr, size, orig_ptr, dma_addr) \
-                free_pages(orig_ptr, get_order(size))
-
 static inline int
 sleep_cond(wait_queue_head_t *wait_queue, int *condition)
 {
diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_network.h b/drivers/net/ethernet/cavium/liquidio/octeon_network.h
index 6bb89419006e..eef2a1e8a7e3 100644
--- a/drivers/net/ethernet/cavium/liquidio/octeon_network.h
+++ b/drivers/net/ethernet/cavium/liquidio/octeon_network.h
@@ -62,6 +62,9 @@ struct lio {
 
         /** Array of gather component linked lists */
         struct list_head *glist;
+        void **glists_virt_base;
+        dma_addr_t *glists_dma_base;
+        u32 glist_entry_size;
 
         /** Pointer to the NIC properties for the Octeon device this network
          *  interface is associated with.
@@ -344,6 +347,29 @@ static inline void tx_buffer_free(void *buffer)
 #define lio_dma_free(oct, size, virt_addr, dma_addr) \
         dma_free_coherent(&(oct)->pci_dev->dev, size, virt_addr, dma_addr)
 
+static inline void *
+lio_alloc_info_buffer(struct octeon_device *oct,
+                      struct octeon_droq *droq)
+{
+        void *virt_ptr;
+
+        virt_ptr = lio_dma_alloc(oct, (droq->max_count * OCT_DROQ_INFO_SIZE),
+                                 &droq->info_list_dma);
+        if (virt_ptr) {
+                droq->info_alloc_size = droq->max_count * OCT_DROQ_INFO_SIZE;
+                droq->info_base_addr = virt_ptr;
+        }
+
+        return virt_ptr;
+}
+
+static inline void lio_free_info_buffer(struct octeon_device *oct,
+                                        struct octeon_droq *droq)
+{
+        lio_dma_free(oct, droq->info_alloc_size, droq->info_base_addr,
+                     droq->info_list_dma);
+}
+
 static inline
 void *get_rbd(struct sk_buff *skb)
 {
@@ -359,22 +385,7 @@ void *get_rbd(struct sk_buff *skb)
 static inline u64
 lio_map_ring_info(struct octeon_droq *droq, u32 i)
 {
-        dma_addr_t dma_addr;
-        struct octeon_device *oct = droq->oct_dev;
-
-        dma_addr = dma_map_single(&oct->pci_dev->dev, &droq->info_list[i],
-                                  OCT_DROQ_INFO_SIZE, DMA_FROM_DEVICE);
-
-        WARN_ON(dma_mapping_error(&oct->pci_dev->dev, dma_addr));
-
-        return (u64)dma_addr;
-}
-
-static inline void
-lio_unmap_ring_info(struct pci_dev *pci_dev,
-                    u64 info_ptr, u32 size)
-{
-        dma_unmap_single(&pci_dev->dev, info_ptr, size, DMA_FROM_DEVICE);
+        return droq->info_list_dma + (i * sizeof(struct octeon_droq_info));
 }
 
 static inline u64
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index e739c7153562..2269ff562d95 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -269,6 +269,7 @@ struct nicvf {
 #define MAX_QUEUES_PER_QSET                     8
         struct queue_set        *qs;
         struct nicvf_cq_poll    *napi[8];
+        void                    *iommu_domain;
         u8                      vf_id;
         u8                      sqs_id;
         bool                    sqs_mode;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 6feaa24bcfd4..24017588f531 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -16,6 +16,7 @@
 #include <linux/log2.h>
 #include <linux/prefetch.h>
 #include <linux/irq.h>
+#include <linux/iommu.h>
 
 #include "nic_reg.h"
 #include "nic.h"
@@ -525,7 +526,12 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
                         /* Get actual TSO descriptors and free them */
                         tso_sqe =
                          (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_unmap_sndq_buffers(nic, sq, hdr->rsvd2,
+                                                 tso_sqe->subdesc_cnt);
                         nicvf_put_sq_desc(sq, tso_sqe->subdesc_cnt + 1);
+                } else {
+                        nicvf_unmap_sndq_buffers(nic, sq, cqe_tx->sqe_ptr,
+                                                 hdr->subdesc_cnt);
                 }
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
                 prefetch(skb);
@@ -576,6 +582,7 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
 {
         struct sk_buff *skb;
         struct nicvf *nic = netdev_priv(netdev);
+        struct nicvf *snic = nic;
         int err = 0;
         int rq_idx;
 
@@ -592,7 +599,7 @@ static void nicvf_rcv_pkt_handler(struct net_device *netdev,
         if (err && !cqe_rx->rb_cnt)
                 return;
 
-        skb = nicvf_get_rcv_skb(nic, cqe_rx);
+        skb = nicvf_get_rcv_skb(snic, cqe_rx);
         if (!skb) {
                 netdev_dbg(nic->netdev, "Packet not received\n");
                 return;
@@ -1643,6 +1650,9 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!pass1_silicon(nic->pdev))
                 nic->hw_tso = true;
 
+        /* Get iommu domain for iova to physical addr conversion */
+        nic->iommu_domain = iommu_get_domain_for_dev(dev);
+
         pci_read_config_word(nic->pdev, PCI_SUBSYSTEM_ID, &sdevid);
         if (sdevid == 0xA134)
                 nic->t88 = true;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index ac0390be3b12..f13289f0d238 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -10,6 +10,7 @@
 #include <linux/netdevice.h>
 #include <linux/ip.h>
 #include <linux/etherdevice.h>
+#include <linux/iommu.h>
 #include <net/ip.h>
 #include <net/tso.h>
 
@@ -18,6 +19,16 @@
 #include "q_struct.h"
 #include "nicvf_queues.h"
 
+#define NICVF_PAGE_ORDER ((PAGE_SIZE <= 4096) ?  PAGE_ALLOC_COSTLY_ORDER : 0)
+
+static inline u64 nicvf_iova_to_phys(struct nicvf *nic, dma_addr_t dma_addr)
+{
+        /* Translation is installed only when IOMMU is present */
+        if (nic->iommu_domain)
+                return iommu_iova_to_phys(nic->iommu_domain, dma_addr);
+        return dma_addr;
+}
+
 static void nicvf_get_page(struct nicvf *nic)
 {
         if (!nic->rb_pageref || !nic->rb_page)
@@ -87,7 +98,7 @@ static void nicvf_free_q_desc_mem(struct nicvf *nic, struct q_desc_mem *dmem)
 static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, gfp_t gfp,
                                          u32 buf_len, u64 **rbuf)
 {
-        int order = (PAGE_SIZE <= 4096) ?  PAGE_ALLOC_COSTLY_ORDER : 0;
+        int order = NICVF_PAGE_ORDER;
 
         /* Check if request can be accomodated in previous allocated page */
         if (nic->rb_page &&
@@ -97,22 +108,27 @@ static inline int nicvf_alloc_rcv_buffer(struct nicvf *nic, gfp_t gfp,
         }
 
         nicvf_get_page(nic);
-        nic->rb_page = NULL;
 
         /* Allocate a new page */
+        nic->rb_page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
+                                   order);
         if (!nic->rb_page) {
-                nic->rb_page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
-                                           order);
-                if (!nic->rb_page) {
-                        this_cpu_inc(nic->pnicvf->drv_stats->
-                                     rcv_buffer_alloc_failures);
-                        return -ENOMEM;
-                }
-                nic->rb_page_offset = 0;
+                this_cpu_inc(nic->pnicvf->drv_stats->rcv_buffer_alloc_failures);
+                return -ENOMEM;
         }
-
+        nic->rb_page_offset = 0;
 ret:
-        *rbuf = (u64 *)((u64)page_address(nic->rb_page) + nic->rb_page_offset);
+        /* HW will ensure data coherency, CPU sync not required */
+        *rbuf = (u64 *)((u64)dma_map_page_attrs(&nic->pdev->dev, nic->rb_page,
+                                                nic->rb_page_offset, buf_len,
+                                                DMA_FROM_DEVICE,
+                                                DMA_ATTR_SKIP_CPU_SYNC));
+        if (dma_mapping_error(&nic->pdev->dev, (dma_addr_t)*rbuf)) {
+                if (!nic->rb_page_offset)
+                        __free_pages(nic->rb_page, order);
+                nic->rb_page = NULL;
+                return -ENOMEM;
+        }
         nic->rb_page_offset += buf_len;
 
         return 0;
@@ -158,16 +174,21 @@ static int  nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
         rbdr->dma_size = buf_size;
         rbdr->enable = true;
         rbdr->thresh = RBDR_THRESH;
+        rbdr->head = 0;
+        rbdr->tail = 0;
 
         nic->rb_page = NULL;
         for (idx = 0; idx < ring_len; idx++) {
                 err = nicvf_alloc_rcv_buffer(nic, GFP_KERNEL, RCV_FRAG_LEN,
                                              &rbuf);
-                if (err)
+                if (err) {
+                        /* To free already allocated and mapped ones */
+                        rbdr->tail = idx - 1;
                         return err;
+                }
 
                 desc = GET_RBDR_DESC(rbdr, idx);
-                desc->buf_addr = virt_to_phys(rbuf) >> NICVF_RCV_BUF_ALIGN;
+                desc->buf_addr = (u64)rbuf >> NICVF_RCV_BUF_ALIGN;
         }
 
         nicvf_get_page(nic);
@@ -179,7 +200,7 @@ static int  nicvf_init_rbdr(struct nicvf *nic, struct rbdr *rbdr,
 static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
 {
         int head, tail;
-        u64 buf_addr;
+        u64 buf_addr, phys_addr;
         struct rbdr_entry_t *desc;
 
         if (!rbdr)
@@ -192,18 +213,26 @@ static void nicvf_free_rbdr(struct nicvf *nic, struct rbdr *rbdr)
         head = rbdr->head;
         tail = rbdr->tail;
 
-        /* Free SKBs */
+        /* Release page references */
         while (head != tail) {
                 desc = GET_RBDR_DESC(rbdr, head);
-                buf_addr = desc->buf_addr << NICVF_RCV_BUF_ALIGN;
-                put_page(virt_to_page(phys_to_virt(buf_addr)));
+                buf_addr = ((u64)desc->buf_addr) << NICVF_RCV_BUF_ALIGN;
+                phys_addr = nicvf_iova_to_phys(nic, buf_addr);
+                dma_unmap_page_attrs(&nic->pdev->dev, buf_addr, RCV_FRAG_LEN,
+                                     DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+                if (phys_addr)
+                        put_page(virt_to_page(phys_to_virt(phys_addr)));
                 head++;
                 head &= (rbdr->dmem.q_len - 1);
         }
-        /* Free SKB of tail desc */
+        /* Release buffer of tail desc */
         desc = GET_RBDR_DESC(rbdr, tail);
-        buf_addr = desc->buf_addr << NICVF_RCV_BUF_ALIGN;
-        put_page(virt_to_page(phys_to_virt(buf_addr)));
+        buf_addr = ((u64)desc->buf_addr) << NICVF_RCV_BUF_ALIGN;
+        phys_addr = nicvf_iova_to_phys(nic, buf_addr);
+        dma_unmap_page_attrs(&nic->pdev->dev, buf_addr, RCV_FRAG_LEN,
+                             DMA_FROM_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+        if (phys_addr)
+                put_page(virt_to_page(phys_to_virt(phys_addr)));
 
         /* Free RBDR ring */
         nicvf_free_q_desc_mem(nic, &rbdr->dmem);
@@ -250,7 +279,7 @@ refill:
                         break;
 
                 desc = GET_RBDR_DESC(rbdr, tail);
-                desc->buf_addr = virt_to_phys(rbuf) >> NICVF_RCV_BUF_ALIGN;
+                desc->buf_addr = (u64)rbuf >> NICVF_RCV_BUF_ALIGN;
                 refill_rb_cnt--;
                 new_rb++;
         }
@@ -361,9 +390,29 @@ static int nicvf_init_snd_queue(struct nicvf *nic,
         return 0;
 }
 
+void nicvf_unmap_sndq_buffers(struct nicvf *nic, struct snd_queue *sq,
+                              int hdr_sqe, u8 subdesc_cnt)
+{
+        u8 idx;
+        struct sq_gather_subdesc *gather;
+
+        /* Unmap DMA mapped skb data buffers */
+        for (idx = 0; idx < subdesc_cnt; idx++) {
+                hdr_sqe++;
+                hdr_sqe &= (sq->dmem.q_len - 1);
+                gather = (struct sq_gather_subdesc *)GET_SQ_DESC(sq, hdr_sqe);
+                /* HW will ensure data coherency, CPU sync not required */
+                dma_unmap_page_attrs(&nic->pdev->dev, gather->addr,
+                                     gather->size, DMA_TO_DEVICE,
+                                     DMA_ATTR_SKIP_CPU_SYNC);
+        }
+}
+
 static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
 {
         struct sk_buff *skb;
+        struct sq_hdr_subdesc *hdr;
+        struct sq_hdr_subdesc *tso_sqe;
 
         if (!sq)
                 return;
@@ -379,8 +428,22 @@ static void nicvf_free_snd_queue(struct nicvf *nic, struct snd_queue *sq)
         smp_rmb();
         while (sq->head != sq->tail) {
                 skb = (struct sk_buff *)sq->skbuff[sq->head];
-                if (skb)
-                        dev_kfree_skb_any(skb);
+                if (!skb)
+                        goto next;
+                hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, sq->head);
+                /* Check for dummy descriptor used for HW TSO offload on 88xx */
+                if (hdr->dont_send) {
+                        /* Get actual TSO descriptors and unmap them */
+                        tso_sqe =
+                         (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_unmap_sndq_buffers(nic, sq, hdr->rsvd2,
+                                                 tso_sqe->subdesc_cnt);
+                } else {
+                        nicvf_unmap_sndq_buffers(nic, sq, sq->head,
+                                                 hdr->subdesc_cnt);
+                }
+                dev_kfree_skb_any(skb);
+next:
                 sq->head++;
                 sq->head &= (sq->dmem.q_len - 1);
         }
@@ -559,9 +622,11 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs,
         nicvf_send_msg_to_pf(nic, &mbx);
 
         if (!nic->sqs_mode && (qidx == 0)) {
-                /* Enable checking L3/L4 length and TCP/UDP checksums */
+                /* Enable checking L3/L4 length and TCP/UDP checksums
+                 * Also allow IPv6 pkts with zero UDP checksum.
+                 */
                 nicvf_queue_reg_write(nic, NIC_QSET_RQ_GEN_CFG, 0,
-                                      (BIT(24) | BIT(23) | BIT(21)));
+                                      (BIT(24) | BIT(23) | BIT(21) | BIT(20)));
                 nicvf_config_vlan_stripping(nic, nic->netdev->features);
         }
 
@@ -882,6 +947,14 @@ static inline int nicvf_get_sq_desc(struct snd_queue *sq, int desc_cnt)
         return qentry;
 }
 
+/* Rollback to previous tail pointer when descriptors not used */
+static inline void nicvf_rollback_sq_desc(struct snd_queue *sq,
+                                          int qentry, int desc_cnt)
+{
+        sq->tail = qentry;
+        atomic_add(desc_cnt, &sq->free_cnt);
+}
+
 /* Free descriptor back to SQ for future use */
 void nicvf_put_sq_desc(struct snd_queue *sq, int desc_cnt)
 {
@@ -1207,8 +1280,9 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct snd_queue *sq,
                         struct sk_buff *skb, u8 sq_num)
 {
         int i, size;
-        int subdesc_cnt, tso_sqe = 0;
+        int subdesc_cnt, hdr_sqe = 0;
         int qentry;
+        u64 dma_addr;
 
         subdesc_cnt = nicvf_sq_subdesc_required(nic, skb);
         if (subdesc_cnt > atomic_read(&sq->free_cnt))
@@ -1223,12 +1297,21 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct snd_queue *sq,
         /* Add SQ header subdesc */
         nicvf_sq_add_hdr_subdesc(nic, sq, qentry, subdesc_cnt - 1,
                                  skb, skb->len);
-        tso_sqe = qentry;
+        hdr_sqe = qentry;
 
         /* Add SQ gather subdescs */
         qentry = nicvf_get_nxt_sqentry(sq, qentry);
         size = skb_is_nonlinear(skb) ? skb_headlen(skb) : skb->len;
-        nicvf_sq_add_gather_subdesc(sq, qentry, size, virt_to_phys(skb->data));
+        /* HW will ensure data coherency, CPU sync not required */
+        dma_addr = dma_map_page_attrs(&nic->pdev->dev, virt_to_page(skb->data),
+                                      offset_in_page(skb->data), size,
+                                      DMA_TO_DEVICE, DMA_ATTR_SKIP_CPU_SYNC);
+        if (dma_mapping_error(&nic->pdev->dev, dma_addr)) {
+                nicvf_rollback_sq_desc(sq, qentry, subdesc_cnt);
+                return 0;
+        }
+
+        nicvf_sq_add_gather_subdesc(sq, qentry, size, dma_addr);
 
         /* Check for scattered buffer */
         if (!skb_is_nonlinear(skb))
@@ -1241,15 +1324,26 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct snd_queue *sq,
 
                 qentry = nicvf_get_nxt_sqentry(sq, qentry);
                 size = skb_frag_size(frag);
-                nicvf_sq_add_gather_subdesc(sq, qentry, size,
-                                            virt_to_phys(
-                                            skb_frag_address(frag)));
+                dma_addr = dma_map_page_attrs(&nic->pdev->dev,
+                                              skb_frag_page(frag),
+                                              frag->page_offset, size,
+                                              DMA_TO_DEVICE,
+                                              DMA_ATTR_SKIP_CPU_SYNC);
+                if (dma_mapping_error(&nic->pdev->dev, dma_addr)) {
+                        /* Free entire chain of mapped buffers
+                         * here 'i' = frags mapped + above mapped skb->data
+                         */
+                        nicvf_unmap_sndq_buffers(nic, sq, hdr_sqe, i);
+                        nicvf_rollback_sq_desc(sq, qentry, subdesc_cnt);
+                        return 0;
+                }
+                nicvf_sq_add_gather_subdesc(sq, qentry, size, dma_addr);
         }
 
 doorbell:
         if (nic->t88 && skb_shinfo(skb)->gso_size) {
                 qentry = nicvf_get_nxt_sqentry(sq, qentry);
-                nicvf_sq_add_cqe_subdesc(sq, qentry, tso_sqe, skb);
+                nicvf_sq_add_cqe_subdesc(sq, qentry, hdr_sqe, skb);
         }
 
         nicvf_sq_doorbell(nic, skb, sq_num, subdesc_cnt);
@@ -1282,6 +1376,7 @@ struct sk_buff *nicvf_get_rcv_skb(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
         int offset;
         u16 *rb_lens = NULL;
         u64 *rb_ptrs = NULL;
+        u64 phys_addr;
 
         rb_lens = (void *)cqe_rx + (3 * sizeof(u64));
         /* Except 88xx pass1 on all other chips CQE_RX2_S is added to
@@ -1296,15 +1391,23 @@ struct sk_buff *nicvf_get_rcv_skb(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
         else
                 rb_ptrs = (void *)cqe_rx + (7 * sizeof(u64));
 
-        netdev_dbg(nic->netdev, "%s rb_cnt %d rb0_ptr %llx rb0_sz %d\n",
-                   __func__, cqe_rx->rb_cnt, cqe_rx->rb0_ptr, cqe_rx->rb0_sz);
-
         for (frag = 0; frag < cqe_rx->rb_cnt; frag++) {
                 payload_len = rb_lens[frag_num(frag)];
+                phys_addr = nicvf_iova_to_phys(nic, *rb_ptrs);
+                if (!phys_addr) {
+                        if (skb)
+                                dev_kfree_skb_any(skb);
+                        return NULL;
+                }
+
                 if (!frag) {
                         /* First fragment */
+                        dma_unmap_page_attrs(&nic->pdev->dev,
+                                             *rb_ptrs - cqe_rx->align_pad,
+                                             RCV_FRAG_LEN, DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
                         skb = nicvf_rb_ptr_to_skb(nic,
-                                                  *rb_ptrs - cqe_rx->align_pad,
+                                                  phys_addr - cqe_rx->align_pad,
                                                   payload_len);
                         if (!skb)
                                 return NULL;
@@ -1312,8 +1415,11 @@ struct sk_buff *nicvf_get_rcv_skb(struct nicvf *nic, struct cqe_rx_t *cqe_rx)
                         skb_put(skb, payload_len);
                 } else {
                         /* Add fragments */
-                        page = virt_to_page(phys_to_virt(*rb_ptrs));
-                        offset = phys_to_virt(*rb_ptrs) - page_address(page);
+                        dma_unmap_page_attrs(&nic->pdev->dev, *rb_ptrs,
+                                             RCV_FRAG_LEN, DMA_FROM_DEVICE,
+                                             DMA_ATTR_SKIP_CPU_SYNC);
+                        page = virt_to_page(phys_to_virt(phys_addr));
+                        offset = phys_to_virt(phys_addr) - page_address(page);
                         skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
                                         offset, payload_len, RCV_FRAG_LEN);
                 }
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
index 5cb84da99a2d..10cb4b84625b 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.h
@@ -87,7 +87,7 @@
 #define RCV_BUF_COUNT           (1ULL << (RBDR_SIZE + 13))
 #define MAX_RCV_BUF_COUNT       (1ULL << (RBDR_SIZE6 + 13))
 #define RBDR_THRESH             (RCV_BUF_COUNT / 2)
-#define DMA_BUFFER_LEN          2048 /* In multiples of 128bytes */
+#define DMA_BUFFER_LEN          1536 /* In multiples of 128bytes */
 #define RCV_FRAG_LEN     (SKB_DATA_ALIGN(DMA_BUFFER_LEN + NET_SKB_PAD) + \
                          SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 
@@ -301,6 +301,8 @@ struct queue_set {
 
 #define CQ_ERR_MASK     (CQ_WR_FULL | CQ_WR_DISABLE | CQ_WR_FAULT)
 
+void nicvf_unmap_sndq_buffers(struct nicvf *nic, struct snd_queue *sq,
+                              int hdr_sqe, u8 subdesc_cnt);
 void nicvf_config_vlan_stripping(struct nicvf *nic,
                                  netdev_features_t features);
 int nicvf_set_qset_resources(struct nicvf *nic);
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 4c8e8cf730bb..a0ca68ce3fbb 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -123,14 +123,45 @@ static int bgx_poll_reg(struct bgx *bgx, u8 lmac, u64 reg, u64 mask, bool zero)
         return 1;
 }
 
+static int max_bgx_per_node;
+static void set_max_bgx_per_node(struct pci_dev *pdev)
+{
+        u16 sdevid;
+
+        if (max_bgx_per_node)
+                return;
+
+        pci_read_config_word(pdev, PCI_SUBSYSTEM_ID, &sdevid);
+        switch (sdevid) {
+        case PCI_SUBSYS_DEVID_81XX_BGX:
+        case PCI_SUBSYS_DEVID_81XX_RGX:
+                max_bgx_per_node = MAX_BGX_PER_CN81XX;
+                break;
+        case PCI_SUBSYS_DEVID_83XX_BGX:
+                max_bgx_per_node = MAX_BGX_PER_CN83XX;
+                break;
+        case PCI_SUBSYS_DEVID_88XX_BGX:
+        default:
+                max_bgx_per_node = MAX_BGX_PER_CN88XX;
+                break;
+        }
+}
+
+static struct bgx *get_bgx(int node, int bgx_idx)
+{
+        int idx = (node * max_bgx_per_node) + bgx_idx;
+
+        return bgx_vnic[idx];
+}
+
 /* Return number of BGX present in HW */
 unsigned bgx_get_map(int node)
 {
         int i;
         unsigned map = 0;
 
-        for (i = 0; i < MAX_BGX_PER_NODE; i++) {
-                if (bgx_vnic[(node * MAX_BGX_PER_NODE) + i])
+        for (i = 0; i < max_bgx_per_node; i++) {
+                if (bgx_vnic[(node * max_bgx_per_node) + i])
                         map |= (1 << i);
         }
 
@@ -143,7 +174,7 @@ int bgx_get_lmac_count(int node, int bgx_idx)
 {
         struct bgx *bgx;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (bgx)
                 return bgx->lmac_count;
 
@@ -158,7 +189,7 @@ void bgx_get_lmac_link_state(int node, int bgx_idx, int lmacid, void *status)
         struct bgx *bgx;
         struct lmac *lmac;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return;
 
@@ -172,7 +203,7 @@ EXPORT_SYMBOL(bgx_get_lmac_link_state);
 
 const u8 *bgx_get_lmac_mac(int node, int bgx_idx, int lmacid)
 {
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
 
         if (bgx)
                 return bgx->lmac[lmacid].mac;
@@ -183,7 +214,7 @@ EXPORT_SYMBOL(bgx_get_lmac_mac);
 
 void bgx_set_lmac_mac(int node, int bgx_idx, int lmacid, const u8 *mac)
 {
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
 
         if (!bgx)
                 return;
@@ -194,7 +225,7 @@ EXPORT_SYMBOL(bgx_set_lmac_mac);
 
 void bgx_lmac_rx_tx_enable(int node, int bgx_idx, int lmacid, bool enable)
 {
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
         struct lmac *lmac;
         u64 cfg;
 
@@ -217,7 +248,7 @@ EXPORT_SYMBOL(bgx_lmac_rx_tx_enable);
 void bgx_lmac_get_pfc(int node, int bgx_idx, int lmacid, void *pause)
 {
         struct pfc *pfc = (struct pfc *)pause;
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_CN88XX) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
         struct lmac *lmac;
         u64 cfg;
 
@@ -237,7 +268,7 @@ EXPORT_SYMBOL(bgx_lmac_get_pfc);
 void bgx_lmac_set_pfc(int node, int bgx_idx, int lmacid, void *pause)
 {
         struct pfc *pfc = (struct pfc *)pause;
-        struct bgx *bgx = bgx_vnic[(node * MAX_BGX_PER_CN88XX) + bgx_idx];
+        struct bgx *bgx = get_bgx(node, bgx_idx);
         struct lmac *lmac;
         u64 cfg;
 
@@ -369,7 +400,7 @@ u64 bgx_get_rx_stats(int node, int bgx_idx, int lmac, int idx)
 {
         struct bgx *bgx;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return 0;
 
@@ -383,7 +414,7 @@ u64 bgx_get_tx_stats(int node, int bgx_idx, int lmac, int idx)
 {
         struct bgx *bgx;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return 0;
 
@@ -411,7 +442,7 @@ void bgx_lmac_internal_loopback(int node, int bgx_idx,
         struct lmac *lmac;
         u64    cfg;
 
-        bgx = bgx_vnic[(node * MAX_BGX_PER_NODE) + bgx_idx];
+        bgx = get_bgx(node, bgx_idx);
         if (!bgx)
                 return;
 
@@ -1011,12 +1042,6 @@ static void bgx_print_qlm_mode(struct bgx *bgx, u8 lmacid)
                         dev_info(dev, "%s: 40G_KR4\n", (char *)str);
                 break;
         case BGX_MODE_QSGMII:
-                if ((lmacid == 0) &&
-                    (bgx_get_lane2sds_cfg(bgx, lmac) != lmacid))
-                        return;
-                if ((lmacid == 2) &&
-                    (bgx_get_lane2sds_cfg(bgx, lmac) == lmacid))
-                        return;
                 dev_info(dev, "%s: QSGMII\n", (char *)str);
                 break;
         case BGX_MODE_RGMII:
@@ -1334,11 +1359,13 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_release_regions;
         }
 
+        set_max_bgx_per_node(pdev);
+
         pci_read_config_word(pdev, PCI_DEVICE_ID, &sdevid);
         if (sdevid != PCI_DEVICE_ID_THUNDER_RGX) {
                 bgx->bgx_id = (pci_resource_start(pdev,
                         PCI_CFG_REG_BAR_NUM) >> 24) & BGX_ID_MASK;
-                bgx->bgx_id += nic_get_node_id(pdev) * MAX_BGX_PER_NODE;
+                bgx->bgx_id += nic_get_node_id(pdev) * max_bgx_per_node;
                 bgx->max_lmac = MAX_LMAC_PER_BGX;
                 bgx_vnic[bgx->bgx_id] = bgx;
         } else {
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index a60f189429bb..6b7fe6fdd13b 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -16,13 +16,13 @@
 /* Subsystem device IDs */
 #define PCI_SUBSYS_DEVID_88XX_BGX               0xA126
 #define PCI_SUBSYS_DEVID_81XX_BGX               0xA226
+#define PCI_SUBSYS_DEVID_81XX_RGX               0xA254
 #define PCI_SUBSYS_DEVID_83XX_BGX               0xA326
 
 #define    MAX_BGX_THUNDER                      8 /* Max 2 nodes, 4 per node */
 #define    MAX_BGX_PER_CN88XX                   2
 #define    MAX_BGX_PER_CN81XX                   3 /* 2 BGXs + 1 RGX */
 #define    MAX_BGX_PER_CN83XX                   4
-#define    MAX_BGX_PER_NODE                     4
 #define    MAX_LMAC_PER_BGX                     4
 #define    MAX_BGX_CHANS_PER_LMAC               16
 #define    MAX_DMAC_PER_LMAC                    8
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 30e855004c57..02dd5246dfae 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -4939,8 +4939,9 @@ static int
 __be_cmd_set_logical_link_config(struct be_adapter *adapter,
                                  int link_state, int version, u8 domain)
 {
-        struct be_mcc_wrb *wrb;
         struct be_cmd_req_set_ll_link *req;
+        struct be_mcc_wrb *wrb;
+        u32 link_config = 0;
         int status;
 
         mutex_lock(&adapter->mcc_lock);
@@ -4962,10 +4963,12 @@ __be_cmd_set_logical_link_config(struct be_adapter *adapter,
 
         if (link_state == IFLA_VF_LINK_STATE_ENABLE ||
             link_state == IFLA_VF_LINK_STATE_AUTO)
-                req->link_config |= PLINK_ENABLE;
+                link_config |= PLINK_ENABLE;
 
         if (link_state == IFLA_VF_LINK_STATE_AUTO)
-                req->link_config |= PLINK_TRACK;
+                link_config |= PLINK_TRACK;
+
+        req->link_config = cpu_to_le32(link_config);
 
         status = be_mcc_notify_wait(adapter);
 err:
diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c
index 992ebe973d25..f819843e2bae 100644
--- a/drivers/net/ethernet/ezchip/nps_enet.c
+++ b/drivers/net/ethernet/ezchip/nps_enet.c
@@ -189,11 +189,9 @@ static int nps_enet_poll(struct napi_struct *napi, int budget)
 
         nps_enet_tx_handler(ndev);
         work_done = nps_enet_rx_handler(ndev);
-        if (work_done < budget) {
+        if ((work_done < budget) && napi_complete_done(napi, work_done)) {
                 u32 buf_int_enable_value = 0;
 
-                napi_complete_done(napi, work_done);
-
                 /* set tx_done and rx_rdy bits */
                 buf_int_enable_value |= NPS_ENET_ENABLE << RX_RDY_SHIFT;
                 buf_int_enable_value |= NPS_ENET_ENABLE << TX_DONE_SHIFT;
diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
index 928b0df2b8e0..ade6b3e4ed13 100644
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -28,8 +28,10 @@
 #include <linux/io.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
+#include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
+#include <linux/property.h>
 #include <net/ip.h>
 #include <net/ncsi.h>
 
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
index 3239d27143b9..bdd8cdd732fb 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -82,9 +82,12 @@ void hns_mac_get_link_status(struct hns_mac_cb *mac_cb, u32 *link_status)
         else
                 *link_status = 0;
 
-        ret = mac_cb->dsaf_dev->misc_op->get_sfp_prsnt(mac_cb, &sfp_prsnt);
-        if (!ret)
-                *link_status = *link_status && sfp_prsnt;
+        if (mac_cb->media_type == HNAE_MEDIA_TYPE_FIBER) {
+                ret = mac_cb->dsaf_dev->misc_op->get_sfp_prsnt(mac_cb,
+                                                               &sfp_prsnt);
+                if (!ret)
+                        *link_status = *link_status && sfp_prsnt;
+        }
 
         mac_cb->link = *link_status;
 }
@@ -855,7 +858,7 @@ static int  hns_mac_get_info(struct hns_mac_cb *mac_cb)
                 of_node_put(np);
 
                 np = of_parse_phandle(to_of_node(mac_cb->fw_port),
-                                        "serdes-syscon", 0);
+                                      "serdes-syscon", 0);
                 syscon = syscon_node_to_regmap(np);
                 of_node_put(np);
                 if (IS_ERR_OR_NULL(syscon)) {
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
index 90dbda792614..403ea9db6dbd 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
@@ -1519,6 +1519,7 @@ static void hns_dsaf_set_mac_key(
         mac_key->high.bits.mac_3 = addr[3];
         mac_key->low.bits.mac_4 = addr[4];
         mac_key->low.bits.mac_5 = addr[5];
+        mac_key->low.bits.port_vlan = 0;
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_VLAN_M,
                        DSAF_TBL_TCAM_KEY_VLAN_S, vlan_id);
         dsaf_set_field(mac_key->low.bits.port_vlan, DSAF_TBL_TCAM_KEY_PORT_M,
@@ -2924,10 +2925,11 @@ void hns_dsaf_set_promisc_tcam(struct dsaf_device *dsaf_dev,
         /* find the tcam entry index for promisc */
         entry_index = dsaf_promisc_tcam_entry(port);
 
+        memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
+        memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
+
         /* config key mask */
         if (enable) {
-                memset(&tbl_tcam_data, 0, sizeof(tbl_tcam_data));
-                memset(&tbl_tcam_mask, 0, sizeof(tbl_tcam_mask));
                 dsaf_set_field(tbl_tcam_data.low.bits.port_vlan,
                                DSAF_TBL_TCAM_KEY_PORT_M,
                                DSAF_TBL_TCAM_KEY_PORT_S, port);
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
index a2c22d084ce9..e13aa064a8e9 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
@@ -461,6 +461,32 @@ int hns_mac_get_sfp_prsnt(struct hns_mac_cb *mac_cb, int *sfp_prsnt)
         return 0;
 }
 
+int hns_mac_get_sfp_prsnt_acpi(struct hns_mac_cb *mac_cb, int *sfp_prsnt)
+{
+        union acpi_object *obj;
+        union acpi_object obj_args, argv4;
+
+        obj_args.integer.type = ACPI_TYPE_INTEGER;
+        obj_args.integer.value = mac_cb->mac_id;
+
+        argv4.type = ACPI_TYPE_PACKAGE,
+        argv4.package.count = 1,
+        argv4.package.elements = &obj_args,
+
+        obj = acpi_evaluate_dsm(ACPI_HANDLE(mac_cb->dev),
+                                hns_dsaf_acpi_dsm_uuid, 0,
+                                HNS_OP_GET_SFP_STAT_FUNC, &argv4);
+
+        if (!obj || obj->type != ACPI_TYPE_INTEGER)
+                return -ENODEV;
+
+        *sfp_prsnt = obj->integer.value;
+
+        ACPI_FREE(obj);
+
+        return 0;
+}
+
 /**
  * hns_mac_config_sds_loopback - set loop back for serdes
  * @mac_cb: mac control block
@@ -592,7 +618,7 @@ struct dsaf_misc_op *hns_misc_op_get(struct dsaf_device *dsaf_dev)
                 misc_op->hns_dsaf_roce_srst = hns_dsaf_roce_srst_acpi;
 
                 misc_op->get_phy_if = hns_mac_get_phy_if_acpi;
-                misc_op->get_sfp_prsnt = hns_mac_get_sfp_prsnt;
+                misc_op->get_sfp_prsnt = hns_mac_get_sfp_prsnt_acpi;
 
                 misc_op->cfg_serdes_loopback = hns_mac_config_sds_loopback_acpi;
         } else {
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 275c2e2349ad..c44036d5761a 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -2589,8 +2589,6 @@ static int emac_dt_mdio_probe(struct emac_instance *dev)
 static int emac_dt_phy_connect(struct emac_instance *dev,
                                struct device_node *phy_handle)
 {
-        int res;
-
         dev->phy.def = devm_kzalloc(&dev->ofdev->dev, sizeof(*dev->phy.def),
                                     GFP_KERNEL);
         if (!dev->phy.def)
@@ -2617,7 +2615,7 @@ static int emac_dt_phy_probe(struct emac_instance *dev)
 {
         struct device_node *np = dev->ofdev->dev.of_node;
         struct device_node *phy_handle;
-        int res = 0;
+        int res = 1;
 
         phy_handle = of_parse_phandle(np, "phy-handle", 0);
 
@@ -2714,13 +2712,24 @@ static int emac_init_phy(struct emac_instance *dev)
         if (emac_has_feature(dev, EMAC_FTR_HAS_RGMII)) {
                 int res = emac_dt_phy_probe(dev);
 
-                mutex_unlock(&emac_phy_map_lock);
-                if (!res)
+                switch (res) {
+                case 1:
+                        /* No phy-handle property configured.
+                         * Continue with the existing phy probe
+                         * and setup code.
+                         */
+                        break;
+
+                case 0:
+                        mutex_unlock(&emac_phy_map_lock);
                         goto init_phy;
 
-                dev_err(&dev->ofdev->dev, "failed to attach dt phy (%d).\n",
-                        res);
-                return res;
+                default:
+                        mutex_unlock(&emac_phy_map_lock);
+                        dev_err(&dev->ofdev->dev, "failed to attach dt phy (%d).\n",
+                                res);
+                        return res;
+                }
         }
 
         if (dev->phy_address != 0xffffffff)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 9198e6bd5160..b23d6545f835 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -404,7 +404,7 @@ static int ibmvnic_open(struct net_device *netdev)
         send_map_query(adapter);
         for (i = 0; i < rxadd_subcrqs; i++) {
                 init_rx_pool(adapter, &adapter->rx_pool[i],
-                             IBMVNIC_BUFFS_PER_POOL, i,
+                             adapter->req_rx_add_entries_per_subcrq, i,
                              be64_to_cpu(size_array[i]), 1);
                 if (alloc_rx_pool(adapter, &adapter->rx_pool[i])) {
                         dev_err(dev, "Couldn't alloc rx pool\n");
@@ -419,23 +419,23 @@ static int ibmvnic_open(struct net_device *netdev)
         for (i = 0; i < tx_subcrqs; i++) {
                 tx_pool = &adapter->tx_pool[i];
                 tx_pool->tx_buff =
-                    kcalloc(adapter->max_tx_entries_per_subcrq,
+                    kcalloc(adapter->req_tx_entries_per_subcrq,
                             sizeof(struct ibmvnic_tx_buff), GFP_KERNEL);
                 if (!tx_pool->tx_buff)
                         goto tx_pool_alloc_failed;
 
                 if (alloc_long_term_buff(adapter, &tx_pool->long_term_buff,
-                                         adapter->max_tx_entries_per_subcrq *
+                                         adapter->req_tx_entries_per_subcrq *
                                          adapter->req_mtu))
                         goto tx_ltb_alloc_failed;
 
                 tx_pool->free_map =
-                    kcalloc(adapter->max_tx_entries_per_subcrq,
+                    kcalloc(adapter->req_tx_entries_per_subcrq,
                             sizeof(int), GFP_KERNEL);
                 if (!tx_pool->free_map)
                         goto tx_fm_alloc_failed;
 
-                for (j = 0; j < adapter->max_tx_entries_per_subcrq; j++)
+                for (j = 0; j < adapter->req_tx_entries_per_subcrq; j++)
                         tx_pool->free_map[j] = j;
 
                 tx_pool->consumer_index = 0;
@@ -705,6 +705,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         u8 *hdrs = (u8 *)&adapter->tx_rx_desc_req;
         struct device *dev = &adapter->vdev->dev;
         struct ibmvnic_tx_buff *tx_buff = NULL;
+        struct ibmvnic_sub_crq_queue *tx_scrq;
         struct ibmvnic_tx_pool *tx_pool;
         unsigned int tx_send_failed = 0;
         unsigned int tx_map_failed = 0;
@@ -724,6 +725,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
         int ret = 0;
 
         tx_pool = &adapter->tx_pool[queue_num];
+        tx_scrq = adapter->tx_scrq[queue_num];
         txq = netdev_get_tx_queue(netdev, skb_get_queue_mapping(skb));
         handle_array = (u64 *)((u8 *)(adapter->login_rsp_buf) +
                                    be32_to_cpu(adapter->login_rsp_buf->
@@ -744,7 +746,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
 
         tx_pool->consumer_index =
             (tx_pool->consumer_index + 1) %
-                adapter->max_tx_entries_per_subcrq;
+                adapter->req_tx_entries_per_subcrq;
 
         tx_buff = &tx_pool->tx_buff[index];
         tx_buff->skb = skb;
@@ -817,7 +819,7 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
 
                 if (tx_pool->consumer_index == 0)
                         tx_pool->consumer_index =
-                                adapter->max_tx_entries_per_subcrq - 1;
+                                adapter->req_tx_entries_per_subcrq - 1;
                 else
                         tx_pool->consumer_index--;
 
@@ -826,6 +828,14 @@ static int ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
                 ret = NETDEV_TX_BUSY;
                 goto out;
         }
+
+        atomic_inc(&tx_scrq->used);
+
+        if (atomic_read(&tx_scrq->used) >= adapter->req_tx_entries_per_subcrq) {
+                netdev_info(netdev, "Stopping queue %d\n", queue_num);
+                netif_stop_subqueue(netdev, queue_num);
+        }
+
         tx_packets++;
         tx_bytes += skb->len;
         txq->trans_start = jiffies;
@@ -1213,6 +1223,7 @@ static struct ibmvnic_sub_crq_queue *init_sub_crq_queue(struct ibmvnic_adapter
         scrq->adapter = adapter;
         scrq->size = 4 * PAGE_SIZE / sizeof(*scrq->msgs);
         scrq->cur = 0;
+        atomic_set(&scrq->used, 0);
         scrq->rx_skb_top = NULL;
         spin_lock_init(&scrq->lock);
 
@@ -1246,6 +1257,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 release_sub_crq_queue(adapter,
                                                       adapter->tx_scrq[i]);
                         }
+                kfree(adapter->tx_scrq);
                 adapter->tx_scrq = NULL;
         }
 
@@ -1258,6 +1270,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter)
                                 release_sub_crq_queue(adapter,
                                                       adapter->rx_scrq[i]);
                         }
+                kfree(adapter->rx_scrq);
                 adapter->rx_scrq = NULL;
         }
 }
@@ -1355,14 +1368,28 @@ restart_loop:
                                                  DMA_TO_DEVICE);
                         }
 
-                        if (txbuff->last_frag)
+                        if (txbuff->last_frag) {
+                                atomic_dec(&scrq->used);
+
+                                if (atomic_read(&scrq->used) <=
+                                    (adapter->req_tx_entries_per_subcrq / 2) &&
+                                    netif_subqueue_stopped(adapter->netdev,
+                                                           txbuff->skb)) {
+                                        netif_wake_subqueue(adapter->netdev,
+                                                            scrq->pool_index);
+                                        netdev_dbg(adapter->netdev,
+                                                   "Started queue %d\n",
+                                                   scrq->pool_index);
+                                }
+
                                 dev_kfree_skb_any(txbuff->skb);
+                        }
 
                         adapter->tx_pool[pool].free_map[adapter->tx_pool[pool].
                                                      producer_index] = index;
                         adapter->tx_pool[pool].producer_index =
                             (adapter->tx_pool[pool].producer_index + 1) %
-                            adapter->max_tx_entries_per_subcrq;
+                            adapter->req_tx_entries_per_subcrq;
                 }
                 /* remove tx_comp scrq*/
                 next->tx_comp.first = 0;
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 422824f1f42a..1993b42666f7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -863,6 +863,7 @@ struct ibmvnic_sub_crq_queue {
         spinlock_t lock;
         struct sk_buff *rx_skb_top;
         struct ibmvnic_adapter *adapter;
+        atomic_t used;
 };
 
 struct ibmvnic_long_term_buff {
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 2175cced402f..e9af89ad039c 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6274,8 +6274,8 @@ static int e1000e_pm_freeze(struct device *dev)
                 /* Quiesce the device without resetting the hardware */
                 e1000e_down(adapter, false);
                 e1000_free_irq(adapter);
-                e1000e_reset_interrupt_capability(adapter);
         }
+        e1000e_reset_interrupt_capability(adapter);
 
         /* Allow time for pending master requests to run */
         e1000e_disable_pcie_master(&adapter->hw);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index e8a8351c8ea9..82a95cc2c8ee 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4438,8 +4438,12 @@ static void i40e_napi_enable_all(struct i40e_vsi *vsi)
         if (!vsi->netdev)
                 return;
 
-        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-                napi_enable(&vsi->q_vectors[q_idx]->napi);
+        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
+                struct i40e_q_vector *q_vector = vsi->q_vectors[q_idx];
+
+                if (q_vector->rx.ring || q_vector->tx.ring)
+                        napi_enable(&q_vector->napi);
+        }
 }
 
 /**
@@ -4453,8 +4457,12 @@ static void i40e_napi_disable_all(struct i40e_vsi *vsi)
         if (!vsi->netdev)
                 return;
 
-        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++)
-                napi_disable(&vsi->q_vectors[q_idx]->napi);
+        for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) {
+                struct i40e_q_vector *q_vector = vsi->q_vectors[q_idx];
+
+                if (q_vector->rx.ring || q_vector->tx.ring)
+                        napi_disable(&q_vector->napi);
+        }
 }
 
 /**
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 9e757684816d..93949139e62c 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -613,7 +613,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         struct mtk_mac *mac = netdev_priv(dev);
         struct mtk_eth *eth = mac->hw;
         struct mtk_tx_dma *itxd, *txd;
-        struct mtk_tx_buf *tx_buf;
+        struct mtk_tx_buf *itx_buf, *tx_buf;
         dma_addr_t mapped_addr;
         unsigned int nr_frags;
         int i, n_desc = 1;
@@ -627,8 +627,8 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
         txd4 |= fport;
 
-        tx_buf = mtk_desc_to_tx_buf(ring, itxd);
-        memset(tx_buf, 0, sizeof(*tx_buf));
+        itx_buf = mtk_desc_to_tx_buf(ring, itxd);
+        memset(itx_buf, 0, sizeof(*itx_buf));
 
         if (gso)
                 txd4 |= TX_DMA_TSO;
@@ -647,9 +647,11 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                 return -ENOMEM;
 
         WRITE_ONCE(itxd->txd1, mapped_addr);
-        tx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
-        dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
-        dma_unmap_len_set(tx_buf, dma_len0, skb_headlen(skb));
+        itx_buf->flags |= MTK_TX_FLAGS_SINGLE0;
+        itx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+                          MTK_TX_FLAGS_FPORT1;
+        dma_unmap_addr_set(itx_buf, dma_addr0, mapped_addr);
+        dma_unmap_len_set(itx_buf, dma_len0, skb_headlen(skb));
 
         /* TX SG offload */
         txd = itxd;
@@ -685,11 +687,13 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                                                last_frag * TX_DMA_LS0));
                         WRITE_ONCE(txd->txd4, fport);
 
-                        tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf = mtk_desc_to_tx_buf(ring, txd);
                         memset(tx_buf, 0, sizeof(*tx_buf));
-
+                        tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf->flags |= MTK_TX_FLAGS_PAGE0;
+                        tx_buf->flags |= (!mac->id) ? MTK_TX_FLAGS_FPORT0 :
+                                         MTK_TX_FLAGS_FPORT1;
+
                         dma_unmap_addr_set(tx_buf, dma_addr0, mapped_addr);
                         dma_unmap_len_set(tx_buf, dma_len0, frag_map_size);
                         frag_size -= frag_map_size;
@@ -698,7 +702,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         }
 
         /* store skb to cleanup */
-        tx_buf->skb = skb;
+        itx_buf->skb = skb;
 
         WRITE_ONCE(itxd->txd4, txd4);
         WRITE_ONCE(itxd->txd3, (TX_DMA_SWC | TX_DMA_PLEN0(skb_headlen(skb)) |
@@ -1012,17 +1016,16 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget)
 
         while ((cpu != dma) && budget) {
                 u32 next_cpu = desc->txd2;
-                int mac;
+                int mac = 0;
 
                 desc = mtk_qdma_phys_to_virt(ring, desc->txd2);
                 if ((desc->txd3 & TX_DMA_OWNER_CPU) == 0)
                         break;
 
-                mac = (desc->txd4 >> TX_DMA_FPORT_SHIFT) &
-                       TX_DMA_FPORT_MASK;
-                mac--;
-
                 tx_buf = mtk_desc_to_tx_buf(ring, desc);
+                if (tx_buf->flags & MTK_TX_FLAGS_FPORT1)
+                        mac = 1;
+
                 skb = tx_buf->skb;
                 if (!skb) {
                         condition = 1;
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index 99b1c8e9f16f..08285a96ff70 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -406,12 +406,18 @@ struct mtk_hw_stats {
         struct u64_stats_sync   syncp;
 };
 
-/* PDMA descriptor can point at 1-2 segments. This enum allows us to track how
- * memory was allocated so that it can be freed properly
- */
 enum mtk_tx_flags {
+        /* PDMA descriptor can point at 1-2 segments. This enum allows us to
+         * track how memory was allocated so that it can be freed properly.
+         */
         MTK_TX_FLAGS_SINGLE0    = 0x01,
         MTK_TX_FLAGS_PAGE0      = 0x02,
+
+        /* MTK_TX_FLAGS_FPORTx allows tracking which port the transmitted
+         * SKB out instead of looking up through hardware TX descriptor.
+         */
+        MTK_TX_FLAGS_FPORT0     = 0x04,
+        MTK_TX_FLAGS_FPORT1     = 0x08,
 };
 
 /* This enum allows us to identify how the clock is defined on the array of the
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index e8c105164931..0e0fa7030565 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2305,6 +2305,17 @@ static int sync_toggles(struct mlx4_dev *dev)
                 rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read));
                 if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) {
                         /* PCI might be offline */
+
+                        /* If device removal has been requested,
+                         * do not continue retrying.
+                         */
+                        if (dev->persist->interface_state &
+                            MLX4_INTERFACE_STATE_NOWAIT) {
+                                mlx4_warn(dev,
+                                          "communication channel is offline\n");
+                                return -EIO;
+                        }
+
                         msleep(100);
                         wr_toggle = swab32(readl(&priv->mfunc.comm->
                                            slave_write));
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 21377c315083..703205475524 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1940,6 +1940,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev)
                                (u32)(1 << COMM_CHAN_OFFLINE_OFFSET));
                 if (!offline_bit)
                         return 0;
+
+                /* If device removal has been requested,
+                 * do not continue retrying.
+                 */
+                if (dev->persist->interface_state &
+                    MLX4_INTERFACE_STATE_NOWAIT)
+                        break;
+
                 /* There are cases as part of AER/Reset flow that PF needs
                  * around 100 msec to load. We therefore sleep for 100 msec
                  * to allow other tasks to make use of that CPU during this
@@ -3955,6 +3963,9 @@ static void mlx4_remove_one(struct pci_dev *pdev)
         struct devlink *devlink = priv_to_devlink(priv);
         int active_vfs = 0;
 
+        if (mlx4_is_slave(dev))
+                persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT;
+
         mutex_lock(&persist->interface_state_mutex);
         persist->interface_state |= MLX4_INTERFACE_STATE_DELETION;
         mutex_unlock(&persist->interface_state_mutex);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index ddb4ca4ff930..117170014e88 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -14,6 +14,7 @@ config MLX5_CORE
 config MLX5_CORE_EN
         bool "Mellanox Technologies ConnectX-4 Ethernet support"
         depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on IPV6=y || IPV6=n || MLX5_CORE=m
         imply PTP_1588_CLOCK
         default n
         ---help---
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index caa837e5e2b9..a380353a78c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -361,6 +361,8 @@ static int mlx5_internal_err_ret_value(struct mlx5_core_dev *dev, u16 op,
         case MLX5_CMD_OP_QUERY_VPORT_COUNTER:
         case MLX5_CMD_OP_ALLOC_Q_COUNTER:
         case MLX5_CMD_OP_QUERY_Q_COUNTER:
+        case MLX5_CMD_OP_SET_RATE_LIMIT:
+        case MLX5_CMD_OP_QUERY_RATE_LIMIT:
         case MLX5_CMD_OP_ALLOC_PD:
         case MLX5_CMD_OP_ALLOC_UAR:
         case MLX5_CMD_OP_CONFIG_INT_MODERATION:
@@ -497,6 +499,8 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_Q_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_Q_COUNTER);
+        MLX5_COMMAND_STR_CASE(SET_RATE_LIMIT);
+        MLX5_COMMAND_STR_CASE(QUERY_RATE_LIMIT);
         MLX5_COMMAND_STR_CASE(ALLOC_PD);
         MLX5_COMMAND_STR_CASE(DEALLOC_PD);
         MLX5_COMMAND_STR_CASE(ALLOC_UAR);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index f6a6ded204f6..dc52053128bc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -928,10 +928,6 @@ void mlx5e_destroy_netdev(struct mlx5_core_dev *mdev, struct mlx5e_priv *priv);
 int mlx5e_attach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 void mlx5e_detach_netdev(struct mlx5_core_dev *mdev, struct net_device *netdev);
 u32 mlx5e_choose_lro_timeout(struct mlx5_core_dev *mdev, u32 wanted_timeout);
-void mlx5e_add_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti);
-void mlx5e_del_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti);
 
 int mlx5e_get_offload_stats(int attr_id, const struct net_device *dev,
                             void *sp);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 0523ed47f597..8fa23f6a1f67 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -302,6 +302,9 @@ static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         struct mlx5e_priv *priv = netdev_priv(dev);
         struct mlx5e_dcbx *dcbx = &priv->dcbx;
 
+        if (mode & DCB_CAP_DCBX_LLD_MANAGED)
+                return 1;
+
         if ((!mode) && MLX5_CAP_GEN(priv->mdev, dcbx)) {
                 if (dcbx->mode == MLX5E_DCBX_PARAM_VER_OPER_AUTO)
                         return 0;
@@ -315,13 +318,10 @@ static u8 mlx5e_dcbnl_setdcbx(struct net_device *dev, u8 mode)
                 return 1;
         }
 
-        if (mlx5e_dcbnl_switch_to_host_mode(netdev_priv(dev)))
+        if (!(mode & DCB_CAP_DCBX_HOST))
                 return 1;
 
-        if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
-            !(mode & DCB_CAP_DCBX_VER_CEE) ||
-            !(mode & DCB_CAP_DCBX_VER_IEEE) ||
-            !(mode & DCB_CAP_DCBX_HOST))
+        if (mlx5e_dcbnl_switch_to_host_mode(netdev_priv(dev)))
                 return 1;
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 8ef64c4db2c2..66c133757a5e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3100,8 +3100,8 @@ static int mlx5e_get_vf_stats(struct net_device *dev,
                                             vf_stats);
 }
 
-void mlx5e_add_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti)
+static void mlx5e_add_vxlan_port(struct net_device *netdev,
+                                 struct udp_tunnel_info *ti)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
@@ -3114,8 +3114,8 @@ void mlx5e_add_vxlan_port(struct net_device *netdev,
         mlx5e_vxlan_queue_work(priv, ti->sa_family, be16_to_cpu(ti->port), 1);
 }
 
-void mlx5e_del_vxlan_port(struct net_device *netdev,
-                          struct udp_tunnel_info *ti)
+static void mlx5e_del_vxlan_port(struct net_device *netdev,
+                                 struct udp_tunnel_info *ti)
 {
         struct mlx5e_priv *priv = netdev_priv(netdev);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 2c864574a9d5..f621373bd7a5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -393,8 +393,6 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = {
         .ndo_get_phys_port_name  = mlx5e_rep_get_phys_port_name,
         .ndo_setup_tc            = mlx5e_rep_ndo_setup_tc,
         .ndo_get_stats64         = mlx5e_rep_get_stats,
-        .ndo_udp_tunnel_add      = mlx5e_add_vxlan_port,
-        .ndo_udp_tunnel_del      = mlx5e_del_vxlan_port,
         .ndo_has_offload_stats   = mlx5e_has_offload_stats,
         .ndo_get_offload_stats   = mlx5e_get_offload_stats,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 3d371688fbbb..bafcb349a50c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -601,6 +601,10 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
         if (lro_num_seg > 1) {
                 mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt);
                 skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg);
+                /* Subtract one since we already counted this as one
+                 * "regular" packet in mlx5e_complete_rx_cqe()
+                 */
+                rq->stats.packets += lro_num_seg - 1;
                 rq->stats.lro_packets++;
                 rq->stats.lro_bytes += cqe_bcnt;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 31e3cb7ee5fe..5621dcfda4f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -204,9 +204,6 @@ mlx5e_test_loopback_validate(struct sk_buff *skb,
         struct iphdr *iph;
 
         /* We are only going to peek, no need to clone the SKB */
-        if (skb->protocol != htons(ETH_P_IP))
-                goto out;
-
         if (MLX5E_TEST_PKT_SIZE - ETH_HLEN > skb_headlen(skb))
                 goto out;
 
@@ -249,7 +246,7 @@ static int mlx5e_test_loopback_setup(struct mlx5e_priv *priv,
         lbtp->loopback_ok = false;
         init_completion(&lbtp->comp);
 
-        lbtp->pt.type = htons(ETH_P_ALL);
+        lbtp->pt.type = htons(ETH_P_IP);
         lbtp->pt.func = mlx5e_test_loopback_validate;
         lbtp->pt.dev = priv->netdev;
         lbtp->pt.af_packet_priv = lbtp;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 44406a5ec15d..fade7233dac5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -48,9 +48,14 @@
 #include "eswitch.h"
 #include "vxlan.h"
 
+enum {
+        MLX5E_TC_FLOW_ESWITCH   = BIT(0),
+};
+
 struct mlx5e_tc_flow {
         struct rhash_head       node;
         u64                     cookie;
+        u8                      flags;
         struct mlx5_flow_handle *rule;
         struct list_head        encap; /* flows sharing the same encap */
         struct mlx5_esw_flow_attr *attr;
@@ -128,6 +133,23 @@ err_create_ft:
         return rule;
 }
 
+static void mlx5e_tc_del_nic_flow(struct mlx5e_priv *priv,
+                                  struct mlx5e_tc_flow *flow)
+{
+        struct mlx5_fc *counter = NULL;
+
+        if (!IS_ERR(flow->rule)) {
+                counter = mlx5_flow_rule_counter(flow->rule);
+                mlx5_del_flow_rules(flow->rule);
+                mlx5_fc_destroy(priv->mdev, counter);
+        }
+
+        if (!mlx5e_tc_num_filters(priv) && (priv->fs.tc.t)) {
+                mlx5_destroy_flow_table(priv->fs.tc.t);
+                priv->fs.tc.t = NULL;
+        }
+}
+
 static struct mlx5_flow_handle *
 mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
                       struct mlx5_flow_spec *spec,
@@ -144,7 +166,24 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,
 }
 
 static void mlx5e_detach_encap(struct mlx5e_priv *priv,
-                               struct mlx5e_tc_flow *flow) {
+                               struct mlx5e_tc_flow *flow);
+
+static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
+                                  struct mlx5e_tc_flow *flow)
+{
+        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+
+        mlx5_eswitch_del_offloaded_rule(esw, flow->rule, flow->attr);
+
+        mlx5_eswitch_del_vlan_action(esw, flow->attr);
+
+        if (flow->attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
+                mlx5e_detach_encap(priv, flow);
+}
+
+static void mlx5e_detach_encap(struct mlx5e_priv *priv,
+                               struct mlx5e_tc_flow *flow)
+{
         struct list_head *next = flow->encap.next;
 
         list_del(&flow->encap);
@@ -168,25 +207,10 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
 static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
                               struct mlx5e_tc_flow *flow)
 {
-        struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        struct mlx5_fc *counter = NULL;
-
-        if (!IS_ERR(flow->rule)) {
-                counter = mlx5_flow_rule_counter(flow->rule);
-                mlx5_del_flow_rules(flow->rule);
-                mlx5_fc_destroy(priv->mdev, counter);
-        }
-
-        if (esw && esw->mode == SRIOV_OFFLOADS) {
-                mlx5_eswitch_del_vlan_action(esw, flow->attr);
-                if (flow->attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)
-                        mlx5e_detach_encap(priv, flow);
-        }
-
-        if (!mlx5e_tc_num_filters(priv) && (priv->fs.tc.t)) {
-                mlx5_destroy_flow_table(priv->fs.tc.t);
-                priv->fs.tc.t = NULL;
-        }
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH)
+                mlx5e_tc_del_fdb_flow(priv, flow);
+        else
+                mlx5e_tc_del_nic_flow(priv, flow);
 }
 
 static void parse_vxlan_attr(struct mlx5_flow_spec *spec,
@@ -243,12 +267,15 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv,
                         skb_flow_dissector_target(f->dissector,
                                                   FLOW_DISSECTOR_KEY_ENC_PORTS,
                                                   f->mask);
+                struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+                struct net_device *up_dev = mlx5_eswitch_get_uplink_netdev(esw);
+                struct mlx5e_priv *up_priv = netdev_priv(up_dev);
 
                 /* Full udp dst port must be given */
                 if (memchr_inv(&mask->dst, 0xff, sizeof(mask->dst)))
                         goto vxlan_match_offload_err;
 
-                if (mlx5e_vxlan_lookup_port(priv, be16_to_cpu(key->dst)) &&
+                if (mlx5e_vxlan_lookup_port(up_priv, be16_to_cpu(key->dst)) &&
                     MLX5_CAP_ESW(priv->mdev, vxlan_encap_decap))
                         parse_vxlan_attr(spec, f);
                 else {
@@ -598,6 +625,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 }
 
 static int parse_cls_flower(struct mlx5e_priv *priv,
+                            struct mlx5e_tc_flow *flow,
                             struct mlx5_flow_spec *spec,
                             struct tc_cls_flower_offload *f)
 {
@@ -609,7 +637,7 @@ static int parse_cls_flower(struct mlx5e_priv *priv,
 
         err = __parse_cls_flower(priv, spec, f, &min_inline);
 
-        if (!err && esw->mode == SRIOV_OFFLOADS &&
+        if (!err && (flow->flags & MLX5E_TC_FLOW_ESWITCH) &&
             rep->vport != FDB_UPLINK_VPORT) {
                 if (min_inline > esw->offloads.inline_mode) {
                         netdev_warn(priv->netdev,
@@ -970,6 +998,8 @@ static int mlx5e_attach_encap(struct mlx5e_priv *priv,
                               struct mlx5_esw_flow_attr *attr)
 {
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        struct net_device *up_dev = mlx5_eswitch_get_uplink_netdev(esw);
+        struct mlx5e_priv *up_priv = netdev_priv(up_dev);
         unsigned short family = ip_tunnel_info_af(tun_info);
         struct ip_tunnel_key *key = &tun_info->key;
         struct mlx5_encap_entry *e;
@@ -990,7 +1020,7 @@ vxlan_encap_offload_err:
                 return -EOPNOTSUPP;
         }
 
-        if (mlx5e_vxlan_lookup_port(priv, be16_to_cpu(key->tp_dst)) &&
+        if (mlx5e_vxlan_lookup_port(up_priv, be16_to_cpu(key->tp_dst)) &&
             MLX5_CAP_ESW(priv->mdev, vxlan_encap_decap)) {
                 tunnel_type = MLX5_HEADER_TYPE_VXLAN;
         } else {
@@ -1106,14 +1136,16 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                 }
 
                 if (is_tcf_vlan(a)) {
-                        if (tcf_vlan_action(a) == VLAN_F_POP) {
+                        if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) {
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP;
-                        } else if (tcf_vlan_action(a) == VLAN_F_PUSH) {
+                        } else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) {
                                 if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q))
                                         return -EOPNOTSUPP;
 
                                 attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH;
                                 attr->vlan = tcf_vlan_push_vid(a);
+                        } else { /* action is TCA_VLAN_ACT_MODIFY */
+                                return -EOPNOTSUPP;
                         }
                         continue;
                 }
@@ -1132,23 +1164,19 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, __be16 protocol,
                            struct tc_cls_flower_offload *f)
 {
         struct mlx5e_tc_table *tc = &priv->fs.tc;
-        int err = 0;
-        bool fdb_flow = false;
+        int err, attr_size = 0;
         u32 flow_tag, action;
         struct mlx5e_tc_flow *flow;
         struct mlx5_flow_spec *spec;
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+        u8 flow_flags = 0;
 
-        if (esw && esw->mode == SRIOV_OFFLOADS)
-                fdb_flow = true;
-
-        if (fdb_flow)
-                flow = kzalloc(sizeof(*flow) +
-                               sizeof(struct mlx5_esw_flow_attr),
-                               GFP_KERNEL);
-        else
-                flow = kzalloc(sizeof(*flow), GFP_KERNEL);
+        if (esw && esw->mode == SRIOV_OFFLOADS) {
+                flow_flags = MLX5E_TC_FLOW_ESWITCH;
+                attr_size  = sizeof(struct mlx5_esw_flow_attr);
+        }
 
+        flow = kzalloc(sizeof(*flow) + attr_size, GFP_KERNEL);
         spec = mlx5_vzalloc(sizeof(*spec));
         if (!spec || !flow) {
                 err = -ENOMEM;
@@ -1156,12 +1184,13 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, __be16 protocol,
         }
 
         flow->cookie = f->cookie;
+        flow->flags = flow_flags;
 
-        err = parse_cls_flower(priv, spec, f);
+        err = parse_cls_flower(priv, flow, spec, f);
         if (err < 0)
                 goto err_free;
 
-        if (fdb_flow) {
+        if (flow->flags & MLX5E_TC_FLOW_ESWITCH) {
                 flow->attr  = (struct mlx5_esw_flow_attr *)(flow + 1);
                 err = parse_tc_fdb_actions(priv, f->exts, flow);
                 if (err < 0)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index f193128bac4b..57f5e2d7ebd1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -274,15 +274,18 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                         sq->stats.tso_bytes += skb->len - ihs;
                 }
 
+                sq->stats.packets += skb_shinfo(skb)->gso_segs;
                 num_bytes = skb->len + (skb_shinfo(skb)->gso_segs - 1) * ihs;
         } else {
                 bf = sq->bf_budget &&
                      !skb->xmit_more &&
                      !skb_shinfo(skb)->nr_frags;
                 ihs = mlx5e_get_inline_hdr_size(sq, skb, bf);
+                sq->stats.packets++;
                 num_bytes = max_t(unsigned int, skb->len, ETH_ZLEN);
         }
 
+        sq->stats.bytes += num_bytes;
         wi->num_bytes = num_bytes;
 
         ds_cnt = sizeof(*wqe) / MLX5_SEND_WQE_DS;
@@ -381,8 +384,6 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         if (bf)
                 sq->bf_budget--;
 
-        sq->stats.packets++;
-        sq->stats.bytes += num_bytes;
         return NETDEV_TX_OK;
 
 dma_unmap_wqe_err:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 5b78883d5654..ad329b1680b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -209,6 +209,7 @@ struct mlx5_esw_offload {
         struct mlx5_eswitch_rep *vport_reps;
         DECLARE_HASHTABLE(encap_tbl, 8);
         u8 inline_mode;
+        u64 num_flows;
 };
 
 struct mlx5_eswitch {
@@ -271,6 +272,11 @@ struct mlx5_flow_handle *
 mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                                 struct mlx5_flow_spec *spec,
                                 struct mlx5_esw_flow_attr *attr);
+void
+mlx5_eswitch_del_offloaded_rule(struct mlx5_eswitch *esw,
+                                struct mlx5_flow_handle *rule,
+                                struct mlx5_esw_flow_attr *attr);
+
 struct mlx5_flow_handle *
 mlx5_eswitch_create_vport_rx_rule(struct mlx5_eswitch *esw, int vport, u32 tirn);
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 4f5b0d47d5f3..307ec6c5fd3b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -93,10 +93,27 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
                                    spec, &flow_act, dest, i);
         if (IS_ERR(rule))
                 mlx5_fc_destroy(esw->dev, counter);
+        else
+                esw->offloads.num_flows++;
 
         return rule;
 }
 
+void
+mlx5_eswitch_del_offloaded_rule(struct mlx5_eswitch *esw,
+                                struct mlx5_flow_handle *rule,
+                                struct mlx5_esw_flow_attr *attr)
+{
+        struct mlx5_fc *counter = NULL;
+
+        if (!IS_ERR(rule)) {
+                counter = mlx5_flow_rule_counter(rule);
+                mlx5_del_flow_rules(rule);
+                mlx5_fc_destroy(esw->dev, counter);
+                esw->offloads.num_flows--;
+        }
+}
+
 static int esw_set_global_vlan_pop(struct mlx5_eswitch *esw, u8 val)
 {
         struct mlx5_eswitch_rep *rep;
@@ -908,6 +925,11 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode)
             MLX5_CAP_INLINE_MODE_VPORT_CONTEXT)
                 return -EOPNOTSUPP;
 
+        if (esw->offloads.num_flows > 0) {
+                esw_warn(dev, "Can't set inline mode when flows are configured\n");
+                return -EOPNOTSUPP;
+        }
+
         err = esw_inline_mode_from_devlink(mode, &mlx5_mode);
         if (err)
                 goto out;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 2478516a61e2..ded27bb9a3b6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1136,7 +1136,7 @@ static struct mlx5_flow_group *create_autogroup(struct mlx5_flow_table *ft,
                                                 u32 *match_criteria)
 {
         int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
-        struct list_head *prev = ft->node.children.prev;
+        struct list_head *prev = &ft->node.children;
         unsigned int candidate_index = 0;
         struct mlx5_flow_group *fg;
         void *match_criteria_addr;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 55957246c0e8..b5d5519542e8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -294,7 +294,7 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
                                          struct netdev_notifier_changeupper_info *info)
 {
         struct net_device *upper = info->upper_dev, *ndev_tmp;
-        struct netdev_lag_upper_info *lag_upper_info;
+        struct netdev_lag_upper_info *lag_upper_info = NULL;
         bool is_bonded;
         int bond_status = 0;
         int num_slaves = 0;
@@ -303,7 +303,8 @@ static int mlx5_handle_changeupper_event(struct mlx5_lag *ldev,
         if (!netif_is_lag_master(upper))
                 return 0;
 
-        lag_upper_info = info->upper_info;
+        if (info->linking)
+                lag_upper_info = info->upper_info;
 
         /* The event may still be of interest if the slave does not belong to
          * us, but is enslaved to a master which has one or more of our netdevs
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index c4242a4e8130..60154a175bd3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -87,7 +87,7 @@ static struct mlx5_profile profile[] = {
         [2] = {
                 .mask           = MLX5_PROF_MASK_QP_SIZE |
                                   MLX5_PROF_MASK_MR_CACHE,
-                .log_max_qp     = 17,
+                .log_max_qp     = 18,
                 .mr_cache[0]    = {
                         .size   = 500,
                         .limit  = 250
@@ -1352,6 +1352,7 @@ static int init_one(struct pci_dev *pdev,
         if (err)
                 goto clean_load;
 
+        pci_save_state(pdev);
         return 0;
 
 clean_load:
@@ -1407,9 +1408,8 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
 
         mlx5_enter_error_state(dev);
         mlx5_unload_one(dev, priv, false);
-        /* In case of kernel call save the pci state and drain the health wq */
+        /* In case of kernel call drain the health wq */
         if (state) {
-                pci_save_state(pdev);
                 mlx5_drain_health_wq(dev);
                 mlx5_pci_disable_device(dev);
         }
@@ -1461,6 +1461,7 @@ static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 
         pci_set_master(pdev);
         pci_restore_state(pdev);
+        pci_save_state(pdev);
 
         if (wait_vital(pdev)) {
                 dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 0899e2d310e2..d9616daf8a70 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -769,7 +769,7 @@ static inline void mlxsw_reg_spvid_pack(char *payload, u8 local_port, u16 pvid)
 #define MLXSW_REG_SPVM_ID 0x200F
 #define MLXSW_REG_SPVM_BASE_LEN 0x04 /* base length, without records */
 #define MLXSW_REG_SPVM_REC_LEN 0x04 /* record length */
-#define MLXSW_REG_SPVM_REC_MAX_COUNT 256
+#define MLXSW_REG_SPVM_REC_MAX_COUNT 255
 #define MLXSW_REG_SPVM_LEN (MLXSW_REG_SPVM_BASE_LEN +   \
                     MLXSW_REG_SPVM_REC_LEN * MLXSW_REG_SPVM_REC_MAX_COUNT)
 
@@ -1702,7 +1702,7 @@ static inline void mlxsw_reg_sfmr_pack(char *payload,
 #define MLXSW_REG_SPVMLR_ID 0x2020
 #define MLXSW_REG_SPVMLR_BASE_LEN 0x04 /* base length, without records */
 #define MLXSW_REG_SPVMLR_REC_LEN 0x04 /* record length */
-#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 256
+#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 255
 #define MLXSW_REG_SPVMLR_LEN (MLXSW_REG_SPVMLR_BASE_LEN + \
                               MLXSW_REG_SPVMLR_REC_LEN * \
                               MLXSW_REG_SPVMLR_REC_MAX_COUNT)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index 22ab42925377..ae6cccc666e4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -303,11 +303,11 @@ void mlxsw_sp_flower_destroy(struct mlxsw_sp_port *mlxsw_sp_port, bool ingress,
         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, mlxsw_sp_port->dev,
                                            ingress,
                                            MLXSW_SP_ACL_PROFILE_FLOWER);
-        if (WARN_ON(IS_ERR(ruleset)))
+        if (IS_ERR(ruleset))
                 return;
 
         rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
-        if (!WARN_ON(!rule)) {
+        if (rule) {
                 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
                 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
         }
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index 06c9f4100cb9..6ad44be08b33 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -25,6 +25,7 @@
 #include <linux/of_irq.h>
 #include <linux/crc32.h>
 #include <linux/crc32c.h>
+#include <linux/circ_buf.h>
 
 #include "moxart_ether.h"
 
@@ -278,6 +279,13 @@ rx_next:
         return rx;
 }
 
+static int moxart_tx_queue_space(struct net_device *ndev)
+{
+        struct moxart_mac_priv_t *priv = netdev_priv(ndev);
+
+        return CIRC_SPACE(priv->tx_head, priv->tx_tail, TX_DESC_NUM);
+}
+
 static void moxart_tx_finished(struct net_device *ndev)
 {
         struct moxart_mac_priv_t *priv = netdev_priv(ndev);
@@ -297,6 +305,9 @@ static void moxart_tx_finished(struct net_device *ndev)
                 tx_tail = TX_NEXT(tx_tail);
         }
         priv->tx_tail = tx_tail;
+        if (netif_queue_stopped(ndev) &&
+            moxart_tx_queue_space(ndev) >= TX_WAKE_THRESHOLD)
+                netif_wake_queue(ndev);
 }
 
 static irqreturn_t moxart_mac_interrupt(int irq, void *dev_id)
@@ -324,13 +335,18 @@ static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct moxart_mac_priv_t *priv = netdev_priv(ndev);
         void *desc;
         unsigned int len;
-        unsigned int tx_head = priv->tx_head;
+        unsigned int tx_head;
         u32 txdes1;
         int ret = NETDEV_TX_BUSY;
 
+        spin_lock_irq(&priv->txlock);
+
+        tx_head = priv->tx_head;
         desc = priv->tx_desc_base + (TX_REG_DESC_SIZE * tx_head);
 
-        spin_lock_irq(&priv->txlock);
+        if (moxart_tx_queue_space(ndev) == 1)
+                netif_stop_queue(ndev);
+
         if (moxart_desc_read(desc + TX_REG_OFFSET_DESC0) & TX_DESC0_DMA_OWN) {
                 net_dbg_ratelimited("no TX space for packet\n");
                 priv->stats.tx_dropped++;
diff --git a/drivers/net/ethernet/moxa/moxart_ether.h b/drivers/net/ethernet/moxa/moxart_ether.h
index 93a9563ac7c6..afc32ec998c0 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.h
+++ b/drivers/net/ethernet/moxa/moxart_ether.h
@@ -59,6 +59,7 @@
 #define TX_NEXT(N)              (((N) + 1) & (TX_DESC_NUM_MASK))
 #define TX_BUF_SIZE             1600
 #define TX_BUF_SIZE_MAX         (TX_DESC1_BUF_SIZE_MASK+1)
+#define TX_WAKE_THRESHOLD       16
 
 #define RX_DESC_NUM             64
 #define RX_DESC_NUM_MASK        (RX_DESC_NUM-1)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 9179a99563af..a41377e26c07 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3275,9 +3275,10 @@ void nfp_net_netdev_clean(struct net_device *netdev)
 {
         struct nfp_net *nn = netdev_priv(netdev);
 
+        unregister_netdev(nn->netdev);
+
         if (nn->xdp_prog)
                 bpf_prog_put(nn->xdp_prog);
         if (nn->bpf_offload_xdp)
                 nfp_net_xdp_offload(nn, NULL);
-        unregister_netdev(nn->netdev);
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
index d42d03df751a..7e3a6fed3da6 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
@@ -422,8 +422,9 @@ static void qed_cxt_set_proto_cid_count(struct qed_hwfn *p_hwfn,
                 u32 page_sz = p_mgr->clients[ILT_CLI_CDUC].p_size.val;
                 u32 cxt_size = CONN_CXT_SIZE(p_hwfn);
                 u32 elems_per_page = ILT_PAGE_IN_BYTES(page_sz) / cxt_size;
+                u32 align = elems_per_page * DQ_RANGE_ALIGN;
 
-                p_conn->cid_count = roundup(p_conn->cid_count, elems_per_page);
+                p_conn->cid_count = roundup(p_conn->cid_count, align);
         }
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 5bd36a4a8fcd..a6e2bbe629bd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -583,6 +583,13 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
                    p_params->ets_cbs,
                    p_ets->pri_tc_tbl[0], p_params->max_ets_tc);
 
+        if (p_params->ets_enabled && !p_params->max_ets_tc) {
+                p_params->max_ets_tc = QED_MAX_PFC_PRIORITIES;
+                DP_VERBOSE(p_hwfn, QED_MSG_DCB,
+                           "ETS params: max_ets_tc is forced to %d\n",
+                p_params->max_ets_tc);
+        }
+
         /* 8 bit tsa and bw data corresponding to each of the 8 TC's are
          * encoded in a type u32 array of size 2.
          */
@@ -1001,6 +1008,8 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
         u8 pfc_map = 0;
         int i;
 
+        *pfc &= ~DCBX_PFC_ERROR_MASK;
+
         if (p_params->pfc.willing)
                 *pfc |= DCBX_PFC_WILLING_MASK;
         else
@@ -1255,7 +1264,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_ATOMIC);
         if (!dcbx_info)
                 return NULL;
 
@@ -2073,6 +2082,8 @@ static int qed_dcbnl_ieee_setpfc(struct qed_dev *cdev, struct ieee_pfc *pfc)
         for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++)
                 dcbx_set.config.params.pfc.prio[i] = !!(pfc->pfc_en & BIT(i));
 
+        dcbx_set.config.params.pfc.max_tc = pfc->pfc_cap;
+
         ptt = qed_ptt_acquire(hwfn);
         if (!ptt)
                 return -EINVAL;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
index e2a081ceaf52..e518f914eab1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
@@ -2389,9 +2389,8 @@ qed_chain_alloc_sanity_check(struct qed_dev *cdev,
          * size/capacity fields are of a u32 type.
          */
         if ((cnt_type == QED_CHAIN_CNT_TYPE_U16 &&
-             chain_size > 0x10000) ||
-            (cnt_type == QED_CHAIN_CNT_TYPE_U32 &&
-             chain_size > 0x100000000ULL)) {
+             chain_size > ((u32)U16_MAX + 1)) ||
+            (cnt_type == QED_CHAIN_CNT_TYPE_U32 && chain_size > U32_MAX)) {
                 DP_NOTICE(cdev,
                           "The actual chain size (0x%llx) is larger than the maximal possible value\n",
                           chain_size);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
index 3a44d6b395fa..098766f7fe88 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
@@ -190,6 +190,9 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
         p_init->num_sq_pages_in_ring = p_params->num_sq_pages_in_ring;
         p_init->num_r2tq_pages_in_ring = p_params->num_r2tq_pages_in_ring;
         p_init->num_uhq_pages_in_ring = p_params->num_uhq_pages_in_ring;
+        p_init->ooo_enable = p_params->ooo_enable;
+        p_init->ll2_rx_queue_id = p_hwfn->hw_info.resc_start[QED_LL2_QUEUE] +
+                                  p_params->ll2_ooo_queue_id;
         p_init->func_params.log_page_size = p_params->log_page_size;
         val = p_params->num_tasks;
         p_init->func_params.num_tasks = cpu_to_le16(val);
@@ -786,6 +789,23 @@ static void qed_iscsi_release_connection(struct qed_hwfn *p_hwfn,
         spin_unlock_bh(&p_hwfn->p_iscsi_info->lock);
 }
 
+void qed_iscsi_free_connection(struct qed_hwfn *p_hwfn,
+                               struct qed_iscsi_conn *p_conn)
+{
+        qed_chain_free(p_hwfn->cdev, &p_conn->xhq);
+        qed_chain_free(p_hwfn->cdev, &p_conn->uhq);
+        qed_chain_free(p_hwfn->cdev, &p_conn->r2tq);
+        dma_free_coherent(&p_hwfn->cdev->pdev->dev,
+                          sizeof(struct tcp_upload_params),
+                          p_conn->tcp_upload_params_virt_addr,
+                          p_conn->tcp_upload_params_phys_addr);
+        dma_free_coherent(&p_hwfn->cdev->pdev->dev,
+                          sizeof(struct scsi_terminate_extra_params),
+                          p_conn->queue_cnts_virt_addr,
+                          p_conn->queue_cnts_phys_addr);
+        kfree(p_conn);
+}
+
 struct qed_iscsi_info *qed_iscsi_alloc(struct qed_hwfn *p_hwfn)
 {
         struct qed_iscsi_info *p_iscsi_info;
@@ -807,6 +827,17 @@ void qed_iscsi_setup(struct qed_hwfn *p_hwfn,
 void qed_iscsi_free(struct qed_hwfn *p_hwfn,
                     struct qed_iscsi_info *p_iscsi_info)
 {
+        struct qed_iscsi_conn *p_conn = NULL;
+
+        while (!list_empty(&p_hwfn->p_iscsi_info->free_list)) {
+                p_conn = list_first_entry(&p_hwfn->p_iscsi_info->free_list,
+                                          struct qed_iscsi_conn, list_entry);
+                if (p_conn) {
+                        list_del(&p_conn->list_entry);
+                        qed_iscsi_free_connection(p_hwfn, p_conn);
+                }
+        }
+
         kfree(p_iscsi_info);
 }
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 9a0b9af10a57..0d3cef409c96 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -211,6 +211,8 @@ static void qed_ll2b_complete_rx_packet(struct qed_hwfn *p_hwfn,
         /* If need to reuse or there's no replacement buffer, repost this */
         if (rc)
                 goto out_post;
+        dma_unmap_single(&cdev->pdev->dev, buffer->phys_addr,
+                         cdev->ll2->rx_size, DMA_FROM_DEVICE);
 
         skb = build_skb(buffer->data, 0);
         if (!skb) {
@@ -474,7 +476,7 @@ qed_ll2_rxq_completion_gsi(struct qed_hwfn *p_hwfn,
 static int qed_ll2_rxq_completion_reg(struct qed_hwfn *p_hwfn,
                                       struct qed_ll2_info *p_ll2_conn,
                                       union core_rx_cqe_union *p_cqe,
-                                      unsigned long lock_flags,
+                                      unsigned long *p_lock_flags,
                                       bool b_last_cqe)
 {
         struct qed_ll2_rx_queue *p_rx = &p_ll2_conn->rx_queue;
@@ -495,10 +497,10 @@ static int qed_ll2_rxq_completion_reg(struct qed_hwfn *p_hwfn,
                           "Mismatch between active_descq and the LL2 Rx chain\n");
         list_add_tail(&p_pkt->list_entry, &p_rx->free_descq);
 
-        spin_unlock_irqrestore(&p_rx->lock, lock_flags);
+        spin_unlock_irqrestore(&p_rx->lock, *p_lock_flags);
         qed_ll2b_complete_rx_packet(p_hwfn, p_ll2_conn->my_id,
                                     p_pkt, &p_cqe->rx_cqe_fp, b_last_cqe);
-        spin_lock_irqsave(&p_rx->lock, lock_flags);
+        spin_lock_irqsave(&p_rx->lock, *p_lock_flags);
 
         return 0;
 }
@@ -538,7 +540,8 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie)
                         break;
                 case CORE_RX_CQE_TYPE_REGULAR:
                         rc = qed_ll2_rxq_completion_reg(p_hwfn, p_ll2_conn,
-                                                        cqe, flags, b_last_cqe);
+                                                        cqe, &flags,
+                                                        b_last_cqe);
                         break;
                 default:
                         rc = -EIO;
@@ -968,7 +971,7 @@ static int qed_ll2_start_ooo(struct qed_dev *cdev,
 {
         struct qed_hwfn *hwfn = QED_LEADING_HWFN(cdev);
         u8 *handle = &hwfn->pf_params.iscsi_pf_params.ll2_ooo_queue_id;
-        struct qed_ll2_conn ll2_info;
+        struct qed_ll2_conn ll2_info = { 0 };
         int rc;
 
         ll2_info.conn_type = QED_LL2_TYPE_ISCSI_OOO;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ooo.c b/drivers/net/ethernet/qlogic/qed/qed_ooo.c
index 7d731c6cb892..378afce58b3f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ooo.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ooo.c
@@ -159,6 +159,8 @@ struct qed_ooo_info *qed_ooo_alloc(struct qed_hwfn *p_hwfn)
         if (!p_ooo_info->ooo_history.p_cqes)
                 goto no_history_mem;
 
+        p_ooo_info->ooo_history.num_of_cqes = QED_MAX_NUM_OOO_HISTORY_ENTRIES;
+
         return p_ooo_info;
 
 no_history_mem:
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 6d31f92ef2b6..84ac50f92c9c 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -1162,8 +1162,8 @@ struct ob_mac_tso_iocb_rsp {
 struct ib_mac_iocb_rsp {
         u8 opcode;              /* 0x20 */
         u8 flags1;
-#define IB_MAC_IOCB_RSP_OI      0x01    /* Overide intr delay */
-#define IB_MAC_IOCB_RSP_I       0x02    /* Disble Intr Generation */
+#define IB_MAC_IOCB_RSP_OI      0x01    /* Override intr delay */
+#define IB_MAC_IOCB_RSP_I       0x02    /* Disable Intr Generation */
 #define IB_MAC_CSUM_ERR_MASK 0x1c       /* A mask to use for csum errs */
 #define IB_MAC_IOCB_RSP_TE      0x04    /* Checksum error */
 #define IB_MAC_IOCB_RSP_NU      0x08    /* No checksum rcvd */
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 54248775f227..f68c4db656ed 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1127,12 +1127,70 @@ static struct mdiobb_ops bb_ops = {
         .get_mdio_data = sh_get_mdio,
 };
 
+/* free Tx skb function */
+static int sh_eth_tx_free(struct net_device *ndev, bool sent_only)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        struct sh_eth_txdesc *txdesc;
+        int free_num = 0;
+        int entry;
+        bool sent;
+
+        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
+                entry = mdp->dirty_tx % mdp->num_tx_ring;
+                txdesc = &mdp->tx_ring[entry];
+                sent = !(txdesc->status & cpu_to_le32(TD_TACT));
+                if (sent_only && !sent)
+                        break;
+                /* TACT bit must be checked before all the following reads */
+                dma_rmb();
+                netif_info(mdp, tx_done, ndev,
+                           "tx entry %d status 0x%08x\n",
+                           entry, le32_to_cpu(txdesc->status));
+                /* Free the original skb. */
+                if (mdp->tx_skbuff[entry]) {
+                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
+                                         le32_to_cpu(txdesc->len) >> 16,
+                                         DMA_TO_DEVICE);
+                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
+                        mdp->tx_skbuff[entry] = NULL;
+                        free_num++;
+                }
+                txdesc->status = cpu_to_le32(TD_TFP);
+                if (entry >= mdp->num_tx_ring - 1)
+                        txdesc->status |= cpu_to_le32(TD_TDLE);
+
+                if (sent) {
+                        ndev->stats.tx_packets++;
+                        ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
+                }
+        }
+        return free_num;
+}
+
 /* free skb and descriptor buffer */
 static void sh_eth_ring_free(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         int ringsize, i;
 
+        if (mdp->rx_ring) {
+                for (i = 0; i < mdp->num_rx_ring; i++) {
+                        if (mdp->rx_skbuff[i]) {
+                                struct sh_eth_rxdesc *rxdesc = &mdp->rx_ring[i];
+
+                                dma_unmap_single(&ndev->dev,
+                                                 le32_to_cpu(rxdesc->addr),
+                                                 ALIGN(mdp->rx_buf_sz, 32),
+                                                 DMA_FROM_DEVICE);
+                        }
+                }
+                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
+                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
+                                  mdp->rx_desc_dma);
+                mdp->rx_ring = NULL;
+        }
+
         /* Free Rx skb ringbuffer */
         if (mdp->rx_skbuff) {
                 for (i = 0; i < mdp->num_rx_ring; i++)
@@ -1141,27 +1199,18 @@ static void sh_eth_ring_free(struct net_device *ndev)
         kfree(mdp->rx_skbuff);
         mdp->rx_skbuff = NULL;
 
-        /* Free Tx skb ringbuffer */
-        if (mdp->tx_skbuff) {
-                for (i = 0; i < mdp->num_tx_ring; i++)
-                        dev_kfree_skb(mdp->tx_skbuff[i]);
-        }
-        kfree(mdp->tx_skbuff);
-        mdp->tx_skbuff = NULL;
-
-        if (mdp->rx_ring) {
-                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
-                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
-                                  mdp->rx_desc_dma);
-                mdp->rx_ring = NULL;
-        }
-
         if (mdp->tx_ring) {
+                sh_eth_tx_free(ndev, false);
+
                 ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
                 dma_free_coherent(NULL, ringsize, mdp->tx_ring,
                                   mdp->tx_desc_dma);
                 mdp->tx_ring = NULL;
         }
+
+        /* Free Tx skb ringbuffer */
+        kfree(mdp->tx_skbuff);
+        mdp->tx_skbuff = NULL;
 }
 
 /* format skb and descriptor buffer */
@@ -1409,43 +1458,6 @@ static void sh_eth_dev_exit(struct net_device *ndev)
         update_mac_address(ndev);
 }
 
-/* free Tx skb function */
-static int sh_eth_txfree(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        struct sh_eth_txdesc *txdesc;
-        int free_num = 0;
-        int entry;
-
-        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
-                entry = mdp->dirty_tx % mdp->num_tx_ring;
-                txdesc = &mdp->tx_ring[entry];
-                if (txdesc->status & cpu_to_le32(TD_TACT))
-                        break;
-                /* TACT bit must be checked before all the following reads */
-                dma_rmb();
-                netif_info(mdp, tx_done, ndev,
-                           "tx entry %d status 0x%08x\n",
-                           entry, le32_to_cpu(txdesc->status));
-                /* Free the original skb. */
-                if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
-                                         le32_to_cpu(txdesc->len) >> 16,
-                                         DMA_TO_DEVICE);
-                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
-                        mdp->tx_skbuff[entry] = NULL;
-                        free_num++;
-                }
-                txdesc->status = cpu_to_le32(TD_TFP);
-                if (entry >= mdp->num_tx_ring - 1)
-                        txdesc->status |= cpu_to_le32(TD_TDLE);
-
-                ndev->stats.tx_packets++;
-                ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
-        }
-        return free_num;
-}
-
 /* Packet receive function */
 static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 {
@@ -1690,7 +1702,7 @@ static void sh_eth_error(struct net_device *ndev, u32 intr_status)
                            intr_status, mdp->cur_tx, mdp->dirty_tx,
                            (u32)ndev->state, edtrr);
                 /* dirty buffer free */
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
 
                 /* SH7712 BUG */
                 if (edtrr ^ sh_eth_get_edtrr_trns(mdp)) {
@@ -1751,7 +1763,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                 /* Clear Tx interrupts */
                 sh_eth_write(ndev, intr_status & cd->tx_check, EESR);
 
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
                 netif_wake_queue(ndev);
         }
 
@@ -2412,7 +2424,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         spin_lock_irqsave(&mdp->lock, flags);
         if ((mdp->cur_tx - mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) {
-                if (!sh_eth_txfree(ndev)) {
+                if (!sh_eth_tx_free(ndev, true)) {
                         netif_warn(mdp, tx_queued, ndev, "TxFD exhausted.\n");
                         netif_stop_queue(ndev);
                         spin_unlock_irqrestore(&mdp->lock, flags);
diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c
index 7cd76b6b5cb9..2ae852454780 100644
--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c
+++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c
@@ -2216,18 +2216,15 @@ static int ofdpa_port_stp_update(struct ofdpa_port *ofdpa_port,
 {
         bool want[OFDPA_CTRL_MAX] = { 0, };
         bool prev_ctrls[OFDPA_CTRL_MAX];
-        u8 uninitialized_var(prev_state);
+        u8 prev_state;
         int err;
         int i;
 
-        if (switchdev_trans_ph_prepare(trans)) {
-                memcpy(prev_ctrls, ofdpa_port->ctrls, sizeof(prev_ctrls));
-                prev_state = ofdpa_port->stp_state;
-        }
-
-        if (ofdpa_port->stp_state == state)
+        prev_state = ofdpa_port->stp_state;
+        if (prev_state == state)
                 return 0;
 
+        memcpy(prev_ctrls, ofdpa_port->ctrls, sizeof(prev_ctrls));
         ofdpa_port->stp_state = state;
 
         switch (state) {
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 334bcc6df6b2..b9cb697b2818 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1371,6 +1371,13 @@ static unsigned int efx_wanted_parallelism(struct efx_nic *efx)
                 free_cpumask_var(thread_mask);
         }
 
+        if (count > EFX_MAX_RX_QUEUES) {
+                netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,
+                               "Reducing number of rx queues from %u to %u.\n",
+                               count, EFX_MAX_RX_QUEUES);
+                count = EFX_MAX_RX_QUEUES;
+        }
+
         /* If RSS is requested for the PF *and* VFs then we can't write RSS
          * table entries that are inaccessible to VFs
          */
@@ -2404,7 +2411,7 @@ static void efx_udp_tunnel_del(struct net_device *dev, struct udp_tunnel_info *t
         tnl.type = (u16)efx_tunnel_type;
         tnl.port = ti->port;
 
-        if (efx->type->udp_tnl_add_port)
+        if (efx->type->udp_tnl_del_port)
                 (void)efx->type->udp_tnl_del_port(efx, tnl);
 }
 
diff --git a/drivers/net/ethernet/sfc/falcon/efx.c b/drivers/net/ethernet/sfc/falcon/efx.c
index f5e5cd1659a1..29614da91cbf 100644
--- a/drivers/net/ethernet/sfc/falcon/efx.c
+++ b/drivers/net/ethernet/sfc/falcon/efx.c
@@ -1354,6 +1354,13 @@ static unsigned int ef4_wanted_parallelism(struct ef4_nic *efx)
                 free_cpumask_var(thread_mask);
         }
 
+        if (count > EF4_MAX_RX_QUEUES) {
+                netif_cond_dbg(efx, probe, efx->net_dev, !rss_cpus, warn,
+                               "Reducing number of rx queues from %u to %u.\n",
+                               count, EF4_MAX_RX_QUEUES);
+                count = EF4_MAX_RX_QUEUES;
+        }
+
         return count;
 }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 65077c77082a..91e9bd7159ab 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -1535,32 +1535,33 @@ static int smc_close(struct net_device *dev)
  * Ethtool support
  */
 static int
-smc_ethtool_getsettings(struct net_device *dev, struct ethtool_cmd *cmd)
+smc_ethtool_get_link_ksettings(struct net_device *dev,
+                               struct ethtool_link_ksettings *cmd)
 {
         struct smc_local *lp = netdev_priv(dev);
         int ret;
 
-        cmd->maxtxpkt = 1;
-        cmd->maxrxpkt = 1;
-
         if (lp->phy_type != 0) {
                 spin_lock_irq(&lp->lock);
-                ret = mii_ethtool_gset(&lp->mii, cmd);
+                ret = mii_ethtool_get_link_ksettings(&lp->mii, cmd);
                 spin_unlock_irq(&lp->lock);
         } else {
-                cmd->supported = SUPPORTED_10baseT_Half |
+                u32 supported = SUPPORTED_10baseT_Half |
                                  SUPPORTED_10baseT_Full |
                                  SUPPORTED_TP | SUPPORTED_AUI;
 
                 if (lp->ctl_rspeed == 10)
-                        ethtool_cmd_speed_set(cmd, SPEED_10);
+                        cmd->base.speed = SPEED_10;
                 else if (lp->ctl_rspeed == 100)
-                        ethtool_cmd_speed_set(cmd, SPEED_100);
+                        cmd->base.speed = SPEED_100;
+
+                cmd->base.autoneg = AUTONEG_DISABLE;
+                cmd->base.port = 0;
+                cmd->base.duplex = lp->tcr_cur_mode & TCR_SWFDUP ?
+                        DUPLEX_FULL : DUPLEX_HALF;
 
-                cmd->autoneg = AUTONEG_DISABLE;
-                cmd->transceiver = XCVR_INTERNAL;
-                cmd->port = 0;
-                cmd->duplex = lp->tcr_cur_mode & TCR_SWFDUP ? DUPLEX_FULL : DUPLEX_HALF;
+                ethtool_convert_legacy_u32_to_link_mode(
+                        cmd->link_modes.supported, supported);
 
                 ret = 0;
         }
@@ -1569,24 +1570,26 @@ smc_ethtool_getsettings(struct net_device *dev, struct ethtool_cmd *cmd)
 }
 
 static int
-smc_ethtool_setsettings(struct net_device *dev, struct ethtool_cmd *cmd)
+smc_ethtool_set_link_ksettings(struct net_device *dev,
+                               const struct ethtool_link_ksettings *cmd)
 {
         struct smc_local *lp = netdev_priv(dev);
         int ret;
 
         if (lp->phy_type != 0) {
                 spin_lock_irq(&lp->lock);
-                ret = mii_ethtool_sset(&lp->mii, cmd);
+                ret = mii_ethtool_set_link_ksettings(&lp->mii, cmd);
                 spin_unlock_irq(&lp->lock);
         } else {
-                if (cmd->autoneg != AUTONEG_DISABLE ||
-                    cmd->speed != SPEED_10 ||
-                    (cmd->duplex != DUPLEX_HALF && cmd->duplex != DUPLEX_FULL) ||
-                    (cmd->port != PORT_TP && cmd->port != PORT_AUI))
+                if (cmd->base.autoneg != AUTONEG_DISABLE ||
+                    cmd->base.speed != SPEED_10 ||
+                    (cmd->base.duplex != DUPLEX_HALF &&
+                     cmd->base.duplex != DUPLEX_FULL) ||
+                    (cmd->base.port != PORT_TP && cmd->base.port != PORT_AUI))
                         return -EINVAL;
 
-//              lp->port = cmd->port;
-                lp->ctl_rfduplx = cmd->duplex == DUPLEX_FULL;
+//              lp->port = cmd->base.port;
+                lp->ctl_rfduplx = cmd->base.duplex == DUPLEX_FULL;
 
 //              if (netif_running(dev))
 //                      smc_set_port(dev);
@@ -1744,8 +1747,6 @@ static int smc_ethtool_seteeprom(struct net_device *dev,
 
 
 static const struct ethtool_ops smc_ethtool_ops = {
-        .get_settings   = smc_ethtool_getsettings,
-        .set_settings   = smc_ethtool_setsettings,
         .get_drvinfo    = smc_ethtool_getdrvinfo,
 
         .get_msglevel   = smc_ethtool_getmsglevel,
@@ -1755,6 +1756,8 @@ static const struct ethtool_ops smc_ethtool_ops = {
         .get_eeprom_len = smc_ethtool_geteeprom_len,
         .get_eeprom     = smc_ethtool_geteeprom,
         .set_eeprom     = smc_ethtool_seteeprom,
+        .get_link_ksettings     = smc_ethtool_get_link_ksettings,
+        .set_link_ksettings     = smc_ethtool_set_link_ksettings,
 };
 
 static const struct net_device_ops smc_netdev_ops = {
diff --git a/drivers/net/ethernet/ti/Kconfig b/drivers/net/ethernet/ti/Kconfig
index 296c8efd0038..9e631952b86f 100644
--- a/drivers/net/ethernet/ti/Kconfig
+++ b/drivers/net/ethernet/ti/Kconfig
@@ -74,15 +74,21 @@ config TI_CPSW
           will be called cpsw.
 
 config TI_CPTS
-        tristate "TI Common Platform Time Sync (CPTS) Support"
+        bool "TI Common Platform Time Sync (CPTS) Support"
         depends on TI_CPSW || TI_KEYSTONE_NETCP
-        imply PTP_1588_CLOCK
+        depends on PTP_1588_CLOCK
         ---help---
           This driver supports the Common Platform Time Sync unit of
           the CPSW Ethernet Switch and Keystone 2 1g/10g Switch Subsystem.
           The unit can time stamp PTP UDP/IPv4 and Layer 2 packets, and the
           driver offers a PTP Hardware Clock.
 
+config TI_CPTS_MOD
+        tristate
+        depends on TI_CPTS
+        default y if TI_CPSW=y || TI_KEYSTONE_NETCP=y
+        default m
+
 config TI_KEYSTONE_NETCP
         tristate "TI Keystone NETCP Core Support"
         select TI_CPSW_ALE
diff --git a/drivers/net/ethernet/ti/Makefile b/drivers/net/ethernet/ti/Makefile
index 1e7c10bf8713..10e6b0ce51ba 100644
--- a/drivers/net/ethernet/ti/Makefile
+++ b/drivers/net/ethernet/ti/Makefile
@@ -12,7 +12,7 @@ obj-$(CONFIG_TI_DAVINCI_MDIO) += davinci_mdio.o
 obj-$(CONFIG_TI_DAVINCI_CPDMA) += davinci_cpdma.o
 obj-$(CONFIG_TI_CPSW_PHY_SEL) += cpsw-phy-sel.o
 obj-$(CONFIG_TI_CPSW_ALE) += cpsw_ale.o
-obj-$(CONFIG_TI_CPTS) += cpts.o
+obj-$(CONFIG_TI_CPTS_MOD) += cpts.o
 obj-$(CONFIG_TI_CPSW) += ti_cpsw.o
 ti_cpsw-y := cpsw.o
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 9f3d9c67e3fe..fa674a8bda0c 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1267,6 +1267,7 @@ static void soft_reset_slave(struct cpsw_slave *slave)
 static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
 {
         u32 slave_port;
+        struct phy_device *phy;
         struct cpsw_common *cpsw = priv->cpsw;
 
         soft_reset_slave(slave);
@@ -1300,27 +1301,28 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
                                    1 << slave_port, 0, 0, ALE_MCAST_FWD_2);
 
         if (slave->data->phy_node) {
-                slave->phy = of_phy_connect(priv->ndev, slave->data->phy_node,
+                phy = of_phy_connect(priv->ndev, slave->data->phy_node,
                                  &cpsw_adjust_link, 0, slave->data->phy_if);
-                if (!slave->phy) {
+                if (!phy) {
                         dev_err(priv->dev, "phy \"%s\" not found on slave %d\n",
                                 slave->data->phy_node->full_name,
                                 slave->slave_num);
                         return;
                 }
         } else {
-                slave->phy = phy_connect(priv->ndev, slave->data->phy_id,
+                phy = phy_connect(priv->ndev, slave->data->phy_id,
                                  &cpsw_adjust_link, slave->data->phy_if);
-                if (IS_ERR(slave->phy)) {
+                if (IS_ERR(phy)) {
                         dev_err(priv->dev,
                                 "phy \"%s\" not found on slave %d, err %ld\n",
                                 slave->data->phy_id, slave->slave_num,
-                                PTR_ERR(slave->phy));
-                        slave->phy = NULL;
+                                PTR_ERR(phy));
                         return;
                 }
         }
 
+        slave->phy = phy;
+
         phy_attached_info(slave->phy);
 
         phy_start(slave->phy);
@@ -1817,6 +1819,8 @@ static void cpsw_ndo_tx_timeout(struct net_device *ndev)
         }
 
         cpsw_intr_enable(cpsw);
+        netif_trans_update(ndev);
+        netif_tx_wake_all_queues(ndev);
 }
 
 static int cpsw_ndo_set_mac_address(struct net_device *ndev, void *p)
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index b75d9cdcfb0c..ae48c809bac9 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -45,6 +45,8 @@ MODULE_DESCRIPTION("FUJITSU Extended Socket Network Device Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
+#define ACPI_MOTHERBOARD_RESOURCE_HID "PNP0C02"
+
 static int fjes_request_irq(struct fjes_adapter *);
 static void fjes_free_irq(struct fjes_adapter *);
 
@@ -78,7 +80,7 @@ static void fjes_rx_irq(struct fjes_adapter *, int);
 static int fjes_poll(struct napi_struct *, int);
 
 static const struct acpi_device_id fjes_acpi_ids[] = {
-        {"PNP0C02", 0},
+        {ACPI_MOTHERBOARD_RESOURCE_HID, 0},
         {"", 0},
 };
 MODULE_DEVICE_TABLE(acpi, fjes_acpi_ids);
@@ -115,18 +117,17 @@ static struct resource fjes_resource[] = {
         },
 };
 
-static int fjes_acpi_add(struct acpi_device *device)
+static bool is_extended_socket_device(struct acpi_device *device)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
         char str_buf[sizeof(FJES_ACPI_SYMBOL) + 1];
-        struct platform_device *plat_dev;
         union acpi_object *str;
         acpi_status status;
         int result;
 
         status = acpi_evaluate_object(device->handle, "_STR", NULL, &buffer);
         if (ACPI_FAILURE(status))
-                return -ENODEV;
+                return false;
 
         str = buffer.pointer;
         result = utf16s_to_utf8s((wchar_t *)str->string.pointer,
@@ -136,10 +137,42 @@ static int fjes_acpi_add(struct acpi_device *device)
 
         if (strncmp(FJES_ACPI_SYMBOL, str_buf, strlen(FJES_ACPI_SYMBOL)) != 0) {
                 kfree(buffer.pointer);
-                return -ENODEV;
+                return false;
         }
         kfree(buffer.pointer);
 
+        return true;
+}
+
+static int acpi_check_extended_socket_status(struct acpi_device *device)
+{
+        unsigned long long sta;
+        acpi_status status;
+
+        status = acpi_evaluate_integer(device->handle, "_STA", NULL, &sta);
+        if (ACPI_FAILURE(status))
+                return -ENODEV;
+
+        if (!((sta & ACPI_STA_DEVICE_PRESENT) &&
+              (sta & ACPI_STA_DEVICE_ENABLED) &&
+              (sta & ACPI_STA_DEVICE_UI) &&
+              (sta & ACPI_STA_DEVICE_FUNCTIONING)))
+                return -ENODEV;
+
+        return 0;
+}
+
+static int fjes_acpi_add(struct acpi_device *device)
+{
+        struct platform_device *plat_dev;
+        acpi_status status;
+
+        if (!is_extended_socket_device(device))
+                return -ENODEV;
+
+        if (acpi_check_extended_socket_status(device))
+                return -ENODEV;
+
         status = acpi_walk_resources(device->handle, METHOD_NAME__CRS,
                                      fjes_get_acpi_resource, fjes_resource);
         if (ACPI_FAILURE(status))
@@ -1316,7 +1349,7 @@ static void fjes_netdev_setup(struct net_device *netdev)
         netdev->min_mtu = fjes_support_mtu[0];
         netdev->max_mtu = fjes_support_mtu[3];
         netdev->flags |= IFF_BROADCAST;
-        netdev->features |= NETIF_F_HW_CSUM | NETIF_F_HW_VLAN_CTAG_FILTER;
+        netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
 }
 
 static void fjes_irq_watch_task(struct work_struct *work)
@@ -1473,11 +1506,44 @@ static void fjes_watch_unshare_task(struct work_struct *work)
         }
 }
 
+static acpi_status
+acpi_find_extended_socket_device(acpi_handle obj_handle, u32 level,
+                                 void *context, void **return_value)
+{
+        struct acpi_device *device;
+        bool *found = context;
+        int result;
+
+        result = acpi_bus_get_device(obj_handle, &device);
+        if (result)
+                return AE_OK;
+
+        if (strcmp(acpi_device_hid(device), ACPI_MOTHERBOARD_RESOURCE_HID))
+                return AE_OK;
+
+        if (!is_extended_socket_device(device))
+                return AE_OK;
+
+        if (acpi_check_extended_socket_status(device))
+                return AE_OK;
+
+        *found = true;
+        return AE_CTRL_TERMINATE;
+}
+
 /* fjes_init_module - Driver Registration Routine */
 static int __init fjes_init_module(void)
 {
+        bool found = false;
         int result;
 
+        acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, ACPI_UINT32_MAX,
+                            acpi_find_extended_socket_device, NULL, &found,
+                            NULL);
+
+        if (!found)
+                return -ENODEV;
+
         pr_info("%s - version %s - %s\n",
                 fjes_driver_string, fjes_driver_version, fjes_copyright);
 
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index d3e73ac158ae..f9f3dba7a588 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -700,6 +700,8 @@ struct net_device_context {
 
         u32 tx_checksum_mask;
 
+        u32 tx_send_table[VRSS_SEND_TAB_SIZE];
+
         /* Ethtool settings */
         u8 duplex;
         u32 speed;
@@ -757,7 +759,6 @@ struct netvsc_device {
 
         struct nvsp_message revoke_packet;
 
-        u32 send_table[VRSS_SEND_TAB_SIZE];
         u32 max_chn;
         u32 num_chn;
         spinlock_t sc_lock; /* Protects num_sc_offered variable */
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index d35ebd993b38..8dd0b8770328 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -1136,15 +1136,11 @@ static void netvsc_receive(struct net_device *ndev,
 static void netvsc_send_table(struct hv_device *hdev,
                               struct nvsp_message *nvmsg)
 {
-        struct netvsc_device *nvscdev;
         struct net_device *ndev = hv_get_drvdata(hdev);
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
         int i;
         u32 count, *tab;
 
-        nvscdev = get_outbound_net_device(hdev);
-        if (!nvscdev)
-                return;
-
         count = nvmsg->msg.v5_msg.send_table.count;
         if (count != VRSS_SEND_TAB_SIZE) {
                 netdev_err(ndev, "Received wrong send-table size:%u\n", count);
@@ -1155,7 +1151,7 @@ static void netvsc_send_table(struct hv_device *hdev,
                       nvmsg->msg.v5_msg.send_table.offset);
 
         for (i = 0; i < count; i++)
-                nvscdev->send_table[i] = tab[i];
+                net_device_ctx->tx_send_table[i] = tab[i];
 }
 
 static void netvsc_send_vf(struct net_device_context *net_device_ctx,
@@ -1235,8 +1231,11 @@ void netvsc_channel_cb(void *context)
                 return;
 
         net_device = net_device_to_netvsc_device(ndev);
-        if (unlikely(net_device->destroy) &&
-            netvsc_channel_idle(net_device, q_idx))
+        if (unlikely(!net_device))
+                return;
+
+        if (unlikely(net_device->destroy &&
+                     netvsc_channel_idle(net_device, q_idx)))
                 return;
 
         /* commit_rd_index() -> hv_signal_on_read() needs this. */
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index bc05c895d958..5ede87f30463 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -206,17 +206,15 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
                         void *accel_priv, select_queue_fallback_t fallback)
 {
         struct net_device_context *net_device_ctx = netdev_priv(ndev);
-        struct netvsc_device *nvsc_dev = net_device_ctx->nvdev;
+        unsigned int num_tx_queues = ndev->real_num_tx_queues;
         struct sock *sk = skb->sk;
         int q_idx = sk_tx_queue_get(sk);
 
-        if (q_idx < 0 || skb->ooo_okay ||
-            q_idx >= ndev->real_num_tx_queues) {
+        if (q_idx < 0 || skb->ooo_okay || q_idx >= num_tx_queues) {
                 u16 hash = __skb_tx_hash(ndev, skb, VRSS_SEND_TAB_SIZE);
                 int new_idx;
 
-                new_idx = nvsc_dev->send_table[hash]
-                        % nvsc_dev->num_chn;
+                new_idx = net_device_ctx->tx_send_table[hash] % num_tx_queues;
 
                 if (q_idx != new_idx && sk &&
                     sk_fullsock(sk) && rcu_access_pointer(sk->sk_dst_cache))
@@ -225,9 +223,6 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb,
                 q_idx = new_idx;
         }
 
-        if (unlikely(!nvsc_dev->chan_table[q_idx].channel))
-                q_idx = 0;
-
         return q_idx;
 }
 
diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c
index ffedad2a360a..15b920086251 100644
--- a/drivers/net/irda/vlsi_ir.c
+++ b/drivers/net/irda/vlsi_ir.c
@@ -418,8 +418,9 @@ static struct vlsi_ring *vlsi_alloc_ring(struct pci_dev *pdev, struct ring_descr
                 memset(rd, 0, sizeof(*rd));
                 rd->hw = hwmap + i;
                 rd->buf = kmalloc(len, GFP_KERNEL|GFP_DMA);
-                if (rd->buf == NULL ||
-                    !(busaddr = pci_map_single(pdev, rd->buf, len, dir))) {
+                if (rd->buf)
+                        busaddr = pci_map_single(pdev, rd->buf, len, dir);
+                if (rd->buf == NULL || pci_dma_mapping_error(pdev, busaddr)) {
                         if (rd->buf) {
                                 net_err_ratelimited("%s: failed to create PCI-MAP for %p\n",
                                                     __func__, rd->buf);
@@ -430,8 +431,7 @@ static struct vlsi_ring *vlsi_alloc_ring(struct pci_dev *pdev, struct ring_descr
                                 rd = r->rd + j;
                                 busaddr = rd_get_addr(rd);
                                 rd_set_addr_status(rd, 0, 0);
-                                if (busaddr)
-                                        pci_unmap_single(pdev, busaddr, len, dir);
+                                pci_unmap_single(pdev, busaddr, len, dir);
                                 kfree(rd->buf);
                                 rd->buf = NULL;
                         }
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index e2460a57e4b1..ed0d10f54f26 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1438,8 +1438,6 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
                 skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                 skb_queue_tail(&dp83640->rx_queue, skb);
                 schedule_delayed_work(&dp83640->ts_work, SKB_TIMESTAMP_TIMEOUT);
-        } else {
-                netif_rx_ni(skb);
         }
 
         return true;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index f9d0fa315a47..272b051a0199 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1883,17 +1883,6 @@ static int m88e1510_probe(struct phy_device *phydev)
         return m88e1510_hwmon_probe(phydev);
 }
 
-static void marvell_remove(struct phy_device *phydev)
-{
-#ifdef CONFIG_HWMON
-
-        struct marvell_priv *priv = phydev->priv;
-
-        if (priv && priv->hwmon_dev)
-                hwmon_device_unregister(priv->hwmon_dev);
-#endif
-}
-
 static struct phy_driver marvell_drivers[] = {
         {
                 .phy_id = MARVELL_PHY_ID_88E1101,
@@ -1974,7 +1963,6 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = &m88e1121_probe,
-                .remove = &marvell_remove,
                 .config_init = &m88e1121_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
@@ -2087,7 +2075,6 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES | SUPPORTED_FIBRE,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = &m88e1510_probe,
-                .remove = &marvell_remove,
                 .config_init = &m88e1510_config_init,
                 .config_aneg = &m88e1510_config_aneg,
                 .read_status = &marvell_read_status,
@@ -2109,7 +2096,6 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = m88e1510_probe,
-                .remove = &marvell_remove,
                 .config_init = &marvell_config_init,
                 .config_aneg = &m88e1510_config_aneg,
                 .read_status = &marvell_read_status,
@@ -2127,7 +2113,6 @@ static struct phy_driver marvell_drivers[] = {
                 .phy_id_mask = MARVELL_PHY_ID_MASK,
                 .name = "Marvell 88E1545",
                 .probe = m88e1510_probe,
-                .remove = &marvell_remove,
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .config_init = &marvell_config_init,
diff --git a/drivers/net/phy/mdio-boardinfo.c b/drivers/net/phy/mdio-boardinfo.c
index 6b988f77da08..61941e29daae 100644
--- a/drivers/net/phy/mdio-boardinfo.c
+++ b/drivers/net/phy/mdio-boardinfo.c
@@ -84,3 +84,4 @@ int mdiobus_register_board_info(const struct mdio_board_info *info,
 
         return 0;
 }
+EXPORT_SYMBOL(mdiobus_register_board_info);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6742070ca676..1326d99771c1 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -798,9 +798,6 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -940,9 +937,6 @@ static struct phy_driver ksphy_driver[] = {
         .read_status    = genphy_read_status,
         .ack_interrupt  = kszphy_ack_interrupt,
         .config_intr    = kszphy_config_intr,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -952,6 +946,7 @@ static struct phy_driver ksphy_driver[] = {
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .driver_data    = &ksz9021_type,
+        .probe          = kszphy_probe,
         .config_init    = ksz9021_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
@@ -971,6 +966,7 @@ static struct phy_driver ksphy_driver[] = {
         .features       = PHY_GBIT_FEATURES,
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .driver_data    = &ksz9021_type,
+        .probe          = kszphy_probe,
         .config_init    = ksz9031_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = ksz9031_read_status,
@@ -989,9 +985,6 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = ksz8873mll_config_aneg,
         .read_status    = ksz8873mll_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -1003,9 +996,6 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = genphy_config_aneg,
         .read_status    = genphy_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 }, {
@@ -1017,9 +1007,6 @@ static struct phy_driver ksphy_driver[] = {
         .config_init    = kszphy_config_init,
         .config_aneg    = ksz8873mll_config_aneg,
         .read_status    = ksz8873mll_read_status,
-        .get_sset_count = kszphy_get_sset_count,
-        .get_strings    = kszphy_get_strings,
-        .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
         .resume         = genphy_resume,
 } };
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1be69d8bc909..a2bfc82e95d7 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -681,7 +681,7 @@ void phy_stop_machine(struct phy_device *phydev)
         cancel_delayed_work_sync(&phydev->state_queue);
 
         mutex_lock(&phydev->lock);
-        if (phydev->state > PHY_UP)
+        if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
                 phydev->state = PHY_UP;
         mutex_unlock(&phydev->lock);
 }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index daec6555f3b1..5198ccfa347f 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1864,7 +1864,7 @@ static struct phy_driver genphy_driver[] = {
         .phy_id         = 0xffffffff,
         .phy_id_mask    = 0xffffffff,
         .name           = "Generic PHY",
-        .soft_reset     = genphy_soft_reset,
+        .soft_reset     = genphy_no_soft_reset,
         .config_init    = genphy_config_init,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_MII |
                           SUPPORTED_AUI | SUPPORTED_FIBRE |
diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c
index 93ffedfa2994..1e2d4f1179da 100644
--- a/drivers/net/phy/spi_ks8995.c
+++ b/drivers/net/phy/spi_ks8995.c
@@ -491,13 +491,14 @@ static int ks8995_probe(struct spi_device *spi)
         if (err)
                 return err;
 
-        ks->regs_attr.size = ks->chip->regs_size;
         memcpy(&ks->regs_attr, &ks8995_registers_attr, sizeof(ks->regs_attr));
+        ks->regs_attr.size = ks->chip->regs_size;
 
         err = ks8995_reset(ks);
         if (err)
                 return err;
 
+        sysfs_attr_init(&ks->regs_attr.attr);
         err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr);
         if (err) {
                 dev_err(&spi->dev, "unable to create sysfs file, err=%d\n",
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 4a24b5d15f5a..f8c81f12d988 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -990,7 +990,7 @@ static void team_port_disable(struct team *team,
 #define TEAM_ENC_FEATURES       (NETIF_F_HW_CSUM | NETIF_F_SG | \
                                  NETIF_F_RXCSUM | NETIF_F_ALL_TSO)
 
-static void ___team_compute_features(struct team *team)
+static void __team_compute_features(struct team *team)
 {
         struct team_port *port;
         u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
@@ -1023,16 +1023,10 @@ static void ___team_compute_features(struct team *team)
                 team->dev->priv_flags |= IFF_XMIT_DST_RELEASE;
 }
 
-static void __team_compute_features(struct team *team)
-{
-        ___team_compute_features(team);
-        netdev_change_features(team->dev);
-}
-
 static void team_compute_features(struct team *team)
 {
         mutex_lock(&team->lock);
-        ___team_compute_features(team);
+        __team_compute_features(team);
         mutex_unlock(&team->lock);
         netdev_change_features(team->dev);
 }
@@ -1641,6 +1635,7 @@ static void team_uninit(struct net_device *dev)
         team_notify_peers_fini(team);
         team_queue_override_fini(team);
         mutex_unlock(&team->lock);
+        netdev_change_features(dev);
 }
 
 static void team_destructor(struct net_device *dev)
@@ -1928,6 +1923,10 @@ static int team_add_slave(struct net_device *dev, struct net_device *port_dev)
         mutex_lock(&team->lock);
         err = team_port_add(team, port_dev);
         mutex_unlock(&team->lock);
+
+        if (!err)
+                netdev_change_features(dev);
+
         return err;
 }
 
@@ -1939,6 +1938,10 @@ static int team_del_slave(struct net_device *dev, struct net_device *port_dev)
         mutex_lock(&team->lock);
         err = team_port_del(team, port_dev);
         mutex_unlock(&team->lock);
+
+        if (!err)
+                netdev_change_features(dev);
+
         return err;
 }
 
@@ -2072,6 +2075,7 @@ static int team_dev_type_check_change(struct net_device *dev,
 static void team_setup(struct net_device *dev)
 {
         ether_setup(dev);
+        dev->max_mtu = ETH_MAX_MTU;
 
         dev->netdev_ops = &team_netdev_ops;
         dev->ethtool_ops = &team_ethtool_ops;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index dc1b1dd9157c..cc88cd7856f5 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -822,7 +822,18 @@ static void tun_net_uninit(struct net_device *dev)
 /* Net device open. */
 static int tun_net_open(struct net_device *dev)
 {
+        struct tun_struct *tun = netdev_priv(dev);
+        int i;
+
         netif_tx_start_all_queues(dev);
+
+        for (i = 0; i < tun->numqueues; i++) {
+                struct tun_file *tfile;
+
+                tfile = rtnl_dereference(tun->tfiles[i]);
+                tfile->socket.sk->sk_write_space(tfile->socket.sk);
+        }
+
         return 0;
 }
 
@@ -1103,9 +1114,10 @@ static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
         if (!skb_array_empty(&tfile->tx_array))
                 mask |= POLLIN | POLLRDNORM;
 
-        if (sock_writeable(sk) ||
-            (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
-             sock_writeable(sk)))
+        if (tun->dev->flags & IFF_UP &&
+            (sock_writeable(sk) ||
+             (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
+              sock_writeable(sk))))
                 mask |= POLLOUT | POLLWRNORM;
 
         if (tun->dev->reg_state != NETREG_REGISTERED)
@@ -1919,6 +1931,8 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                 return -EINVAL;
 
         tun->set_features = features;
+        tun->dev->wanted_features &= ~TUN_USER_FEATURES;
+        tun->dev->wanted_features |= features;
         netdev_update_features(tun->dev);
 
         return 0;
@@ -2570,7 +2584,6 @@ static int __init tun_init(void)
         int ret = 0;
 
         pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
-        pr_info("%s\n", DRV_COPYRIGHT);
 
         ret = rtnl_link_register(&tun_link_ops);
         if (ret) {
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index f5552aaaa77a..f3ae88fdf332 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -532,6 +532,7 @@ static const struct driver_info wwan_info = {
 #define LENOVO_VENDOR_ID        0x17ef
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
+#define MICROSOFT_VENDOR_ID     0x045e
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -761,6 +762,20 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* Microsoft Surface 2 dock (based on Realtek RTL8152) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(MICROSOFT_VENDOR_ID, 0x07ab, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
+/* Microsoft Surface 3 dock (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(MICROSOFT_VENDOR_ID, 0x07c6, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index 8a40202c0a17..c4f1c363e24b 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -254,14 +254,9 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         tx_overhead = 0x40;
 
         len = skb->len;
-        if (skb_headroom(skb) < tx_overhead) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);
+        if (skb_cow_head(skb, tx_overhead)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         __skb_push(skb, tx_overhead);
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index e221bfcee76b..947bea81d924 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 {
         int len = skb->len;
 
-        if (skb_headroom(skb) < 2) {
-                struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
+        if (skb_cow_head(skb, 2)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
         skb_push(skb, 2);
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 876f02f4945e..2a2c3edb6bad 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -803,18 +803,12 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb,
         }
 
         /* We now decide whether we can put our special header into the sk_buff */
-        if (skb_cloned(skb) || skb_headroom(skb) < 2) {
-                /* no such luck - we make our own */
-                struct sk_buff *copied_skb;
-                copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);
-                dev_kfree_skb_irq(skb);
-                skb = copied_skb;
-                if (!copied_skb) {
-                        kaweth->stats.tx_errors++;
-                        netif_start_queue(net);
-                        spin_unlock_irq(&kaweth->device_lock);
-                        return NETDEV_TX_OK;
-                }
+        if (skb_cow_head(skb, 2)) {
+                kaweth->stats.tx_errors++;
+                netif_start_queue(net);
+                spin_unlock_irq(&kaweth->device_lock);
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
         }
 
         private_header = (__le16 *)__skb_push(skb, 2);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 9889a70ff4f6..636f48f19d1e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2607,14 +2607,9 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        if (skb_headroom(skb) < TX_OVERHEAD) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         if (lan78xx_linearize(skb) < 0)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 805674550683..2474618404f5 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -580,6 +580,10 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* Motorola Mapphone devices with MDM6600 */
+                USB_VENDOR_AND_INTERFACE_INFO(0x22b8, USB_CLASS_VENDOR_SPEC, 0xfb, 0xff),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 2. Combined interface devices matching on class+protocol */
         {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -904,7 +908,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
         {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
-        {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
+        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
         {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},    /* Olivetti Olicard 100 */
         {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},    /* Olivetti Olicard 120 */
@@ -925,6 +929,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b1, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81b3, 8)},    /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+        {QMI_FIXED_INTF(0x413c, 0x81b6, 8)},    /* Dell Wireless 5811e */
+        {QMI_FIXED_INTF(0x413c, 0x81b6, 10)},   /* Dell Wireless 5811e */
         {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)},    /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */
         {QMI_FIXED_INTF(0x22de, 0x9061, 3)},    /* WeTelecom WPD-600N */
         {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},    /* SIMCom 7230E */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 986243c932cc..07f788c49d57 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -32,7 +32,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "8"
+#define NET_VERSION             "9"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -501,6 +501,8 @@ enum rtl_register_content {
 #define RTL8153_RMS             RTL8153_MAX_PACKET
 #define RTL8152_TX_TIMEOUT      (5 * HZ)
 #define RTL8152_NAPI_WEIGHT     64
+#define rx_reserved_size(x)     ((x) + VLAN_ETH_HLEN + CRC_SIZE + \
+                                 sizeof(struct rx_desc) + RX_ALIGN)
 
 /* rtl8152 flags */
 enum rtl8152_flags {
@@ -515,6 +517,7 @@ enum rtl8152_flags {
 
 /* Define these values to match your device */
 #define VENDOR_ID_REALTEK               0x0bda
+#define VENDOR_ID_MICROSOFT             0x045e
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
 #define VENDOR_ID_NVIDIA                0x0955
@@ -1292,6 +1295,7 @@ static void intr_callback(struct urb *urb)
                 }
         } else {
                 if (netif_carrier_ok(tp->netdev)) {
+                        netif_stop_queue(tp->netdev);
                         set_bit(RTL8152_LINK_CHG, &tp->flags);
                         schedule_delayed_work(&tp->schedule, 0);
                 }
@@ -1362,6 +1366,7 @@ static int alloc_all_mem(struct r8152 *tp)
         spin_lock_init(&tp->rx_lock);
         spin_lock_init(&tp->tx_lock);
         INIT_LIST_HEAD(&tp->tx_free);
+        INIT_LIST_HEAD(&tp->rx_done);
         skb_queue_head_init(&tp->tx_queue);
         skb_queue_head_init(&tp->rx_queue);
 
@@ -2252,8 +2257,7 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp)
 
 static void r8153_set_rx_early_size(struct r8152 *tp)
 {
-        u32 mtu = tp->netdev->mtu;
-        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 8;
+        u32 ocp_data = (agg_buf_sz - rx_reserved_size(tp->netdev->mtu)) / 4;
 
         ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE, ocp_data);
 }
@@ -2898,7 +2902,8 @@ static void r8153_first_init(struct r8152 *tp)
 
         rtl_rx_vlan_en(tp, tp->netdev->features & NETIF_F_HW_VLAN_CTAG_RX);
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8153_RMS);
+        ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + CRC_SIZE;
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
         ocp_write_byte(tp, MCU_TYPE_PLA, PLA_MTPS, MTPS_JUMBO);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TCR0);
@@ -2950,7 +2955,8 @@ static void r8153_enter_oob(struct r8152 *tp)
                 usleep_range(1000, 2000);
         }
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8153_RMS);
+        ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + CRC_SIZE;
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
 
         ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_TEREDO_CFG);
         ocp_data &= ~TEREDO_WAKE_MASK;
@@ -3165,6 +3171,9 @@ static void set_carrier(struct r8152 *tp)
                         napi_enable(&tp->napi);
                         netif_wake_queue(netdev);
                         netif_info(tp, link, netdev, "carrier on\n");
+                } else if (netif_queue_stopped(netdev) &&
+                           skb_queue_len(&tp->tx_queue) < tp->tx_qlen) {
+                        netif_wake_queue(netdev);
                 }
         } else {
                 if (netif_carrier_ok(netdev)) {
@@ -3698,8 +3707,18 @@ static int rtl8152_resume(struct usb_interface *intf)
                         tp->rtl_ops.autosuspend_en(tp, false);
                         napi_disable(&tp->napi);
                         set_bit(WORK_ENABLE, &tp->flags);
-                        if (netif_carrier_ok(tp->netdev))
-                                rtl_start_rx(tp);
+
+                        if (netif_carrier_ok(tp->netdev)) {
+                                if (rtl8152_get_speed(tp) & LINK_STATUS) {
+                                        rtl_start_rx(tp);
+                                } else {
+                                        netif_carrier_off(tp->netdev);
+                                        tp->rtl_ops.disable(tp);
+                                        netif_info(tp, link, tp->netdev,
+                                                   "linking down\n");
+                                }
+                        }
+
                         napi_enable(&tp->napi);
                         clear_bit(SELECTIVE_SUSPEND, &tp->flags);
                         smp_mb__after_atomic();
@@ -4200,8 +4219,14 @@ static int rtl8152_change_mtu(struct net_device *dev, int new_mtu)
 
         dev->mtu = new_mtu;
 
-        if (netif_running(dev) && netif_carrier_ok(dev))
-                r8153_set_rx_early_size(tp);
+        if (netif_running(dev)) {
+                u32 rms = new_mtu + VLAN_ETH_HLEN + CRC_SIZE;
+
+                ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, rms);
+
+                if (netif_carrier_ok(dev))
+                        r8153_set_rx_early_size(tp);
+        }
 
         mutex_unlock(&tp->control);
 
@@ -4497,6 +4522,8 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 static struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8152)},
         {REALTEK_USB_DEVICE(VENDOR_ID_REALTEK, 0x8153)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07ab)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07c6)},
         {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x304f)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x3062)},
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 0b17b40d7a4f..190de9a90f73 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2203,13 +2203,9 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
-                struct sk_buff *skb2 =
-                        skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 831aa33d078a..5f19fb0f025d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -2001,13 +2001,13 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
         /* We do not advertise SG, so skbs should be already linearized */
         BUG_ON(skb_shinfo(skb)->nr_frags);
 
-        if (skb_headroom(skb) < overhead) {
-                struct sk_buff *skb2 = skb_copy_expand(skb,
-                        overhead, 0, flags);
+        /* Make writable and expand header space by overhead if required */
+        if (skb_cow_head(skb, overhead)) {
+                /* Must deallocate here as returning NULL to indicate error
+                 * means the skb won't be deallocated in the caller.
+                 */
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         if (csum) {
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 4a1e9c489f1f..aadfe1d1c37e 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 
         len = skb->len;
 
-        if (skb_headroom(skb) < SR_TX_OVERHEAD) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         __skb_push(skb, SR_TX_OVERHEAD);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3de65ea6531a..453244805c52 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1929,7 +1929,7 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                    " value=0x%04x index=0x%04x size=%d\n",
                    cmd, reqtype, value, index, size);
 
-        if (data) {
+        if (size) {
                 buf = kmalloc(size, GFP_KERNEL);
                 if (!buf)
                         goto out;
@@ -1938,8 +1938,13 @@ static int __usbnet_read_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
         err = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
                               USB_CTRL_GET_TIMEOUT);
-        if (err > 0 && err <= size)
-                memcpy(data, buf, err);
+        if (err > 0 && err <= size) {
+        if (data)
+            memcpy(data, buf, err);
+        else
+            netdev_dbg(dev->net,
+                "Huh? Data requested but thrown away.\n");
+    }
         kfree(buf);
 out:
         return err;
@@ -1960,7 +1965,13 @@ static int __usbnet_write_cmd(struct usbnet *dev, u8 cmd, u8 reqtype,
                 buf = kmemdup(data, size, GFP_KERNEL);
                 if (!buf)
                         goto out;
-        }
+        } else {
+        if (size) {
+            WARN_ON_ONCE(1);
+            err = -EINVAL;
+            goto out;
+        }
+    }
 
         err = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                               cmd, reqtype, value, index, buf, size,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index ea9890d61967..f36584616e7d 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2230,14 +2230,8 @@ static bool virtnet_validate_features(struct virtio_device *vdev)
 #define MIN_MTU ETH_MIN_MTU
 #define MAX_MTU ETH_MAX_MTU
 
-static int virtnet_probe(struct virtio_device *vdev)
+static int virtnet_validate(struct virtio_device *vdev)
 {
-        int i, err;
-        struct net_device *dev;
-        struct virtnet_info *vi;
-        u16 max_queue_pairs;
-        int mtu;
-
         if (!vdev->config->get) {
                 dev_err(&vdev->dev, "%s failure: config access disabled\n",
                         __func__);
@@ -2247,6 +2241,25 @@ static int virtnet_probe(struct virtio_device *vdev)
         if (!virtnet_validate_features(vdev))
                 return -EINVAL;
 
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_MTU)) {
+                int mtu = virtio_cread16(vdev,
+                                         offsetof(struct virtio_net_config,
+                                                  mtu));
+                if (mtu < MIN_MTU)
+                        __virtio_clear_bit(vdev, VIRTIO_NET_F_MTU);
+        }
+
+        return 0;
+}
+
+static int virtnet_probe(struct virtio_device *vdev)
+{
+        int i, err;
+        struct net_device *dev;
+        struct virtnet_info *vi;
+        u16 max_queue_pairs;
+        int mtu;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
@@ -2362,11 +2375,20 @@ static int virtnet_probe(struct virtio_device *vdev)
                                      offsetof(struct virtio_net_config,
                                               mtu));
                 if (mtu < dev->min_mtu) {
-                        __virtio_clear_bit(vdev, VIRTIO_NET_F_MTU);
-                } else {
-                        dev->mtu = mtu;
-                        dev->max_mtu = mtu;
+                        /* Should never trigger: MTU was previously validated
+                         * in virtnet_validate.
+                         */
+                        dev_err(&vdev->dev, "device MTU appears to have changed "
+                                "it is now %d < %d", mtu, dev->min_mtu);
+                        goto free_stats;
                 }
+
+                dev->mtu = mtu;
+                dev->max_mtu = mtu;
+
+                /* TODO: size buffers correctly in this case. */
+                if (dev->mtu > ETH_DATA_LEN)
+                        vi->big_packets = true;
         }
 
         if (vi->any_header_sg)
@@ -2544,6 +2566,7 @@ static struct virtio_driver virtio_net_driver = {
         .driver.name =  KBUILD_MODNAME,
         .driver.owner = THIS_MODULE,
         .id_table =     id_table,
+        .validate =     virtnet_validate,
         .probe =        virtnet_probe,
         .remove =       virtnet_remove,
         .config_changed = virtnet_config_changed,
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 22379da63400..7d909c8183e9 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -340,6 +340,7 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
 
 static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
 {
+        int len = skb->len;
         netdev_tx_t ret = is_ip_tx_frame(skb, dev);
 
         if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
@@ -347,7 +348,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 u64_stats_update_begin(&dstats->syncp);
                 dstats->tx_pkts++;
-                dstats->tx_bytes += skb->len;
+                dstats->tx_bytes += len;
                 u64_stats_update_end(&dstats->syncp);
         } else {
                 this_cpu_inc(dev->dstats->tx_drps);
@@ -461,8 +462,10 @@ static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
         }
 
         if (rt6_local) {
-                if (rt6_local->rt6i_idev)
+                if (rt6_local->rt6i_idev) {
                         in6_dev_put(rt6_local->rt6i_idev);
+                        rt6_local->rt6i_idev = NULL;
+                }
 
                 dst = &rt6_local->dst;
                 dev_put(dst->dev);
@@ -1125,7 +1128,7 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
                 goto nla_put_failure;
 
         /* rule only needs to appear once */
-        nlh->nlmsg_flags &= NLM_F_EXCL;
+        nlh->nlmsg_flags |= NLM_F_EXCL;
 
         frh = nlmsg_data(nlh);
         memset(frh, 0, sizeof(*frh));
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index e375560cc74e..bdb6ae16d4a8 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2976,6 +2976,44 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         return 0;
 }
 
+static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+                              struct vxlan_config *conf)
+{
+        struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+        struct vxlan_dev *vxlan = netdev_priv(dev);
+        int err;
+
+        err = vxlan_dev_configure(net, dev, conf, false);
+        if (err)
+                return err;
+
+        dev->ethtool_ops = &vxlan_ethtool_ops;
+
+        /* create an fdb entry for a valid default destination */
+        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
+                err = vxlan_fdb_create(vxlan, all_zeros_mac,
+                                       &vxlan->default_dst.remote_ip,
+                                       NUD_REACHABLE | NUD_PERMANENT,
+                                       NLM_F_EXCL | NLM_F_CREATE,
+                                       vxlan->cfg.dst_port,
+                                       vxlan->default_dst.remote_vni,
+                                       vxlan->default_dst.remote_vni,
+                                       vxlan->default_dst.remote_ifindex,
+                                       NTF_SELF);
+                if (err)
+                        return err;
+        }
+
+        err = register_netdevice(dev);
+        if (err) {
+                vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni);
+                return err;
+        }
+
+        list_add(&vxlan->next, &vn->vxlan_list);
+        return 0;
+}
+
 static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
                          struct net_device *dev, struct vxlan_config *conf,
                          bool changelink)
@@ -3172,8 +3210,6 @@ static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
 static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
-        struct vxlan_net *vn = net_generic(src_net, vxlan_net_id);
-        struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_config conf;
         int err;
 
@@ -3181,36 +3217,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (err)
                 return err;
 
-        err = vxlan_dev_configure(src_net, dev, &conf, false);
-        if (err)
-                return err;
-
-        dev->ethtool_ops = &vxlan_ethtool_ops;
-
-        /* create an fdb entry for a valid default destination */
-        if (!vxlan_addr_any(&vxlan->default_dst.remote_ip)) {
-                err = vxlan_fdb_create(vxlan, all_zeros_mac,
-                                       &vxlan->default_dst.remote_ip,
-                                       NUD_REACHABLE | NUD_PERMANENT,
-                                       NLM_F_EXCL | NLM_F_CREATE,
-                                       vxlan->cfg.dst_port,
-                                       vxlan->default_dst.remote_vni,
-                                       vxlan->default_dst.remote_vni,
-                                       vxlan->default_dst.remote_ifindex,
-                                       NTF_SELF);
-                if (err)
-                        return err;
-        }
-
-        err = register_netdevice(dev);
-        if (err) {
-                vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni);
-                return err;
-        }
-
-        list_add(&vxlan->next, &vn->vxlan_list);
-
-        return 0;
+        return __vxlan_dev_create(src_net, dev, &conf);
 }
 
 static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
@@ -3440,7 +3447,7 @@ struct net_device *vxlan_dev_create(struct net *net, const char *name,
         if (IS_ERR(dev))
                 return dev;
 
-        err = vxlan_dev_configure(net, dev, conf, false);
+        err = __vxlan_dev_create(net, dev, conf);
         if (err < 0) {
                 free_netdev(dev);
                 return ERR_PTR(err);
diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index a5045b5279d7..6742ae605660 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -381,8 +381,8 @@ static netdev_tx_t ucc_hdlc_tx(struct sk_buff *skb, struct net_device *dev)
         /* set bd status and length */
         bd_status = (bd_status & T_W_S) | T_R_S | T_I_S | T_L_S | T_TC_S;
 
-        iowrite16be(bd_status, &bd->status);
         iowrite16be(skb->len, &bd->length);
+        iowrite16be(bd_status, &bd->status);
 
         /* Move to next BD in the ring */
         if (!(bd_status & T_W_S))
@@ -457,7 +457,7 @@ static int hdlc_rx_done(struct ucc_hdlc_private *priv, int rx_work_limit)
         struct sk_buff *skb;
         hdlc_device *hdlc = dev_to_hdlc(dev);
         struct qe_bd *bd;
-        u32 bd_status;
+        u16 bd_status;
         u16 length, howmany = 0;
         u8 *bdbuffer;
         int i;
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index e7f5910a6519..f8eb66ef2944 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -467,6 +467,9 @@ int i2400mu_probe(struct usb_interface *iface,
         struct i2400mu *i2400mu;
         struct usb_device *usb_dev = interface_to_usbdev(iface);
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 4)
+                return -ENODEV;
+
         if (usb_dev->speed != USB_SPEED_HIGH)
                 dev_err(dev, "device not connected as high speed\n");
 
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
index 33fb26833cd0..d9f37ee4bfdd 100644
--- a/drivers/net/wireless/ath/ath10k/hw.c
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -51,7 +51,7 @@ const struct ath10k_hw_regs qca6174_regs = {
         .rtc_soc_base_address                   = 0x00000800,
         .rtc_wmac_base_address                  = 0x00001000,
         .soc_core_base_address                  = 0x0003a000,
-        .wlan_mac_base_address                  = 0x00020000,
+        .wlan_mac_base_address                  = 0x00010000,
         .ce_wrapper_base_address                = 0x00034000,
         .ce0_base_address                       = 0x00034400,
         .ce1_base_address                       = 0x00034800,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index de19c7c92bc6..85d949e03f79 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2238,14 +2238,16 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
         struct brcmf_p2p_info *p2p = &cfg->p2p;
         struct brcmf_cfg80211_vif *vif;
+        enum nl80211_iftype iftype;
         bool wait_for_disable = false;
         int err;
 
         brcmf_dbg(TRACE, "delete P2P vif\n");
         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 
+        iftype = vif->wdev.iftype;
         brcmf_cfg80211_arm_vif_event(cfg, vif);
-        switch (vif->wdev.iftype) {
+        switch (iftype) {
         case NL80211_IFTYPE_P2P_CLIENT:
                 if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
                         wait_for_disable = true;
@@ -2275,7 +2277,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                                             BRCMF_P2P_DISABLE_TIMEOUT);
 
         err = 0;
-        if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE) {
+        if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
                 brcmf_vif_clear_mgmt_ies(vif);
                 err = brcmf_p2p_release_p2p_if(vif);
         }
@@ -2291,7 +2293,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         brcmf_remove_interface(vif->ifp, true);
 
         brcmf_cfg80211_arm_vif_event(cfg, NULL);
-        if (vif->wdev.iftype != NL80211_IFTYPE_P2P_DEVICE)
+        if (iftype != NL80211_IFTYPE_P2P_DEVICE)
                 p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
 
         return err;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index a260cd503200..077bfd8f4c0c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
 
         if (ret)
                 return ret;
+        if (count == 0)
+                return 0;
 
         iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
                                (count - 1), NULL);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 99132ea16ede..c5734e1a02d2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -216,7 +216,8 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
                         qmask |= BIT(vif->hw_queue[ac]);
         }
 
-        if (vif->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC)
                 qmask |= BIT(vif->cab_queue);
 
         return qmask;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index d37b1695c64e..486dcceed17a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -2319,7 +2319,7 @@ iwl_mvm_mac_release_buffered_frames(struct ieee80211_hw *hw,
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
-        /* Called when we need to transmit (a) frame(s) from agg queue */
+        /* Called when we need to transmit (a) frame(s) from agg or dqa queue */
 
         iwl_mvm_sta_modify_sleep_tx_count(mvm, sta, reason, num_frames,
                                           tids, more_data, true);
@@ -2338,7 +2338,8 @@ static void __iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
         for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) {
                 struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
 
-                if (tid_data->state != IWL_AGG_ON &&
+                if (!iwl_mvm_is_dqa_supported(mvm) &&
+                    tid_data->state != IWL_AGG_ON &&
                     tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA)
                         continue;
 
@@ -2400,7 +2401,7 @@ void iwl_mvm_sta_pm_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
                 return;
 
         rcu_read_lock();
-        sta = mvm->fw_id_to_mac_id[notif->sta_id];
+        sta = rcu_dereference(mvm->fw_id_to_mac_id[notif->sta_id]);
         if (WARN_ON(IS_ERR_OR_NULL(sta))) {
                 rcu_read_unlock();
                 return;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index bd1dcc863d8f..9d28db7f56aa 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1806,7 +1806,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                         iwl_mvm_get_wd_timeout(mvm, vif, false, false);
                 int queue;
 
-                if (vif->type == NL80211_IFTYPE_AP)
+                if (vif->type == NL80211_IFTYPE_AP ||
+                    vif->type == NL80211_IFTYPE_ADHOC)
                         queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
                 else if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
                         queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
@@ -1837,7 +1838,8 @@ int iwl_mvm_send_add_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
          * enabled-cab_queue to the mask)
          */
         if (iwl_mvm_is_dqa_supported(mvm) &&
-            vif->type == NL80211_IFTYPE_AP) {
+            (vif->type == NL80211_IFTYPE_AP ||
+             vif->type == NL80211_IFTYPE_ADHOC)) {
                 struct iwl_trans_txq_scd_cfg cfg = {
                         .fifo = IWL_MVM_TX_FIFO_MCAST,
                         .sta_id = mvmvif->bcast_sta.sta_id,
@@ -1862,7 +1864,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (vif->type == NL80211_IFTYPE_AP)
+        if (vif->type == NL80211_IFTYPE_AP ||
+            vif->type == NL80211_IFTYPE_ADHOC)
                 iwl_mvm_disable_txq(mvm, vif->cab_queue, vif->cab_queue,
                                     IWL_MAX_TID_COUNT, 0);
 
@@ -3135,7 +3138,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        struct ieee80211_sta *sta,
                                        enum ieee80211_frame_release_type reason,
                                        u16 cnt, u16 tids, bool more_data,
-                                       bool agg)
+                                       bool single_sta_queue)
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {
@@ -3155,14 +3158,14 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
         for_each_set_bit(tid, &_tids, IWL_MAX_TID_COUNT)
                 cmd.awake_acs |= BIT(tid_to_ucode_ac[tid]);
 
-        /* If we're releasing frames from aggregation queues then check if the
-         * all queues combined that we're releasing frames from have
+        /* If we're releasing frames from aggregation or dqa queues then check
+         * if all the queues that we're releasing frames from, combined, have:
          *  - more frames than the service period, in which case more_data
          *    needs to be set
          *  - fewer than 'cnt' frames, in which case we need to adjust the
          *    firmware command (but do that unconditionally)
          */
-        if (agg) {
+        if (single_sta_queue) {
                 int remaining = cnt;
                 int sleep_tx_count;
 
@@ -3172,7 +3175,8 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                         u16 n_queued;
 
                         tid_data = &mvmsta->tid_data[tid];
-                        if (WARN(tid_data->state != IWL_AGG_ON &&
+                        if (WARN(!iwl_mvm_is_dqa_supported(mvm) &&
+                                 tid_data->state != IWL_AGG_ON &&
                                  tid_data->state != IWL_EMPTYING_HW_QUEUE_DELBA,
                                  "TID %d state is %d\n",
                                  tid, tid_data->state)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 4be34f902278..1927ce607798 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -547,7 +547,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
                                        struct ieee80211_sta *sta,
                                        enum ieee80211_frame_release_type reason,
                                        u16 cnt, u16 tids, bool more_data,
-                                       bool agg);
+                                       bool single_sta_queue);
 int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
                       bool drain);
 void iwl_mvm_sta_modify_disable_tx(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dd2b4a300819..1ba0a6f55503 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -7,7 +7,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016        Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -34,6 +34,7 @@
  *
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -505,6 +506,7 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
 
         switch (info->control.vif->type) {
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_ADHOC:
                 /*
                  * Handle legacy hostapd as well, where station may be added
                  * only after assoc. Take care of the case where we send a
@@ -516,7 +518,8 @@ static int iwl_mvm_get_ctrl_vif_queue(struct iwl_mvm *mvm,
                 if (info->hw_queue == info->control.vif->cab_queue)
                         return info->hw_queue;
 
-                WARN_ONCE(1, "fc=0x%02x", le16_to_cpu(fc));
+                WARN_ONCE(info->control.vif->type != NL80211_IFTYPE_ADHOC,
+                          "fc=0x%02x", le16_to_cpu(fc));
                 return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
         case NL80211_IFTYPE_P2P_DEVICE:
                 if (ieee80211_is_mgmt(fc))
@@ -583,7 +586,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                         iwl_mvm_vif_from_mac80211(info.control.vif);
 
                 if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
-                    info.control.vif->type == NL80211_IFTYPE_AP) {
+                    info.control.vif->type == NL80211_IFTYPE_AP ||
+                    info.control.vif->type == NL80211_IFTYPE_ADHOC) {
                         sta_id = mvmvif->bcast_sta.sta_id;
                         queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info,
                                                            hdr->frame_control);
@@ -628,8 +632,10 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
          * values.
          * Note that we don't need to make sure it isn't agg'd, since we're
          * TXing non-sta
+         * For DQA mode - we shouldn't increase it though
          */
-        atomic_inc(&mvm->pending_frames[sta_id]);
+        if (!iwl_mvm_is_dqa_supported(mvm))
+                atomic_inc(&mvm->pending_frames[sta_id]);
 
         return 0;
 }
@@ -1005,11 +1011,8 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
 
         spin_unlock(&mvmsta->lock);
 
-        /* Increase pending frames count if this isn't AMPDU */
-        if ((iwl_mvm_is_dqa_supported(mvm) &&
-             mvmsta->tid_data[tx_cmd->tid_tspec].state != IWL_AGG_ON &&
-             mvmsta->tid_data[tx_cmd->tid_tspec].state != IWL_AGG_STARTING) ||
-            (!iwl_mvm_is_dqa_supported(mvm) && !is_ampdu))
+        /* Increase pending frames count if this isn't AMPDU or DQA queue */
+        if (!iwl_mvm_is_dqa_supported(mvm) && !is_ampdu)
                 atomic_inc(&mvm->pending_frames[mvmsta->sta_id]);
 
         return 0;
@@ -1079,12 +1082,13 @@ static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
         lockdep_assert_held(&mvmsta->lock);
 
         if ((tid_data->state == IWL_AGG_ON ||
-             tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA) &&
+             tid_data->state == IWL_EMPTYING_HW_QUEUE_DELBA ||
+             iwl_mvm_is_dqa_supported(mvm)) &&
             iwl_mvm_tid_queued(tid_data) == 0) {
                 /*
-                 * Now that this aggregation queue is empty tell mac80211 so it
-                 * knows we no longer have frames buffered for the station on
-                 * this TID (for the TIM bitmap calculation.)
+                 * Now that this aggregation or DQA queue is empty tell
+                 * mac80211 so it knows we no longer have frames buffered for
+                 * the station on this TID (for the TIM bitmap calculation.)
                  */
                 ieee80211_sta_set_buffered(sta, tid, false);
         }
@@ -1257,7 +1261,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         u8 skb_freed = 0;
         u16 next_reclaimed, seq_ctl;
         bool is_ndp = false;
-        bool txq_agg = false; /* Is this TXQ aggregated */
 
         __skb_queue_head_init(&skbs);
 
@@ -1283,6 +1286,10 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         info->flags |= IEEE80211_TX_STAT_ACK;
                         break;
                 case TX_STATUS_FAIL_DEST_PS:
+                        /* In DQA, the FW should have stopped the queue and not
+                         * return this status
+                         */
+                        WARN_ON(iwl_mvm_is_dqa_supported(mvm));
                         info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
                         break;
                 default:
@@ -1387,15 +1394,6 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         bool send_eosp_ndp = false;
 
                         spin_lock_bh(&mvmsta->lock);
-                        if (iwl_mvm_is_dqa_supported(mvm)) {
-                                enum iwl_mvm_agg_state state;
-
-                                state = mvmsta->tid_data[tid].state;
-                                txq_agg = (state == IWL_AGG_ON ||
-                                        state == IWL_EMPTYING_HW_QUEUE_DELBA);
-                        } else {
-                                txq_agg = txq_id >= mvm->first_agg_queue;
-                        }
 
                         if (!is_ndp) {
                                 tid_data->next_reclaimed = next_reclaimed;
@@ -1452,11 +1450,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
          * If the txq is not an AMPDU queue, there is no chance we freed
          * several skbs. Check that out...
          */
-        if (txq_agg)
+        if (iwl_mvm_is_dqa_supported(mvm) || txq_id >= mvm->first_agg_queue)
                 goto out;
 
         /* We can't free more than one frame at once on a shared queue */
-        WARN_ON(!iwl_mvm_is_dqa_supported(mvm) && (skb_freed > 1));
+        WARN_ON(skb_freed > 1);
 
         /* If we have still frames for this STA nothing to do here */
         if (!atomic_sub_and_test(skb_freed, &mvm->pending_frames[sta_id]))
diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
index 5ebca1d0cfc7..b62e03d11c2e 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.c
+++ b/drivers/net/wireless/marvell/mwifiex/main.c
@@ -57,8 +57,8 @@ MODULE_PARM_DESC(mfg_mode, "manufacturing mode enable:1, disable:0");
  * In case of any errors during inittialization, this function also ensures
  * proper cleanup before exiting.
  */
-static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
-                            void **padapter)
+static int mwifiex_register(void *card, struct device *dev,
+                            struct mwifiex_if_ops *if_ops, void **padapter)
 {
         struct mwifiex_adapter *adapter;
         int i;
@@ -68,6 +68,7 @@ static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
                 return -ENOMEM;
 
         *padapter = adapter;
+        adapter->dev = dev;
         adapter->card = card;
 
         /* Save interface specific operations in adapter */
@@ -1568,12 +1569,11 @@ mwifiex_add_card(void *card, struct completion *fw_done,
 {
         struct mwifiex_adapter *adapter;
 
-        if (mwifiex_register(card, if_ops, (void **)&adapter)) {
+        if (mwifiex_register(card, dev, if_ops, (void **)&adapter)) {
                 pr_err("%s: software init failed\n", __func__);
                 goto err_init_sw;
         }
 
-        adapter->dev = dev;
         mwifiex_probe_of(adapter);
 
         adapter->iface_type = iface_type;
@@ -1718,6 +1718,9 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter)
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 
+        if (adapter->irq_wakeup >= 0)
+                device_init_wakeup(adapter->dev, false);
+
         /* Unregister device */
         mwifiex_dbg(adapter, INFO,
                     "info: unregister device\n");
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index a0d918094889..b8c990d10d6e 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -2739,6 +2739,21 @@ static void mwifiex_pcie_device_dump(struct mwifiex_adapter *adapter)
         schedule_work(&card->work);
 }
 
+static void mwifiex_pcie_free_buffers(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        if (reg->sleep_cookie)
+                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+
+        mwifiex_pcie_delete_cmdrsp_buf(adapter);
+        mwifiex_pcie_delete_evtbd_ring(adapter);
+        mwifiex_pcie_delete_rxbd_ring(adapter);
+        mwifiex_pcie_delete_txbd_ring(adapter);
+        card->cmdrsp_buf = NULL;
+}
+
 /*
  * This function initializes the PCI-E host memory space, WCB rings, etc.
  *
@@ -2850,13 +2865,6 @@ err_enable_dev:
 
 /*
  * This function cleans up the allocated card buffers.
- *
- * The following are freed by this function -
- *      - TXBD ring buffers
- *      - RXBD ring buffers
- *      - Event BD ring buffers
- *      - Command response ring buffer
- *      - Sleep cookie buffer
  */
 static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
 {
@@ -2875,6 +2883,8 @@ static void mwifiex_cleanup_pcie(struct mwifiex_adapter *adapter)
                                     "Failed to write driver not-ready signature\n");
         }
 
+        mwifiex_pcie_free_buffers(adapter);
+
         if (pdev) {
                 pci_iounmap(pdev, card->pci_mmap);
                 pci_iounmap(pdev, card->pci_mmap1);
@@ -3126,10 +3136,7 @@ err_cre_txbd:
         pci_iounmap(pdev, card->pci_mmap1);
 }
 
-/* This function cleans up the PCI-E host memory space.
- * Some code is extracted from mwifiex_unregister_dev()
- *
- */
+/* This function cleans up the PCI-E host memory space. */
 static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
@@ -3140,14 +3147,7 @@ static void mwifiex_pcie_down_dev(struct mwifiex_adapter *adapter)
 
         adapter->seq_num = 0;
 
-        if (reg->sleep_cookie)
-                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
-
-        mwifiex_pcie_delete_cmdrsp_buf(adapter);
-        mwifiex_pcie_delete_evtbd_ring(adapter);
-        mwifiex_pcie_delete_rxbd_ring(adapter);
-        mwifiex_pcie_delete_txbd_ring(adapter);
-        card->cmdrsp_buf = NULL;
+        mwifiex_pcie_free_buffers(adapter);
 }
 
 static struct mwifiex_if_ops pcie_ops = {
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index caea350f05aa..bdc379178e87 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -1742,12 +1742,14 @@ void rtl_c2hcmd_enqueue(struct ieee80211_hw *hw, u8 tag, u8 len, u8 *val)
         unsigned long flags;
         struct rtl_c2hcmd *c2hcmd;
 
-        c2hcmd = kmalloc(sizeof(*c2hcmd), GFP_KERNEL);
+        c2hcmd = kmalloc(sizeof(*c2hcmd),
+                         in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 
         if (!c2hcmd)
                 goto label_err;
 
-        c2hcmd->val = kmalloc(len, GFP_KERNEL);
+        c2hcmd->val = kmalloc(len,
+                              in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
 
         if (!c2hcmd->val)
                 goto label_err2;
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 829b26cd4549..8397f6c92451 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -165,13 +165,17 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
-        unsigned int num_queues = vif->num_queues;
+        unsigned int num_queues;
         u16 index;
         struct xenvif_rx_cb *cb;
 
         BUG_ON(skb->dev != dev);
 
-        /* Drop the packet if queues are not set up */
+        /* Drop the packet if queues are not set up.
+         * This handler should be called inside an RCU read section
+         * so we don't need to enter it here explicitly.
+         */
+        num_queues = READ_ONCE(vif->num_queues);
         if (num_queues < 1)
                 goto drop;
 
@@ -222,18 +226,18 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
+        unsigned int num_queues;
         u64 rx_bytes = 0;
         u64 rx_packets = 0;
         u64 tx_bytes = 0;
         u64 tx_packets = 0;
         unsigned int index;
 
-        spin_lock(&vif->lock);
-        if (vif->queues == NULL)
-                goto out;
+        rcu_read_lock();
+        num_queues = READ_ONCE(vif->num_queues);
 
         /* Aggregate tx and rx stats from each queue */
-        for (index = 0; index < vif->num_queues; ++index) {
+        for (index = 0; index < num_queues; ++index) {
                 queue = &vif->queues[index];
                 rx_bytes += queue->stats.rx_bytes;
                 rx_packets += queue->stats.rx_packets;
@@ -241,8 +245,7 @@ static struct net_device_stats *xenvif_get_stats(struct net_device *dev)
                 tx_packets += queue->stats.tx_packets;
         }
 
-out:
-        spin_unlock(&vif->lock);
+        rcu_read_unlock();
 
         vif->dev->stats.rx_bytes = rx_bytes;
         vif->dev->stats.rx_packets = rx_packets;
@@ -378,10 +381,13 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                                      struct ethtool_stats *stats, u64 * data)
 {
         struct xenvif *vif = netdev_priv(dev);
-        unsigned int num_queues = vif->num_queues;
+        unsigned int num_queues;
         int i;
         unsigned int queue_index;
 
+        rcu_read_lock();
+        num_queues = READ_ONCE(vif->num_queues);
+
         for (i = 0; i < ARRAY_SIZE(xenvif_stats); i++) {
                 unsigned long accum = 0;
                 for (queue_index = 0; queue_index < num_queues; ++queue_index) {
@@ -390,6 +396,8 @@ static void xenvif_get_ethtool_stats(struct net_device *dev,
                 }
                 data[i] = accum;
         }
+
+        rcu_read_unlock();
 }
 
 static void xenvif_get_strings(struct net_device *dev, u32 stringset, u8 * data)
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f9bcf4a665bc..602d408fa25e 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -214,7 +214,7 @@ static void xenvif_fatal_tx_err(struct xenvif *vif)
         netdev_err(vif->dev, "fatal error; disabling device\n");
         vif->disabled = true;
         /* Disable the vif from queue 0's kthread */
-        if (vif->queues)
+        if (vif->num_queues)
                 xenvif_kick_thread(&vif->queues[0]);
 }
 
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index d2d7cd9145b1..a56d3eab35dd 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -495,26 +495,26 @@ static void backend_disconnect(struct backend_info *be)
         struct xenvif *vif = be->vif;
 
         if (vif) {
+                unsigned int num_queues = vif->num_queues;
                 unsigned int queue_index;
-                struct xenvif_queue *queues;
 
                 xen_unregister_watchers(vif);
 #ifdef CONFIG_DEBUG_FS
                 xenvif_debugfs_delif(vif);
 #endif /* CONFIG_DEBUG_FS */
                 xenvif_disconnect_data(vif);
-                for (queue_index = 0;
-                     queue_index < vif->num_queues;
-                     ++queue_index)
-                        xenvif_deinit_queue(&vif->queues[queue_index]);
 
-                spin_lock(&vif->lock);
-                queues = vif->queues;
+                /* At this point some of the handlers may still be active
+                 * so we need to have additional synchronization here.
+                 */
                 vif->num_queues = 0;
-                vif->queues = NULL;
-                spin_unlock(&vif->lock);
+                synchronize_net();
 
-                vfree(queues);
+                for (queue_index = 0; queue_index < num_queues; ++queue_index)
+                        xenvif_deinit_queue(&vif->queues[queue_index]);
+
+                vfree(vif->queues);
+                vif->queues = NULL;
 
                 xenvif_disconnect_ctrl(vif);
         }
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 23d4a1728cdf..351bac8f6503 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -934,8 +934,14 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, NULL);
         if (rc < 0)
                 goto out_unlock;
+        nvdimm_bus_unlock(&nvdimm_bus->dev);
+
         if (copy_to_user(p, buf, buf_len))
                 rc = -EFAULT;
+
+        vfree(buf);
+        return rc;
+
  out_unlock:
         nvdimm_bus_unlock(&nvdimm_bus->dev);
  out:
diff --git a/drivers/nvdimm/claim.c b/drivers/nvdimm/claim.c
index b3323c0697f6..ca6d572c48fc 100644
--- a/drivers/nvdimm/claim.c
+++ b/drivers/nvdimm/claim.c
@@ -243,7 +243,15 @@ static int nsio_rw_bytes(struct nd_namespace_common *ndns,
         }
 
         if (unlikely(is_bad_pmem(&nsio->bb, sector, sz_align))) {
-                if (IS_ALIGNED(offset, 512) && IS_ALIGNED(size, 512)) {
+                /*
+                 * FIXME: nsio_rw_bytes() may be called from atomic
+                 * context in the btt case and nvdimm_clear_poison()
+                 * takes a sleeping lock. Until the locking can be
+                 * reworked this capability requires that the namespace
+                 * is not claimed by btt.
+                 */
+                if (IS_ALIGNED(offset, 512) && IS_ALIGNED(size, 512)
+                                && (!ndns->claim || !is_nd_btt(ndns->claim))) {
                         long cleared;
 
                         cleared = nvdimm_clear_poison(&ndns->dev, offset, size);
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index 0eedc49e0d47..8b721321be5b 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -395,7 +395,7 @@ EXPORT_SYMBOL_GPL(nvdimm_create);
 
 int alias_dpa_busy(struct device *dev, void *data)
 {
-        resource_size_t map_end, blk_start, new, busy;
+        resource_size_t map_end, blk_start, new;
         struct blk_alloc_info *info = data;
         struct nd_mapping *nd_mapping;
         struct nd_region *nd_region;
@@ -436,29 +436,19 @@ int alias_dpa_busy(struct device *dev, void *data)
  retry:
         /*
          * Find the free dpa from the end of the last pmem allocation to
-         * the end of the interleave-set mapping that is not already
-         * covered by a blk allocation.
+         * the end of the interleave-set mapping.
          */
-        busy = 0;
         for_each_dpa_resource(ndd, res) {
+                if (strncmp(res->name, "pmem", 4) != 0)
+                        continue;
                 if ((res->start >= blk_start && res->start < map_end)
                                 || (res->end >= blk_start
                                         && res->end <= map_end)) {
-                        if (strncmp(res->name, "pmem", 4) == 0) {
-                                new = max(blk_start, min(map_end + 1,
-                                                        res->end + 1));
-                                if (new != blk_start) {
-                                        blk_start = new;
-                                        goto retry;
-                                }
-                        } else
-                                busy += min(map_end, res->end)
-                                        - max(nd_mapping->start, res->start) + 1;
-                } else if (nd_mapping->start > res->start
-                                && map_end < res->end) {
-                        /* total eclipse of the PMEM region mapping */
-                        busy += nd_mapping->size;
-                        break;
+                        new = max(blk_start, min(map_end + 1, res->end + 1));
+                        if (new != blk_start) {
+                                blk_start = new;
+                                goto retry;
+                        }
                 }
         }
 
@@ -470,52 +460,11 @@ int alias_dpa_busy(struct device *dev, void *data)
                 return 1;
         }
 
-        info->available -= blk_start - nd_mapping->start + busy;
+        info->available -= blk_start - nd_mapping->start;
 
         return 0;
 }
 
-static int blk_dpa_busy(struct device *dev, void *data)
-{
-        struct blk_alloc_info *info = data;
-        struct nd_mapping *nd_mapping;
-        struct nd_region *nd_region;
-        resource_size_t map_end;
-        int i;
-
-        if (!is_nd_pmem(dev))
-                return 0;
-
-        nd_region = to_nd_region(dev);
-        for (i = 0; i < nd_region->ndr_mappings; i++) {
-                nd_mapping  = &nd_region->mapping[i];
-                if (nd_mapping->nvdimm == info->nd_mapping->nvdimm)
-                        break;
-        }
-
-        if (i >= nd_region->ndr_mappings)
-                return 0;
-
-        map_end = nd_mapping->start + nd_mapping->size - 1;
-        if (info->res->start >= nd_mapping->start
-                        && info->res->start < map_end) {
-                if (info->res->end <= map_end) {
-                        info->busy = 0;
-                        return 1;
-                } else {
-                        info->busy -= info->res->end - map_end;
-                        return 0;
-                }
-        } else if (info->res->end >= nd_mapping->start
-                        && info->res->end <= map_end) {
-                info->busy -= nd_mapping->start - info->res->start;
-                return 0;
-        } else {
-                info->busy -= nd_mapping->size;
-                return 0;
-        }
-}
-
 /**
  * nd_blk_available_dpa - account the unused dpa of BLK region
  * @nd_mapping: container of dpa-resource-root + labels
@@ -545,11 +494,7 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region)
         for_each_dpa_resource(ndd, res) {
                 if (strncmp(res->name, "blk", 3) != 0)
                         continue;
-
-                info.res = res;
-                info.busy = resource_size(res);
-                device_for_each_child(&nvdimm_bus->dev, &info, blk_dpa_busy);
-                info.available -= info.busy;
+                info.available -= resource_size(res);
         }
 
         return info.available;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9b3b57fef446..eeb409c287b8 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -270,7 +270,7 @@ static inline int nvme_setup_discard(struct nvme_ns *ns, struct request *req,
         memset(cmnd, 0, sizeof(*cmnd));
         cmnd->dsm.opcode = nvme_cmd_dsm;
         cmnd->dsm.nsid = cpu_to_le32(ns->ns_id);
-        cmnd->dsm.nr = segments - 1;
+        cmnd->dsm.nr = cpu_to_le32(segments - 1);
         cmnd->dsm.attributes = cpu_to_le32(NVME_DSMGMT_AD);
 
         req->special_vec.bv_page = virt_to_page(range);
@@ -1316,6 +1316,14 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                                 table->entries[state] = target;
 
                         /*
+                         * Don't allow transitions to the deepest state
+                         * if it's quirked off.
+                         */
+                        if (state == ctrl->npss &&
+                            (ctrl->quirks & NVME_QUIRK_NO_DEEPEST_PS))
+                                continue;
+
+                        /*
                          * Is this state a useful non-operational state for
                          * higher-power states to autonomously transition to?
                          */
@@ -1387,16 +1395,15 @@ struct nvme_core_quirk_entry {
 };
 
 static const struct nvme_core_quirk_entry core_quirks[] = {
-        /*
-         * Seen on a Samsung "SM951 NVMe SAMSUNG 256GB": using APST causes
-         * the controller to go out to lunch.  It dies when the watchdog
-         * timer reads CSTS and gets 0xffffffff.
-         */
         {
-                .vid = 0x144d,
-                .fr = "BXW75D0Q",
+                /*
+                 * This Toshiba device seems to die using any APST states.  See:
+                 * https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1678184/comments/11
+                 */
+                .vid = 0x1179,
+                .mn = "THNSF5256GPUK TOSHIBA",
                 .quirks = NVME_QUIRK_NO_APST,
-        },
+        }
 };
 
 /* match is null-terminated but idstr is space-padded. */
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 9690beb15e69..d996ca73d3be 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2023,7 +2023,7 @@ nvme_fc_configure_admin_queue(struct nvme_fc_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 2aa20e3e5675..ab2d6ec7eb5c 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -83,6 +83,11 @@ enum nvme_quirks {
          * APST should not be used.
          */
         NVME_QUIRK_NO_APST                      = (1 << 4),
+
+        /*
+         * The deepest sleep state should not be used.
+         */
+        NVME_QUIRK_NO_DEEPEST_PS                = (1 << 5),
 };
 
 /*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 26a5fd05fe88..5d309535abbd 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -19,6 +19,7 @@
 #include <linux/blk-mq-pci.h>
 #include <linux/cpu.h>
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/genhd.h>
@@ -1943,10 +1944,31 @@ static int nvme_dev_map(struct nvme_dev *dev)
         return -ENODEV;
 }
 
+static unsigned long check_dell_samsung_bug(struct pci_dev *pdev)
+{
+        if (pdev->vendor == 0x144d && pdev->device == 0xa802) {
+                /*
+                 * Several Samsung devices seem to drop off the PCIe bus
+                 * randomly when APST is on and uses the deepest sleep state.
+                 * This has been observed on a Samsung "SM951 NVMe SAMSUNG
+                 * 256GB", a "PM951 NVMe SAMSUNG 512GB", and a "Samsung SSD
+                 * 950 PRO 256GB", but it seems to be restricted to two Dell
+                 * laptops.
+                 */
+                if (dmi_match(DMI_SYS_VENDOR, "Dell Inc.") &&
+                    (dmi_match(DMI_PRODUCT_NAME, "XPS 15 9550") ||
+                     dmi_match(DMI_PRODUCT_NAME, "Precision 5510")))
+                        return NVME_QUIRK_NO_DEEPEST_PS;
+        }
+
+        return 0;
+}
+
 static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         int node, result = -ENOMEM;
         struct nvme_dev *dev;
+        unsigned long quirks = id->driver_data;
 
         node = dev_to_node(&pdev->dev);
         if (node == NUMA_NO_NODE)
@@ -1978,8 +2000,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         if (result)
                 goto put_pci;
 
+        quirks |= check_dell_samsung_bug(pdev);
+
         result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops,
-                        id->driver_data);
+                        quirks);
         if (result)
                 goto release_pools;
 
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 779f516e7a4e..16f84eb0b95e 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -343,8 +343,6 @@ static int __nvme_rdma_init_request(struct nvme_rdma_ctrl *ctrl,
         struct ib_device *ibdev = dev->dev;
         int ret;
 
-        BUG_ON(queue_idx >= ctrl->queue_count);
-
         ret = nvme_rdma_alloc_qe(ibdev, &req->sqe, sizeof(struct nvme_command),
                         DMA_TO_DEVICE);
         if (ret)
@@ -652,8 +650,22 @@ out_free_queues:
 
 static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
 {
+        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        unsigned int nr_io_queues;
         int i, ret;
 
+        nr_io_queues = min(opts->nr_io_queues, num_online_cpus());
+        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
+        if (ret)
+                return ret;
+
+        ctrl->queue_count = nr_io_queues + 1;
+        if (ctrl->queue_count < 2)
+                return 0;
+
+        dev_info(ctrl->ctrl.device,
+                "creating %d I/O queues.\n", nr_io_queues);
+
         for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvme_rdma_init_queue(ctrl, i,
                                            ctrl->ctrl.opts->queue_size);
@@ -1594,7 +1606,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
@@ -1791,20 +1803,8 @@ static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
 
 static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
 {
-        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
         int ret;
 
-        ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues);
-        if (ret)
-                return ret;
-
-        ctrl->queue_count = opts->nr_io_queues + 1;
-        if (ctrl->queue_count < 2)
-                return 0;
-
-        dev_info(ctrl->ctrl.device,
-                "creating %d I/O queues.\n", opts->nr_io_queues);
-
         ret = nvme_rdma_init_io_queues(ctrl);
         if (ret)
                 return ret;
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index a7bcff45f437..76450b0c55f1 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -100,7 +100,7 @@ static u16 nvmet_get_smart_log(struct nvmet_req *req,
         u16 status;
 
         WARN_ON(req == NULL || slog == NULL);
-        if (req->cmd->get_log_page.nsid == 0xFFFFFFFF)
+        if (req->cmd->get_log_page.nsid == cpu_to_le32(0xFFFFFFFF))
                 status = nvmet_get_smart_log_all(req, slog);
         else
                 status = nvmet_get_smart_log_nsid(req, slog);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 11b0a0a5f661..798653b329b2 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -425,6 +425,13 @@ void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
         ctrl->sqs[qid] = sq;
 }
 
+static void nvmet_confirm_sq(struct percpu_ref *ref)
+{
+        struct nvmet_sq *sq = container_of(ref, struct nvmet_sq, ref);
+
+        complete(&sq->confirm_done);
+}
+
 void nvmet_sq_destroy(struct nvmet_sq *sq)
 {
         /*
@@ -433,7 +440,8 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)
          */
         if (sq->ctrl && sq->ctrl->sqs && sq->ctrl->sqs[0] == sq)
                 nvmet_async_events_free(sq->ctrl);
-        percpu_ref_kill(&sq->ref);
+        percpu_ref_kill_and_confirm(&sq->ref, nvmet_confirm_sq);
+        wait_for_completion(&sq->confirm_done);
         wait_for_completion(&sq->free_done);
         percpu_ref_exit(&sq->ref);
 
@@ -461,6 +469,7 @@ int nvmet_sq_init(struct nvmet_sq *sq)
                 return ret;
         }
         init_completion(&sq->free_done);
+        init_completion(&sq->confirm_done);
 
         return 0;
 }
diff --git a/drivers/nvme/target/io-cmd.c b/drivers/nvme/target/io-cmd.c
index 4195115c7e54..6b0baa9caab9 100644
--- a/drivers/nvme/target/io-cmd.c
+++ b/drivers/nvme/target/io-cmd.c
@@ -180,7 +180,7 @@ static void nvmet_execute_write_zeroes(struct nvmet_req *req)
 
         sector = le64_to_cpu(write_zeroes->slba) <<
                 (req->ns->blksize_shift - 9);
-        nr_sector = (((sector_t)le32_to_cpu(write_zeroes->length)) <<
+        nr_sector = (((sector_t)le16_to_cpu(write_zeroes->length)) <<
                 (req->ns->blksize_shift - 9)) + 1;
 
         if (__blkdev_issue_zeroout(req->ns->bdev, sector, nr_sector,
@@ -230,7 +230,7 @@ int nvmet_parse_io_cmd(struct nvmet_req *req)
                 return 0;
         case nvme_cmd_dsm:
                 req->execute = nvmet_execute_dsm;
-                req->data_len = le32_to_cpu(cmd->dsm.nr + 1) *
+                req->data_len = (le32_to_cpu(cmd->dsm.nr) + 1) *
                         sizeof(struct nvme_dsm_range);
                 return 0;
         case nvme_cmd_write_zeroes:
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index d1f06e7768ff..c7b0b6a52708 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -223,8 +223,6 @@ static void nvme_loop_submit_async_event(struct nvme_ctrl *arg, int aer_idx)
 static int nvme_loop_init_iod(struct nvme_loop_ctrl *ctrl,
                 struct nvme_loop_iod *iod, unsigned int queue_idx)
 {
-        BUG_ON(queue_idx >= ctrl->queue_count);
-
         iod->req.cmd = &iod->cmd;
         iod->req.rsp = &iod->rsp;
         iod->queue = &ctrl->queues[queue_idx];
@@ -288,9 +286,9 @@ static struct blk_mq_ops nvme_loop_admin_mq_ops = {
 
 static void nvme_loop_destroy_admin_queue(struct nvme_loop_ctrl *ctrl)
 {
+        nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
         blk_cleanup_queue(ctrl->ctrl.admin_q);
         blk_mq_free_tag_set(&ctrl->admin_tag_set);
-        nvmet_sq_destroy(&ctrl->queues[0].nvme_sq);
 }
 
 static void nvme_loop_free_ctrl(struct nvme_ctrl *nctrl)
@@ -314,6 +312,43 @@ free_ctrl:
         kfree(ctrl);
 }
 
+static void nvme_loop_destroy_io_queues(struct nvme_loop_ctrl *ctrl)
+{
+        int i;
+
+        for (i = 1; i < ctrl->queue_count; i++)
+                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+}
+
+static int nvme_loop_init_io_queues(struct nvme_loop_ctrl *ctrl)
+{
+        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
+        unsigned int nr_io_queues;
+        int ret, i;
+
+        nr_io_queues = min(opts->nr_io_queues, num_online_cpus());
+        ret = nvme_set_queue_count(&ctrl->ctrl, &nr_io_queues);
+        if (ret || !nr_io_queues)
+                return ret;
+
+        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", nr_io_queues);
+
+        for (i = 1; i <= nr_io_queues; i++) {
+                ctrl->queues[i].ctrl = ctrl;
+                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
+                if (ret)
+                        goto out_destroy_queues;
+
+                ctrl->queue_count++;
+        }
+
+        return 0;
+
+out_destroy_queues:
+        nvme_loop_destroy_io_queues(ctrl);
+        return ret;
+}
+
 static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
 {
         int error;
@@ -357,7 +392,7 @@ static int nvme_loop_configure_admin_queue(struct nvme_loop_ctrl *ctrl)
         }
 
         ctrl->ctrl.sqsize =
-                min_t(int, NVME_CAP_MQES(ctrl->cap) + 1, ctrl->ctrl.sqsize);
+                min_t(int, NVME_CAP_MQES(ctrl->cap), ctrl->ctrl.sqsize);
 
         error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
         if (error)
@@ -385,17 +420,13 @@ out_free_sq:
 
 static void nvme_loop_shutdown_ctrl(struct nvme_loop_ctrl *ctrl)
 {
-        int i;
-
         nvme_stop_keep_alive(&ctrl->ctrl);
 
         if (ctrl->queue_count > 1) {
                 nvme_stop_queues(&ctrl->ctrl);
                 blk_mq_tagset_busy_iter(&ctrl->tag_set,
                                         nvme_cancel_request, &ctrl->ctrl);
-
-                for (i = 1; i < ctrl->queue_count; i++)
-                        nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+                nvme_loop_destroy_io_queues(ctrl);
         }
 
         if (ctrl->ctrl.state == NVME_CTRL_LIVE)
@@ -467,19 +498,14 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
         if (ret)
                 goto out_disable;
 
-        for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) {
-                ctrl->queues[i].ctrl = ctrl;
-                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
-                if (ret)
-                        goto out_free_queues;
-
-                ctrl->queue_count++;
-        }
+        ret = nvme_loop_init_io_queues(ctrl);
+        if (ret)
+                goto out_destroy_admin;
 
-        for (i = 1; i <= ctrl->ctrl.opts->nr_io_queues; i++) {
+        for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
                 if (ret)
-                        goto out_free_queues;
+                        goto out_destroy_io;
         }
 
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -492,9 +518,9 @@ static void nvme_loop_reset_ctrl_work(struct work_struct *work)
 
         return;
 
-out_free_queues:
-        for (i = 1; i < ctrl->queue_count; i++)
-                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+out_destroy_io:
+        nvme_loop_destroy_io_queues(ctrl);
+out_destroy_admin:
         nvme_loop_destroy_admin_queue(ctrl);
 out_disable:
         dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
@@ -533,25 +559,12 @@ static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
 
 static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
 {
-        struct nvmf_ctrl_options *opts = ctrl->ctrl.opts;
         int ret, i;
 
-        ret = nvme_set_queue_count(&ctrl->ctrl, &opts->nr_io_queues);
-        if (ret || !opts->nr_io_queues)
+        ret = nvme_loop_init_io_queues(ctrl);
+        if (ret)
                 return ret;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                opts->nr_io_queues);
-
-        for (i = 1; i <= opts->nr_io_queues; i++) {
-                ctrl->queues[i].ctrl = ctrl;
-                ret = nvmet_sq_init(&ctrl->queues[i].nvme_sq);
-                if (ret)
-                        goto out_destroy_queues;
-
-                ctrl->queue_count++;
-        }
-
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_loop_mq_ops;
         ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
@@ -575,7 +588,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
                 goto out_free_tagset;
         }
 
-        for (i = 1; i <= opts->nr_io_queues; i++) {
+        for (i = 1; i < ctrl->queue_count; i++) {
                 ret = nvmf_connect_io_queue(&ctrl->ctrl, i);
                 if (ret)
                         goto out_cleanup_connect_q;
@@ -588,8 +601,7 @@ out_cleanup_connect_q:
 out_free_tagset:
         blk_mq_free_tag_set(&ctrl->tag_set);
 out_destroy_queues:
-        for (i = 1; i < ctrl->queue_count; i++)
-                nvmet_sq_destroy(&ctrl->queues[i].nvme_sq);
+        nvme_loop_destroy_io_queues(ctrl);
         return ret;
 }
 
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 1370eee0a3c0..f7ff15f17ca9 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -73,6 +73,7 @@ struct nvmet_sq {
         u16                     qid;
         u16                     size;
         struct completion       free_done;
+        struct completion       confirm_done;
 };
 
 /**
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 9aa1da3778b3..ecc4fe862561 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -703,11 +703,6 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,
 {
         u16 status;
 
-        cmd->queue = queue;
-        cmd->n_rdma = 0;
-        cmd->req.port = queue->port;
-
-
         ib_dma_sync_single_for_cpu(queue->dev->device,
                 cmd->cmd->sge[0].addr, cmd->cmd->sge[0].length,
                 DMA_FROM_DEVICE);
@@ -760,9 +755,12 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
 
         cmd->queue = queue;
         rsp = nvmet_rdma_get_rsp(queue);
+        rsp->queue = queue;
         rsp->cmd = cmd;
         rsp->flags = 0;
         rsp->req.cmd = cmd->nvme_cmd;
+        rsp->req.port = queue->port;
+        rsp->n_rdma = 0;
 
         if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) {
                 unsigned long flags;
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index bc090daa850a..5dc53d420ca8 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -939,8 +939,10 @@ parport_register_dev_model(struct parport *port, const char *name,
          * pardevice fields. -arca
          */
         port->ops->init_state(par_dev, par_dev->state);
-        port->proc_device = par_dev;
-        parport_device_proc_register(par_dev);
+        if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) {
+                port->proc_device = par_dev;
+                parport_device_proc_register(par_dev);
+        }
 
         return par_dev;
 
diff --git a/drivers/pci/dwc/Kconfig b/drivers/pci/dwc/Kconfig
index dfb8a69afc28..d2d2ba5b8a68 100644
--- a/drivers/pci/dwc/Kconfig
+++ b/drivers/pci/dwc/Kconfig
@@ -89,6 +89,7 @@ config PCI_HISI
         depends on PCI_MSI_IRQ_DOMAIN
         select PCIEPORTBUS
         select PCIE_DW_HOST
+        select PCI_HOST_COMMON
         help
           Say Y here if you want PCIe controller support on HiSilicon
           Hip05 and Hip06 SoCs
diff --git a/drivers/pci/dwc/pci-exynos.c b/drivers/pci/dwc/pci-exynos.c
index 993b650ef275..44f774c12fb2 100644
--- a/drivers/pci/dwc/pci-exynos.c
+++ b/drivers/pci/dwc/pci-exynos.c
@@ -132,10 +132,6 @@ static int exynos5440_pcie_get_mem_resources(struct platform_device *pdev,
         struct device *dev = pci->dev;
         struct resource *res;
 
-        /* If using the PHY framework, doesn't need to get other resource */
-        if (ep->using_phy)
-                return 0;
-
         ep->mem_res = devm_kzalloc(dev, sizeof(*ep->mem_res), GFP_KERNEL);
         if (!ep->mem_res)
                 return -ENOMEM;
@@ -145,6 +141,10 @@ static int exynos5440_pcie_get_mem_resources(struct platform_device *pdev,
         if (IS_ERR(ep->mem_res->elbi_base))
                 return PTR_ERR(ep->mem_res->elbi_base);
 
+        /* If using the PHY framework, doesn't need to get other resource */
+        if (ep->using_phy)
+                return 0;
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         ep->mem_res->phy_base = devm_ioremap_resource(dev, res);
         if (IS_ERR(ep->mem_res->phy_base))
diff --git a/drivers/pci/dwc/pcie-artpec6.c b/drivers/pci/dwc/pcie-artpec6.c
index fcd3ef845883..6d23683c0892 100644
--- a/drivers/pci/dwc/pcie-artpec6.c
+++ b/drivers/pci/dwc/pcie-artpec6.c
@@ -234,6 +234,9 @@ static int artpec6_add_pcie_port(struct artpec6_pcie *artpec6_pcie,
         return 0;
 }
 
+static const struct dw_pcie_ops dw_pcie_ops = {
+};
+
 static int artpec6_pcie_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -252,6 +255,7 @@ static int artpec6_pcie_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         pci->dev = dev;
+        pci->ops = &dw_pcie_ops;
 
         artpec6_pcie->pci = pci;
 
diff --git a/drivers/pci/dwc/pcie-designware-plat.c b/drivers/pci/dwc/pcie-designware-plat.c
index b6c832ba39dd..f20d494922ab 100644
--- a/drivers/pci/dwc/pcie-designware-plat.c
+++ b/drivers/pci/dwc/pcie-designware-plat.c
@@ -86,6 +86,9 @@ static int dw_plat_add_pcie_port(struct pcie_port *pp,
         return 0;
 }
 
+static const struct dw_pcie_ops dw_pcie_ops = {
+};
+
 static int dw_plat_pcie_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -103,6 +106,7 @@ static int dw_plat_pcie_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         pci->dev = dev;
+        pci->ops = &dw_pcie_ops;
 
         dw_plat_pcie->pci = pci;
 
diff --git a/drivers/pci/dwc/pcie-hisi.c b/drivers/pci/dwc/pcie-hisi.c
index fd66a3199db7..cf9d6a9d9fd4 100644
--- a/drivers/pci/dwc/pcie-hisi.c
+++ b/drivers/pci/dwc/pcie-hisi.c
@@ -380,9 +380,13 @@ struct pci_ecam_ops hisi_pcie_platform_ops = {
 
 static const struct of_device_id hisi_pcie_almost_ecam_of_match[] = {
         {
-                .compatible = "hisilicon,pcie-almost-ecam",
+                .compatible =  "hisilicon,hip06-pcie-ecam",
                 .data       = (void *) &hisi_pcie_platform_ops,
         },
+        {
+                .compatible =  "hisilicon,hip07-pcie-ecam",
+                .data       = (void *) &hisi_pcie_platform_ops,
+        },
         {},
 };
 
diff --git a/drivers/pci/host/pci-thunder-pem.c b/drivers/pci/host/pci-thunder-pem.c
index 52b5bdccf5f0..6e031b522529 100644
--- a/drivers/pci/host/pci-thunder-pem.c
+++ b/drivers/pci/host/pci-thunder-pem.c
@@ -14,6 +14,7 @@
  * Copyright (C) 2015 - 2016 Cavium, Inc.
  */
 
+#include <linux/bitfield.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/of_address.h>
@@ -334,6 +335,49 @@ static int thunder_pem_init(struct device *dev, struct pci_config_window *cfg,
 
 #if defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS)
 
+#define PEM_RES_BASE            0x87e0c0000000UL
+#define PEM_NODE_MASK           GENMASK(45, 44)
+#define PEM_INDX_MASK           GENMASK(26, 24)
+#define PEM_MIN_DOM_IN_NODE     4
+#define PEM_MAX_DOM_IN_NODE     10
+
+static void thunder_pem_reserve_range(struct device *dev, int seg,
+                                      struct resource *r)
+{
+        resource_size_t start = r->start, end = r->end;
+        struct resource *res;
+        const char *regionid;
+
+        regionid = kasprintf(GFP_KERNEL, "PEM RC:%d", seg);
+        if (!regionid)
+                return;
+
+        res = request_mem_region(start, end - start + 1, regionid);
+        if (res)
+                res->flags &= ~IORESOURCE_BUSY;
+        else
+                kfree(regionid);
+
+        dev_info(dev, "%pR %s reserved\n", r,
+                 res ? "has been" : "could not be");
+}
+
+static void thunder_pem_legacy_fw(struct acpi_pci_root *root,
+                                 struct resource *res_pem)
+{
+        int node = acpi_get_node(root->device->handle);
+        int index;
+
+        if (node == NUMA_NO_NODE)
+                node = 0;
+
+        index = root->segment - PEM_MIN_DOM_IN_NODE;
+        index -= node * PEM_MAX_DOM_IN_NODE;
+        res_pem->start = PEM_RES_BASE | FIELD_PREP(PEM_NODE_MASK, node) |
+                                        FIELD_PREP(PEM_INDX_MASK, index);
+        res_pem->flags = IORESOURCE_MEM;
+}
+
 static int thunder_pem_acpi_init(struct pci_config_window *cfg)
 {
         struct device *dev = cfg->parent;
@@ -346,10 +390,24 @@ static int thunder_pem_acpi_init(struct pci_config_window *cfg)
         if (!res_pem)
                 return -ENOMEM;
 
-        ret = acpi_get_rc_resources(dev, "THRX0002", root->segment, res_pem);
+        ret = acpi_get_rc_resources(dev, "CAVA02B", root->segment, res_pem);
+
+        /*
+         * If we fail to gather resources it means that we run with old
+         * FW where we need to calculate PEM-specific resources manually.
+         */
         if (ret) {
-                dev_err(dev, "can't get rc base address\n");
-                return ret;
+                thunder_pem_legacy_fw(root, res_pem);
+                /*
+                 * Reserve 64K size PEM specific resources. The full 16M range
+                 * size is required for thunder_pem_init() call.
+                 */
+                res_pem->end = res_pem->start + SZ_64K - 1;
+                thunder_pem_reserve_range(dev, root->segment, res_pem);
+                res_pem->end = res_pem->start + SZ_16M - 1;
+
+                /* Reserve PCI configuration space as well. */
+                thunder_pem_reserve_range(dev, root->segment, &cfg->res);
         }
 
         return thunder_pem_init(dev, cfg, res_pem);
diff --git a/drivers/pci/host/pcie-iproc-bcma.c b/drivers/pci/host/pcie-iproc-bcma.c
index bd4c9ec25edc..384c27e664fe 100644
--- a/drivers/pci/host/pcie-iproc-bcma.c
+++ b/drivers/pci/host/pcie-iproc-bcma.c
@@ -44,8 +44,7 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 {
         struct device *dev = &bdev->dev;
         struct iproc_pcie *pcie;
-        LIST_HEAD(res);
-        struct resource res_mem;
+        LIST_HEAD(resources);
         int ret;
 
         pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
@@ -63,22 +62,23 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 
         pcie->base_addr = bdev->addr;
 
-        res_mem.start = bdev->addr_s[0];
-        res_mem.end = bdev->addr_s[0] + SZ_128M - 1;
-        res_mem.name = "PCIe MEM space";
-        res_mem.flags = IORESOURCE_MEM;
-        pci_add_resource(&res, &res_mem);
+        pcie->mem.start = bdev->addr_s[0];
+        pcie->mem.end = bdev->addr_s[0] + SZ_128M - 1;
+        pcie->mem.name = "PCIe MEM space";
+        pcie->mem.flags = IORESOURCE_MEM;
+        pci_add_resource(&resources, &pcie->mem);
 
         pcie->map_irq = iproc_pcie_bcma_map_irq;
 
-        ret = iproc_pcie_setup(pcie, &res);
-        if (ret)
+        ret = iproc_pcie_setup(pcie, &resources);
+        if (ret) {
                 dev_err(dev, "PCIe controller setup failed\n");
-
-        pci_free_resource_list(&res);
+                pci_free_resource_list(&resources);
+                return ret;
+        }
 
         bcma_set_drvdata(bdev, pcie);
-        return ret;
+        return 0;
 }
 
 static void iproc_pcie_bcma_remove(struct bcma_device *bdev)
diff --git a/drivers/pci/host/pcie-iproc-platform.c b/drivers/pci/host/pcie-iproc-platform.c
index f4909bb0b2ad..8c6a327ca6cd 100644
--- a/drivers/pci/host/pcie-iproc-platform.c
+++ b/drivers/pci/host/pcie-iproc-platform.c
@@ -51,7 +51,7 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
         struct device_node *np = dev->of_node;
         struct resource reg;
         resource_size_t iobase = 0;
-        LIST_HEAD(res);
+        LIST_HEAD(resources);
         int ret;
 
         pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
@@ -96,10 +96,10 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
                 pcie->phy = NULL;
         }
 
-        ret = of_pci_get_host_bridge_resources(np, 0, 0xff, &res, &iobase);
+        ret = of_pci_get_host_bridge_resources(np, 0, 0xff, &resources,
+                                               &iobase);
         if (ret) {
-                dev_err(dev,
-                        "unable to get PCI host bridge resources\n");
+                dev_err(dev, "unable to get PCI host bridge resources\n");
                 return ret;
         }
 
@@ -112,14 +112,15 @@ static int iproc_pcie_pltfm_probe(struct platform_device *pdev)
                 pcie->map_irq = of_irq_parse_and_map_pci;
         }
 
-        ret = iproc_pcie_setup(pcie, &res);
-        if (ret)
+        ret = iproc_pcie_setup(pcie, &resources);
+        if (ret) {
                 dev_err(dev, "PCIe controller setup failed\n");
-
-        pci_free_resource_list(&res);
+                pci_free_resource_list(&resources);
+                return ret;
+        }
 
         platform_set_drvdata(pdev, pcie);
-        return ret;
+        return 0;
 }
 
 static int iproc_pcie_pltfm_remove(struct platform_device *pdev)
diff --git a/drivers/pci/host/pcie-iproc.h b/drivers/pci/host/pcie-iproc.h
index 04fed8e907f1..0bbe2ea44f3e 100644
--- a/drivers/pci/host/pcie-iproc.h
+++ b/drivers/pci/host/pcie-iproc.h
@@ -90,6 +90,7 @@ struct iproc_pcie {
 #ifdef CONFIG_ARM
         struct pci_sys_data sysdata;
 #endif
+        struct resource mem;
         struct pci_bus *root_bus;
         struct phy *phy;
         int (*map_irq)(const struct pci_dev *, u8, u8);
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 973472c23d89..1dfa10cc566b 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -478,7 +478,7 @@ static void aspm_calc_l1ss_info(struct pcie_link_state *link,
 
 static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 {
-        struct pci_dev *child, *parent = link->pdev;
+        struct pci_dev *child = link->downstream, *parent = link->pdev;
         struct pci_bus *linkbus = parent->subordinate;
         struct aspm_register_info upreg, dwreg;
 
@@ -491,9 +491,7 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 
         /* Get upstream/downstream components' register state */
         pcie_get_aspm_reg(parent, &upreg);
-        child = pci_function_0(linkbus);
         pcie_get_aspm_reg(child, &dwreg);
-        link->downstream = child;
 
         /*
          * If ASPM not supported, don't mess with the clocks and link,
@@ -800,6 +798,7 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
         INIT_LIST_HEAD(&link->children);
         INIT_LIST_HEAD(&link->link);
         link->pdev = pdev;
+        link->downstream = pci_function_0(pdev->subordinate);
 
         /*
          * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f754453fe754..673683660b5c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2174,6 +2174,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005d, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LSI_LOGIC, 0x005f, quirk_blacklist_vpd);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATTANSIC, PCI_ANY_ID,
                 quirk_blacklist_vpd);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_QLOGIC, 0x2261, quirk_blacklist_vpd);
 
 /*
  * For Broadcom 5706, 5708, 5709 rev. A nics, any read beyond the
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index dc5277ad1b5a..005cadb7a3f8 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -449,6 +449,7 @@ config PHY_QCOM_UFS
 config PHY_QCOM_USB_HS
         tristate "Qualcomm USB HS PHY module"
         depends on USB_ULPI_BUS
+        depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in
         select GENERIC_PHY
         help
           Support for the USB high-speed ULPI compliant phy on Qualcomm
@@ -510,12 +511,4 @@ config PHY_MESON8B_USB2
           and GXBB SoCs.
           If unsure, say N.
 
-config PHY_NSP_USB3
-        tristate "Broadcom NorthStar plus USB3 PHY driver"
-        depends on OF && (ARCH_BCM_NSP || COMPILE_TEST)
-        select GENERIC_PHY
-        default ARCH_BCM_NSP
-        help
-          Enable this to support the Broadcom Northstar plus USB3 PHY.
-          If unsure, say N.
 endmenu
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
index e7b0feb1e125..dd8f3b5d2918 100644
--- a/drivers/phy/Makefile
+++ b/drivers/phy/Makefile
@@ -62,4 +62,3 @@ obj-$(CONFIG_PHY_CYGNUS_PCIE)		+= phy-bcm-cygnus-pcie.o
 obj-$(CONFIG_ARCH_TEGRA) += tegra/
 obj-$(CONFIG_PHY_NS2_PCIE)              += phy-bcm-ns2-pcie.o
 obj-$(CONFIG_PHY_MESON8B_USB2)          += phy-meson8b-usb2.o
-obj-$(CONFIG_PHY_NSP_USB3)              += phy-bcm-nsp-usb3.o
diff --git a/drivers/phy/phy-bcm-nsp-usb3.c b/drivers/phy/phy-bcm-nsp-usb3.c
deleted file mode 100644
index 49024eaa5545..000000000000
--- a/drivers/phy/phy-bcm-nsp-usb3.c
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
- * Copyright (C) 2016 Broadcom
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation version 2.
- *
- * This program is distributed "as is" WITHOUT ANY WARRANTY of any
- * kind, whether express or implied; without even the implied warranty
- * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/delay.h>
-#include <linux/io.h>
-#include <linux/kernel.h>
-#include <linux/mfd/syscon.h>
-#include <linux/mdio.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_address.h>
-#include <linux/phy/phy.h>
-#include <linux/regmap.h>
-
-#define NSP_USB3_RST_CTRL_OFFSET        0x3f8
-
-/* mdio reg access */
-#define NSP_USB3_PHY_BASE_ADDR_REG      0x1f
-
-#define NSP_USB3_PHY_PLL30_BLOCK        0x8000
-#define NSP_USB3_PLL_CONTROL            0x01
-#define NSP_USB3_PLLA_CONTROL0          0x0a
-#define NSP_USB3_PLLA_CONTROL1          0x0b
-
-#define NSP_USB3_PHY_TX_PMD_BLOCK       0x8040
-#define NSP_USB3_TX_PMD_CONTROL1        0x01
-
-#define NSP_USB3_PHY_PIPE_BLOCK         0x8060
-#define NSP_USB3_LFPS_CMP               0x02
-#define NSP_USB3_LFPS_DEGLITCH          0x03
-
-struct nsp_usb3_phy {
-        struct regmap *usb3_ctrl;
-        struct phy *phy;
-        struct mdio_device *mdiodev;
-};
-
-static int nsp_usb3_phy_init(struct phy *phy)
-{
-        struct nsp_usb3_phy *iphy = phy_get_drvdata(phy);
-        struct mii_bus *bus = iphy->mdiodev->bus;
-        int addr = iphy->mdiodev->addr;
-        u32 data;
-        int rc;
-
-        rc = regmap_read(iphy->usb3_ctrl, 0, &data);
-        if (rc)
-                return rc;
-        data |= 1;
-        rc = regmap_write(iphy->usb3_ctrl, 0, data);
-        if (rc)
-                return rc;
-
-        rc = regmap_write(iphy->usb3_ctrl, NSP_USB3_RST_CTRL_OFFSET, 1);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_PLL30_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLL_CONTROL, 0x1000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL0, 0x6400);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL1, 0xc000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLLA_CONTROL1, 0x8000);
-        if (rc)
-                return rc;
-
-        rc = regmap_write(iphy->usb3_ctrl, NSP_USB3_RST_CTRL_OFFSET, 0);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PLL_CONTROL, 0x9000);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_PIPE_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_LFPS_CMP, 0xf30d);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_LFPS_DEGLITCH, 0x6302);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_PHY_BASE_ADDR_REG,
-                           NSP_USB3_PHY_TX_PMD_BLOCK);
-        if (rc)
-                return rc;
-
-        rc = mdiobus_write(bus, addr, NSP_USB3_TX_PMD_CONTROL1, 0x1003);
-
-        return rc;
-}
-
-static struct phy_ops nsp_usb3_phy_ops = {
-        .init   = nsp_usb3_phy_init,
-        .owner  = THIS_MODULE,
-};
-
-static int nsp_usb3_phy_probe(struct mdio_device *mdiodev)
-{
-        struct device *dev = &mdiodev->dev;
-        struct phy_provider *provider;
-        struct nsp_usb3_phy *iphy;
-
-        iphy = devm_kzalloc(dev, sizeof(*iphy), GFP_KERNEL);
-        if (!iphy)
-                return -ENOMEM;
-        iphy->mdiodev = mdiodev;
-
-        iphy->usb3_ctrl = syscon_regmap_lookup_by_phandle(dev->of_node,
-                                                 "usb3-ctrl-syscon");
-        if (IS_ERR(iphy->usb3_ctrl))
-                return PTR_ERR(iphy->usb3_ctrl);
-
-        iphy->phy = devm_phy_create(dev, dev->of_node, &nsp_usb3_phy_ops);
-        if (IS_ERR(iphy->phy)) {
-                dev_err(dev, "failed to create PHY\n");
-                return PTR_ERR(iphy->phy);
-        }
-
-        phy_set_drvdata(iphy->phy, iphy);
-
-        provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
-        if (IS_ERR(provider)) {
-                dev_err(dev, "could not register PHY provider\n");
-                return PTR_ERR(provider);
-        }
-
-        return 0;
-}
-
-static const struct of_device_id nsp_usb3_phy_of_match[] = {
-        {.compatible = "brcm,nsp-usb3-phy",},
-        { /* sentinel */ }
-};
-
-static struct mdio_driver nsp_usb3_phy_driver = {
-        .mdiodrv = {
-                .driver = {
-                        .name = "nsp-usb3-phy",
-                        .of_match_table = nsp_usb3_phy_of_match,
-                },
-        },
-        .probe = nsp_usb3_phy_probe,
-};
-
-mdio_module_driver(nsp_usb3_phy_driver);
-
-MODULE_DESCRIPTION("Broadcom NSP USB3 PHY driver");
-MODULE_LICENSE("GPL v2");
-MODULE_AUTHOR("Yendapally Reddy Dhananjaya Reddy <yendapally.reddy@broadcom.com");
diff --git a/drivers/phy/phy-exynos-pcie.c b/drivers/phy/phy-exynos-pcie.c
index 4f60b83641d5..60baf25d98e2 100644
--- a/drivers/phy/phy-exynos-pcie.c
+++ b/drivers/phy/phy-exynos-pcie.c
@@ -254,8 +254,8 @@ static int exynos_pcie_phy_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         exynos_phy->blk_base = devm_ioremap_resource(dev, res);
-        if (IS_ERR(exynos_phy->phy_base))
-                return PTR_ERR(exynos_phy->phy_base);
+        if (IS_ERR(exynos_phy->blk_base))
+                return PTR_ERR(exynos_phy->blk_base);
 
         exynos_phy->drv_data = drv_data;
 
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index d69046537b75..32822b0d9cd0 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -2010,29 +2010,57 @@ out_err:
         return ERR_PTR(ret);
 }
 
-static int pinctrl_create_and_start(struct pinctrl_dev *pctldev)
+static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev)
 {
         pctldev->p = create_pinctrl(pctldev->dev, pctldev);
-        if (!IS_ERR(pctldev->p)) {
-                kref_get(&pctldev->p->users);
-                pctldev->hog_default =
-                        pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT);
-                if (IS_ERR(pctldev->hog_default)) {
-                        dev_dbg(pctldev->dev,
-                                "failed to lookup the default state\n");
-                } else {
-                        if (pinctrl_select_state(pctldev->p,
-                                                pctldev->hog_default))
-                                dev_err(pctldev->dev,
-                                        "failed to select default state\n");
-                }
+        if (PTR_ERR(pctldev->p) == -ENODEV) {
+                dev_dbg(pctldev->dev, "no hogs found\n");
 
-                pctldev->hog_sleep =
-                        pinctrl_lookup_state(pctldev->p,
-                                                    PINCTRL_STATE_SLEEP);
-                if (IS_ERR(pctldev->hog_sleep))
-                        dev_dbg(pctldev->dev,
-                                "failed to lookup the sleep state\n");
+                return 0;
+        }
+
+        if (IS_ERR(pctldev->p)) {
+                dev_err(pctldev->dev, "error claiming hogs: %li\n",
+                        PTR_ERR(pctldev->p));
+
+                return PTR_ERR(pctldev->p);
+        }
+
+        kref_get(&pctldev->p->users);
+        pctldev->hog_default =
+                pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT);
+        if (IS_ERR(pctldev->hog_default)) {
+                dev_dbg(pctldev->dev,
+                        "failed to lookup the default state\n");
+        } else {
+                if (pinctrl_select_state(pctldev->p,
+                                         pctldev->hog_default))
+                        dev_err(pctldev->dev,
+                                "failed to select default state\n");
+        }
+
+        pctldev->hog_sleep =
+                pinctrl_lookup_state(pctldev->p,
+                                     PINCTRL_STATE_SLEEP);
+        if (IS_ERR(pctldev->hog_sleep))
+                dev_dbg(pctldev->dev,
+                        "failed to lookup the sleep state\n");
+
+        return 0;
+}
+
+int pinctrl_enable(struct pinctrl_dev *pctldev)
+{
+        int error;
+
+        error = pinctrl_claim_hogs(pctldev);
+        if (error) {
+                dev_err(pctldev->dev, "could not claim hogs: %i\n",
+                        error);
+                mutex_destroy(&pctldev->mutex);
+                kfree(pctldev);
+
+                return error;
         }
 
         mutex_lock(&pinctrldev_list_mutex);
@@ -2043,6 +2071,7 @@ static int pinctrl_create_and_start(struct pinctrl_dev *pctldev)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(pinctrl_enable);
 
 /**
  * pinctrl_register() - register a pin controller device
@@ -2065,25 +2094,30 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
         if (IS_ERR(pctldev))
                 return pctldev;
 
-        error = pinctrl_create_and_start(pctldev);
-        if (error) {
-                mutex_destroy(&pctldev->mutex);
-                kfree(pctldev);
-
+        error = pinctrl_enable(pctldev);
+        if (error)
                 return ERR_PTR(error);
-        }
 
         return pctldev;
 
 }
 EXPORT_SYMBOL_GPL(pinctrl_register);
 
+/**
+ * pinctrl_register_and_init() - register and init pin controller device
+ * @pctldesc: descriptor for this pin controller
+ * @dev: parent device for this pin controller
+ * @driver_data: private pin controller data for this pin controller
+ * @pctldev: pin controller device
+ *
+ * Note that pinctrl_enable() still needs to be manually called after
+ * this once the driver is ready.
+ */
 int pinctrl_register_and_init(struct pinctrl_desc *pctldesc,
                               struct device *dev, void *driver_data,
                               struct pinctrl_dev **pctldev)
 {
         struct pinctrl_dev *p;
-        int error;
 
         p = pinctrl_init_controller(pctldesc, dev, driver_data);
         if (IS_ERR(p))
@@ -2097,15 +2131,6 @@ int pinctrl_register_and_init(struct pinctrl_desc *pctldesc,
          */
         *pctldev = p;
 
-        error = pinctrl_create_and_start(p);
-        if (error) {
-                mutex_destroy(&p->mutex);
-                kfree(p);
-                *pctldev = NULL;
-
-                return error;
-        }
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(pinctrl_register_and_init);
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index a7ace9e1ad81..74bd90dfd7b1 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -790,7 +790,7 @@ int imx_pinctrl_probe(struct platform_device *pdev,
 
         dev_info(&pdev->dev, "initialized IMX pinctrl driver\n");
 
-        return 0;
+        return pinctrl_enable(ipctl->pctl);
 
 free:
         imx_free_resources(ipctl);
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index f80134e3e0b6..9ff790174906 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -13,6 +13,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/dmi.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -1524,10 +1525,31 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
+/*
+ * Certain machines seem to hardcode Linux IRQ numbers in their ACPI
+ * tables. Since we leave GPIOs that are not capable of generating
+ * interrupts out of the irqdomain the numbering will be different and
+ * cause devices using the hardcoded IRQ numbers fail. In order not to
+ * break such machines we will only mask pins from irqdomain if the machine
+ * is not listed below.
+ */
+static const struct dmi_system_id chv_no_valid_mask[] = {
+        {
+                /* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
+                .ident = "Acer Chromebook (CYAN)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
+                        DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
+                },
+        }
+};
+
 static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
 {
         const struct chv_gpio_pinrange *range;
         struct gpio_chip *chip = &pctrl->chip;
+        bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
         int ret, i, offset;
 
         *chip = chv_gpio_chip;
@@ -1536,7 +1558,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         chip->label = dev_name(pctrl->dev);
         chip->parent = pctrl->dev;
         chip->base = -1;
-        chip->irq_need_valid_mask = true;
+        chip->irq_need_valid_mask = need_valid_mask;
 
         ret = devm_gpiochip_add_data(pctrl->dev, chip, pctrl);
         if (ret) {
@@ -1567,7 +1589,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 intsel &= CHV_PADCTRL0_INTSEL_MASK;
                 intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
 
-                if (intsel >= pctrl->community->nirqs)
+                if (need_valid_mask && intsel >= pctrl->community->nirqs)
                         clear_bit(i, chip->irq_valid_mask);
         }
 
diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
index 7671424d46cb..31a3a98d067c 100644
--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
@@ -667,11 +667,11 @@ static const char * const uart_ao_b_groups[] = {
 };
 
 static const char * const i2c_ao_groups[] = {
-        "i2c_sdk_ao", "i2c_sda_ao",
+        "i2c_sck_ao", "i2c_sda_ao",
 };
 
 static const char * const i2c_slave_ao_groups[] = {
-        "i2c_slave_sdk_ao", "i2c_slave_sda_ao",
+        "i2c_slave_sck_ao", "i2c_slave_sda_ao",
 };
 
 static const char * const remote_input_ao_groups[] = {
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 8b2d45e85bae..9c267dcda094 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1781,7 +1781,7 @@ static int pcs_probe(struct platform_device *pdev)
         dev_info(pcs->dev, "%i pins at pa %p size %u\n",
                  pcs->desc.npins, pcs->base, pcs->size);
 
-        return 0;
+        return pinctrl_enable(pcs->pctl);
 
 free:
         pcs_free_resources(pcs);
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 676efcc032d2..3ae8066bc127 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1285,6 +1285,22 @@ static void st_gpio_irq_unmask(struct irq_data *d)
         writel(BIT(d->hwirq), bank->base + REG_PIO_SET_PMASK);
 }
 
+static int st_gpio_irq_request_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+
+        st_gpio_direction_input(gc, d->hwirq);
+
+        return gpiochip_lock_as_irq(gc, d->hwirq);
+}
+
+static void st_gpio_irq_release_resources(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+
+        gpiochip_unlock_as_irq(gc, d->hwirq);
+}
+
 static int st_gpio_irq_set_type(struct irq_data *d, unsigned type)
 {
         struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
@@ -1438,12 +1454,14 @@ static struct gpio_chip st_gpio_template = {
 };
 
 static struct irq_chip st_gpio_irqchip = {
-        .name           = "GPIO",
-        .irq_disable    = st_gpio_irq_mask,
-        .irq_mask       = st_gpio_irq_mask,
-        .irq_unmask     = st_gpio_irq_unmask,
-        .irq_set_type   = st_gpio_irq_set_type,
-        .flags          = IRQCHIP_SKIP_SET_WAKE,
+        .name                   = "GPIO",
+        .irq_request_resources  = st_gpio_irq_request_resources,
+        .irq_release_resources  = st_gpio_irq_release_resources,
+        .irq_disable            = st_gpio_irq_mask,
+        .irq_mask               = st_gpio_irq_mask,
+        .irq_unmask             = st_gpio_irq_unmask,
+        .irq_set_type           = st_gpio_irq_set_type,
+        .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
 static int st_gpiolib_register_bank(struct st_pinctrl *info,
diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
index b68ae424cee2..743d1f458205 100644
--- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c
+++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
@@ -405,6 +405,36 @@ static const struct msm_pingroup ipq4019_groups[] = {
         PINGROUP(67, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
         PINGROUP(68, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
         PINGROUP(69, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(73, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(74, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(75, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(76, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(77, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(78, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(79, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(80, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(81, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(82, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(83, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(84, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(85, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(86, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(87, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(88, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(89, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(90, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(91, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(92, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(93, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(94, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(98, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+        PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 };
 
 static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index f8e9e1c2b2f6..273badd92561 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -422,6 +422,20 @@ static int msm_gpio_direction_output(struct gpio_chip *chip, unsigned offset, in
         return 0;
 }
 
+static int msm_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
+{
+        struct msm_pinctrl *pctrl = gpiochip_get_data(chip);
+        const struct msm_pingroup *g;
+        u32 val;
+
+        g = &pctrl->soc->groups[offset];
+
+        val = readl(pctrl->regs + g->ctl_reg);
+
+        /* 0 = output, 1 = input */
+        return val & BIT(g->oe_bit) ? 0 : 1;
+}
+
 static int msm_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
         const struct msm_pingroup *g;
@@ -510,6 +524,7 @@ static void msm_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
 static struct gpio_chip msm_gpio_template = {
         .direction_input  = msm_gpio_direction_input,
         .direction_output = msm_gpio_direction_output,
+        .get_direction    = msm_gpio_get_direction,
         .get              = msm_gpio_get,
         .set              = msm_gpio_set,
         .request          = gpiochip_generic_request,
@@ -594,10 +609,6 @@ static void msm_gpio_irq_unmask(struct irq_data *d)
 
         raw_spin_lock_irqsave(&pctrl->lock, flags);
 
-        val = readl(pctrl->regs + g->intr_status_reg);
-        val &= ~BIT(g->intr_status_bit);
-        writel(val, pctrl->regs + g->intr_status_reg);
-
         val = readl(pctrl->regs + g->intr_cfg_reg);
         val |= BIT(g->intr_enable_bit);
         writel(val, pctrl->regs + g->intr_cfg_reg);
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
index f9b49967f512..63e51b56a22a 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
@@ -1468,82 +1468,82 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = {
 
 /* pin banks of exynos5433 pin-controller - ALIVE */
 static const struct samsung_pin_bank_data exynos5433_pin_banks0[] __initconst = {
-        EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
-        EXYNOS_PIN_BANK_EINTW(8, 0x020, "gpa1", 0x04),
-        EXYNOS_PIN_BANK_EINTW(8, 0x040, "gpa2", 0x08),
-        EXYNOS_PIN_BANK_EINTW(8, 0x060, "gpa3", 0x0c),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x020, "gpf1", 0x1004, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(4, 0x040, "gpf2", 0x1008, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(4, 0x060, "gpf3", 0x100c, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x080, "gpf4", 0x1010, 1),
-        EXYNOS_PIN_BANK_EINTW_EXT(8, 0x0a0, "gpf5", 0x1014, 1),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x020, "gpa1", 0x04),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x040, "gpa2", 0x08),
+        EXYNOS5433_PIN_BANK_EINTW(8, 0x060, "gpa3", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x020, "gpf1", 0x1004, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(4, 0x040, "gpf2", 0x1008, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(4, 0x060, "gpf3", 0x100c, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x080, "gpf4", 0x1010, 1),
+        EXYNOS5433_PIN_BANK_EINTW_EXT(8, 0x0a0, "gpf5", 0x1014, 1),
 };
 
 /* pin banks of exynos5433 pin-controller - AUD */
 static const struct samsung_pin_bank_data exynos5433_pin_banks1[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(7, 0x000, "gpz0", 0x00),
-        EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x000, "gpz0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04),
 };
 
 /* pin banks of exynos5433 pin-controller - CPIF */
 static const struct samsung_pin_bank_data exynos5433_pin_banks2[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(2, 0x000, "gpv6", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x000, "gpv6", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - eSE */
 static const struct samsung_pin_bank_data exynos5433_pin_banks3[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj2", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj2", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - FINGER */
 static const struct samsung_pin_bank_data exynos5433_pin_banks4[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpd5", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x000, "gpd5", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - FSYS */
 static const struct samsung_pin_bank_data exynos5433_pin_banks5[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(6, 0x000, "gph1", 0x00),
-        EXYNOS_PIN_BANK_EINTG(7, 0x020, "gpr4", 0x04),
-        EXYNOS_PIN_BANK_EINTG(5, 0x040, "gpr0", 0x08),
-        EXYNOS_PIN_BANK_EINTG(8, 0x060, "gpr1", 0x0c),
-        EXYNOS_PIN_BANK_EINTG(2, 0x080, "gpr2", 0x10),
-        EXYNOS_PIN_BANK_EINTG(8, 0x0a0, "gpr3", 0x14),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x000, "gph1", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x020, "gpr4", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x040, "gpr0", 0x08),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x060, "gpr1", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x080, "gpr2", 0x10),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x0a0, "gpr3", 0x14),
 };
 
 /* pin banks of exynos5433 pin-controller - IMEM */
 static const struct samsung_pin_bank_data exynos5433_pin_banks6[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpf0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x000, "gpf0", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - NFC */
 static const struct samsung_pin_bank_data exynos5433_pin_banks7[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj0", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj0", 0x00),
 };
 
 /* pin banks of exynos5433 pin-controller - PERIC */
 static const struct samsung_pin_bank_data exynos5433_pin_banks8[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(6, 0x000, "gpv7", 0x00),
-        EXYNOS_PIN_BANK_EINTG(5, 0x020, "gpb0", 0x04),
-        EXYNOS_PIN_BANK_EINTG(8, 0x040, "gpc0", 0x08),
-        EXYNOS_PIN_BANK_EINTG(2, 0x060, "gpc1", 0x0c),
-        EXYNOS_PIN_BANK_EINTG(6, 0x080, "gpc2", 0x10),
-        EXYNOS_PIN_BANK_EINTG(8, 0x0a0, "gpc3", 0x14),
-        EXYNOS_PIN_BANK_EINTG(2, 0x0c0, "gpg0", 0x18),
-        EXYNOS_PIN_BANK_EINTG(4, 0x0e0, "gpd0", 0x1c),
-        EXYNOS_PIN_BANK_EINTG(6, 0x100, "gpd1", 0x20),
-        EXYNOS_PIN_BANK_EINTG(8, 0x120, "gpd2", 0x24),
-        EXYNOS_PIN_BANK_EINTG(5, 0x140, "gpd4", 0x28),
-        EXYNOS_PIN_BANK_EINTG(2, 0x160, "gpd8", 0x2c),
-        EXYNOS_PIN_BANK_EINTG(7, 0x180, "gpd6", 0x30),
-        EXYNOS_PIN_BANK_EINTG(3, 0x1a0, "gpd7", 0x34),
-        EXYNOS_PIN_BANK_EINTG(5, 0x1c0, "gpg1", 0x38),
-        EXYNOS_PIN_BANK_EINTG(2, 0x1e0, "gpg2", 0x3c),
-        EXYNOS_PIN_BANK_EINTG(8, 0x200, "gpg3", 0x40),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x000, "gpv7", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x020, "gpb0", 0x04),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x040, "gpc0", 0x08),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x060, "gpc1", 0x0c),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x080, "gpc2", 0x10),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x0a0, "gpc3", 0x14),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x0c0, "gpg0", 0x18),
+        EXYNOS5433_PIN_BANK_EINTG(4, 0x0e0, "gpd0", 0x1c),
+        EXYNOS5433_PIN_BANK_EINTG(6, 0x100, "gpd1", 0x20),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x120, "gpd2", 0x24),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x140, "gpd4", 0x28),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x160, "gpd8", 0x2c),
+        EXYNOS5433_PIN_BANK_EINTG(7, 0x180, "gpd6", 0x30),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x1a0, "gpd7", 0x34),
+        EXYNOS5433_PIN_BANK_EINTG(5, 0x1c0, "gpg1", 0x38),
+        EXYNOS5433_PIN_BANK_EINTG(2, 0x1e0, "gpg2", 0x3c),
+        EXYNOS5433_PIN_BANK_EINTG(8, 0x200, "gpg3", 0x40),
 };
 
 /* pin banks of exynos5433 pin-controller - TOUCH */
 static const struct samsung_pin_bank_data exynos5433_pin_banks9[] __initconst = {
-        EXYNOS_PIN_BANK_EINTG(3, 0x000, "gpj1", 0x00),
+        EXYNOS5433_PIN_BANK_EINTG(3, 0x000, "gpj1", 0x00),
 };
 
 /*
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.h b/drivers/pinctrl/samsung/pinctrl-exynos.h
index a473092fb8d2..cd046eb7d705 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.h
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.h
@@ -79,17 +79,6 @@
                 .name           = id                    \
         }
 
-#define EXYNOS_PIN_BANK_EINTW_EXT(pins, reg, id, offs, pctl_idx) \
-        {                                               \
-                .type           = &bank_type_alive,     \
-                .pctl_offset    = reg,                  \
-                .nr_pins        = pins,                 \
-                .eint_type      = EINT_TYPE_WKUP,       \
-                .eint_offset    = offs,                 \
-                .name           = id,                   \
-                .pctl_res_idx   = pctl_idx,             \
-        }                                               \
-
 #define EXYNOS5433_PIN_BANK_EINTG(pins, reg, id, offs)          \
         {                                                       \
                 .type           = &exynos5433_bank_type_off,    \
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index f9ddba7decc1..d7aa22cff480 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -988,9 +988,16 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d,
 
         for (i = 0; i < ctrl->nr_ext_resources + 1; i++) {
                 res = platform_get_resource(pdev, IORESOURCE_MEM, i);
-                virt_base[i] = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(virt_base[i]))
-                        return ERR_CAST(virt_base[i]);
+                if (!res) {
+                        dev_err(&pdev->dev, "failed to get mem%d resource\n", i);
+                        return ERR_PTR(-EINVAL);
+                }
+                virt_base[i] = devm_ioremap(&pdev->dev, res->start,
+                                                resource_size(res));
+                if (!virt_base[i]) {
+                        dev_err(&pdev->dev, "failed to ioremap %pR\n", res);
+                        return ERR_PTR(-EIO);
+                }
         }
 
         bank = d->pin_banks;
diff --git a/drivers/pinctrl/sh-pfc/pinctrl.c b/drivers/pinctrl/sh-pfc/pinctrl.c
index 08150a321be6..a70157f0acf4 100644
--- a/drivers/pinctrl/sh-pfc/pinctrl.c
+++ b/drivers/pinctrl/sh-pfc/pinctrl.c
@@ -816,6 +816,13 @@ int sh_pfc_register_pinctrl(struct sh_pfc *pfc)
         pmx->pctl_desc.pins = pmx->pins;
         pmx->pctl_desc.npins = pfc->info->nr_pins;
 
-        return devm_pinctrl_register_and_init(pfc->dev, &pmx->pctl_desc, pmx,
-                                              &pmx->pctl);
+        ret = devm_pinctrl_register_and_init(pfc->dev, &pmx->pctl_desc, pmx,
+                                             &pmx->pctl);
+        if (ret) {
+                dev_err(pfc->dev, "could not register: %i\n", ret);
+
+                return ret;
+        }
+
+        return pinctrl_enable(pmx->pctl);
 }
diff --git a/drivers/pinctrl/ti/Kconfig b/drivers/pinctrl/ti/Kconfig
index 815a88673d38..542077069391 100644
--- a/drivers/pinctrl/ti/Kconfig
+++ b/drivers/pinctrl/ti/Kconfig
@@ -1,6 +1,6 @@
 config PINCTRL_TI_IODELAY
         tristate "TI IODelay Module pinconf driver"
-        depends on OF
+        depends on OF && (SOC_DRA7XX || COMPILE_TEST)
         select GENERIC_PINCTRL_GROUPS
         select GENERIC_PINMUX_FUNCTIONS
         select GENERIC_PINCONF
diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
index 717e3404900c..362c50918c13 100644
--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
+++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c
@@ -893,6 +893,8 @@ static int ti_iodelay_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, iod);
 
+        return pinctrl_enable(iod->pctl);
+
 exit_out:
         of_node_put(np);
         return ret;
diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
index 77a0236ee781..83f8864fa76a 100644
--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c
@@ -390,22 +390,22 @@ static const struct pinctrl_pin_desc uniphier_ld11_pins[] = {
         UNIPHIER_PINCTRL_PIN(140, "AO1D0", 140,
                              140, UNIPHIER_PIN_DRV_1BIT,
                              140, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(141, "TCON0", 141,
+        UNIPHIER_PINCTRL_PIN(141, "AO1D1", 141,
                              141, UNIPHIER_PIN_DRV_1BIT,
                              141, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(142, "TCON1", 142,
+        UNIPHIER_PINCTRL_PIN(142, "AO1D2", 142,
                              142, UNIPHIER_PIN_DRV_1BIT,
                              142, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(143, "TCON2", 143,
+        UNIPHIER_PINCTRL_PIN(143, "XIRQ9", 143,
                              143, UNIPHIER_PIN_DRV_1BIT,
                              143, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(144, "TCON3", 144,
+        UNIPHIER_PINCTRL_PIN(144, "XIRQ10", 144,
                              144, UNIPHIER_PIN_DRV_1BIT,
                              144, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(145, "TCON4", 145,
+        UNIPHIER_PINCTRL_PIN(145, "XIRQ11", 145,
                              145, UNIPHIER_PIN_DRV_1BIT,
                              145, UNIPHIER_PIN_PULL_DOWN),
-        UNIPHIER_PINCTRL_PIN(146, "TCON5", 146,
+        UNIPHIER_PINCTRL_PIN(146, "XIRQ13", 146,
                              146, UNIPHIER_PIN_DRV_1BIT,
                              146, UNIPHIER_PIN_PULL_DOWN),
         UNIPHIER_PINCTRL_PIN(147, "PWMA", 147,
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 5be4783e40d4..dea98ffb6f60 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -103,15 +103,6 @@ static struct quirk_entry quirk_asus_x200ca = {
         .wapf = 2,
 };
 
-static struct quirk_entry quirk_no_rfkill = {
-        .no_rfkill = true,
-};
-
-static struct quirk_entry quirk_no_rfkill_wapf4 = {
-        .wapf = 4,
-        .no_rfkill = true,
-};
-
 static struct quirk_entry quirk_asus_ux303ub = {
         .wmi_backlight_native = true,
 };
@@ -194,7 +185,7 @@ static const struct dmi_system_id asus_quirks[] = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
                         DMI_MATCH(DMI_PRODUCT_NAME, "X456UA"),
                 },
-                .driver_data = &quirk_no_rfkill_wapf4,
+                .driver_data = &quirk_asus_wapf4,
         },
         {
                 .callback = dmi_matched,
@@ -203,7 +194,7 @@ static const struct dmi_system_id asus_quirks[] = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
                         DMI_MATCH(DMI_PRODUCT_NAME, "X456UF"),
                 },
-                .driver_data = &quirk_no_rfkill_wapf4,
+                .driver_data = &quirk_asus_wapf4,
         },
         {
                 .callback = dmi_matched,
@@ -369,42 +360,6 @@ static const struct dmi_system_id asus_quirks[] = {
         },
         {
                 .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. X555UB",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "X555UB"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. N552VW",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "N552VW"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. U303LB",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "U303LB"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
-                .ident = "ASUSTeK COMPUTER INC. Z550MA",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Z550MA"),
-                },
-                .driver_data = &quirk_no_rfkill,
-        },
-        {
-                .callback = dmi_matched,
                 .ident = "ASUSTeK COMPUTER INC. UX303UB",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 43cb680adbb4..8fe5890bf539 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -159,6 +159,8 @@ MODULE_LICENSE("GPL");
 #define USB_INTEL_XUSB2PR               0xD0
 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI   0x9c31
 
+static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL };
+
 struct bios_args {
         u32 arg0;
         u32 arg1;
@@ -2051,6 +2053,16 @@ static int asus_wmi_fan_init(struct asus_wmi *asus)
         return 0;
 }
 
+static bool ashs_present(void)
+{
+        int i = 0;
+        while (ashs_ids[i]) {
+                if (acpi_dev_found(ashs_ids[i++]))
+                        return true;
+        }
+        return false;
+}
+
 /*
  * WMI Driver
  */
@@ -2095,7 +2107,11 @@ static int asus_wmi_add(struct platform_device *pdev)
         if (err)
                 goto fail_leds;
 
-        if (!asus->driver->quirks->no_rfkill) {
+        asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result);
+        if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
+                asus->driver->wlan_ctrl_by_user = 1;
+
+        if (!(asus->driver->wlan_ctrl_by_user && ashs_present())) {
                 err = asus_wmi_rfkill_init(asus);
                 if (err)
                         goto fail_rfkill;
@@ -2134,10 +2150,6 @@ static int asus_wmi_add(struct platform_device *pdev)
         if (err)
                 goto fail_debugfs;
 
-        asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_WLAN, &result);
-        if (result & (ASUS_WMI_DSTS_PRESENCE_BIT | ASUS_WMI_DSTS_USER_BIT))
-                asus->driver->wlan_ctrl_by_user = 1;
-
         return 0;
 
 fail_debugfs:
diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
index fdff626c3b51..c9589d9342bb 100644
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -39,7 +39,6 @@ struct key_entry;
 struct asus_wmi;
 
 struct quirk_entry {
-        bool no_rfkill;
         bool hotplug_wireless;
         bool scalar_panel_brightness;
         bool store_backlight_power;
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index 2b218b1d13e5..e12cc3504d48 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -78,18 +78,18 @@
 
 #define FUJITSU_LCD_N_LEVELS 8
 
-#define ACPI_FUJITSU_CLASS              "fujitsu"
-#define ACPI_FUJITSU_HID                "FUJ02B1"
-#define ACPI_FUJITSU_DRIVER_NAME        "Fujitsu laptop FUJ02B1 ACPI brightness driver"
-#define ACPI_FUJITSU_DEVICE_NAME        "Fujitsu FUJ02B1"
-#define ACPI_FUJITSU_HOTKEY_HID         "FUJ02E3"
-#define ACPI_FUJITSU_HOTKEY_DRIVER_NAME "Fujitsu laptop FUJ02E3 ACPI hotkeys driver"
-#define ACPI_FUJITSU_HOTKEY_DEVICE_NAME "Fujitsu FUJ02E3"
+#define ACPI_FUJITSU_CLASS              "fujitsu"
+#define ACPI_FUJITSU_BL_HID             "FUJ02B1"
+#define ACPI_FUJITSU_BL_DRIVER_NAME     "Fujitsu laptop FUJ02B1 ACPI brightness driver"
+#define ACPI_FUJITSU_BL_DEVICE_NAME     "Fujitsu FUJ02B1"
+#define ACPI_FUJITSU_LAPTOP_HID         "FUJ02E3"
+#define ACPI_FUJITSU_LAPTOP_DRIVER_NAME "Fujitsu laptop FUJ02E3 ACPI hotkeys driver"
+#define ACPI_FUJITSU_LAPTOP_DEVICE_NAME "Fujitsu FUJ02E3"
 
 #define ACPI_FUJITSU_NOTIFY_CODE1     0x80
 
 /* FUNC interface - command values */
-#define FUNC_RFKILL     0x1000
+#define FUNC_FLAGS      0x1000
 #define FUNC_LEDS       0x1001
 #define FUNC_BUTTONS    0x1002
 #define FUNC_BACKLIGHT  0x1004
@@ -97,6 +97,11 @@
 /* FUNC interface - responses */
 #define UNSUPPORTED_CMD 0x80000000
 
+/* FUNC interface - status flags */
+#define FLAG_RFKILL     0x020
+#define FLAG_LID        0x100
+#define FLAG_DOCK       0x200
+
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
 /* FUNC interface - LED control */
 #define FUNC_LED_OFF    0x1
@@ -136,7 +141,7 @@
 #endif
 
 /* Device controlling the backlight and associated keys */
-struct fujitsu_t {
+struct fujitsu_bl {
         acpi_handle acpi_handle;
         struct acpi_device *dev;
         struct input_dev *input;
@@ -150,12 +155,12 @@ struct fujitsu_t {
         unsigned int brightness_level;
 };
 
-static struct fujitsu_t *fujitsu;
+static struct fujitsu_bl *fujitsu_bl;
 static int use_alt_lcd_levels = -1;
 static int disable_brightness_adjust = -1;
 
-/* Device used to access other hotkeys on the laptop */
-struct fujitsu_hotkey_t {
+/* Device used to access hotkeys and other features on the laptop */
+struct fujitsu_laptop {
         acpi_handle acpi_handle;
         struct acpi_device *dev;
         struct input_dev *input;
@@ -163,17 +168,15 @@ struct fujitsu_hotkey_t {
         struct platform_device *pf_device;
         struct kfifo fifo;
         spinlock_t fifo_lock;
-        int rfkill_supported;
-        int rfkill_state;
+        int flags_supported;
+        int flags_state;
         int logolamp_registered;
         int kblamps_registered;
         int radio_led_registered;
         int eco_led_registered;
 };
 
-static struct fujitsu_hotkey_t *fujitsu_hotkey;
-
-static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event);
+static struct fujitsu_laptop *fujitsu_laptop;
 
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
 static enum led_brightness logolamp_get(struct led_classdev *cdev);
@@ -222,8 +225,6 @@ static struct led_classdev eco_led = {
 static u32 dbg_level = 0x03;
 #endif
 
-static void acpi_fujitsu_notify(struct acpi_device *device, u32 event);
-
 /* Fujitsu ACPI interface function */
 
 static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
@@ -239,7 +240,7 @@ static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
         unsigned long long value;
         acpi_handle handle = NULL;
 
-        status = acpi_get_handle(fujitsu_hotkey->acpi_handle, "FUNC", &handle);
+        status = acpi_get_handle(fujitsu_laptop->acpi_handle, "FUNC", &handle);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_ERROR,
                                 "FUNC interface is not present\n");
@@ -300,9 +301,9 @@ static int radio_led_set(struct led_classdev *cdev,
                                 enum led_brightness brightness)
 {
         if (brightness >= LED_FULL)
-                return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON);
+                return call_fext_func(FUNC_FLAGS, 0x5, RADIO_LED_ON, RADIO_LED_ON);
         else
-                return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0);
+                return call_fext_func(FUNC_FLAGS, 0x5, RADIO_LED_ON, 0x0);
 }
 
 static int eco_led_set(struct led_classdev *cdev,
@@ -346,7 +347,7 @@ static enum led_brightness radio_led_get(struct led_classdev *cdev)
 {
         enum led_brightness brightness = LED_OFF;
 
-        if (call_fext_func(FUNC_RFKILL, 0x4, 0x0, 0x0) & RADIO_LED_ON)
+        if (call_fext_func(FUNC_FLAGS, 0x4, 0x0, 0x0) & RADIO_LED_ON)
                 brightness = LED_FULL;
 
         return brightness;
@@ -373,10 +374,10 @@ static int set_lcd_level(int level)
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "set lcd level via SBLL [%d]\n",
                     level);
 
-        if (level < 0 || level >= fujitsu->max_brightness)
+        if (level < 0 || level >= fujitsu_bl->max_brightness)
                 return -EINVAL;
 
-        status = acpi_get_handle(fujitsu->acpi_handle, "SBLL", &handle);
+        status = acpi_get_handle(fujitsu_bl->acpi_handle, "SBLL", &handle);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_ERROR, "SBLL not present\n");
                 return -ENODEV;
@@ -398,10 +399,10 @@ static int set_lcd_level_alt(int level)
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "set lcd level via SBL2 [%d]\n",
                     level);
 
-        if (level < 0 || level >= fujitsu->max_brightness)
+        if (level < 0 || level >= fujitsu_bl->max_brightness)
                 return -EINVAL;
 
-        status = acpi_get_handle(fujitsu->acpi_handle, "SBL2", &handle);
+        status = acpi_get_handle(fujitsu_bl->acpi_handle, "SBL2", &handle);
         if (ACPI_FAILURE(status)) {
                 vdbg_printk(FUJLAPTOP_DBG_ERROR, "SBL2 not present\n");
                 return -ENODEV;
@@ -421,19 +422,19 @@ static int get_lcd_level(void)
 
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "get lcd level via GBLL\n");
 
-        status =
-            acpi_evaluate_integer(fujitsu->acpi_handle, "GBLL", NULL, &state);
+        status = acpi_evaluate_integer(fujitsu_bl->acpi_handle, "GBLL", NULL,
+                                       &state);
         if (ACPI_FAILURE(status))
                 return 0;
 
-        fujitsu->brightness_level = state & 0x0fffffff;
+        fujitsu_bl->brightness_level = state & 0x0fffffff;
 
         if (state & 0x80000000)
-                fujitsu->brightness_changed = 1;
+                fujitsu_bl->brightness_changed = 1;
         else
-                fujitsu->brightness_changed = 0;
+                fujitsu_bl->brightness_changed = 0;
 
-        return fujitsu->brightness_level;
+        return fujitsu_bl->brightness_level;
 }
 
 static int get_max_brightness(void)
@@ -443,14 +444,14 @@ static int get_max_brightness(void)
 
         vdbg_printk(FUJLAPTOP_DBG_TRACE, "get max lcd level via RBLL\n");
 
-        status =
-            acpi_evaluate_integer(fujitsu->acpi_handle, "RBLL", NULL, &state);
+        status = acpi_evaluate_integer(fujitsu_bl->acpi_handle, "RBLL", NULL,
+                                       &state);
         if (ACPI_FAILURE(status))
                 return -1;
 
-        fujitsu->max_brightness = state;
+        fujitsu_bl->max_brightness = state;
 
-        return fujitsu->max_brightness;
+        return fujitsu_bl->max_brightness;
 }
 
 /* Backlight device stuff */
@@ -483,7 +484,7 @@ static int bl_update_status(struct backlight_device *b)
         return ret;
 }
 
-static const struct backlight_ops fujitsubl_ops = {
+static const struct backlight_ops fujitsu_bl_ops = {
         .get_brightness = bl_get_brightness,
         .update_status = bl_update_status,
 };
@@ -511,7 +512,7 @@ show_brightness_changed(struct device *dev,
 
         int ret;
 
-        ret = fujitsu->brightness_changed;
+        ret = fujitsu_bl->brightness_changed;
         if (ret < 0)
                 return ret;
 
@@ -539,7 +540,7 @@ static ssize_t store_lcd_level(struct device *dev,
         int level, ret;
 
         if (sscanf(buf, "%i", &level) != 1
-            || (level < 0 || level >= fujitsu->max_brightness))
+            || (level < 0 || level >= fujitsu_bl->max_brightness))
                 return -EINVAL;
 
         if (use_alt_lcd_levels)
@@ -567,9 +568,9 @@ static ssize_t
 show_lid_state(struct device *dev,
                         struct device_attribute *attr, char *buf)
 {
-        if (!(fujitsu_hotkey->rfkill_supported & 0x100))
+        if (!(fujitsu_laptop->flags_supported & FLAG_LID))
                 return sprintf(buf, "unknown\n");
-        if (fujitsu_hotkey->rfkill_state & 0x100)
+        if (fujitsu_laptop->flags_state & FLAG_LID)
                 return sprintf(buf, "open\n");
         else
                 return sprintf(buf, "closed\n");
@@ -579,9 +580,9 @@ static ssize_t
 show_dock_state(struct device *dev,
                         struct device_attribute *attr, char *buf)
 {
-        if (!(fujitsu_hotkey->rfkill_supported & 0x200))
+        if (!(fujitsu_laptop->flags_supported & FLAG_DOCK))
                 return sprintf(buf, "unknown\n");
-        if (fujitsu_hotkey->rfkill_state & 0x200)
+        if (fujitsu_laptop->flags_state & FLAG_DOCK)
                 return sprintf(buf, "docked\n");
         else
                 return sprintf(buf, "undocked\n");
@@ -591,9 +592,9 @@ static ssize_t
 show_radios_state(struct device *dev,
                         struct device_attribute *attr, char *buf)
 {
-        if (!(fujitsu_hotkey->rfkill_supported & 0x20))
+        if (!(fujitsu_laptop->flags_supported & FLAG_RFKILL))
                 return sprintf(buf, "unknown\n");
-        if (fujitsu_hotkey->rfkill_state & 0x20)
+        if (fujitsu_laptop->flags_state & FLAG_RFKILL)
                 return sprintf(buf, "on\n");
         else
                 return sprintf(buf, "killed\n");
@@ -607,7 +608,7 @@ static DEVICE_ATTR(lid, 0444, show_lid_state, ignore_store);
 static DEVICE_ATTR(dock, 0444, show_dock_state, ignore_store);
 static DEVICE_ATTR(radios, 0444, show_radios_state, ignore_store);
 
-static struct attribute *fujitsupf_attributes[] = {
+static struct attribute *fujitsu_pf_attributes[] = {
         &dev_attr_brightness_changed.attr,
         &dev_attr_max_brightness.attr,
         &dev_attr_lcd_level.attr,
@@ -617,11 +618,11 @@ static struct attribute *fujitsupf_attributes[] = {
         NULL
 };
 
-static struct attribute_group fujitsupf_attribute_group = {
-        .attrs = fujitsupf_attributes
+static struct attribute_group fujitsu_pf_attribute_group = {
+        .attrs = fujitsu_pf_attributes
 };
 
-static struct platform_driver fujitsupf_driver = {
+static struct platform_driver fujitsu_pf_driver = {
         .driver = {
                    .name = "fujitsu-laptop",
                    }
@@ -630,39 +631,30 @@ static struct platform_driver fujitsupf_driver = {
 static void __init dmi_check_cb_common(const struct dmi_system_id *id)
 {
         pr_info("Identified laptop model '%s'\n", id->ident);
-        if (use_alt_lcd_levels == -1) {
-                if (acpi_has_method(NULL,
-                                "\\_SB.PCI0.LPCB.FJEX.SBL2"))
-                        use_alt_lcd_levels = 1;
-                else
-                        use_alt_lcd_levels = 0;
-                vdbg_printk(FUJLAPTOP_DBG_TRACE, "auto-detected usealt as "
-                        "%i\n", use_alt_lcd_levels);
-        }
 }
 
 static int __init dmi_check_cb_s6410(const struct dmi_system_id *id)
 {
         dmi_check_cb_common(id);
-        fujitsu->keycode1 = KEY_SCREENLOCK;     /* "Lock" */
-        fujitsu->keycode2 = KEY_HELP;   /* "Mobility Center" */
+        fujitsu_bl->keycode1 = KEY_SCREENLOCK;  /* "Lock" */
+        fujitsu_bl->keycode2 = KEY_HELP;        /* "Mobility Center" */
         return 1;
 }
 
 static int __init dmi_check_cb_s6420(const struct dmi_system_id *id)
 {
         dmi_check_cb_common(id);
-        fujitsu->keycode1 = KEY_SCREENLOCK;     /* "Lock" */
-        fujitsu->keycode2 = KEY_HELP;   /* "Mobility Center" */
+        fujitsu_bl->keycode1 = KEY_SCREENLOCK;  /* "Lock" */
+        fujitsu_bl->keycode2 = KEY_HELP;        /* "Mobility Center" */
         return 1;
 }
 
 static int __init dmi_check_cb_p8010(const struct dmi_system_id *id)
 {
         dmi_check_cb_common(id);
-        fujitsu->keycode1 = KEY_HELP;   /* "Support" */
-        fujitsu->keycode3 = KEY_SWITCHVIDEOMODE;        /* "Presentation" */
-        fujitsu->keycode4 = KEY_WWW;    /* "Internet" */
+        fujitsu_bl->keycode1 = KEY_HELP;                /* "Support" */
+        fujitsu_bl->keycode3 = KEY_SWITCHVIDEOMODE;     /* "Presentation" */
+        fujitsu_bl->keycode4 = KEY_WWW;                 /* "Internet" */
         return 1;
 }
 
@@ -693,7 +685,7 @@ static const struct dmi_system_id fujitsu_dmi_table[] __initconst = {
 
 /* ACPI device for LCD brightness control */
 
-static int acpi_fujitsu_add(struct acpi_device *device)
+static int acpi_fujitsu_bl_add(struct acpi_device *device)
 {
         int state = 0;
         struct input_dev *input;
@@ -702,22 +694,22 @@ static int acpi_fujitsu_add(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
-        fujitsu->acpi_handle = device->handle;
-        sprintf(acpi_device_name(device), "%s", ACPI_FUJITSU_DEVICE_NAME);
+        fujitsu_bl->acpi_handle = device->handle;
+        sprintf(acpi_device_name(device), "%s", ACPI_FUJITSU_BL_DEVICE_NAME);
         sprintf(acpi_device_class(device), "%s", ACPI_FUJITSU_CLASS);
-        device->driver_data = fujitsu;
+        device->driver_data = fujitsu_bl;
 
-        fujitsu->input = input = input_allocate_device();
+        fujitsu_bl->input = input = input_allocate_device();
         if (!input) {
                 error = -ENOMEM;
                 goto err_stop;
         }
 
-        snprintf(fujitsu->phys, sizeof(fujitsu->phys),
+        snprintf(fujitsu_bl->phys, sizeof(fujitsu_bl->phys),
                  "%s/video/input0", acpi_device_hid(device));
 
         input->name = acpi_device_name(device);
-        input->phys = fujitsu->phys;
+        input->phys = fujitsu_bl->phys;
         input->id.bustype = BUS_HOST;
         input->id.product = 0x06;
         input->dev.parent = &device->dev;
@@ -730,7 +722,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
         if (error)
                 goto err_free_input_dev;
 
-        error = acpi_bus_update_power(fujitsu->acpi_handle, &state);
+        error = acpi_bus_update_power(fujitsu_bl->acpi_handle, &state);
         if (error) {
                 pr_err("Error reading power state\n");
                 goto err_unregister_input_dev;
@@ -740,7 +732,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
                acpi_device_name(device), acpi_device_bid(device),
                !device->power.state ? "on" : "off");
 
-        fujitsu->dev = device;
+        fujitsu_bl->dev = device;
 
         if (acpi_has_method(device->handle, METHOD_NAME__INI)) {
                 vdbg_printk(FUJLAPTOP_DBG_INFO, "Invoking _INI\n");
@@ -750,6 +742,15 @@ static int acpi_fujitsu_add(struct acpi_device *device)
                         pr_err("_INI Method failed\n");
         }
 
+        if (use_alt_lcd_levels == -1) {
+                if (acpi_has_method(NULL, "\\_SB.PCI0.LPCB.FJEX.SBL2"))
+                        use_alt_lcd_levels = 1;
+                else
+                        use_alt_lcd_levels = 0;
+                vdbg_printk(FUJLAPTOP_DBG_TRACE, "auto-detected usealt as %i\n",
+                            use_alt_lcd_levels);
+        }
+
         /* do config (detect defaults) */
         use_alt_lcd_levels = use_alt_lcd_levels == 1 ? 1 : 0;
         disable_brightness_adjust = disable_brightness_adjust == 1 ? 1 : 0;
@@ -758,7 +759,7 @@ static int acpi_fujitsu_add(struct acpi_device *device)
                     use_alt_lcd_levels, disable_brightness_adjust);
 
         if (get_max_brightness() <= 0)
-                fujitsu->max_brightness = FUJITSU_LCD_N_LEVELS;
+                fujitsu_bl->max_brightness = FUJITSU_LCD_N_LEVELS;
         get_lcd_level();
 
         return 0;
@@ -772,38 +773,38 @@ err_stop:
         return error;
 }
 
-static int acpi_fujitsu_remove(struct acpi_device *device)
+static int acpi_fujitsu_bl_remove(struct acpi_device *device)
 {
-        struct fujitsu_t *fujitsu = acpi_driver_data(device);
-        struct input_dev *input = fujitsu->input;
+        struct fujitsu_bl *fujitsu_bl = acpi_driver_data(device);
+        struct input_dev *input = fujitsu_bl->input;
 
         input_unregister_device(input);
 
-        fujitsu->acpi_handle = NULL;
+        fujitsu_bl->acpi_handle = NULL;
 
         return 0;
 }
 
 /* Brightness notify */
 
-static void acpi_fujitsu_notify(struct acpi_device *device, u32 event)
+static void acpi_fujitsu_bl_notify(struct acpi_device *device, u32 event)
 {
         struct input_dev *input;
         int keycode;
         int oldb, newb;
 
-        input = fujitsu->input;
+        input = fujitsu_bl->input;
 
         switch (event) {
         case ACPI_FUJITSU_NOTIFY_CODE1:
                 keycode = 0;
-                oldb = fujitsu->brightness_level;
+                oldb = fujitsu_bl->brightness_level;
                 get_lcd_level();
-                newb = fujitsu->brightness_level;
+                newb = fujitsu_bl->brightness_level;
 
                 vdbg_printk(FUJLAPTOP_DBG_TRACE,
                             "brightness button event [%i -> %i (%i)]\n",
-                            oldb, newb, fujitsu->brightness_changed);
+                            oldb, newb, fujitsu_bl->brightness_changed);
 
                 if (oldb < newb) {
                         if (disable_brightness_adjust != 1) {
@@ -840,7 +841,7 @@ static void acpi_fujitsu_notify(struct acpi_device *device, u32 event)
 
 /* ACPI device for hotkey handling */
 
-static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
+static int acpi_fujitsu_laptop_add(struct acpi_device *device)
 {
         int result = 0;
         int state = 0;
@@ -851,42 +852,42 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
-        fujitsu_hotkey->acpi_handle = device->handle;
+        fujitsu_laptop->acpi_handle = device->handle;
         sprintf(acpi_device_name(device), "%s",
-                ACPI_FUJITSU_HOTKEY_DEVICE_NAME);
+                ACPI_FUJITSU_LAPTOP_DEVICE_NAME);
         sprintf(acpi_device_class(device), "%s", ACPI_FUJITSU_CLASS);
-        device->driver_data = fujitsu_hotkey;
+        device->driver_data = fujitsu_laptop;
 
         /* kfifo */
-        spin_lock_init(&fujitsu_hotkey->fifo_lock);
-        error = kfifo_alloc(&fujitsu_hotkey->fifo, RINGBUFFERSIZE * sizeof(int),
+        spin_lock_init(&fujitsu_laptop->fifo_lock);
+        error = kfifo_alloc(&fujitsu_laptop->fifo, RINGBUFFERSIZE * sizeof(int),
                         GFP_KERNEL);
         if (error) {
                 pr_err("kfifo_alloc failed\n");
                 goto err_stop;
         }
 
-        fujitsu_hotkey->input = input = input_allocate_device();
+        fujitsu_laptop->input = input = input_allocate_device();
         if (!input) {
                 error = -ENOMEM;
                 goto err_free_fifo;
         }
 
-        snprintf(fujitsu_hotkey->phys, sizeof(fujitsu_hotkey->phys),
+        snprintf(fujitsu_laptop->phys, sizeof(fujitsu_laptop->phys),
                  "%s/video/input0", acpi_device_hid(device));
 
         input->name = acpi_device_name(device);
-        input->phys = fujitsu_hotkey->phys;
+        input->phys = fujitsu_laptop->phys;
         input->id.bustype = BUS_HOST;
         input->id.product = 0x06;
         input->dev.parent = &device->dev;
 
         set_bit(EV_KEY, input->evbit);
-        set_bit(fujitsu->keycode1, input->keybit);
-        set_bit(fujitsu->keycode2, input->keybit);
-        set_bit(fujitsu->keycode3, input->keybit);
-        set_bit(fujitsu->keycode4, input->keybit);
-        set_bit(fujitsu->keycode5, input->keybit);
+        set_bit(fujitsu_bl->keycode1, input->keybit);
+        set_bit(fujitsu_bl->keycode2, input->keybit);
+        set_bit(fujitsu_bl->keycode3, input->keybit);
+        set_bit(fujitsu_bl->keycode4, input->keybit);
+        set_bit(fujitsu_bl->keycode5, input->keybit);
         set_bit(KEY_TOUCHPAD_TOGGLE, input->keybit);
         set_bit(KEY_UNKNOWN, input->keybit);
 
@@ -894,7 +895,7 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
         if (error)
                 goto err_free_input_dev;
 
-        error = acpi_bus_update_power(fujitsu_hotkey->acpi_handle, &state);
+        error = acpi_bus_update_power(fujitsu_laptop->acpi_handle, &state);
         if (error) {
                 pr_err("Error reading power state\n");
                 goto err_unregister_input_dev;
@@ -904,7 +905,7 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
                 acpi_device_name(device), acpi_device_bid(device),
                 !device->power.state ? "on" : "off");
 
-        fujitsu_hotkey->dev = device;
+        fujitsu_laptop->dev = device;
 
         if (acpi_has_method(device->handle, METHOD_NAME__INI)) {
                 vdbg_printk(FUJLAPTOP_DBG_INFO, "Invoking _INI\n");
@@ -920,27 +921,27 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
                 ; /* No action, result is discarded */
         vdbg_printk(FUJLAPTOP_DBG_INFO, "Discarded %i ringbuffer entries\n", i);
 
-        fujitsu_hotkey->rfkill_supported =
-                call_fext_func(FUNC_RFKILL, 0x0, 0x0, 0x0);
+        fujitsu_laptop->flags_supported =
+                call_fext_func(FUNC_FLAGS, 0x0, 0x0, 0x0);
 
         /* Make sure our bitmask of supported functions is cleared if the
            RFKILL function block is not implemented, like on the S7020. */
-        if (fujitsu_hotkey->rfkill_supported == UNSUPPORTED_CMD)
-                fujitsu_hotkey->rfkill_supported = 0;
+        if (fujitsu_laptop->flags_supported == UNSUPPORTED_CMD)
+                fujitsu_laptop->flags_supported = 0;
 
-        if (fujitsu_hotkey->rfkill_supported)
-                fujitsu_hotkey->rfkill_state =
-                        call_fext_func(FUNC_RFKILL, 0x4, 0x0, 0x0);
+        if (fujitsu_laptop->flags_supported)
+                fujitsu_laptop->flags_state =
+                        call_fext_func(FUNC_FLAGS, 0x4, 0x0, 0x0);
 
         /* Suspect this is a keymap of the application panel, print it */
         pr_info("BTNI: [0x%x]\n", call_fext_func(FUNC_BUTTONS, 0x0, 0x0, 0x0));
 
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
         if (call_fext_func(FUNC_LEDS, 0x0, 0x0, 0x0) & LOGOLAMP_POWERON) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &logolamp_led);
                 if (result == 0) {
-                        fujitsu_hotkey->logolamp_registered = 1;
+                        fujitsu_laptop->logolamp_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for logo lamp, error %i\n",
                                result);
@@ -949,10 +950,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
 
         if ((call_fext_func(FUNC_LEDS, 0x0, 0x0, 0x0) & KEYBOARD_LAMPS) &&
            (call_fext_func(FUNC_BUTTONS, 0x0, 0x0, 0x0) == 0x0)) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &kblamps_led);
                 if (result == 0) {
-                        fujitsu_hotkey->kblamps_registered = 1;
+                        fujitsu_laptop->kblamps_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for keyboard lamps, error %i\n",
                                result);
@@ -966,10 +967,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
          * that an RF LED is present.
          */
         if (call_fext_func(FUNC_BUTTONS, 0x0, 0x0, 0x0) & BIT(24)) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &radio_led);
                 if (result == 0) {
-                        fujitsu_hotkey->radio_led_registered = 1;
+                        fujitsu_laptop->radio_led_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for radio LED, error %i\n",
                                result);
@@ -983,10 +984,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
         */
         if ((call_fext_func(FUNC_LEDS, 0x0, 0x0, 0x0) & BIT(14)) &&
            (call_fext_func(FUNC_LEDS, 0x2, ECO_LED, 0x0) != UNSUPPORTED_CMD)) {
-                result = led_classdev_register(&fujitsu->pf_device->dev,
+                result = led_classdev_register(&fujitsu_bl->pf_device->dev,
                                                 &eco_led);
                 if (result == 0) {
-                        fujitsu_hotkey->eco_led_registered = 1;
+                        fujitsu_laptop->eco_led_registered = 1;
                 } else {
                         pr_err("Could not register LED handler for eco LED, error %i\n",
                                result);
@@ -1002,47 +1003,47 @@ err_unregister_input_dev:
 err_free_input_dev:
         input_free_device(input);
 err_free_fifo:
-        kfifo_free(&fujitsu_hotkey->fifo);
+        kfifo_free(&fujitsu_laptop->fifo);
 err_stop:
         return error;
 }
 
-static int acpi_fujitsu_hotkey_remove(struct acpi_device *device)
+static int acpi_fujitsu_laptop_remove(struct acpi_device *device)
 {
-        struct fujitsu_hotkey_t *fujitsu_hotkey = acpi_driver_data(device);
-        struct input_dev *input = fujitsu_hotkey->input;
+        struct fujitsu_laptop *fujitsu_laptop = acpi_driver_data(device);
+        struct input_dev *input = fujitsu_laptop->input;
 
 #if IS_ENABLED(CONFIG_LEDS_CLASS)
-        if (fujitsu_hotkey->logolamp_registered)
+        if (fujitsu_laptop->logolamp_registered)
                 led_classdev_unregister(&logolamp_led);
 
-        if (fujitsu_hotkey->kblamps_registered)
+        if (fujitsu_laptop->kblamps_registered)
                 led_classdev_unregister(&kblamps_led);
 
-        if (fujitsu_hotkey->radio_led_registered)
+        if (fujitsu_laptop->radio_led_registered)
                 led_classdev_unregister(&radio_led);
 
-        if (fujitsu_hotkey->eco_led_registered)
+        if (fujitsu_laptop->eco_led_registered)
                 led_classdev_unregister(&eco_led);
 #endif
 
         input_unregister_device(input);
 
-        kfifo_free(&fujitsu_hotkey->fifo);
+        kfifo_free(&fujitsu_laptop->fifo);
 
-        fujitsu_hotkey->acpi_handle = NULL;
+        fujitsu_laptop->acpi_handle = NULL;
 
         return 0;
 }
 
-static void acpi_fujitsu_hotkey_press(int keycode)
+static void acpi_fujitsu_laptop_press(int keycode)
 {
-        struct input_dev *input = fujitsu_hotkey->input;
+        struct input_dev *input = fujitsu_laptop->input;
         int status;
 
-        status = kfifo_in_locked(&fujitsu_hotkey->fifo,
+        status = kfifo_in_locked(&fujitsu_laptop->fifo,
                                  (unsigned char *)&keycode, sizeof(keycode),
-                                 &fujitsu_hotkey->fifo_lock);
+                                 &fujitsu_laptop->fifo_lock);
         if (status != sizeof(keycode)) {
                 vdbg_printk(FUJLAPTOP_DBG_WARN,
                             "Could not push keycode [0x%x]\n", keycode);
@@ -1054,16 +1055,16 @@ static void acpi_fujitsu_hotkey_press(int keycode)
                     "Push keycode into ringbuffer [%d]\n", keycode);
 }
 
-static void acpi_fujitsu_hotkey_release(void)
+static void acpi_fujitsu_laptop_release(void)
 {
-        struct input_dev *input = fujitsu_hotkey->input;
+        struct input_dev *input = fujitsu_laptop->input;
         int keycode, status;
 
         while (true) {
-                status = kfifo_out_locked(&fujitsu_hotkey->fifo,
+                status = kfifo_out_locked(&fujitsu_laptop->fifo,
                                           (unsigned char *)&keycode,
                                           sizeof(keycode),
-                                          &fujitsu_hotkey->fifo_lock);
+                                          &fujitsu_laptop->fifo_lock);
                 if (status != sizeof(keycode))
                         return;
                 input_report_key(input, keycode, 0);
@@ -1073,14 +1074,14 @@ static void acpi_fujitsu_hotkey_release(void)
         }
 }
 
-static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
+static void acpi_fujitsu_laptop_notify(struct acpi_device *device, u32 event)
 {
         struct input_dev *input;
         int keycode;
         unsigned int irb = 1;
         int i;
 
-        input = fujitsu_hotkey->input;
+        input = fujitsu_laptop->input;
 
         if (event != ACPI_FUJITSU_NOTIFY_CODE1) {
                 keycode = KEY_UNKNOWN;
@@ -1093,9 +1094,9 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
                 return;
         }
 
-        if (fujitsu_hotkey->rfkill_supported)
-                fujitsu_hotkey->rfkill_state =
-                        call_fext_func(FUNC_RFKILL, 0x4, 0x0, 0x0);
+        if (fujitsu_laptop->flags_supported)
+                fujitsu_laptop->flags_state =
+                        call_fext_func(FUNC_FLAGS, 0x4, 0x0, 0x0);
 
         i = 0;
         while ((irb =
@@ -1103,19 +1104,19 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
                         && (i++) < MAX_HOTKEY_RINGBUFFER_SIZE) {
                 switch (irb & 0x4ff) {
                 case KEY1_CODE:
-                        keycode = fujitsu->keycode1;
+                        keycode = fujitsu_bl->keycode1;
                         break;
                 case KEY2_CODE:
-                        keycode = fujitsu->keycode2;
+                        keycode = fujitsu_bl->keycode2;
                         break;
                 case KEY3_CODE:
-                        keycode = fujitsu->keycode3;
+                        keycode = fujitsu_bl->keycode3;
                         break;
                 case KEY4_CODE:
-                        keycode = fujitsu->keycode4;
+                        keycode = fujitsu_bl->keycode4;
                         break;
                 case KEY5_CODE:
-                        keycode = fujitsu->keycode5;
+                        keycode = fujitsu_bl->keycode5;
                         break;
                 case 0:
                         keycode = 0;
@@ -1128,17 +1129,17 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
                 }
 
                 if (keycode > 0)
-                        acpi_fujitsu_hotkey_press(keycode);
+                        acpi_fujitsu_laptop_press(keycode);
                 else if (keycode == 0)
-                        acpi_fujitsu_hotkey_release();
+                        acpi_fujitsu_laptop_release();
         }
 
         /* On some models (first seen on the Skylake-based Lifebook
          * E736/E746/E756), the touchpad toggle hotkey (Fn+F4) is
-         * handled in software; its state is queried using FUNC_RFKILL
+         * handled in software; its state is queried using FUNC_FLAGS
          */
-        if ((fujitsu_hotkey->rfkill_supported & BIT(26)) &&
-            (call_fext_func(FUNC_RFKILL, 0x1, 0x0, 0x0) & BIT(26))) {
+        if ((fujitsu_laptop->flags_supported & BIT(26)) &&
+            (call_fext_func(FUNC_FLAGS, 0x1, 0x0, 0x0) & BIT(26))) {
                 keycode = KEY_TOUCHPAD_TOGGLE;
                 input_report_key(input, keycode, 1);
                 input_sync(input);
@@ -1150,83 +1151,81 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
 
 /* Initialization */
 
-static const struct acpi_device_id fujitsu_device_ids[] = {
-        {ACPI_FUJITSU_HID, 0},
+static const struct acpi_device_id fujitsu_bl_device_ids[] = {
+        {ACPI_FUJITSU_BL_HID, 0},
         {"", 0},
 };
 
-static struct acpi_driver acpi_fujitsu_driver = {
-        .name = ACPI_FUJITSU_DRIVER_NAME,
+static struct acpi_driver acpi_fujitsu_bl_driver = {
+        .name = ACPI_FUJITSU_BL_DRIVER_NAME,
         .class = ACPI_FUJITSU_CLASS,
-        .ids = fujitsu_device_ids,
+        .ids = fujitsu_bl_device_ids,
         .ops = {
-                .add = acpi_fujitsu_add,
-                .remove = acpi_fujitsu_remove,
-                .notify = acpi_fujitsu_notify,
+                .add = acpi_fujitsu_bl_add,
+                .remove = acpi_fujitsu_bl_remove,
+                .notify = acpi_fujitsu_bl_notify,
                 },
 };
 
-static const struct acpi_device_id fujitsu_hotkey_device_ids[] = {
-        {ACPI_FUJITSU_HOTKEY_HID, 0},
+static const struct acpi_device_id fujitsu_laptop_device_ids[] = {
+        {ACPI_FUJITSU_LAPTOP_HID, 0},
         {"", 0},
 };
 
-static struct acpi_driver acpi_fujitsu_hotkey_driver = {
-        .name = ACPI_FUJITSU_HOTKEY_DRIVER_NAME,
+static struct acpi_driver acpi_fujitsu_laptop_driver = {
+        .name = ACPI_FUJITSU_LAPTOP_DRIVER_NAME,
         .class = ACPI_FUJITSU_CLASS,
-        .ids = fujitsu_hotkey_device_ids,
+        .ids = fujitsu_laptop_device_ids,
         .ops = {
-                .add = acpi_fujitsu_hotkey_add,
-                .remove = acpi_fujitsu_hotkey_remove,
-                .notify = acpi_fujitsu_hotkey_notify,
+                .add = acpi_fujitsu_laptop_add,
+                .remove = acpi_fujitsu_laptop_remove,
+                .notify = acpi_fujitsu_laptop_notify,
                 },
 };
 
 static const struct acpi_device_id fujitsu_ids[] __used = {
-        {ACPI_FUJITSU_HID, 0},
-        {ACPI_FUJITSU_HOTKEY_HID, 0},
+        {ACPI_FUJITSU_BL_HID, 0},
+        {ACPI_FUJITSU_LAPTOP_HID, 0},
         {"", 0}
 };
 MODULE_DEVICE_TABLE(acpi, fujitsu_ids);
 
 static int __init fujitsu_init(void)
 {
-        int ret, result, max_brightness;
+        int ret, max_brightness;
 
         if (acpi_disabled)
                 return -ENODEV;
 
-        fujitsu = kzalloc(sizeof(struct fujitsu_t), GFP_KERNEL);
-        if (!fujitsu)
+        fujitsu_bl = kzalloc(sizeof(struct fujitsu_bl), GFP_KERNEL);
+        if (!fujitsu_bl)
                 return -ENOMEM;
-        fujitsu->keycode1 = KEY_PROG1;
-        fujitsu->keycode2 = KEY_PROG2;
-        fujitsu->keycode3 = KEY_PROG3;
-        fujitsu->keycode4 = KEY_PROG4;
-        fujitsu->keycode5 = KEY_RFKILL;
+        fujitsu_bl->keycode1 = KEY_PROG1;
+        fujitsu_bl->keycode2 = KEY_PROG2;
+        fujitsu_bl->keycode3 = KEY_PROG3;
+        fujitsu_bl->keycode4 = KEY_PROG4;
+        fujitsu_bl->keycode5 = KEY_RFKILL;
         dmi_check_system(fujitsu_dmi_table);
 
-        result = acpi_bus_register_driver(&acpi_fujitsu_driver);
-        if (result < 0) {
-                ret = -ENODEV;
+        ret = acpi_bus_register_driver(&acpi_fujitsu_bl_driver);
+        if (ret)
                 goto fail_acpi;
-        }
 
         /* Register platform stuff */
 
-        fujitsu->pf_device = platform_device_alloc("fujitsu-laptop", -1);
-        if (!fujitsu->pf_device) {
+        fujitsu_bl->pf_device = platform_device_alloc("fujitsu-laptop", -1);
+        if (!fujitsu_bl->pf_device) {
                 ret = -ENOMEM;
                 goto fail_platform_driver;
         }
 
-        ret = platform_device_add(fujitsu->pf_device);
+        ret = platform_device_add(fujitsu_bl->pf_device);
         if (ret)
                 goto fail_platform_device1;
 
         ret =
-            sysfs_create_group(&fujitsu->pf_device->dev.kobj,
-                               &fujitsupf_attribute_group);
+            sysfs_create_group(&fujitsu_bl->pf_device->dev.kobj,
+                               &fujitsu_pf_attribute_group);
         if (ret)
                 goto fail_platform_device2;
 
@@ -1236,90 +1235,88 @@ static int __init fujitsu_init(void)
                 struct backlight_properties props;
 
                 memset(&props, 0, sizeof(struct backlight_properties));
-                max_brightness = fujitsu->max_brightness;
+                max_brightness = fujitsu_bl->max_brightness;
                 props.type = BACKLIGHT_PLATFORM;
                 props.max_brightness = max_brightness - 1;
-                fujitsu->bl_device = backlight_device_register("fujitsu-laptop",
-                                                               NULL, NULL,
-                                                               &fujitsubl_ops,
-                                                               &props);
-                if (IS_ERR(fujitsu->bl_device)) {
-                        ret = PTR_ERR(fujitsu->bl_device);
-                        fujitsu->bl_device = NULL;
+                fujitsu_bl->bl_device = backlight_device_register("fujitsu-laptop",
+                                                                  NULL, NULL,
+                                                                  &fujitsu_bl_ops,
+                                                                  &props);
+                if (IS_ERR(fujitsu_bl->bl_device)) {
+                        ret = PTR_ERR(fujitsu_bl->bl_device);
+                        fujitsu_bl->bl_device = NULL;
                         goto fail_sysfs_group;
                 }
-                fujitsu->bl_device->props.brightness = fujitsu->brightness_level;
+                fujitsu_bl->bl_device->props.brightness = fujitsu_bl->brightness_level;
         }
 
-        ret = platform_driver_register(&fujitsupf_driver);
+        ret = platform_driver_register(&fujitsu_pf_driver);
         if (ret)
                 goto fail_backlight;
 
-        /* Register hotkey driver */
+        /* Register laptop driver */
 
-        fujitsu_hotkey = kzalloc(sizeof(struct fujitsu_hotkey_t), GFP_KERNEL);
-        if (!fujitsu_hotkey) {
+        fujitsu_laptop = kzalloc(sizeof(struct fujitsu_laptop), GFP_KERNEL);
+        if (!fujitsu_laptop) {
                 ret = -ENOMEM;
-                goto fail_hotkey;
+                goto fail_laptop;
         }
 
-        result = acpi_bus_register_driver(&acpi_fujitsu_hotkey_driver);
-        if (result < 0) {
-                ret = -ENODEV;
-                goto fail_hotkey1;
-        }
+        ret = acpi_bus_register_driver(&acpi_fujitsu_laptop_driver);
+        if (ret)
+                goto fail_laptop1;
 
         /* Sync backlight power status (needs FUJ02E3 device, hence deferred) */
         if (acpi_video_get_backlight_type() == acpi_backlight_vendor) {
                 if (call_fext_func(FUNC_BACKLIGHT, 0x2, 0x4, 0x0) == 3)
-                        fujitsu->bl_device->props.power = FB_BLANK_POWERDOWN;
+                        fujitsu_bl->bl_device->props.power = FB_BLANK_POWERDOWN;
                 else
-                        fujitsu->bl_device->props.power = FB_BLANK_UNBLANK;
+                        fujitsu_bl->bl_device->props.power = FB_BLANK_UNBLANK;
         }
 
         pr_info("driver " FUJITSU_DRIVER_VERSION " successfully loaded\n");
 
         return 0;
 
-fail_hotkey1:
-        kfree(fujitsu_hotkey);
-fail_hotkey:
-        platform_driver_unregister(&fujitsupf_driver);
+fail_laptop1:
+        kfree(fujitsu_laptop);
+fail_laptop:
+        platform_driver_unregister(&fujitsu_pf_driver);
 fail_backlight:
-        backlight_device_unregister(fujitsu->bl_device);
+        backlight_device_unregister(fujitsu_bl->bl_device);
 fail_sysfs_group:
-        sysfs_remove_group(&fujitsu->pf_device->dev.kobj,
-                           &fujitsupf_attribute_group);
+        sysfs_remove_group(&fujitsu_bl->pf_device->dev.kobj,
+                           &fujitsu_pf_attribute_group);
 fail_platform_device2:
-        platform_device_del(fujitsu->pf_device);
+        platform_device_del(fujitsu_bl->pf_device);
 fail_platform_device1:
-        platform_device_put(fujitsu->pf_device);
+        platform_device_put(fujitsu_bl->pf_device);
 fail_platform_driver:
-        acpi_bus_unregister_driver(&acpi_fujitsu_driver);
+        acpi_bus_unregister_driver(&acpi_fujitsu_bl_driver);
 fail_acpi:
-        kfree(fujitsu);
+        kfree(fujitsu_bl);
 
         return ret;
 }
 
 static void __exit fujitsu_cleanup(void)
 {
-        acpi_bus_unregister_driver(&acpi_fujitsu_hotkey_driver);
+        acpi_bus_unregister_driver(&acpi_fujitsu_laptop_driver);
 
-        kfree(fujitsu_hotkey);
+        kfree(fujitsu_laptop);
 
-        platform_driver_unregister(&fujitsupf_driver);
+        platform_driver_unregister(&fujitsu_pf_driver);
 
-        backlight_device_unregister(fujitsu->bl_device);
+        backlight_device_unregister(fujitsu_bl->bl_device);
 
-        sysfs_remove_group(&fujitsu->pf_device->dev.kobj,
-                           &fujitsupf_attribute_group);
+        sysfs_remove_group(&fujitsu_bl->pf_device->dev.kobj,
+                           &fujitsu_pf_attribute_group);
 
-        platform_device_unregister(fujitsu->pf_device);
+        platform_device_unregister(fujitsu_bl->pf_device);
 
-        acpi_bus_unregister_driver(&acpi_fujitsu_driver);
+        acpi_bus_unregister_driver(&acpi_fujitsu_bl_driver);
 
-        kfree(fujitsu);
+        kfree(fujitsu_bl);
 
         pr_info("driver unloaded\n");
 }
@@ -1341,7 +1338,3 @@ MODULE_AUTHOR("Jonathan Woithe, Peter Gruber, Tony Vroon");
 MODULE_DESCRIPTION("Fujitsu laptop extras support");
 MODULE_VERSION(FUJITSU_DRIVER_VERSION);
 MODULE_LICENSE("GPL");
-
-MODULE_ALIAS("dmi:*:svnFUJITSUSIEMENS:*:pvr:rvnFUJITSU:rnFJNB1D3:*:cvrS6410:*");
-MODULE_ALIAS("dmi:*:svnFUJITSUSIEMENS:*:pvr:rvnFUJITSU:rnFJNB1E6:*:cvrS6420:*");
-MODULE_ALIAS("dmi:*:svnFUJITSU:*:pvr:rvnFUJITSU:rnFJNB19C:*:cvrS7020:*");
diff --git a/drivers/ptp/ptp_kvm.c b/drivers/ptp/ptp_kvm.c
index 09b4df74291e..bb865695d7a6 100644
--- a/drivers/ptp/ptp_kvm.c
+++ b/drivers/ptp/ptp_kvm.c
@@ -193,10 +193,7 @@ static int __init ptp_kvm_init(void)
 
         kvm_ptp_clock.ptp_clock = ptp_clock_register(&kvm_ptp_clock.caps, NULL);
 
-        if (IS_ERR(kvm_ptp_clock.ptp_clock))
-                return PTR_ERR(kvm_ptp_clock.ptp_clock);
-
-        return 0;
+        return PTR_ERR_OR_ZERO(kvm_ptp_clock.ptp_clock);
 }
 
 module_init(ptp_kvm_init);
diff --git a/drivers/pwm/pwm-lpss-pci.c b/drivers/pwm/pwm-lpss-pci.c
index 053088b9b66e..c1527cb645be 100644
--- a/drivers/pwm/pwm-lpss-pci.c
+++ b/drivers/pwm/pwm-lpss-pci.c
@@ -36,6 +36,14 @@ static const struct pwm_lpss_boardinfo pwm_lpss_bxt_info = {
         .clk_rate = 19200000,
         .npwm = 4,
         .base_unit_bits = 22,
+        .bypass = true,
+};
+
+/* Tangier */
+static const struct pwm_lpss_boardinfo pwm_lpss_tng_info = {
+        .clk_rate = 19200000,
+        .npwm = 4,
+        .base_unit_bits = 22,
 };
 
 static int pwm_lpss_probe_pci(struct pci_dev *pdev,
@@ -97,7 +105,7 @@ static const struct pci_device_id pwm_lpss_pci_ids[] = {
         { PCI_VDEVICE(INTEL, 0x0ac8), (unsigned long)&pwm_lpss_bxt_info},
         { PCI_VDEVICE(INTEL, 0x0f08), (unsigned long)&pwm_lpss_byt_info},
         { PCI_VDEVICE(INTEL, 0x0f09), (unsigned long)&pwm_lpss_byt_info},
-        { PCI_VDEVICE(INTEL, 0x11a5), (unsigned long)&pwm_lpss_bxt_info},
+        { PCI_VDEVICE(INTEL, 0x11a5), (unsigned long)&pwm_lpss_tng_info},
         { PCI_VDEVICE(INTEL, 0x1ac8), (unsigned long)&pwm_lpss_bxt_info},
         { PCI_VDEVICE(INTEL, 0x2288), (unsigned long)&pwm_lpss_bsw_info},
         { PCI_VDEVICE(INTEL, 0x2289), (unsigned long)&pwm_lpss_bsw_info},
diff --git a/drivers/pwm/pwm-lpss-platform.c b/drivers/pwm/pwm-lpss-platform.c
index b22b6fdadb9a..5d6ed1507d29 100644
--- a/drivers/pwm/pwm-lpss-platform.c
+++ b/drivers/pwm/pwm-lpss-platform.c
@@ -37,6 +37,7 @@ static const struct pwm_lpss_boardinfo pwm_lpss_bxt_info = {
         .clk_rate = 19200000,
         .npwm = 4,
         .base_unit_bits = 22,
+        .bypass = true,
 };
 
 static int pwm_lpss_probe_platform(struct platform_device *pdev)
diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
index 689d2c1cbead..8db0d40ccacd 100644
--- a/drivers/pwm/pwm-lpss.c
+++ b/drivers/pwm/pwm-lpss.c
@@ -57,7 +57,7 @@ static inline void pwm_lpss_write(const struct pwm_device *pwm, u32 value)
         writel(value, lpwm->regs + pwm->hwpwm * PWM_SIZE + PWM);
 }
 
-static int pwm_lpss_update(struct pwm_device *pwm)
+static int pwm_lpss_wait_for_update(struct pwm_device *pwm)
 {
         struct pwm_lpss_chip *lpwm = to_lpwm(pwm->chip);
         const void __iomem *addr = lpwm->regs + pwm->hwpwm * PWM_SIZE + PWM;
@@ -65,8 +65,6 @@ static int pwm_lpss_update(struct pwm_device *pwm)
         u32 val;
         int err;
 
-        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
-
         /*
          * PWM Configuration register has SW_UPDATE bit that is set when a new
          * configuration is written to the register. The bit is automatically
@@ -122,6 +120,12 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
         pwm_lpss_write(pwm, ctrl);
 }
 
+static inline void pwm_lpss_cond_enable(struct pwm_device *pwm, bool cond)
+{
+        if (cond)
+                pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_ENABLE);
+}
+
 static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                           struct pwm_state *state)
 {
@@ -137,18 +141,21 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                                 return ret;
                         }
                         pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
-                        ret = pwm_lpss_update(pwm);
+                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+                        pwm_lpss_cond_enable(pwm, lpwm->info->bypass == false);
+                        ret = pwm_lpss_wait_for_update(pwm);
                         if (ret) {
                                 pm_runtime_put(chip->dev);
                                 return ret;
                         }
-                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_ENABLE);
+                        pwm_lpss_cond_enable(pwm, lpwm->info->bypass == true);
                 } else {
                         ret = pwm_lpss_is_updating(pwm);
                         if (ret)
                                 return ret;
                         pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
-                        return pwm_lpss_update(pwm);
+                        pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+                        return pwm_lpss_wait_for_update(pwm);
                 }
         } else if (pwm_is_enabled(pwm)) {
                 pwm_lpss_write(pwm, pwm_lpss_read(pwm) & ~PWM_ENABLE);
diff --git a/drivers/pwm/pwm-lpss.h b/drivers/pwm/pwm-lpss.h
index c94cd7c2695d..98306bb02cfe 100644
--- a/drivers/pwm/pwm-lpss.h
+++ b/drivers/pwm/pwm-lpss.h
@@ -22,6 +22,7 @@ struct pwm_lpss_boardinfo {
         unsigned long clk_rate;
         unsigned int npwm;
         unsigned long base_unit_bits;
+        bool bypass;
 };
 
 struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r,
diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
index ef89df1f7336..744d56197286 100644
--- a/drivers/pwm/pwm-rockchip.c
+++ b/drivers/pwm/pwm-rockchip.c
@@ -191,6 +191,28 @@ static int rockchip_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
         return 0;
 }
 
+static int rockchip_pwm_enable(struct pwm_chip *chip,
+                         struct pwm_device *pwm,
+                         bool enable,
+                         enum pwm_polarity polarity)
+{
+        struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
+        int ret;
+
+        if (enable) {
+                ret = clk_enable(pc->clk);
+                if (ret)
+                        return ret;
+        }
+
+        pc->data->set_enable(chip, pwm, enable, polarity);
+
+        if (!enable)
+                clk_disable(pc->clk);
+
+        return 0;
+}
+
 static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                               struct pwm_state *state)
 {
@@ -207,22 +229,26 @@ static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
                 return ret;
 
         if (state->polarity != curstate.polarity && enabled) {
-                pc->data->set_enable(chip, pwm, false, state->polarity);
+                ret = rockchip_pwm_enable(chip, pwm, false, state->polarity);
+                if (ret)
+                        goto out;
                 enabled = false;
         }
 
         ret = rockchip_pwm_config(chip, pwm, state->duty_cycle, state->period);
         if (ret) {
                 if (enabled != curstate.enabled)
-                        pc->data->set_enable(chip, pwm, !enabled,
-                                             state->polarity);
-
+                        rockchip_pwm_enable(chip, pwm, !enabled,
+                                      state->polarity);
                 goto out;
         }
 
-        if (state->enabled != enabled)
-                pc->data->set_enable(chip, pwm, state->enabled,
-                                     state->polarity);
+        if (state->enabled != enabled) {
+                ret = rockchip_pwm_enable(chip, pwm, state->enabled,
+                                    state->polarity);
+                if (ret)
+                        goto out;
+        }
 
         /*
          * Update the state with the real hardware, which can differ a bit
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 9d19b9a62011..315a4be8dc1e 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -37,8 +37,8 @@
 #include "tsi721.h"
 
 #ifdef DEBUG
-u32 dbg_level;
-module_param(dbg_level, uint, S_IWUSR | S_IRUGO);
+u32 tsi_dbg_level;
+module_param_named(dbg_level, tsi_dbg_level, uint, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(dbg_level, "Debugging output level (default 0 = none)");
 #endif
 
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 5941437cbdd1..957eadc58150 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -40,11 +40,11 @@ enum {
 };
 
 #ifdef DEBUG
-extern u32 dbg_level;
+extern u32 tsi_dbg_level;
 
 #define tsi_debug(level, dev, fmt, arg...)                              \
         do {                                                            \
-                if (DBG_##level & dbg_level)                            \
+                if (DBG_##level & tsi_dbg_level)                                \
                         dev_dbg(dev, "%s: " fmt "\n", __func__, ##arg); \
         } while (0)
 #else
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index 65f86bc24c07..1dc43fc5f65f 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -76,7 +76,7 @@ config QCOM_ADSP_PIL
         depends on OF && ARCH_QCOM
         depends on REMOTEPROC
         depends on QCOM_SMEM
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         select MFD_SYSCON
         select QCOM_MDT_LOADER
         select QCOM_RPROC_COMMON
@@ -93,7 +93,7 @@ config QCOM_Q6V5_PIL
         depends on OF && ARCH_QCOM
         depends on QCOM_SMEM
         depends on REMOTEPROC
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         select MFD_SYSCON
         select QCOM_RPROC_COMMON
         select QCOM_SCM
@@ -104,7 +104,7 @@ config QCOM_Q6V5_PIL
 config QCOM_WCNSS_PIL
         tristate "Qualcomm WCNSS Peripheral Image Loader"
         depends on OF && ARCH_QCOM
-        depends on QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n)
+        depends on RPMSG_QCOM_SMD || QCOM_SMD || (COMPILE_TEST && QCOM_SMD=n && RPMSG_QCOM_SMD=n)
         depends on QCOM_SMEM
         depends on REMOTEPROC
         select QCOM_MDT_LOADER
diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index f1e5e65388bb..cd739d2fa160 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -275,7 +275,7 @@ int reset_control_status(struct reset_control *rstc)
 }
 EXPORT_SYMBOL_GPL(reset_control_status);
 
-static struct reset_control *__reset_control_get(
+static struct reset_control *__reset_control_get_internal(
                                 struct reset_controller_dev *rcdev,
                                 unsigned int index, bool shared)
 {
@@ -308,7 +308,7 @@ static struct reset_control *__reset_control_get(
         return rstc;
 }
 
-static void __reset_control_put(struct reset_control *rstc)
+static void __reset_control_put_internal(struct reset_control *rstc)
 {
         lockdep_assert_held(&reset_list_mutex);
 
@@ -377,7 +377,7 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
         }
 
         /* reset_list_mutex also protects the rcdev's reset_control list */
-        rstc = __reset_control_get(rcdev, rstc_id, shared);
+        rstc = __reset_control_get_internal(rcdev, rstc_id, shared);
 
         mutex_unlock(&reset_list_mutex);
 
@@ -385,6 +385,17 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
 }
 EXPORT_SYMBOL_GPL(__of_reset_control_get);
 
+struct reset_control *__reset_control_get(struct device *dev, const char *id,
+                                          int index, bool shared, bool optional)
+{
+        if (dev->of_node)
+                return __of_reset_control_get(dev->of_node, id, index, shared,
+                                              optional);
+
+        return optional ? NULL : ERR_PTR(-EINVAL);
+}
+EXPORT_SYMBOL_GPL(__reset_control_get);
+
 /**
  * reset_control_put - free the reset controller
  * @rstc: reset controller
@@ -396,7 +407,7 @@ void reset_control_put(struct reset_control *rstc)
                 return;
 
         mutex_lock(&reset_list_mutex);
-        __reset_control_put(rstc);
+        __reset_control_put_internal(rstc);
         mutex_unlock(&reset_list_mutex);
 }
 EXPORT_SYMBOL_GPL(reset_control_put);
@@ -417,8 +428,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev,
         if (!ptr)
                 return ERR_PTR(-ENOMEM);
 
-        rstc = __of_reset_control_get(dev ? dev->of_node : NULL,
-                                      id, index, shared, optional);
+        rstc = __reset_control_get(dev, id, index, shared, optional);
         if (!IS_ERR(rstc)) {
                 *ptr = rstc;
                 devres_add(dev, ptr);
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 40f1136f5568..058db724b5a2 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -572,6 +572,12 @@ int pkey_sec2protkey(u16 cardnr, u16 domain,
                 rc = -EIO;
                 goto out;
         }
+        if (prepcblk->ccp_rscode != 0) {
+                DEBUG_WARN(
+                        "pkey_sec2protkey unwrap secure key warning, card response %d/%d\n",
+                        (int) prepcblk->ccp_rtcode,
+                        (int) prepcblk->ccp_rscode);
+        }
 
         /* process response cprb param block */
         prepcblk->rpl_parmb = ((u8 *) prepcblk) + sizeof(struct CPRBX);
@@ -761,9 +767,10 @@ out:
 }
 
 /*
- * Fetch just the mkvp value via query_crypto_facility from adapter.
+ * Fetch the current and old mkvp values via
+ * query_crypto_facility from adapter.
  */
-static int fetch_mkvp(u16 cardnr, u16 domain, u64 *mkvp)
+static int fetch_mkvp(u16 cardnr, u16 domain, u64 mkvp[2])
 {
         int rc, found = 0;
         size_t rlen, vlen;
@@ -779,9 +786,10 @@ static int fetch_mkvp(u16 cardnr, u16 domain, u64 *mkvp)
         rc = query_crypto_facility(cardnr, domain, "STATICSA",
                                    rarray, &rlen, varray, &vlen);
         if (rc == 0 && rlen > 8*8 && vlen > 184+8) {
-                if (rarray[64] == '2') {
+                if (rarray[8*8] == '2') {
                         /* current master key state is valid */
-                        *mkvp = *((u64 *)(varray + 184));
+                        mkvp[0] = *((u64 *)(varray + 184));
+                        mkvp[1] = *((u64 *)(varray + 172));
                         found = 1;
                 }
         }
@@ -796,14 +804,14 @@ struct mkvp_info {
         struct list_head list;
         u16 cardnr;
         u16 domain;
-        u64 mkvp;
+        u64 mkvp[2];
 };
 
 /* a list with mkvp_info entries */
 static LIST_HEAD(mkvp_list);
 static DEFINE_SPINLOCK(mkvp_list_lock);
 
-static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 *mkvp)
+static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 mkvp[2])
 {
         int rc = -ENOENT;
         struct mkvp_info *ptr;
@@ -812,7 +820,7 @@ static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 *mkvp)
         list_for_each_entry(ptr, &mkvp_list, list) {
                 if (ptr->cardnr == cardnr &&
                     ptr->domain == domain) {
-                        *mkvp = ptr->mkvp;
+                        memcpy(mkvp, ptr->mkvp, 2 * sizeof(u64));
                         rc = 0;
                         break;
                 }
@@ -822,7 +830,7 @@ static int mkvp_cache_fetch(u16 cardnr, u16 domain, u64 *mkvp)
         return rc;
 }
 
-static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp)
+static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp[2])
 {
         int found = 0;
         struct mkvp_info *ptr;
@@ -831,7 +839,7 @@ static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp)
         list_for_each_entry(ptr, &mkvp_list, list) {
                 if (ptr->cardnr == cardnr &&
                     ptr->domain == domain) {
-                        ptr->mkvp = mkvp;
+                        memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
                         found = 1;
                         break;
                 }
@@ -844,7 +852,7 @@ static void mkvp_cache_update(u16 cardnr, u16 domain, u64 mkvp)
                 }
                 ptr->cardnr = cardnr;
                 ptr->domain = domain;
-                ptr->mkvp = mkvp;
+                memcpy(ptr->mkvp, mkvp, 2 * sizeof(u64));
                 list_add(&ptr->list, &mkvp_list);
         }
         spin_unlock_bh(&mkvp_list_lock);
@@ -888,8 +896,8 @@ int pkey_findcard(const struct pkey_seckey *seckey,
         struct secaeskeytoken *t = (struct secaeskeytoken *) seckey;
         struct zcrypt_device_matrix *device_matrix;
         u16 card, dom;
-        u64 mkvp;
-        int i, rc;
+        u64 mkvp[2];
+        int i, rc, oi = -1;
 
         /* mkvp must not be zero */
         if (t->mkvp == 0)
@@ -910,14 +918,14 @@ int pkey_findcard(const struct pkey_seckey *seckey,
                     device_matrix->device[i].functions & 0x04) {
                         /* an enabled CCA Coprocessor card */
                         /* try cached mkvp */
-                        if (mkvp_cache_fetch(card, dom, &mkvp) == 0 &&
-                            t->mkvp == mkvp) {
+                        if (mkvp_cache_fetch(card, dom, mkvp) == 0 &&
+                            t->mkvp == mkvp[0]) {
                                 if (!verify)
                                         break;
                                 /* verify: fetch mkvp from adapter */
-                                if (fetch_mkvp(card, dom, &mkvp) == 0) {
+                                if (fetch_mkvp(card, dom, mkvp) == 0) {
                                         mkvp_cache_update(card, dom, mkvp);
-                                        if (t->mkvp == mkvp)
+                                        if (t->mkvp == mkvp[0])
                                                 break;
                                 }
                         }
@@ -936,14 +944,21 @@ int pkey_findcard(const struct pkey_seckey *seckey,
                         card = AP_QID_CARD(device_matrix->device[i].qid);
                         dom = AP_QID_QUEUE(device_matrix->device[i].qid);
                         /* fresh fetch mkvp from adapter */
-                        if (fetch_mkvp(card, dom, &mkvp) == 0) {
+                        if (fetch_mkvp(card, dom, mkvp) == 0) {
                                 mkvp_cache_update(card, dom, mkvp);
-                                if (t->mkvp == mkvp)
+                                if (t->mkvp == mkvp[0])
                                         break;
+                                if (t->mkvp == mkvp[1] && oi < 0)
+                                        oi = i;
                         }
                 }
+                if (i >= MAX_ZDEV_ENTRIES && oi >= 0) {
+                        /* old mkvp matched, use this card then */
+                        card = AP_QID_CARD(device_matrix->device[oi].qid);
+                        dom = AP_QID_QUEUE(device_matrix->device[oi].qid);
+                }
         }
-        if (i < MAX_ZDEV_ENTRIES) {
+        if (i < MAX_ZDEV_ENTRIES || oi >= 0) {
                 if (pcardnr)
                         *pcardnr = card;
                 if (pdomain)
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index e7addea8741b..d9561e39c3b2 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -961,7 +961,8 @@ int qeth_bridgeport_query_ports(struct qeth_card *card,
 int qeth_bridgeport_setrole(struct qeth_card *card, enum qeth_sbp_roles role);
 int qeth_bridgeport_an_set(struct qeth_card *card, int enable);
 int qeth_get_priority_queue(struct qeth_card *, struct sk_buff *, int, int);
-int qeth_get_elements_no(struct qeth_card *, struct sk_buff *, int);
+int qeth_get_elements_no(struct qeth_card *card, struct sk_buff *skb,
+                         int extra_elems, int data_offset);
 int qeth_get_elements_for_frags(struct sk_buff *);
 int qeth_do_send_packet_fast(struct qeth_card *, struct qeth_qdio_out_q *,
                         struct sk_buff *, struct qeth_hdr *, int, int, int);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 315d8a2db7c0..9a5f99ccb122 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3837,6 +3837,7 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
  * @card:                       qeth card structure, to check max. elems.
  * @skb:                        SKB address
  * @extra_elems:                extra elems needed, to check against max.
+ * @data_offset:                range starts at skb->data + data_offset
  *
  * Returns the number of pages, and thus QDIO buffer elements, needed to cover
  * skb data, including linear part and fragments. Checks if the result plus
@@ -3844,10 +3845,10 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags);
  * Note: extra_elems is not included in the returned result.
  */
 int qeth_get_elements_no(struct qeth_card *card,
-                     struct sk_buff *skb, int extra_elems)
+                     struct sk_buff *skb, int extra_elems, int data_offset)
 {
         int elements = qeth_get_elements_for_range(
-                                (addr_t)skb->data,
+                                (addr_t)skb->data + data_offset,
                                 (addr_t)skb->data + skb_headlen(skb)) +
                         qeth_get_elements_for_frags(skb);
 
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index bea483307618..af4e6a639fec 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -849,7 +849,7 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
          * chaining we can not send long frag lists
          */
         if ((card->info.type != QETH_CARD_TYPE_IQD) &&
-            !qeth_get_elements_no(card, new_skb, 0)) {
+            !qeth_get_elements_no(card, new_skb, 0, 0)) {
                 int lin_rc = skb_linearize(new_skb);
 
                 if (card->options.performance_stats) {
@@ -894,7 +894,8 @@ static int qeth_l2_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
         }
 
-        elements = qeth_get_elements_no(card, new_skb, elements_needed);
+        elements = qeth_get_elements_no(card, new_skb, elements_needed,
+                                        (data_offset > 0) ? data_offset : 0);
         if (!elements) {
                 if (data_offset >= 0)
                         kmem_cache_free(qeth_core_header_cache, hdr);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 06d0addcc058..653f0fb76573 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -2609,17 +2609,13 @@ static void qeth_l3_fill_af_iucv_hdr(struct qeth_card *card,
         char daddr[16];
         struct af_iucv_trans_hdr *iucv_hdr;
 
-        skb_pull(skb, 14);
-        card->dev->header_ops->create(skb, card->dev, 0,
-                                      card->dev->dev_addr, card->dev->dev_addr,
-                                      card->dev->addr_len);
-        skb_pull(skb, 14);
-        iucv_hdr = (struct af_iucv_trans_hdr *)skb->data;
         memset(hdr, 0, sizeof(struct qeth_hdr));
         hdr->hdr.l3.id = QETH_HEADER_TYPE_LAYER3;
         hdr->hdr.l3.ext_flags = 0;
-        hdr->hdr.l3.length = skb->len;
+        hdr->hdr.l3.length = skb->len - ETH_HLEN;
         hdr->hdr.l3.flags = QETH_HDR_IPV6 | QETH_CAST_UNICAST;
+
+        iucv_hdr = (struct af_iucv_trans_hdr *) (skb->data + ETH_HLEN);
         memset(daddr, 0, sizeof(daddr));
         daddr[0] = 0xfe;
         daddr[1] = 0x80;
@@ -2823,10 +2819,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if ((card->info.type == QETH_CARD_TYPE_IQD) &&
             !skb_is_nonlinear(skb)) {
                 new_skb = skb;
-                if (new_skb->protocol == ETH_P_AF_IUCV)
-                        data_offset = 0;
-                else
-                        data_offset = ETH_HLEN;
+                data_offset = ETH_HLEN;
                 hdr = kmem_cache_alloc(qeth_core_header_cache, GFP_ATOMIC);
                 if (!hdr)
                         goto tx_drop;
@@ -2867,7 +2860,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         if ((card->info.type != QETH_CARD_TYPE_IQD) &&
             ((use_tso && !qeth_l3_get_elements_no_tso(card, new_skb, 1)) ||
-             (!use_tso && !qeth_get_elements_no(card, new_skb, 0)))) {
+             (!use_tso && !qeth_get_elements_no(card, new_skb, 0, 0)))) {
                 int lin_rc = skb_linearize(new_skb);
 
                 if (card->options.performance_stats) {
@@ -2909,7 +2902,8 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         elements = use_tso ?
                    qeth_l3_get_elements_no_tso(card, new_skb, hdr_elements) :
-                   qeth_get_elements_no(card, new_skb, hdr_elements);
+                   qeth_get_elements_no(card, new_skb, hdr_elements,
+                                        (data_offset > 0) ? data_offset : 0);
         if (!elements) {
                 if (data_offset >= 0)
                         kmem_cache_free(qeth_core_header_cache, hdr);
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 230043c1c90f..3c52867dfe28 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1241,16 +1241,15 @@ config SCSI_LPFC
         tristate "Emulex LightPulse Fibre Channel Support"
         depends on PCI && SCSI
         depends on SCSI_FC_ATTRS
-        depends on NVME_FC && NVME_TARGET_FC
         select CRC_T10DIF
-        help
+        ---help---
           This lpfc driver supports the Emulex LightPulse
           Family of Fibre Channel PCI host adapters.
 
 config SCSI_LPFC_DEBUG_FS
         bool "Emulex LightPulse Fibre Channel debugfs Support"
         depends on SCSI_LPFC && DEBUG_FS
-        help
+        ---help---
           This makes debugging information from the lpfc driver
           available via the debugfs filesystem.
 
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index d036a806f31c..d281492009fb 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1690,9 +1690,6 @@ struct aac_dev
 #define aac_adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4) \
         (dev)->a_ops.adapter_sync_cmd(dev, command, p1, p2, p3, p4, p5, p6, status, r1, r2, r3, r4)
 
-#define aac_adapter_check_health(dev) \
-        (dev)->a_ops.adapter_check_health(dev)
-
 #define aac_adapter_restart(dev, bled, reset_type) \
         ((dev)->a_ops.adapter_restart(dev, bled, reset_type))
 
@@ -2615,6 +2612,14 @@ static inline unsigned int cap_to_cyls(sector_t capacity, unsigned divisor)
         return capacity;
 }
 
+static inline int aac_adapter_check_health(struct aac_dev *dev)
+{
+        if (unlikely(pci_channel_offline(dev->pdev)))
+                return -1;
+
+        return (dev)->a_ops.adapter_check_health(dev);
+}
+
 /* SCp.phase values */
 #define AAC_OWNER_MIDLEVEL      0x101
 #define AAC_OWNER_LOWLEVEL      0x102
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index a3ad04293487..1f4918355fdb 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1873,7 +1873,8 @@ int aac_check_health(struct aac_dev * aac)
         spin_unlock_irqrestore(&aac->fib_lock, flagv);
 
         if (BlinkLED < 0) {
-                printk(KERN_ERR "%s: Host adapter dead %d\n", aac->name, BlinkLED);
+                printk(KERN_ERR "%s: Host adapter is dead (or got a PCI error) %d\n",
+                                aac->name, BlinkLED);
                 goto out;
         }
 
@@ -2056,7 +2057,6 @@ static int fillup_pools(struct aac_dev *dev, struct hw_fib **hw_fib_pool,
 {
         struct hw_fib **hw_fib_p;
         struct fib **fib_p;
-        int rcode = 1;
 
         hw_fib_p = hw_fib_pool;
         fib_p = fib_pool;
@@ -2074,11 +2074,11 @@ static int fillup_pools(struct aac_dev *dev, struct hw_fib **hw_fib_pool,
                 }
         }
 
+        /*
+         * Get the actual number of allocated fibs
+         */
         num = hw_fib_p - hw_fib_pool;
-        if (!num)
-                rcode = 0;
-
-        return rcode;
+        return num;
 }
 
 static void wakeup_fibctx_threads(struct aac_dev *dev,
@@ -2186,7 +2186,6 @@ static void aac_process_events(struct aac_dev *dev)
         struct fib *fib;
         unsigned long flags;
         spinlock_t *t_lock;
-        unsigned int rcode;
 
         t_lock = dev->queues->queue[HostNormCmdQueue].lock;
         spin_lock_irqsave(t_lock, flags);
@@ -2269,8 +2268,8 @@ static void aac_process_events(struct aac_dev *dev)
                  * Fill up fib pointer pools with actual fibs
                  * and hw_fibs
                  */
-                rcode = fillup_pools(dev, hw_fib_pool, fib_pool, num);
-                if (!rcode)
+                num = fillup_pools(dev, hw_fib_pool, fib_pool, num);
+                if (!num)
                         goto free_mem;
 
                 /*
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index 2e5338dec621..7b0410e0f569 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -468,7 +468,7 @@ err_out:
         return -1;
 
 err_blink:
-        return (status > 16) & 0xFF;
+        return (status >> 16) & 0xFF;
 }
 
 static inline u32 aac_get_vector(struct aac_dev *dev)
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 109e2c99e6c1..95d8f25cbcca 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -6278,7 +6278,7 @@ ahd_reset(struct ahd_softc *ahd, int reinit)
                  * does not disable its parity logic prior to
                  * the start of the reset.  This may cause a
                  * parity error to be detected and thus a
-                 * spurious SERR or PERR assertion.  Disble
+                 * spurious SERR or PERR assertion.  Disable
                  * PERR and SERR responses during the CHIPRST.
                  */
                 mod_cmd = cmd & ~(PCIM_CMD_PERRESPEN|PCIM_CMD_SERRESPEN);
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 48e200102221..c01b47e5b55a 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -113,7 +113,7 @@ struct alua_queue_data {
 #define ALUA_POLICY_SWITCH_ALL          1
 
 static void alua_rtpg_work(struct work_struct *work);
-static void alua_rtpg_queue(struct alua_port_group *pg,
+static bool alua_rtpg_queue(struct alua_port_group *pg,
                             struct scsi_device *sdev,
                             struct alua_queue_data *qdata, bool force);
 static void alua_check(struct scsi_device *sdev, bool force);
@@ -862,7 +862,13 @@ static void alua_rtpg_work(struct work_struct *work)
         kref_put(&pg->kref, release_port_group);
 }
 
-static void alua_rtpg_queue(struct alua_port_group *pg,
+/**
+ * alua_rtpg_queue() - cause RTPG to be submitted asynchronously
+ *
+ * Returns true if and only if alua_rtpg_work() will be called asynchronously.
+ * That function is responsible for calling @qdata->fn().
+ */
+static bool alua_rtpg_queue(struct alua_port_group *pg,
                             struct scsi_device *sdev,
                             struct alua_queue_data *qdata, bool force)
 {
@@ -870,8 +876,8 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
         unsigned long flags;
         struct workqueue_struct *alua_wq = kaluad_wq;
 
-        if (!pg)
-                return;
+        if (WARN_ON_ONCE(!pg) || scsi_device_get(sdev))
+                return false;
 
         spin_lock_irqsave(&pg->lock, flags);
         if (qdata) {
@@ -884,14 +890,12 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 pg->flags |= ALUA_PG_RUN_RTPG;
                 kref_get(&pg->kref);
                 pg->rtpg_sdev = sdev;
-                scsi_device_get(sdev);
                 start_queue = 1;
         } else if (!(pg->flags & ALUA_PG_RUN_RTPG) && force) {
                 pg->flags |= ALUA_PG_RUN_RTPG;
                 /* Do not queue if the worker is already running */
                 if (!(pg->flags & ALUA_PG_RUNNING)) {
                         kref_get(&pg->kref);
-                        sdev = NULL;
                         start_queue = 1;
                 }
         }
@@ -900,13 +904,17 @@ static void alua_rtpg_queue(struct alua_port_group *pg,
                 alua_wq = kaluad_sync_wq;
         spin_unlock_irqrestore(&pg->lock, flags);
 
-        if (start_queue &&
-            !queue_delayed_work(alua_wq, &pg->rtpg_work,
-                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS))) {
-                if (sdev)
-                        scsi_device_put(sdev);
-                kref_put(&pg->kref, release_port_group);
+        if (start_queue) {
+                if (queue_delayed_work(alua_wq, &pg->rtpg_work,
+                                msecs_to_jiffies(ALUA_RTPG_DELAY_MSECS)))
+                        sdev = NULL;
+                else
+                        kref_put(&pg->kref, release_port_group);
         }
+        if (sdev)
+                scsi_device_put(sdev);
+
+        return true;
 }
 
 /*
@@ -1007,11 +1015,13 @@ static int alua_activate(struct scsi_device *sdev,
                 mutex_unlock(&h->init_mutex);
                 goto out;
         }
-        fn = NULL;
         rcu_read_unlock();
         mutex_unlock(&h->init_mutex);
 
-        alua_rtpg_queue(pg, sdev, qdata, true);
+        if (alua_rtpg_queue(pg, sdev, qdata, true))
+                fn = NULL;
+        else
+                err = SCSI_DH_DEV_OFFLINED;
         kref_put(&pg->kref, release_port_group);
 out:
         if (fn)
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 524a0c755ed7..9d659aaace15 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -2956,7 +2956,7 @@ static int hpsa_send_reset(struct ctlr_info *h, unsigned char *scsi3addr,
         /* fill_cmd can't fail here, no data buffer to map. */
         (void) fill_cmd(c, reset_type, h, NULL, 0, 0,
                         scsi3addr, TYPE_MSG);
-        rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, DEFAULT_TIMEOUT);
+        rc = hpsa_scsi_do_simple_cmd(h, c, reply_queue, NO_TIMEOUT);
         if (rc) {
                 dev_warn(&h->pdev->dev, "Failed to send reset command\n");
                 goto out;
@@ -3714,7 +3714,7 @@ exit_failed:
  *  # (integer code indicating one of several NOT READY states
  *     describing why a volume is to be kept offline)
  */
-static int hpsa_volume_offline(struct ctlr_info *h,
+static unsigned char hpsa_volume_offline(struct ctlr_info *h,
                                         unsigned char scsi3addr[])
 {
         struct CommandList *c;
@@ -3735,7 +3735,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
                                         DEFAULT_TIMEOUT);
         if (rc) {
                 cmd_free(h, c);
-                return 0;
+                return HPSA_VPD_LV_STATUS_UNSUPPORTED;
         }
         sense = c->err_info->SenseInfo;
         if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo))
@@ -3746,19 +3746,13 @@ static int hpsa_volume_offline(struct ctlr_info *h,
         cmd_status = c->err_info->CommandStatus;
         scsi_status = c->err_info->ScsiStatus;
         cmd_free(h, c);
-        /* Is the volume 'not ready'? */
-        if (cmd_status != CMD_TARGET_STATUS ||
-                scsi_status != SAM_STAT_CHECK_CONDITION ||
-                sense_key != NOT_READY ||
-                asc != ASC_LUN_NOT_READY)  {
-                return 0;
-        }
 
         /* Determine the reason for not ready state */
         ldstat = hpsa_get_volume_status(h, scsi3addr);
 
         /* Keep volume offline in certain cases: */
         switch (ldstat) {
+        case HPSA_LV_FAILED:
         case HPSA_LV_UNDERGOING_ERASE:
         case HPSA_LV_NOT_AVAILABLE:
         case HPSA_LV_UNDERGOING_RPI:
@@ -3780,7 +3774,7 @@ static int hpsa_volume_offline(struct ctlr_info *h,
         default:
                 break;
         }
-        return 0;
+        return HPSA_LV_OK;
 }
 
 /*
@@ -3853,10 +3847,10 @@ static int hpsa_update_device_info(struct ctlr_info *h,
         /* Do an inquiry to the device to see what it is. */
         if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
                 (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
-                /* Inquiry failed (msg printed already) */
                 dev_err(&h->pdev->dev,
-                        "hpsa_update_device_info: inquiry failed\n");
-                rc = -EIO;
+                        "%s: inquiry failed, device will be skipped.\n",
+                        __func__);
+                rc = HPSA_INQUIRY_FAILED;
                 goto bail_out;
         }
 
@@ -3885,15 +3879,20 @@ static int hpsa_update_device_info(struct ctlr_info *h,
         if ((this_device->devtype == TYPE_DISK ||
                 this_device->devtype == TYPE_ZBC) &&
                 is_logical_dev_addr_mode(scsi3addr)) {
-                int volume_offline;
+                unsigned char volume_offline;
 
                 hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level);
                 if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC)
                         hpsa_get_ioaccel_status(h, scsi3addr, this_device);
                 volume_offline = hpsa_volume_offline(h, scsi3addr);
-                if (volume_offline < 0 || volume_offline > 0xff)
-                        volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED;
-                this_device->volume_offline = volume_offline & 0xff;
+                this_device->volume_offline = volume_offline;
+                if (volume_offline == HPSA_LV_FAILED) {
+                        rc = HPSA_LV_FAILED;
+                        dev_err(&h->pdev->dev,
+                                "%s: LV failed, device will be skipped.\n",
+                                __func__);
+                        goto bail_out;
+                }
         } else {
                 this_device->raid_level = RAID_UNKNOWN;
                 this_device->offload_config = 0;
@@ -4379,8 +4378,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h)
                         goto out;
                 }
                 if (rc) {
-                        dev_warn(&h->pdev->dev,
-                                "Inquiry failed, skipping device.\n");
+                        h->drv_req_rescan = 1;
                         continue;
                 }
 
@@ -5558,7 +5556,7 @@ static void hpsa_scan_complete(struct ctlr_info *h)
 
         spin_lock_irqsave(&h->scan_lock, flags);
         h->scan_finished = 1;
-        wake_up_all(&h->scan_wait_queue);
+        wake_up(&h->scan_wait_queue);
         spin_unlock_irqrestore(&h->scan_lock, flags);
 }
 
@@ -5576,11 +5574,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
         if (unlikely(lockup_detected(h)))
                 return hpsa_scan_complete(h);
 
+        /*
+         * If a scan is already waiting to run, no need to add another
+         */
+        spin_lock_irqsave(&h->scan_lock, flags);
+        if (h->scan_waiting) {
+                spin_unlock_irqrestore(&h->scan_lock, flags);
+                return;
+        }
+
+        spin_unlock_irqrestore(&h->scan_lock, flags);
+
         /* wait until any scan already in progress is finished. */
         while (1) {
                 spin_lock_irqsave(&h->scan_lock, flags);
                 if (h->scan_finished)
                         break;
+                h->scan_waiting = 1;
                 spin_unlock_irqrestore(&h->scan_lock, flags);
                 wait_event(h->scan_wait_queue, h->scan_finished);
                 /* Note: We don't need to worry about a race between this
@@ -5590,6 +5600,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh)
                  */
         }
         h->scan_finished = 0; /* mark scan as in progress */
+        h->scan_waiting = 0;
         spin_unlock_irqrestore(&h->scan_lock, flags);
 
         if (unlikely(lockup_detected(h)))
@@ -8792,6 +8803,7 @@ reinit_after_soft_reset:
         init_waitqueue_head(&h->event_sync_wait_queue);
         mutex_init(&h->reset_mutex);
         h->scan_finished = 1; /* no scan currently in progress */
+        h->scan_waiting = 0;
 
         pci_set_drvdata(pdev, h);
         h->ndevices = 0;
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
index bf6cdc106654..6f04f2ad4125 100644
--- a/drivers/scsi/hpsa.h
+++ b/drivers/scsi/hpsa.h
@@ -201,6 +201,7 @@ struct ctlr_info {
         dma_addr_t              errinfo_pool_dhandle;
         unsigned long           *cmd_pool_bits;
         int                     scan_finished;
+        u8                      scan_waiting : 1;
         spinlock_t              scan_lock;
         wait_queue_head_t       scan_wait_queue;
 
diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
index a584cdf07058..5961705eef76 100644
--- a/drivers/scsi/hpsa_cmd.h
+++ b/drivers/scsi/hpsa_cmd.h
@@ -156,6 +156,7 @@
 #define CFGTBL_BusType_Fibre2G  0x00000200l
 
 /* VPD Inquiry types */
+#define HPSA_INQUIRY_FAILED             0x02
 #define HPSA_VPD_SUPPORTED_PAGES        0x00
 #define HPSA_VPD_LV_DEVICE_ID           0x83
 #define HPSA_VPD_LV_DEVICE_GEOMETRY     0xC1
@@ -166,6 +167,7 @@
 /* Logical volume states */
 #define HPSA_VPD_LV_STATUS_UNSUPPORTED                  0xff
 #define HPSA_LV_OK                                      0x0
+#define HPSA_LV_FAILED                                  0x01
 #define HPSA_LV_NOT_AVAILABLE                           0x0b
 #define HPSA_LV_UNDERGOING_ERASE                        0x0F
 #define HPSA_LV_UNDERGOING_RPI                          0x12
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index b29afafc2885..5d5e272fd815 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6293,7 +6293,12 @@ static void ipr_erp_start(struct ipr_ioa_cfg *ioa_cfg,
                 break;
         case IPR_IOASC_MED_DO_NOT_REALLOC: /* prevent retries */
         case IPR_IOASA_IR_DUAL_IOA_DISABLED:
-                scsi_cmd->result |= (DID_PASSTHROUGH << 16);
+                /*
+                 * exception: do not set DID_PASSTHROUGH on CHECK CONDITION
+                 * so SCSI mid-layer and upper layers handle it accordingly.
+                 */
+                if (scsi_cmd->result != SAM_STAT_CHECK_CONDITION)
+                        scsi_cmd->result |= (DID_PASSTHROUGH << 16);
                 break;
         case IPR_IOASC_BUS_WAS_RESET:
         case IPR_IOASC_BUS_WAS_RESET_BY_OTHER:
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 07c08ce68d70..894b1e3ebd56 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -561,8 +561,12 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
         WARN_ON_ONCE(task->state == ISCSI_TASK_FREE);
         task->state = state;
 
-        if (!list_empty(&task->running))
+        spin_lock_bh(&conn->taskqueuelock);
+        if (!list_empty(&task->running)) {
+                pr_debug_once("%s while task on list", __func__);
                 list_del_init(&task->running);
+        }
+        spin_unlock_bh(&conn->taskqueuelock);
 
         if (conn->task == task)
                 conn->task = NULL;
@@ -784,7 +788,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                 if (session->tt->xmit_task(task))
                         goto free_task;
         } else {
+                spin_lock_bh(&conn->taskqueuelock);
                 list_add_tail(&task->running, &conn->mgmtqueue);
+                spin_unlock_bh(&conn->taskqueuelock);
                 iscsi_conn_queue_work(conn);
         }
 
@@ -1475,8 +1481,10 @@ void iscsi_requeue_task(struct iscsi_task *task)
          * this may be on the requeue list already if the xmit_task callout
          * is handling the r2ts while we are adding new ones
          */
+        spin_lock_bh(&conn->taskqueuelock);
         if (list_empty(&task->running))
                 list_add_tail(&task->running, &conn->requeue);
+        spin_unlock_bh(&conn->taskqueuelock);
         iscsi_conn_queue_work(conn);
 }
 EXPORT_SYMBOL_GPL(iscsi_requeue_task);
@@ -1513,22 +1521,26 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
          * only have one nop-out as a ping from us and targets should not
          * overflow us with nop-ins
          */
+        spin_lock_bh(&conn->taskqueuelock);
 check_mgmt:
         while (!list_empty(&conn->mgmtqueue)) {
                 conn->task = list_entry(conn->mgmtqueue.next,
                                          struct iscsi_task, running);
                 list_del_init(&conn->task->running);
+                spin_unlock_bh(&conn->taskqueuelock);
                 if (iscsi_prep_mgmt_task(conn, conn->task)) {
                         /* regular RX path uses back_lock */
                         spin_lock_bh(&conn->session->back_lock);
                         __iscsi_put_task(conn->task);
                         spin_unlock_bh(&conn->session->back_lock);
                         conn->task = NULL;
+                        spin_lock_bh(&conn->taskqueuelock);
                         continue;
                 }
                 rc = iscsi_xmit_task(conn);
                 if (rc)
                         goto done;
+                spin_lock_bh(&conn->taskqueuelock);
         }
 
         /* process pending command queue */
@@ -1536,19 +1548,24 @@ check_mgmt:
                 conn->task = list_entry(conn->cmdqueue.next, struct iscsi_task,
                                         running);
                 list_del_init(&conn->task->running);
+                spin_unlock_bh(&conn->taskqueuelock);
                 if (conn->session->state == ISCSI_STATE_LOGGING_OUT) {
                         fail_scsi_task(conn->task, DID_IMM_RETRY);
+                        spin_lock_bh(&conn->taskqueuelock);
                         continue;
                 }
                 rc = iscsi_prep_scsi_cmd_pdu(conn->task);
                 if (rc) {
                         if (rc == -ENOMEM || rc == -EACCES) {
+                                spin_lock_bh(&conn->taskqueuelock);
                                 list_add_tail(&conn->task->running,
                                               &conn->cmdqueue);
                                 conn->task = NULL;
+                                spin_unlock_bh(&conn->taskqueuelock);
                                 goto done;
                         } else
                                 fail_scsi_task(conn->task, DID_ABORT);
+                        spin_lock_bh(&conn->taskqueuelock);
                         continue;
                 }
                 rc = iscsi_xmit_task(conn);
@@ -1559,6 +1576,7 @@ check_mgmt:
                  * we need to check the mgmt queue for nops that need to
                  * be sent to aviod starvation
                  */
+                spin_lock_bh(&conn->taskqueuelock);
                 if (!list_empty(&conn->mgmtqueue))
                         goto check_mgmt;
         }
@@ -1578,12 +1596,15 @@ check_mgmt:
                 conn->task = task;
                 list_del_init(&conn->task->running);
                 conn->task->state = ISCSI_TASK_RUNNING;
+                spin_unlock_bh(&conn->taskqueuelock);
                 rc = iscsi_xmit_task(conn);
                 if (rc)
                         goto done;
+                spin_lock_bh(&conn->taskqueuelock);
                 if (!list_empty(&conn->mgmtqueue))
                         goto check_mgmt;
         }
+        spin_unlock_bh(&conn->taskqueuelock);
         spin_unlock_bh(&conn->session->frwd_lock);
         return -ENODATA;
 
@@ -1739,7 +1760,9 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc)
                         goto prepd_reject;
                 }
         } else {
+                spin_lock_bh(&conn->taskqueuelock);
                 list_add_tail(&task->running, &conn->cmdqueue);
+                spin_unlock_bh(&conn->taskqueuelock);
                 iscsi_conn_queue_work(conn);
         }
 
@@ -2897,6 +2920,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
         INIT_LIST_HEAD(&conn->mgmtqueue);
         INIT_LIST_HEAD(&conn->cmdqueue);
         INIT_LIST_HEAD(&conn->requeue);
+        spin_lock_init(&conn->taskqueuelock);
         INIT_WORK(&conn->xmitwork, iscsi_xmitworker);
 
         /* allocate login_task used for the login/text sequences */
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 763f012fdeca..87f5e694dbed 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -221,7 +221,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
                 task->num_scatter = qc->n_elem;
         } else {
                 for_each_sg(qc->sg, sg, qc->n_elem, si)
-                        xfer += sg->length;
+                        xfer += sg_dma_len(sg);
 
                 task->total_xfer_len = xfer;
                 task->num_scatter = si;
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 0bba2e30b4f0..257bbdd0f0b8 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -99,12 +99,13 @@ struct lpfc_sli2_slim;
 #define FC_MAX_ADPTMSG          64
 
 #define MAX_HBAEVT      32
+#define MAX_HBAS_NO_RESET 16
 
 /* Number of MSI-X vectors the driver uses */
 #define LPFC_MSIX_VECTORS       2
 
 /* lpfc wait event data ready flag */
-#define LPFC_DATA_READY         (1<<0)
+#define LPFC_DATA_READY         0       /* bit 0 */
 
 /* queue dump line buffer size */
 #define LPFC_LBUF_SZ            128
@@ -692,6 +693,7 @@ struct lpfc_hba {
                                          * capability
                                          */
 #define HBA_NVME_IOQ_FLUSH      0x80000 /* NVME IO queues flushed. */
+#define NVME_XRI_ABORT_EVENT    0x100000
 
         uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/
         struct lpfc_dmabuf slim2p;
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 5c783ef7f260..22819afbaef5 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -3010,6 +3010,12 @@ MODULE_PARM_DESC(lpfc_poll, "FCP ring polling mode control:"
 static DEVICE_ATTR(lpfc_poll, S_IRUGO | S_IWUSR,
                    lpfc_poll_show, lpfc_poll_store);
 
+int lpfc_no_hba_reset_cnt;
+unsigned long lpfc_no_hba_reset[MAX_HBAS_NO_RESET] = {
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+module_param_array(lpfc_no_hba_reset, ulong, &lpfc_no_hba_reset_cnt, 0444);
+MODULE_PARM_DESC(lpfc_no_hba_reset, "WWPN of HBAs that should not be reset");
+
 LPFC_ATTR(sli_mode, 0, 0, 3,
         "SLI mode selector:"
         " 0 - auto (SLI-3 if supported),"
@@ -3309,9 +3315,9 @@ LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
- * Supported values are [1,3]. Default value is 3
+ * Supported values are [1,3]. Default value is 1
  */
-LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_BOTH,
+LPFC_ATTR_R(enable_fc4_type, LPFC_ENABLE_FCP,
             LPFC_ENABLE_FCP, LPFC_ENABLE_BOTH,
             "Define fc4 type to register with fabric.");
 
@@ -4451,7 +4457,8 @@ lpfc_fcp_imax_store(struct device *dev, struct device_attribute *attr,
                 return -EINVAL;
 
         phba->cfg_fcp_imax = (uint32_t)val;
-        for (i = 0; i < phba->io_channel_irqs; i++)
+
+        for (i = 0; i < phba->io_channel_irqs; i += LPFC_MAX_EQ_DELAY_EQID_CNT)
                 lpfc_modify_hba_eq_delay(phba, i);
 
         return strlen(buf);
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 843dd73004da..54e6ac42fbcd 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -384,7 +384,7 @@ void lpfc_free_sysfs_attr(struct lpfc_vport *);
 extern struct device_attribute *lpfc_hba_attrs[];
 extern struct device_attribute *lpfc_vport_attrs[];
 extern struct scsi_host_template lpfc_template;
-extern struct scsi_host_template lpfc_template_s3;
+extern struct scsi_host_template lpfc_template_no_hr;
 extern struct scsi_host_template lpfc_template_nvme;
 extern struct scsi_host_template lpfc_vport_template;
 extern struct fc_function_template lpfc_transport_functions;
@@ -554,3 +554,5 @@ void lpfc_nvme_abort_fcreq_cmpl(struct lpfc_hba *phba,
                                 struct lpfc_wcqe_complete *abts_cmpl);
 extern int lpfc_enable_nvmet_cnt;
 extern unsigned long long lpfc_enable_nvmet[];
+extern int lpfc_no_hba_reset_cnt;
+extern unsigned long lpfc_no_hba_reset[];
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index c22bb3f887e1..d3e9af983015 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -939,8 +939,8 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                                          "FC4 x%08x, Data: x%08x x%08x\n",
                                          ndlp, did, ndlp->nlp_fc4_type,
                                          FC_TYPE_FCP, FC_TYPE_NVME);
+                        ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
                 }
-                ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE;
                 lpfc_nlp_set_state(vport, ndlp, NLP_STE_PRLI_ISSUE);
                 lpfc_issue_els_prli(vport, ndlp, 0);
         } else
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 9f4798e9d938..913eed822cb8 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -3653,17 +3653,6 @@ lpfc_idiag_queacc_write(struct file *file, const char __user *buf,
                         idiag.ptr_private = phba->sli4_hba.nvmels_cq;
                         goto pass_check;
                 }
-                /* NVME LS complete queue */
-                if (phba->sli4_hba.nvmels_cq &&
-                    phba->sli4_hba.nvmels_cq->queue_id == queid) {
-                        /* Sanity check */
-                        rc = lpfc_idiag_que_param_check(
-                                        phba->sli4_hba.nvmels_cq, index, count);
-                        if (rc)
-                                goto error_out;
-                        idiag.ptr_private = phba->sli4_hba.nvmels_cq;
-                        goto pass_check;
-                }
                 /* FCP complete queue */
                 if (phba->sli4_hba.fcp_cq) {
                         for (qidx = 0; qidx < phba->cfg_fcp_io_channel;
@@ -3738,17 +3727,6 @@ lpfc_idiag_queacc_write(struct file *file, const char __user *buf,
                         idiag.ptr_private = phba->sli4_hba.nvmels_wq;
                         goto pass_check;
                 }
-                /* NVME LS work queue */
-                if (phba->sli4_hba.nvmels_wq &&
-                    phba->sli4_hba.nvmels_wq->queue_id == queid) {
-                        /* Sanity check */
-                        rc = lpfc_idiag_que_param_check(
-                                        phba->sli4_hba.nvmels_wq, index, count);
-                        if (rc)
-                                goto error_out;
-                        idiag.ptr_private = phba->sli4_hba.nvmels_wq;
-                        goto pass_check;
-                }
                 /* FCP work queue */
                 if (phba->sli4_hba.fcp_wq) {
                         for (qidx = 0; qidx < phba->cfg_fcp_io_channel;
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
index c05f56c3023f..7b7d314af0e0 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.h
+++ b/drivers/scsi/lpfc/lpfc_debugfs.h
@@ -44,14 +44,6 @@
 /* hbqinfo output buffer size */
 #define LPFC_HBQINFO_SIZE 8192
 
-enum {
-        DUMP_FCP,
-        DUMP_NVME,
-        DUMP_MBX,
-        DUMP_ELS,
-        DUMP_NVMELS,
-};
-
 /* nvmestat output buffer size */
 #define LPFC_NVMESTAT_SIZE 8192
 #define LPFC_NVMEKTIME_SIZE 8192
@@ -283,8 +275,22 @@ struct lpfc_idiag {
         struct lpfc_idiag_offset offset;
         void *ptr_private;
 };
+
+#else
+
+#define lpfc_nvmeio_data(phba, fmt, arg...) \
+        no_printk(fmt, ##arg)
+
 #endif
 
+enum {
+        DUMP_FCP,
+        DUMP_NVME,
+        DUMP_MBX,
+        DUMP_ELS,
+        DUMP_NVMELS,
+};
+
 /* Mask for discovery_trace */
 #define LPFC_DISC_TRC_ELS_CMD           0x1     /* Trace ELS commands */
 #define LPFC_DISC_TRC_ELS_RSP           0x2     /* Trace ELS response */
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 2d26440e6f2f..a5ca37e45fb6 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -5177,15 +5177,15 @@ lpfc_rdp_res_speed(struct fc_rdp_port_speed_desc *desc, struct lpfc_hba *phba)
 
 static uint32_t
 lpfc_rdp_res_diag_port_names(struct fc_rdp_port_name_desc *desc,
-                struct lpfc_hba *phba)
+                struct lpfc_vport *vport)
 {
 
         desc->tag = cpu_to_be32(RDP_PORT_NAMES_DESC_TAG);
 
-        memcpy(desc->port_names.wwnn, phba->wwnn,
+        memcpy(desc->port_names.wwnn, &vport->fc_nodename,
                         sizeof(desc->port_names.wwnn));
 
-        memcpy(desc->port_names.wwpn, phba->wwpn,
+        memcpy(desc->port_names.wwpn, &vport->fc_portname,
                         sizeof(desc->port_names.wwpn));
 
         desc->length = cpu_to_be32(sizeof(desc->port_names));
@@ -5279,7 +5279,7 @@ lpfc_els_rdp_cmpl(struct lpfc_hba *phba, struct lpfc_rdp_context *rdp_context,
         len += lpfc_rdp_res_link_error((struct fc_rdp_link_error_status_desc *)
                                        (len + pcmd), &rdp_context->link_stat);
         len += lpfc_rdp_res_diag_port_names((struct fc_rdp_port_name_desc *)
-                                             (len + pcmd), phba);
+                                             (len + pcmd), vport);
         len += lpfc_rdp_res_attach_port_names((struct fc_rdp_port_name_desc *)
                                         (len + pcmd), vport, ndlp);
         len += lpfc_rdp_res_fec_desc((struct fc_fec_rdp_desc *)(len + pcmd),
@@ -7968,7 +7968,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                         did, vport->port_state, ndlp->nlp_flag);
 
                 phba->fc_stat.elsRcvPRLI++;
-                if (vport->port_state < LPFC_DISC_AUTH) {
+                if ((vport->port_state < LPFC_DISC_AUTH) &&
+                    (vport->fc_flag & FC_FABRIC)) {
                         rjt_err = LSRJT_UNABLE_TPC;
                         rjt_exp = LSEXP_NOTHING_MORE;
                         break;
@@ -8371,11 +8372,17 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                         spin_lock_irq(shost->host_lock);
                         vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
                         spin_unlock_irq(shost->host_lock);
-                        if (vport->port_type == LPFC_PHYSICAL_PORT
-                                && !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG))
-                                lpfc_issue_init_vfi(vport);
-                        else
+                        if (mb->mbxStatus == MBX_NOT_FINISHED)
+                                break;
+                        if ((vport->port_type == LPFC_PHYSICAL_PORT) &&
+                            !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) {
+                                if (phba->sli_rev == LPFC_SLI_REV4)
+                                        lpfc_issue_init_vfi(vport);
+                                else
+                                        lpfc_initial_flogi(vport);
+                        } else {
                                 lpfc_initial_fdisc(vport);
+                        }
                         break;
                 }
         } else {
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 194a14d5f8a9..180b072beef6 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -313,8 +313,7 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
                                  ndlp->nlp_state, ndlp->nlp_rpi);
         }
 
-        if (!(vport->load_flag & FC_UNLOADING) &&
-            !(ndlp->nlp_flag & NLP_DELAY_TMO) &&
+        if (!(ndlp->nlp_flag & NLP_DELAY_TMO) &&
             !(ndlp->nlp_flag & NLP_NPR_2B_DISC) &&
             (ndlp->nlp_state != NLP_STE_UNMAPPED_NODE) &&
             (ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE) &&
@@ -641,6 +640,8 @@ lpfc_work_done(struct lpfc_hba *phba)
                         lpfc_handle_rrq_active(phba);
                 if (phba->hba_flag & FCP_XRI_ABORT_EVENT)
                         lpfc_sli4_fcp_xri_abort_event_proc(phba);
+                if (phba->hba_flag & NVME_XRI_ABORT_EVENT)
+                        lpfc_sli4_nvme_xri_abort_event_proc(phba);
                 if (phba->hba_flag & ELS_XRI_ABORT_EVENT)
                         lpfc_sli4_els_xri_abort_event_proc(phba);
                 if (phba->hba_flag & ASYNC_EVENT)
@@ -2173,7 +2174,7 @@ lpfc_mbx_cmpl_fcf_scan_read_fcf_rec(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
         uint32_t boot_flag, addr_mode;
         uint16_t fcf_index, next_fcf_index;
         struct lpfc_fcf_rec *fcf_rec = NULL;
-        uint16_t vlan_id;
+        uint16_t vlan_id = LPFC_FCOE_NULL_VID;
         bool select_new_fcf;
         int rc;
 
@@ -4020,9 +4021,11 @@ lpfc_register_remote_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                 rdata = rport->dd_data;
                 /* break the link before dropping the ref */
                 ndlp->rport = NULL;
-                if (rdata && rdata->pnode == ndlp)
-                        lpfc_nlp_put(ndlp);
-                rdata->pnode = NULL;
+                if (rdata) {
+                        if (rdata->pnode == ndlp)
+                                lpfc_nlp_put(ndlp);
+                        rdata->pnode = NULL;
+                }
                 /* drop reference for earlier registeration */
                 put_device(&rport->dev);
         }
@@ -4344,9 +4347,8 @@ lpfc_initialize_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 {
         INIT_LIST_HEAD(&ndlp->els_retry_evt.evt_listp);
         INIT_LIST_HEAD(&ndlp->dev_loss_evt.evt_listp);
-        init_timer(&ndlp->nlp_delayfunc);
-        ndlp->nlp_delayfunc.function = lpfc_els_retry_delay;
-        ndlp->nlp_delayfunc.data = (unsigned long)ndlp;
+        setup_timer(&ndlp->nlp_delayfunc, lpfc_els_retry_delay,
+                        (unsigned long)ndlp);
         ndlp->nlp_DID = did;
         ndlp->vport = vport;
         ndlp->phba = vport->phba;
@@ -4606,9 +4608,9 @@ lpfc_sli4_dequeue_nport_iocbs(struct lpfc_hba *phba,
                 pring = qp->pring;
                 if (!pring)
                         continue;
-                spin_lock_irq(&pring->ring_lock);
+                spin_lock(&pring->ring_lock);
                 __lpfc_dequeue_nport_iocbs(phba, ndlp, pring, dequeue_list);
-                spin_unlock_irq(&pring->ring_lock);
+                spin_unlock(&pring->ring_lock);
         }
         spin_unlock_irq(&phba->hbalock);
 }
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index cfdb068a3bfc..15277705cb6b 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -1001,7 +1001,7 @@ struct eq_delay_info {
         uint32_t phase;
         uint32_t delay_multi;
 };
-#define LPFC_MAX_EQ_DELAY       8
+#define LPFC_MAX_EQ_DELAY_EQID_CNT      8
 
 struct sgl_page_pairs {
         uint32_t sgl_pg0_addr_lo;
@@ -1070,7 +1070,7 @@ struct lpfc_mbx_modify_eq_delay {
         union {
                 struct {
                         uint32_t num_eq;
-                        struct eq_delay_info eq[LPFC_MAX_EQ_DELAY];
+                        struct eq_delay_info eq[LPFC_MAX_EQ_DELAY_EQID_CNT];
                 } request;
                 struct {
                         uint32_t word0;
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 0ee429d773f3..6cc561b04211 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -3555,6 +3555,44 @@ out_free_mem:
         return rc;
 }
 
+static uint64_t
+lpfc_get_wwpn(struct lpfc_hba *phba)
+{
+        uint64_t wwn;
+        int rc;
+        LPFC_MBOXQ_t *mboxq;
+        MAILBOX_t *mb;
+
+
+        mboxq = (LPFC_MBOXQ_t *) mempool_alloc(phba->mbox_mem_pool,
+                                                GFP_KERNEL);
+        if (!mboxq)
+                return (uint64_t)-1;
+
+        /* First get WWN of HBA instance */
+        lpfc_read_nv(phba, mboxq);
+        rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
+        if (rc != MBX_SUCCESS) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                "6019 Mailbox failed , mbxCmd x%x "
+                                "READ_NV, mbxStatus x%x\n",
+                                bf_get(lpfc_mqe_command, &mboxq->u.mqe),
+                                bf_get(lpfc_mqe_status, &mboxq->u.mqe));
+                mempool_free(mboxq, phba->mbox_mem_pool);
+                return (uint64_t) -1;
+        }
+        mb = &mboxq->u.mb;
+        memcpy(&wwn, (char *)mb->un.varRDnvp.portname, sizeof(uint64_t));
+        /* wwn is WWPN of HBA instance */
+        mempool_free(mboxq, phba->mbox_mem_pool);
+        if (phba->sli_rev == LPFC_SLI_REV4)
+                return be64_to_cpu(wwn);
+        else
+                return (((wwn & 0xffffffff00000000) >> 32) |
+                        ((wwn & 0x00000000ffffffff) << 32));
+
+}
+
 /**
  * lpfc_sli4_nvme_sgl_update - update xri-sgl sizing and mapping
  * @phba: pointer to lpfc hba data structure.
@@ -3676,17 +3714,32 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev)
         struct lpfc_vport *vport;
         struct Scsi_Host  *shost = NULL;
         int error = 0;
+        int i;
+        uint64_t wwn;
+        bool use_no_reset_hba = false;
+
+        wwn = lpfc_get_wwpn(phba);
+
+        for (i = 0; i < lpfc_no_hba_reset_cnt; i++) {
+                if (wwn == lpfc_no_hba_reset[i]) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+                                        "6020 Setting use_no_reset port=%llx\n",
+                                        wwn);
+                        use_no_reset_hba = true;
+                        break;
+                }
+        }
 
         if (phba->cfg_enable_fc4_type & LPFC_ENABLE_FCP) {
                 if (dev != &phba->pcidev->dev) {
                         shost = scsi_host_alloc(&lpfc_vport_template,
                                                 sizeof(struct lpfc_vport));
                 } else {
-                        if (phba->sli_rev == LPFC_SLI_REV4)
+                        if (!use_no_reset_hba)
                                 shost = scsi_host_alloc(&lpfc_template,
                                                 sizeof(struct lpfc_vport));
                         else
-                                shost = scsi_host_alloc(&lpfc_template_s3,
+                                shost = scsi_host_alloc(&lpfc_template_no_hr,
                                                 sizeof(struct lpfc_vport));
                 }
         } else if (phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME) {
@@ -3734,17 +3787,14 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev)
         INIT_LIST_HEAD(&vport->rcv_buffer_list);
         spin_lock_init(&vport->work_port_lock);
 
-        init_timer(&vport->fc_disctmo);
-        vport->fc_disctmo.function = lpfc_disc_timeout;
-        vport->fc_disctmo.data = (unsigned long)vport;
+        setup_timer(&vport->fc_disctmo, lpfc_disc_timeout,
+                        (unsigned long)vport);
 
-        init_timer(&vport->els_tmofunc);
-        vport->els_tmofunc.function = lpfc_els_timeout;
-        vport->els_tmofunc.data = (unsigned long)vport;
+        setup_timer(&vport->els_tmofunc, lpfc_els_timeout,
+                        (unsigned long)vport);
 
-        init_timer(&vport->delayed_disc_tmo);
-        vport->delayed_disc_tmo.function = lpfc_delayed_disc_tmo;
-        vport->delayed_disc_tmo.data = (unsigned long)vport;
+        setup_timer(&vport->delayed_disc_tmo, lpfc_delayed_disc_tmo,
+                        (unsigned long)vport);
 
         error = scsi_add_host_with_dma(shost, dev, &phba->pcidev->dev);
         if (error)
@@ -5406,21 +5456,15 @@ lpfc_setup_driver_resource_phase1(struct lpfc_hba *phba)
         INIT_LIST_HEAD(&phba->luns);
 
         /* MBOX heartbeat timer */
-        init_timer(&psli->mbox_tmo);
-        psli->mbox_tmo.function = lpfc_mbox_timeout;
-        psli->mbox_tmo.data = (unsigned long) phba;
+        setup_timer(&psli->mbox_tmo, lpfc_mbox_timeout, (unsigned long)phba);
         /* Fabric block timer */
-        init_timer(&phba->fabric_block_timer);
-        phba->fabric_block_timer.function = lpfc_fabric_block_timeout;
-        phba->fabric_block_timer.data = (unsigned long) phba;
+        setup_timer(&phba->fabric_block_timer, lpfc_fabric_block_timeout,
+                        (unsigned long)phba);
         /* EA polling mode timer */
-        init_timer(&phba->eratt_poll);
-        phba->eratt_poll.function = lpfc_poll_eratt;
-        phba->eratt_poll.data = (unsigned long) phba;
+        setup_timer(&phba->eratt_poll, lpfc_poll_eratt,
+                        (unsigned long)phba);
         /* Heartbeat timer */
-        init_timer(&phba->hb_tmofunc);
-        phba->hb_tmofunc.function = lpfc_hb_timeout;
-        phba->hb_tmofunc.data = (unsigned long)phba;
+        setup_timer(&phba->hb_tmofunc, lpfc_hb_timeout, (unsigned long)phba);
 
         return 0;
 }
@@ -5446,9 +5490,8 @@ lpfc_sli_driver_resource_setup(struct lpfc_hba *phba)
          */
 
         /* FCP polling mode timer */
-        init_timer(&phba->fcp_poll_timer);
-        phba->fcp_poll_timer.function = lpfc_poll_timeout;
-        phba->fcp_poll_timer.data = (unsigned long) phba;
+        setup_timer(&phba->fcp_poll_timer, lpfc_poll_timeout,
+                        (unsigned long)phba);
 
         /* Host attention work mask setup */
         phba->work_ha_mask = (HA_ERATT | HA_MBATT | HA_LATT);
@@ -5482,7 +5525,8 @@ lpfc_sli_driver_resource_setup(struct lpfc_hba *phba)
 
         /* Initialize the host templates the configured values. */
         lpfc_vport_template.sg_tablesize = phba->cfg_sg_seg_cnt;
-        lpfc_template_s3.sg_tablesize = phba->cfg_sg_seg_cnt;
+        lpfc_template_no_hr.sg_tablesize = phba->cfg_sg_seg_cnt;
+        lpfc_template.sg_tablesize = phba->cfg_sg_seg_cnt;
 
         /* There are going to be 2 reserved BDEs: 1 FCP cmnd + 1 FCP rsp */
         if (phba->cfg_enable_bg) {
@@ -5617,14 +5661,11 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
          * Initialize timers used by driver
          */
 
-        init_timer(&phba->rrq_tmr);
-        phba->rrq_tmr.function = lpfc_rrq_timeout;
-        phba->rrq_tmr.data = (unsigned long)phba;
+        setup_timer(&phba->rrq_tmr, lpfc_rrq_timeout, (unsigned long)phba);
 
         /* FCF rediscover timer */
-        init_timer(&phba->fcf.redisc_wait);
-        phba->fcf.redisc_wait.function = lpfc_sli4_fcf_redisc_wait_tmo;
-        phba->fcf.redisc_wait.data = (unsigned long)phba;
+        setup_timer(&phba->fcf.redisc_wait, lpfc_sli4_fcf_redisc_wait_tmo,
+                        (unsigned long)phba);
 
         /*
          * Control structure for handling external multi-buffer mailbox
@@ -5706,6 +5747,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
         /* Initialize the host templates with the updated values. */
         lpfc_vport_template.sg_tablesize = phba->cfg_sg_seg_cnt;
         lpfc_template.sg_tablesize = phba->cfg_sg_seg_cnt;
+        lpfc_template_no_hr.sg_tablesize = phba->cfg_sg_seg_cnt;
 
         if (phba->cfg_sg_dma_buf_size  <= LPFC_MIN_SG_SLI4_BUF_SZ)
                 phba->cfg_sg_dma_buf_size = LPFC_MIN_SG_SLI4_BUF_SZ;
@@ -5736,6 +5778,8 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 /* Initialize the Abort nvme buffer list used by driver */
                 spin_lock_init(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvme_buf_list);
+                /* Fast-path XRI aborted CQ Event work queue list */
+                INIT_LIST_HEAD(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
         }
 
         /* This abort list used by worker thread */
@@ -5847,10 +5891,17 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 /* Check to see if it matches any module parameter */
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
                                 phba->nvmet_support = 1; /* a match */
+#else
+                                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                                "6021 Can't enable NVME Target."
+                                                " NVME_TARGET_FC infrastructure"
+                                                " is not in kernel\n");
+#endif
                         }
                 }
         }
@@ -8712,12 +8763,9 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
                 }
         }
 
-        /*
-         * Configure EQ delay multipier for interrupt coalescing using
-         * MODIFY_EQ_DELAY for all EQs created, LPFC_MAX_EQ_DELAY at a time.
-         */
-        for (qidx = 0; qidx < io_channel; qidx += LPFC_MAX_EQ_DELAY)
+        for (qidx = 0; qidx < io_channel; qidx += LPFC_MAX_EQ_DELAY_EQID_CNT)
                 lpfc_modify_hba_eq_delay(phba, qidx);
+
         return 0;
 
 out_destroy:
@@ -8973,6 +9021,11 @@ lpfc_sli4_cq_event_release_all(struct lpfc_hba *phba)
         /* Pending ELS XRI abort events */
         list_splice_init(&phba->sli4_hba.sp_els_xri_aborted_work_queue,
                          &cqelist);
+        if (phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME) {
+                /* Pending NVME XRI abort events */
+                list_splice_init(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue,
+                                 &cqelist);
+        }
         /* Pending asynnc events */
         list_splice_init(&phba->sli4_hba.sp_asynce_work_queue,
                          &cqelist);
@@ -10400,12 +10453,7 @@ lpfc_pci_remove_one_s3(struct pci_dev *pdev)
         fc_remove_host(shost);
         scsi_remove_host(shost);
 
-        /* Perform ndlp cleanup on the physical port.  The nvme and nvmet
-         * localports are destroyed after to cleanup all transport memory.
-         */
         lpfc_cleanup(vport);
-        lpfc_nvmet_destroy_targetport(phba);
-        lpfc_nvme_destroy_localport(vport);
 
         /*
          * Bring down the SLI Layer. This step disable all interrupts,
@@ -12018,6 +12066,7 @@ static struct pci_driver lpfc_driver = {
         .id_table       = lpfc_id_table,
         .probe          = lpfc_pci_probe_one,
         .remove         = lpfc_pci_remove_one,
+        .shutdown       = lpfc_pci_remove_one,
         .suspend        = lpfc_pci_suspend_one,
         .resume         = lpfc_pci_resume_one,
         .err_handler    = &lpfc_err_handler,
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index c61d8d692ede..5986c7957199 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -646,7 +646,6 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
         }
 
         dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
-        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
         if (!dma_buf->iocbq) {
                 kfree(dma_buf->context);
                 pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
@@ -658,6 +657,7 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
                                 "2621 Ran out of nvmet iocb/WQEs\n");
                 return NULL;
         }
+        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
         nvmewqe = dma_buf->iocbq;
         wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
         /* Initialize WQE */
diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
index 609a908ea9db..0024de1c6c1f 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.c
+++ b/drivers/scsi/lpfc/lpfc_nvme.c
@@ -316,7 +316,7 @@ lpfc_nvme_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp,
         bf_set(wqe_dfctl, &wqe->gen_req.wge_ctl, 0);
         bf_set(wqe_si, &wqe->gen_req.wge_ctl, 1);
         bf_set(wqe_la, &wqe->gen_req.wge_ctl, 1);
-        bf_set(wqe_rctl, &wqe->gen_req.wge_ctl, FC_RCTL_DD_UNSOL_CTL);
+        bf_set(wqe_rctl, &wqe->gen_req.wge_ctl, FC_RCTL_ELS4_REQ);
         bf_set(wqe_type, &wqe->gen_req.wge_ctl, FC_TYPE_NVME);
 
         /* Word 6 */
@@ -620,15 +620,15 @@ lpfc_nvme_adj_fcp_sgls(struct lpfc_vport *vport,
          * Embed the payload in the last half of the WQE
          * WQE words 16-30 get the NVME CMD IU payload
          *
-         * WQE Word 16 is already setup with flags
-         * WQE words 17-19 get payload Words 2-4
+         * WQE words 16-19 get payload Words 1-4
          * WQE words 20-21 get payload Words 6-7
          * WQE words 22-29 get payload Words 16-23
          */
-        wptr = &wqe->words[17];  /* WQE ptr */
+        wptr = &wqe->words[16];  /* WQE ptr */
         dptr = (uint32_t *)nCmd->cmdaddr;  /* payload ptr */
-        dptr += 2;              /* Skip Words 0-1 in payload */
+        dptr++;                 /* Skip Word 0 in payload */
 
+        *wptr++ = *dptr++;      /* Word 1 */
         *wptr++ = *dptr++;      /* Word 2 */
         *wptr++ = *dptr++;      /* Word 3 */
         *wptr++ = *dptr++;      /* Word 4 */
@@ -978,9 +978,6 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
                         bf_set(wqe_cmd_type, &wqe->generic.wqe_com,
                                NVME_WRITE_CMD);
 
-                        /* Word 16 */
-                        wqe->words[16] = LPFC_NVME_EMBED_WRITE;
-
                         phba->fc4NvmeOutputRequests++;
                 } else {
                         /* Word 7 */
@@ -1002,9 +999,6 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
                         bf_set(wqe_cmd_type, &wqe->generic.wqe_com,
                                NVME_READ_CMD);
 
-                        /* Word 16 */
-                        wqe->words[16] = LPFC_NVME_EMBED_READ;
-
                         phba->fc4NvmeInputRequests++;
                 }
         } else {
@@ -1026,9 +1020,6 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport,
                 /* Word 11 */
                 bf_set(wqe_cmd_type, &wqe->generic.wqe_com, NVME_READ_CMD);
 
-                /* Word 16 */
-                wqe->words[16] = LPFC_NVME_EMBED_CMD;
-
                 phba->fc4NvmeControlRequests++;
         }
         /*
@@ -1286,6 +1277,7 @@ lpfc_nvme_fcp_io_submit(struct nvme_fc_local_port *pnvme_lport,
         pnvme_fcreq->private = (void *)lpfc_ncmd;
         lpfc_ncmd->nvmeCmd = pnvme_fcreq;
         lpfc_ncmd->nrport = rport;
+        lpfc_ncmd->ndlp = ndlp;
         lpfc_ncmd->start_time = jiffies;
 
         lpfc_nvme_prep_io_cmd(vport, lpfc_ncmd, ndlp);
@@ -1319,7 +1311,7 @@ lpfc_nvme_fcp_io_submit(struct nvme_fc_local_port *pnvme_lport,
                                  "sid: x%x did: x%x oxid: x%x\n",
                                  ret, vport->fc_myDID, ndlp->nlp_DID,
                                  lpfc_ncmd->cur_iocbq.sli4_xritag);
-                ret = -EINVAL;
+                ret = -EBUSY;
                 goto out_free_nvme_buf;
         }
 
@@ -1821,10 +1813,10 @@ lpfc_post_nvme_sgl_list(struct lpfc_hba *phba,
                                                 pdma_phys_sgl1, cur_xritag);
                                 if (status) {
                                         /* failure, put on abort nvme list */
-                                        lpfc_ncmd->exch_busy = 1;
+                                        lpfc_ncmd->flags |= LPFC_SBUF_XBUSY;
                                 } else {
                                         /* success, put on NVME buffer list */
-                                        lpfc_ncmd->exch_busy = 0;
+                                        lpfc_ncmd->flags &= ~LPFC_SBUF_XBUSY;
                                         lpfc_ncmd->status = IOSTAT_SUCCESS;
                                         num_posted++;
                                 }
@@ -1854,10 +1846,10 @@ lpfc_post_nvme_sgl_list(struct lpfc_hba *phba,
                                          struct lpfc_nvme_buf, list);
                         if (status) {
                                 /* failure, put on abort nvme list */
-                                lpfc_ncmd->exch_busy = 1;
+                                lpfc_ncmd->flags |= LPFC_SBUF_XBUSY;
                         } else {
                                 /* success, put on NVME buffer list */
-                                lpfc_ncmd->exch_busy = 0;
+                                lpfc_ncmd->flags &= ~LPFC_SBUF_XBUSY;
                                 lpfc_ncmd->status = IOSTAT_SUCCESS;
                                 num_posted++;
                         }
@@ -2099,7 +2091,7 @@ lpfc_release_nvme_buf(struct lpfc_hba *phba, struct lpfc_nvme_buf *lpfc_ncmd)
         unsigned long iflag = 0;
 
         lpfc_ncmd->nonsg_phys = 0;
-        if (lpfc_ncmd->exch_busy) {
+        if (lpfc_ncmd->flags & LPFC_SBUF_XBUSY) {
                 spin_lock_irqsave(&phba->sli4_hba.abts_nvme_buf_list_lock,
                                         iflag);
                 lpfc_ncmd->nvmeCmd = NULL;
@@ -2135,11 +2127,12 @@ lpfc_release_nvme_buf(struct lpfc_hba *phba, struct lpfc_nvme_buf *lpfc_ncmd)
 int
 lpfc_nvme_create_localport(struct lpfc_vport *vport)
 {
+        int ret = 0;
         struct lpfc_hba  *phba = vport->phba;
         struct nvme_fc_port_info nfcp_info;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
-        int len, ret = 0;
+        int len;
 
         /* Initialize this localport instance.  The vport wwn usage ensures
          * that NPIV is accounted for.
@@ -2156,8 +2149,12 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
         /* localport is allocated from the stack, but the registration
          * call allocates heap memory as well as the private area.
          */
+#if (IS_ENABLED(CONFIG_NVME_FC))
         ret = nvme_fc_register_localport(&nfcp_info, &lpfc_nvme_template,
                                          &vport->phba->pcidev->dev, &localport);
+#else
+        ret = -ENOMEM;
+#endif
         if (!ret) {
                 lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME | LOG_NVME_DISC,
                                  "6005 Successfully registered local "
@@ -2173,10 +2170,10 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
                 lport->vport = vport;
                 INIT_LIST_HEAD(&lport->rport_list);
                 vport->nvmei_support = 1;
+                len  = lpfc_new_nvme_buf(vport, phba->sli4_hba.nvme_xri_max);
+                vport->phba->total_nvme_bufs += len;
         }
 
-        len  = lpfc_new_nvme_buf(vport, phba->sli4_hba.nvme_xri_max);
-        vport->phba->total_nvme_bufs += len;
         return ret;
 }
 
@@ -2193,6 +2190,7 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
 void
 lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
 {
+#if (IS_ENABLED(CONFIG_NVME_FC))
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
         struct lpfc_nvme_rport *rport = NULL, *rport_next = NULL;
@@ -2208,7 +2206,6 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
         lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME,
                          "6011 Destroying NVME localport %p\n",
                          localport);
-
         list_for_each_entry_safe(rport, rport_next, &lport->rport_list, list) {
                 /* The last node ref has to get released now before the rport
                  * private memory area is released by the transport.
@@ -2222,6 +2219,7 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
                                          "6008 rport fail destroy %x\n", ret);
                 wait_for_completion_timeout(&rport->rport_unreg_done, 5);
         }
+
         /* lport's rport list is clear.  Unregister
          * lport and release resources.
          */
@@ -2245,6 +2243,7 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
                                  "Failed, status x%x\n",
                                  ret);
         }
+#endif
 }
 
 void
@@ -2275,6 +2274,7 @@ lpfc_nvme_update_localport(struct lpfc_vport *vport)
 int
 lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
+#if (IS_ENABLED(CONFIG_NVME_FC))
         int ret = 0;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
@@ -2348,7 +2348,6 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                         rpinfo.port_role |= FC_PORT_ROLE_NVME_INITIATOR;
                 rpinfo.port_name = wwn_to_u64(ndlp->nlp_portname.u.wwn);
                 rpinfo.node_name = wwn_to_u64(ndlp->nlp_nodename.u.wwn);
-
                 ret = nvme_fc_register_remoteport(localport, &rpinfo,
                                                   &remote_port);
                 if (!ret) {
@@ -2384,6 +2383,9 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
                                  ndlp->nlp_type, ndlp->nlp_DID, ndlp);
         }
         return ret;
+#else
+        return 0;
+#endif
 }
 
 /* lpfc_nvme_unregister_port - unbind the DID and port_role from this rport.
@@ -2401,6 +2403,7 @@ lpfc_nvme_register_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 void
 lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
 {
+#if (IS_ENABLED(CONFIG_NVME_FC))
         int ret;
         struct nvme_fc_local_port *localport;
         struct lpfc_nvme_lport *lport;
@@ -2458,7 +2461,61 @@ lpfc_nvme_unregister_port(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
         return;
 
  input_err:
+#endif
         lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_DISC,
                          "6168: State error: lport %p, rport%p FCID x%06x\n",
                          vport->localport, ndlp->rport, ndlp->nlp_DID);
 }
+
+/**
+ * lpfc_sli4_nvme_xri_aborted - Fast-path process of NVME xri abort
+ * @phba: pointer to lpfc hba data structure.
+ * @axri: pointer to the fcp xri abort wcqe structure.
+ *
+ * This routine is invoked by the worker thread to process a SLI4 fast-path
+ * FCP aborted xri.
+ **/
+void
+lpfc_sli4_nvme_xri_aborted(struct lpfc_hba *phba,
+                           struct sli4_wcqe_xri_aborted *axri)
+{
+        uint16_t xri = bf_get(lpfc_wcqe_xa_xri, axri);
+        uint16_t rxid = bf_get(lpfc_wcqe_xa_remote_xid, axri);
+        struct lpfc_nvme_buf *lpfc_ncmd, *next_lpfc_ncmd;
+        struct lpfc_nodelist *ndlp;
+        unsigned long iflag = 0;
+        int rrq_empty = 0;
+
+        if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME))
+                return;
+        spin_lock_irqsave(&phba->hbalock, iflag);
+        spin_lock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+        list_for_each_entry_safe(lpfc_ncmd, next_lpfc_ncmd,
+                                 &phba->sli4_hba.lpfc_abts_nvme_buf_list,
+                                 list) {
+                if (lpfc_ncmd->cur_iocbq.sli4_xritag == xri) {
+                        list_del(&lpfc_ncmd->list);
+                        lpfc_ncmd->flags &= ~LPFC_SBUF_XBUSY;
+                        lpfc_ncmd->status = IOSTAT_SUCCESS;
+                        spin_unlock(
+                                &phba->sli4_hba.abts_nvme_buf_list_lock);
+
+                        rrq_empty = list_empty(&phba->active_rrq_list);
+                        spin_unlock_irqrestore(&phba->hbalock, iflag);
+                        ndlp = lpfc_ncmd->ndlp;
+                        if (ndlp) {
+                                lpfc_set_rrq_active(
+                                        phba, ndlp,
+                                        lpfc_ncmd->cur_iocbq.sli4_lxritag,
+                                        rxid, 1);
+                                lpfc_sli4_abts_err_handler(phba, ndlp, axri);
+                        }
+                        lpfc_release_nvme_buf(phba, lpfc_ncmd);
+                        if (rrq_empty)
+                                lpfc_worker_wake_up(phba);
+                        return;
+                }
+        }
+        spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
+        spin_unlock_irqrestore(&phba->hbalock, iflag);
+}
diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
index b2fae5e813f8..1347deb8dd6c 100644
--- a/drivers/scsi/lpfc/lpfc_nvme.h
+++ b/drivers/scsi/lpfc/lpfc_nvme.h
@@ -57,6 +57,7 @@ struct lpfc_nvme_buf {
         struct list_head list;
         struct nvmefc_fcp_req *nvmeCmd;
         struct lpfc_nvme_rport *nrport;
+        struct lpfc_nodelist *ndlp;
 
         uint32_t timeout;
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index c421e1738ee9..acba1b67e505 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -520,7 +520,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         struct lpfc_hba *phba = ctxp->phba;
         struct lpfc_iocbq *nvmewqeq;
         unsigned long iflags;
-        int rc, id;
+        int rc;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         if (phba->ktime_on) {
@@ -530,7 +530,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                         ctxp->ts_nvme_data = ktime_get_ns();
         }
         if (phba->cpucheck_on & LPFC_CHECK_NVMET_IO) {
-                id = smp_processor_id();
+                int id = smp_processor_id();
                 ctxp->cpu = id;
                 if (id < LPFC_CHECK_CPU_CNT)
                         phba->cpucheck_xmt_io[id]++;
@@ -571,6 +571,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                 "6102 Bad state IO x%x aborted\n",
                                 ctxp->oxid);
+                rc = -ENXIO;
                 goto aerr;
         }
 
@@ -580,6 +581,7 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                 "6152 FCP Drop IO x%x: Prep\n",
                                 ctxp->oxid);
+                rc = -ENXIO;
                 goto aerr;
         }
 
@@ -618,8 +620,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         ctxp->wqeq->hba_wqidx = 0;
         nvmewqeq->context2 = NULL;
         nvmewqeq->context3 = NULL;
+        rc = -EBUSY;
 aerr:
-        return -ENXIO;
+        return rc;
 }
 
 static void
@@ -668,9 +671,13 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
         lpfc_tgttemplate.target_features = NVMET_FCTGTFEAT_READDATA_RSP |
                                            NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED;
 
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         error = nvmet_fc_register_targetport(&pinfo, &lpfc_tgttemplate,
                                              &phba->pcidev->dev,
                                              &phba->targetport);
+#else
+        error = -ENOMEM;
+#endif
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
                                 "6025 Cannot register NVME targetport "
@@ -731,9 +738,25 @@ lpfc_nvmet_update_targetport(struct lpfc_hba *phba)
         return 0;
 }
 
+/**
+ * lpfc_sli4_nvmet_xri_aborted - Fast-path process of nvmet xri abort
+ * @phba: pointer to lpfc hba data structure.
+ * @axri: pointer to the nvmet xri abort wcqe structure.
+ *
+ * This routine is invoked by the worker thread to process a SLI4 fast-path
+ * NVMET aborted xri.
+ **/
+void
+lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
+                            struct sli4_wcqe_xri_aborted *axri)
+{
+        /* TODO: work in progress */
+}
+
 void
 lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
 {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_tgtport *tgtp;
 
         if (phba->nvmet_support == 0)
@@ -745,6 +768,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                 wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
         }
         phba->targetport = NULL;
+#endif
 }
 
 /**
@@ -764,6 +788,7 @@ static void
 lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                            struct hbq_dmabuf *nvmebuf)
 {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
         struct lpfc_nvmet_rcv_ctx *ctxp;
@@ -844,6 +869,7 @@ dropit:
 
         atomic_inc(&tgtp->xmt_ls_abort);
         lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp, sid, oxid);
+#endif
 }
 
 /**
@@ -865,6 +891,7 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                             struct rqb_dmabuf *nvmebuf,
                             uint64_t isr_timestamp)
 {
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
@@ -955,7 +982,7 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
 
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                        "6159 FCP Drop IO x%x: nvmet_fc_rcv_fcp_req x%x\n",
+                        "6159 FCP Drop IO x%x: err x%x\n",
                         ctxp->oxid, rc);
 dropit:
         lpfc_nvmeio_data(phba, "NVMET FCP DROP: xri x%x sz %d from %06x\n",
@@ -970,6 +997,7 @@ dropit:
                 /* We assume a rcv'ed cmd ALWAYs fits into 1 buffer */
                 lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
         }
+#endif
 }
 
 /**
@@ -1114,7 +1142,7 @@ lpfc_nvmet_prep_ls_wqe(struct lpfc_hba *phba,
         bf_set(wqe_dfctl, &wqe->xmit_sequence.wge_ctl, 0);
         bf_set(wqe_ls, &wqe->xmit_sequence.wge_ctl, 1);
         bf_set(wqe_la, &wqe->xmit_sequence.wge_ctl, 0);
-        bf_set(wqe_rctl, &wqe->xmit_sequence.wge_ctl, FC_RCTL_DD_SOL_CTL);
+        bf_set(wqe_rctl, &wqe->xmit_sequence.wge_ctl, FC_RCTL_ELS4_REP);
         bf_set(wqe_type, &wqe->xmit_sequence.wge_ctl, FC_TYPE_NVME);
 
         /* Word 6 */
@@ -1445,7 +1473,6 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
 
         case NVMET_FCOP_RSP:
                 /* Words 0 - 2 */
-                sgel = &rsp->sg[0];
                 physaddr = rsp->rspdma;
                 wqe->fcp_trsp.bde.tus.f.bdeFlags = BUFF_TYPE_BDE_64;
                 wqe->fcp_trsp.bde.tus.f.bdeSize = rsp->rsplen;
@@ -1681,8 +1708,8 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
         struct lpfc_nodelist *ndlp;
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
-                        "6067 %s: Entrypoint: sid %x xri %x\n", __func__,
-                        sid, xri);
+                        "6067 Abort: sid %x xri x%x/x%x\n",
+                        sid, xri, ctxp->wqeq->sli4_xritag);
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
 
@@ -1693,7 +1720,7 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
                 atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6134 Drop ABTS - wrong NDLP state x%x.\n",
-                                ndlp->nlp_state);
+                                (ndlp) ? ndlp->nlp_state : NLP_STE_MAX_STATE);
 
                 /* No failure to an ABTS request. */
                 return 0;
@@ -1791,7 +1818,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
                 atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6160 Drop ABTS - wrong NDLP state x%x.\n",
-                                ndlp->nlp_state);
+                                (ndlp) ? ndlp->nlp_state : NLP_STE_MAX_STATE);
 
                 /* No failure to an ABTS request. */
                 return 0;
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 9d6384af9fce..54fd0c81ceaf 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -5953,12 +5953,13 @@ struct scsi_host_template lpfc_template_nvme = {
         .track_queue_depth      = 0,
 };
 
-struct scsi_host_template lpfc_template_s3 = {
+struct scsi_host_template lpfc_template_no_hr = {
         .module                 = THIS_MODULE,
         .name                   = LPFC_DRIVER_NAME,
         .proc_name              = LPFC_DRIVER_NAME,
         .info                   = lpfc_info,
         .queuecommand           = lpfc_queuecommand,
+        .eh_timed_out           = fc_eh_timed_out,
         .eh_abort_handler       = lpfc_abort_handler,
         .eh_device_reset_handler = lpfc_device_reset_handler,
         .eh_target_reset_handler = lpfc_target_reset_handler,
@@ -6015,7 +6016,6 @@ struct scsi_host_template lpfc_vport_template = {
         .eh_abort_handler       = lpfc_abort_handler,
         .eh_device_reset_handler = lpfc_device_reset_handler,
         .eh_target_reset_handler = lpfc_target_reset_handler,
-        .eh_bus_reset_handler   = lpfc_bus_reset_handler,
         .slave_alloc            = lpfc_slave_alloc,
         .slave_configure        = lpfc_slave_configure,
         .slave_destroy          = lpfc_slave_destroy,
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index e43e5e23c24b..1c9fa45df7eb 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -1,3 +1,4 @@
+
 /*******************************************************************
  * This file is part of the Emulex Linux Device Driver for         *
  * Fibre Channel Host Bus Adapters.                                *
@@ -952,7 +953,7 @@ __lpfc_sli_get_els_sglq(struct lpfc_hba *phba, struct lpfc_iocbq *piocbq)
         start_sglq = sglq;
         while (!found) {
                 if (!sglq)
-                        return NULL;
+                        break;
                 if (ndlp && ndlp->active_rrqs_xri_bitmap &&
                     test_bit(sglq->sli4_lxritag,
                     ndlp->active_rrqs_xri_bitmap)) {
@@ -12213,6 +12214,41 @@ void lpfc_sli4_fcp_xri_abort_event_proc(struct lpfc_hba *phba)
 }
 
 /**
+ * lpfc_sli4_nvme_xri_abort_event_proc - Process nvme xri abort event
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This routine is invoked by the worker thread to process all the pending
+ * SLI4 NVME abort XRI events.
+ **/
+void lpfc_sli4_nvme_xri_abort_event_proc(struct lpfc_hba *phba)
+{
+        struct lpfc_cq_event *cq_event;
+
+        /* First, declare the fcp xri abort event has been handled */
+        spin_lock_irq(&phba->hbalock);
+        phba->hba_flag &= ~NVME_XRI_ABORT_EVENT;
+        spin_unlock_irq(&phba->hbalock);
+        /* Now, handle all the fcp xri abort events */
+        while (!list_empty(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue)) {
+                /* Get the first event from the head of the event queue */
+                spin_lock_irq(&phba->hbalock);
+                list_remove_head(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue,
+                                 cq_event, struct lpfc_cq_event, list);
+                spin_unlock_irq(&phba->hbalock);
+                /* Notify aborted XRI for NVME work queue */
+                if (phba->nvmet_support) {
+                        lpfc_sli4_nvmet_xri_aborted(phba,
+                                                    &cq_event->cqe.wcqe_axri);
+                } else {
+                        lpfc_sli4_nvme_xri_aborted(phba,
+                                                   &cq_event->cqe.wcqe_axri);
+                }
+                /* Free the event processed back to the free pool */
+                lpfc_sli4_cq_event_release(phba, cq_event);
+        }
+}
+
+/**
  * lpfc_sli4_els_xri_abort_event_proc - Process els xri abort event
  * @phba: pointer to lpfc hba data structure.
  *
@@ -12709,10 +12745,22 @@ lpfc_sli4_sp_handle_abort_xri_wcqe(struct lpfc_hba *phba,
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 workposted = true;
                 break;
+        case LPFC_NVME:
+                spin_lock_irqsave(&phba->hbalock, iflags);
+                list_add_tail(&cq_event->list,
+                              &phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
+                /* Set the nvme xri abort event flag */
+                phba->hba_flag |= NVME_XRI_ABORT_EVENT;
+                spin_unlock_irqrestore(&phba->hbalock, iflags);
+                workposted = true;
+                break;
         default:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-                                "0603 Invalid work queue CQE subtype (x%x)\n",
-                                cq->subtype);
+                                "0603 Invalid CQ subtype %d: "
+                                "%08x %08x %08x %08x\n",
+                                cq->subtype, wcqe->word0, wcqe->parameter,
+                                wcqe->word2, wcqe->word3);
+                lpfc_sli4_cq_event_release(phba, cq_event);
                 workposted = false;
                 break;
         }
@@ -13827,6 +13875,8 @@ lpfc_dual_chute_pci_bar_map(struct lpfc_hba *phba, uint16_t pci_barset)
  * @startq: The starting FCP EQ to modify
  *
  * This function sends an MODIFY_EQ_DELAY mailbox command to the HBA.
+ * The command allows up to LPFC_MAX_EQ_DELAY_EQID_CNT EQ ID's to be
+ * updated in one mailbox command.
  *
  * The @phba struct is used to send mailbox command to HBA. The @startq
  * is used to get the starting FCP EQ to change.
@@ -13879,7 +13929,7 @@ lpfc_modify_hba_eq_delay(struct lpfc_hba *phba, uint32_t startq)
                 eq_delay->u.request.eq[cnt].phase = 0;
                 eq_delay->u.request.eq[cnt].delay_multi = dmult;
                 cnt++;
-                if (cnt >= LPFC_MAX_EQ_DELAY)
+                if (cnt >= LPFC_MAX_EQ_DELAY_EQID_CNT)
                         break;
         }
         eq_delay->u.request.num_eq = cnt;
@@ -15185,17 +15235,17 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 drq = drqp[idx];
                 cq  = cqp[idx];
 
-                if (hrq->entry_count != drq->entry_count) {
-                        status = -EINVAL;
-                        goto out;
-                }
-
                 /* sanity check on queue memory */
                 if (!hrq || !drq || !cq) {
                         status = -ENODEV;
                         goto out;
                 }
 
+                if (hrq->entry_count != drq->entry_count) {
+                        status = -EINVAL;
+                        goto out;
+                }
+
                 if (idx == 0) {
                         bf_set(lpfc_mbx_rq_create_num_pages,
                                &rq_create->u.request,
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index 91153c9f6d18..710458cf11d6 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -642,6 +642,7 @@ struct lpfc_sli4_hba {
         struct list_head sp_asynce_work_queue;
         struct list_head sp_fcp_xri_aborted_work_queue;
         struct list_head sp_els_xri_aborted_work_queue;
+        struct list_head sp_nvme_xri_aborted_work_queue;
         struct list_head sp_unsol_work_queue;
         struct lpfc_sli4_link link_state;
         struct lpfc_sli4_lnk_info lnk_info;
@@ -794,9 +795,14 @@ void lpfc_sli4_fcf_redisc_event_proc(struct lpfc_hba *);
 int lpfc_sli4_resume_rpi(struct lpfc_nodelist *,
                         void (*)(struct lpfc_hba *, LPFC_MBOXQ_t *), void *);
 void lpfc_sli4_fcp_xri_abort_event_proc(struct lpfc_hba *);
+void lpfc_sli4_nvme_xri_abort_event_proc(struct lpfc_hba *phba);
 void lpfc_sli4_els_xri_abort_event_proc(struct lpfc_hba *);
 void lpfc_sli4_fcp_xri_aborted(struct lpfc_hba *,
                                struct sli4_wcqe_xri_aborted *);
+void lpfc_sli4_nvme_xri_aborted(struct lpfc_hba *phba,
+                                struct sli4_wcqe_xri_aborted *axri);
+void lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
+                                 struct sli4_wcqe_xri_aborted *axri);
 void lpfc_sli4_els_xri_aborted(struct lpfc_hba *,
                                struct sli4_wcqe_xri_aborted *);
 void lpfc_sli4_vport_delete_els_xri_aborted(struct lpfc_vport *);
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 86c6c9b26b82..d4e95e28f4e3 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -20,7 +20,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "11.2.0.7"
+#define LPFC_DRIVER_VERSION "11.2.0.10"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index e7e5974e1a2c..2b209bbb4c91 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -35,8 +35,8 @@
 /*
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION                         "07.701.16.00-rc1"
-#define MEGASAS_RELDATE                         "February 2, 2017"
+#define MEGASAS_VERSION                         "07.701.17.00-rc1"
+#define MEGASAS_RELDATE                         "March 2, 2017"
 
 /*
  * Device IDs
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 7ac9a9ee9bd4..0016f12cc563 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -1963,6 +1963,9 @@ scan_target:
         if (!mr_device_priv_data)
                 return -ENOMEM;
         sdev->hostdata = mr_device_priv_data;
+
+        atomic_set(&mr_device_priv_data->r1_ldio_hint,
+                   instance->r1_ldio_hint_default);
         return 0;
 }
 
@@ -5034,10 +5037,12 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe)
                                          &instance->irq_context[j]);
                         /* Retry irq register for IO_APIC*/
                         instance->msix_vectors = 0;
-                        if (is_probe)
+                        if (is_probe) {
+                                pci_free_irq_vectors(instance->pdev);
                                 return megasas_setup_irqs_ioapic(instance);
-                        else
+                        } else {
                                 return -1;
+                        }
                 }
         }
         return 0;
@@ -5277,9 +5282,11 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         MPI2_REPLY_POST_HOST_INDEX_OFFSET);
         }
 
-        i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
-        if (i < 0)
-                goto fail_setup_irqs;
+        if (!instance->msix_vectors) {
+                i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
+                if (i < 0)
+                        goto fail_setup_irqs;
+        }
 
         dev_info(&instance->pdev->dev,
                 "firmware supports msix\t: (%d)", fw_msix_count);
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 29650ba669da..f990ab4d45e1 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2159,7 +2159,7 @@ megasas_set_raidflag_cpu_affinity(union RAID_CONTEXT_UNION *praid_context,
                                 cpu_sel = MR_RAID_CTX_CPUSEL_1;
 
                         if (is_stream_detected(rctx_g35) &&
-                            (raid->level == 5) &&
+                            ((raid->level == 5) || (raid->level == 6)) &&
                             (raid->writeMode == MR_RL_WRITE_THROUGH_MODE) &&
                             (cpu_sel == MR_RAID_CTX_CPUSEL_FCFS))
                                 cpu_sel = MR_RAID_CTX_CPUSEL_0;
@@ -2338,7 +2338,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
                                 fp_possible = false;
                                 atomic_dec(&instance->fw_outstanding);
                         } else if ((scsi_buff_len > MR_LARGE_IO_MIN_SIZE) ||
-                                   atomic_dec_if_positive(&mrdev_priv->r1_ldio_hint)) {
+                                   (atomic_dec_if_positive(&mrdev_priv->r1_ldio_hint) > 0)) {
                                 fp_possible = false;
                                 atomic_dec(&instance->fw_outstanding);
                                 if (scsi_buff_len > MR_LARGE_IO_MIN_SIZE)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
index 7fe7e6ed595b..8981806fb13f 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -1442,9 +1442,6 @@ void mpt3sas_transport_update_links(struct MPT3SAS_ADAPTER *ioc,
         u64 sas_address, u16 handle, u8 phy_number, u8 link_rate);
 extern struct sas_function_template mpt3sas_transport_functions;
 extern struct scsi_transport_template *mpt3sas_transport_template;
-extern int scsi_internal_device_block(struct scsi_device *sdev);
-extern int scsi_internal_device_unblock(struct scsi_device *sdev,
-                                enum scsi_device_state new_state);
 /* trigger data externs */
 void mpt3sas_send_trigger_data_event(struct MPT3SAS_ADAPTER *ioc,
         struct SL_WH_TRIGGERS_EVENT_DATA_T *event_data);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 46e866c36c8a..919ba2bb15f1 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -2859,7 +2859,7 @@ _scsih_internal_device_block(struct scsi_device *sdev,
             sas_device_priv_data->sas_target->handle);
         sas_device_priv_data->block = 1;
 
-        r = scsi_internal_device_block(sdev);
+        r = scsi_internal_device_block(sdev, false);
         if (r == -EINVAL)
                 sdev_printk(KERN_WARNING, sdev,
                     "device_block failed with return(%d) for handle(0x%04x)\n",
@@ -2895,7 +2895,7 @@ _scsih_internal_device_unblock(struct scsi_device *sdev,
                     "performing a block followed by an unblock\n",
                     r, sas_device_priv_data->sas_target->handle);
                 sas_device_priv_data->block = 1;
-                r = scsi_internal_device_block(sdev);
+                r = scsi_internal_device_block(sdev, false);
                 if (r)
                         sdev_printk(KERN_WARNING, sdev, "retried device_block "
                             "failed with return(%d) for handle(0x%04x)\n",
@@ -4677,7 +4677,6 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         struct MPT3SAS_DEVICE *sas_device_priv_data;
         u32 response_code = 0;
         unsigned long flags;
-        unsigned int sector_sz;
 
         mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
 
@@ -4742,20 +4741,6 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         }
 
         xfer_cnt = le32_to_cpu(mpi_reply->TransferCount);
-
-        /* In case of bogus fw or device, we could end up having
-         * unaligned partial completion. We can force alignment here,
-         * then scsi-ml does not need to handle this misbehavior.
-         */
-        sector_sz = scmd->device->sector_size;
-        if (unlikely(!blk_rq_is_passthrough(scmd->request) && sector_sz &&
-                     xfer_cnt % sector_sz)) {
-                sdev_printk(KERN_INFO, scmd->device,
-                    "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n",
-                            xfer_cnt, sector_sz);
-                xfer_cnt = round_down(xfer_cnt, sector_sz);
-        }
-
         scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt);
         if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE)
                 log_info =  le32_to_cpu(mpi_reply->IOCLogInfo);
diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h
index 23bd70628a2f..7d173f48a81e 100644
--- a/drivers/scsi/qedf/qedf_dbg.h
+++ b/drivers/scsi/qedf/qedf_dbg.h
@@ -81,14 +81,17 @@ struct qedf_dbg_ctx {
 #define QEDF_INFO(pdev, level, fmt, ...)        \
                 qedf_dbg_info(pdev, __func__, __LINE__, level, fmt,     \
                               ## __VA_ARGS__)
-
-extern void qedf_dbg_err(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
+__printf(4, 5)
+void qedf_dbg_err(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
                           const char *fmt, ...);
-extern void qedf_dbg_warn(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
+__printf(4, 5)
+void qedf_dbg_warn(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
                            const char *, ...);
-extern void qedf_dbg_notice(struct qedf_dbg_ctx *qedf, const char *func,
+__printf(4, 5)
+void qedf_dbg_notice(struct qedf_dbg_ctx *qedf, const char *func,
                             u32 line, const char *, ...);
-extern void qedf_dbg_info(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
+__printf(5, 6)
+void qedf_dbg_info(struct qedf_dbg_ctx *qedf, const char *func, u32 line,
                           u32 info, const char *fmt, ...);
 
 /* GRC Dump related defines */
diff --git a/drivers/scsi/qedf/qedf_fip.c b/drivers/scsi/qedf/qedf_fip.c
index 868d423380d1..e10b91cc3c62 100644
--- a/drivers/scsi/qedf/qedf_fip.c
+++ b/drivers/scsi/qedf/qedf_fip.c
@@ -99,7 +99,8 @@ static void qedf_fcoe_process_vlan_resp(struct qedf_ctx *qedf,
                 qedf_set_vlan_id(qedf, vid);
 
                 /* Inform waiter that it's ok to call fcoe_ctlr_link up() */
-                complete(&qedf->fipvlan_compl);
+                if (!completion_done(&qedf->fipvlan_compl))
+                        complete(&qedf->fipvlan_compl);
         }
 }
 
@@ -203,7 +204,7 @@ void qedf_fip_recv(struct qedf_ctx *qedf, struct sk_buff *skb)
                         case FIP_DT_MAC:
                                 mp = (struct fip_mac_desc *)desc;
                                 QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_LL2,
-                                    "fd_mac=%pM.\n", __func__, mp->fd_mac);
+                                    "fd_mac=%pM\n", mp->fd_mac);
                                 ether_addr_copy(cvl_mac, mp->fd_mac);
                                 break;
                         case FIP_DT_NAME:
diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c
index ee0dcf9d3aba..46debe5034af 100644
--- a/drivers/scsi/qedf/qedf_io.c
+++ b/drivers/scsi/qedf/qedf_io.c
@@ -1342,7 +1342,7 @@ void qedf_scsi_completion(struct qedf_ctx *qedf, struct fcoe_cqe *cqe,
                 } else {
                         refcount = kref_read(&io_req->refcount);
                         QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_IO,
-                            "%d:0:%d:%d xid=0x%0x op=0x%02x "
+                            "%d:0:%d:%lld xid=0x%0x op=0x%02x "
                             "lba=%02x%02x%02x%02x cdb_status=%d "
                             "fcp_resid=0x%x refcount=%d.\n",
                             qedf->lport->host->host_no, sc_cmd->device->id,
@@ -1426,7 +1426,7 @@ void qedf_scsi_done(struct qedf_ctx *qedf, struct qedf_ioreq *io_req,
 
         sc_cmd->result = result << 16;
         refcount = kref_read(&io_req->refcount);
-        QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_IO, "%d:0:%d:%d: Completing "
+        QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_IO, "%d:0:%d:%lld: Completing "
             "sc_cmd=%p result=0x%08x op=0x%02x lba=0x%02x%02x%02x%02x, "
             "allowed=%d retries=%d refcount=%d.\n",
             qedf->lport->host->host_no, sc_cmd->device->id,
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index d9d7a86b5f8b..cceddd995a4b 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2456,8 +2456,8 @@ static int qedf_alloc_bdq(struct qedf_ctx *qedf)
         }
 
         QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC,
-            "BDQ PBL addr=0x%p dma=0x%llx.\n", qedf->bdq_pbl,
-            qedf->bdq_pbl_dma);
+                  "BDQ PBL addr=0x%p dma=%pad\n",
+                  qedf->bdq_pbl, &qedf->bdq_pbl_dma);
 
         /*
          * Populate BDQ PBL with physical and virtual address of individual
@@ -2803,6 +2803,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
                 atomic_set(&qedf->num_offloads, 0);
                 qedf->stop_io_on_error = false;
                 pci_set_drvdata(pdev, qedf);
+                init_completion(&qedf->fipvlan_compl);
 
                 QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_INFO,
                    "QLogic FastLinQ FCoE Module qedf %s, "
diff --git a/drivers/scsi/qedi/qedi_debugfs.c b/drivers/scsi/qedi/qedi_debugfs.c
index 955936274241..59417199bf36 100644
--- a/drivers/scsi/qedi/qedi_debugfs.c
+++ b/drivers/scsi/qedi/qedi_debugfs.c
@@ -14,7 +14,7 @@
 #include <linux/debugfs.h>
 #include <linux/module.h>
 
-int do_not_recover;
+int qedi_do_not_recover;
 static struct dentry *qedi_dbg_root;
 
 void
@@ -74,22 +74,22 @@ qedi_dbg_exit(void)
 static ssize_t
 qedi_dbg_do_not_recover_enable(struct qedi_dbg_ctx *qedi_dbg)
 {
-        if (!do_not_recover)
-                do_not_recover = 1;
+        if (!qedi_do_not_recover)
+                qedi_do_not_recover = 1;
 
         QEDI_INFO(qedi_dbg, QEDI_LOG_DEBUGFS, "do_not_recover=%d\n",
-                  do_not_recover);
+                  qedi_do_not_recover);
         return 0;
 }
 
 static ssize_t
 qedi_dbg_do_not_recover_disable(struct qedi_dbg_ctx *qedi_dbg)
 {
-        if (do_not_recover)
-                do_not_recover = 0;
+        if (qedi_do_not_recover)
+                qedi_do_not_recover = 0;
 
         QEDI_INFO(qedi_dbg, QEDI_LOG_DEBUGFS, "do_not_recover=%d\n",
-                  do_not_recover);
+                  qedi_do_not_recover);
         return 0;
 }
 
@@ -141,7 +141,7 @@ qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer,
         if (*ppos)
                 return 0;
 
-        cnt = sprintf(buffer, "do_not_recover=%d\n", do_not_recover);
+        cnt = sprintf(buffer, "do_not_recover=%d\n", qedi_do_not_recover);
         cnt = min_t(int, count, cnt - *ppos);
         *ppos += cnt;
         return cnt;
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index c9f0ef4e11b3..2bce3efc66a4 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -1461,9 +1461,9 @@ static void qedi_tmf_work(struct work_struct *work)
                   get_itt(tmf_hdr->rtt), get_itt(ctask->itt), cmd->task_id,
                   qedi_conn->iscsi_conn_id);
 
-        if (do_not_recover) {
+        if (qedi_do_not_recover) {
                 QEDI_ERR(&qedi->dbg_ctx, "DONT SEND CLEANUP/ABORT %d\n",
-                         do_not_recover);
+                         qedi_do_not_recover);
                 goto abort_ret;
         }
 
diff --git a/drivers/scsi/qedi/qedi_gbl.h b/drivers/scsi/qedi/qedi_gbl.h
index 8e488de88ece..63d793f46064 100644
--- a/drivers/scsi/qedi/qedi_gbl.h
+++ b/drivers/scsi/qedi/qedi_gbl.h
@@ -12,8 +12,14 @@
 
 #include "qedi_iscsi.h"
 
+#ifdef CONFIG_DEBUG_FS
+extern int qedi_do_not_recover;
+#else
+#define qedi_do_not_recover (0)
+#endif
+
 extern uint qedi_io_tracing;
-extern int do_not_recover;
+
 extern struct scsi_host_template qedi_host_template;
 extern struct iscsi_transport qedi_iscsi_transport;
 extern const struct qed_iscsi_ops *qedi_ops;
diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
index b9f79d36142d..4cc474364c50 100644
--- a/drivers/scsi/qedi/qedi_iscsi.c
+++ b/drivers/scsi/qedi/qedi_iscsi.c
@@ -833,7 +833,7 @@ qedi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
                 return ERR_PTR(ret);
         }
 
-        if (do_not_recover) {
+        if (qedi_do_not_recover) {
                 ret = -ENOMEM;
                 return ERR_PTR(ret);
         }
@@ -957,7 +957,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
         struct qedi_endpoint *qedi_ep;
         int ret = 0;
 
-        if (do_not_recover)
+        if (qedi_do_not_recover)
                 return 1;
 
         qedi_ep = ep->dd_data;
@@ -1025,7 +1025,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
                 }
 
                 if (test_bit(QEDI_IN_RECOVERY, &qedi->flags)) {
-                        if (do_not_recover) {
+                        if (qedi_do_not_recover) {
                                 QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
                                           "Do not recover cid=0x%x\n",
                                           qedi_ep->iscsi_cid);
@@ -1039,7 +1039,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
                 }
         }
 
-        if (do_not_recover)
+        if (qedi_do_not_recover)
                 goto ep_exit_recover;
 
         switch (qedi_ep->state) {
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 5eda21d903e9..92775a8b74b1 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1805,7 +1805,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
          */
         qedi_ops->common->update_pf_params(qedi->cdev, &qedi->pf_params);
 
-        qedi_setup_int(qedi);
+        rc = qedi_setup_int(qedi);
         if (rc)
                 goto stop_iscsi_func;
 
@@ -2007,6 +2007,7 @@ static void qedi_remove(struct pci_dev *pdev)
 
 static struct pci_device_id qedi_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, 0x165E) },
+        { PCI_DEVICE(PCI_VENDOR_ID_QLOGIC, 0x8084) },
         { 0 },
 };
 MODULE_DEVICE_TABLE(pci, qedi_pci_tbl);
diff --git a/drivers/scsi/qla2xxx/Kconfig b/drivers/scsi/qla2xxx/Kconfig
index 67c0d5aa3212..de952935b5d2 100644
--- a/drivers/scsi/qla2xxx/Kconfig
+++ b/drivers/scsi/qla2xxx/Kconfig
@@ -3,6 +3,7 @@ config SCSI_QLA_FC
         depends on PCI && SCSI
         depends on SCSI_FC_ATTRS
         select FW_LOADER
+        select BTREE
         ---help---
         This qla2xxx driver supports all QLogic Fibre Channel
         PCI and PCIe host adapters.
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index f610103994af..435ff7fd6384 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2154,8 +2154,6 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
                     "Timer for the VP[%d] has stopped\n", vha->vp_idx);
         }
 
-        BUG_ON(atomic_read(&vha->vref_count));
-
         qla2x00_free_fcports(vha);
 
         mutex_lock(&ha->vport_lock);
@@ -2166,7 +2164,7 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
         dma_free_coherent(&ha->pdev->dev, vha->gnl.size, vha->gnl.l,
             vha->gnl.ldma);
 
-        if (vha->qpair->vp_idx == vha->vp_idx) {
+        if (vha->qpair && vha->qpair->vp_idx == vha->vp_idx) {
                 if (qla2xxx_delete_qpair(vha, vha->qpair) != QLA_SUCCESS)
                         ql_log(ql_log_warn, vha, 0x7087,
                             "Queue Pair delete failed.\n");
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 21d9fb7fc887..51b4179469d1 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -2707,13 +2707,9 @@ ql_dump_buffer(uint32_t level, scsi_qla_host_t *vha, int32_t id,
             "%-+5d  0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F\n", size);
         ql_dbg(level, vha, id,
             "----- -----------------------------------------------\n");
-        for (cnt = 0; cnt < size; cnt++, buf++) {
-                if (cnt % 16 == 0)
-                        ql_dbg(level, vha, id, "%04x:", cnt & ~0xFU);
-                printk(" %02x", *buf);
-                if (cnt % 16 == 15)
-                        printk("\n");
+        for (cnt = 0; cnt < size; cnt += 16) {
+                ql_dbg(level, vha, id, "%04x: ", cnt);
+                print_hex_dump(KERN_CONT, "", DUMP_PREFIX_NONE, 16, 1,
+                               buf + cnt, min(16U, size - cnt), false);
         }
-        if (cnt % 16 != 0)
-                printk("\n");
 }
diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
index e1fc4e66966a..c6bffe929fe7 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.h
+++ b/drivers/scsi/qla2xxx/qla_dbg.h
@@ -348,6 +348,7 @@ ql_log_pci(uint32_t, struct pci_dev *pdev, int32_t, const char *fmt, ...);
 #define ql_dbg_tgt      0x00004000 /* Target mode */
 #define ql_dbg_tgt_mgt  0x00002000 /* Target mode management */
 #define ql_dbg_tgt_tmr  0x00001000 /* Target mode task management */
+#define ql_dbg_tgt_dif  0x00000800 /* Target mode dif */
 
 extern int qla27xx_dump_mpi_ram(struct qla_hw_data *, uint32_t, uint32_t *,
         uint32_t, void **);
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 625d438e3cce..ae119018dfaa 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -25,6 +25,7 @@
 #include <linux/firmware.h>
 #include <linux/aer.h>
 #include <linux/mutex.h>
+#include <linux/btree.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_host.h>
@@ -395,11 +396,15 @@ struct srb_iocb {
                         struct completion comp;
                 } abt;
                 struct ct_arg ctarg;
+#define MAX_IOCB_MB_REG 28
+#define SIZEOF_IOCB_MB_REG (MAX_IOCB_MB_REG * sizeof(uint16_t))
                 struct {
-                        __le16 in_mb[28];       /* fr fw */
-                        __le16 out_mb[28];      /* to fw */
+                        __le16 in_mb[MAX_IOCB_MB_REG];  /* from FW */
+                        __le16 out_mb[MAX_IOCB_MB_REG]; /* to FW */
                         void *out, *in;
                         dma_addr_t out_dma, in_dma;
+                        struct completion comp;
+                        int rc;
                 } mbx;
                 struct {
                         struct imm_ntfy_from_isp *ntfy;
@@ -437,7 +442,7 @@ typedef struct srb {
         uint32_t handle;
         uint16_t flags;
         uint16_t type;
-        char *name;
+        const char *name;
         int iocbs;
         struct qla_qpair *qpair;
         u32 gen1;       /* scratch */
@@ -2300,6 +2305,8 @@ typedef struct fc_port {
         struct ct_sns_desc ct_desc;
         enum discovery_state disc_state;
         enum login_state fw_login_state;
+        unsigned long plogi_nack_done_deadline;
+
         u32 login_gen, last_login_gen;
         u32 rscn_gen, last_rscn_gen;
         u32 chip_reset;
@@ -3106,6 +3113,16 @@ struct qla_chip_state_84xx {
         uint32_t gold_fw_version;
 };
 
+struct qla_dif_statistics {
+        uint64_t dif_input_bytes;
+        uint64_t dif_output_bytes;
+        uint64_t dif_input_requests;
+        uint64_t dif_output_requests;
+        uint32_t dif_guard_err;
+        uint32_t dif_ref_tag_err;
+        uint32_t dif_app_tag_err;
+};
+
 struct qla_statistics {
         uint32_t total_isp_aborts;
         uint64_t input_bytes;
@@ -3118,6 +3135,8 @@ struct qla_statistics {
         uint32_t stat_max_pend_cmds;
         uint32_t stat_max_qfull_cmds_alloc;
         uint32_t stat_max_qfull_cmds_dropped;
+
+        struct qla_dif_statistics qla_dif_stats;
 };
 
 struct bidi_statistics {
@@ -3125,6 +3144,16 @@ struct bidi_statistics {
         unsigned long long transfer_bytes;
 };
 
+struct qla_tc_param {
+        struct scsi_qla_host *vha;
+        uint32_t blk_sz;
+        uint32_t bufflen;
+        struct scatterlist *sg;
+        struct scatterlist *prot_sg;
+        struct crc_context *ctx;
+        uint8_t *ctx_dsd_alloced;
+};
+
 /* Multi queue support */
 #define MBC_INITIALIZE_MULTIQ 0x1f
 #define QLA_QUE_PAGE 0X1000
@@ -3272,6 +3301,8 @@ struct qlt_hw_data {
         uint8_t tgt_node_name[WWN_SIZE];
 
         struct dentry *dfs_tgt_sess;
+        struct dentry *dfs_tgt_port_database;
+
         struct list_head q_full_list;
         uint32_t num_pend_cmds;
         uint32_t num_qfull_cmds_alloc;
@@ -3281,6 +3312,7 @@ struct qlt_hw_data {
         spinlock_t sess_lock;
         int rspq_vector_cpuid;
         spinlock_t atio_lock ____cacheline_aligned;
+        struct btree_head32 host_map;
 };
 
 #define MAX_QFULL_CMDS_ALLOC    8192
@@ -3290,6 +3322,10 @@ struct qlt_hw_data {
 
 #define LEAK_EXCHG_THRESH_HOLD_PERCENT 75       /* 75 percent */
 
+#define QLA_EARLY_LINKUP(_ha) \
+        ((_ha->flags.n2n_ae || _ha->flags.lip_ae) && \
+         _ha->flags.fw_started && !_ha->flags.fw_init_done)
+
 /*
  * Qlogic host adapter specific data structure.
 */
@@ -3339,7 +3375,11 @@ struct qla_hw_data {
                 uint32_t        fawwpn_enabled:1;
                 uint32_t        exlogins_enabled:1;
                 uint32_t        exchoffld_enabled:1;
-                /* 35 bits */
+
+                uint32_t        lip_ae:1;
+                uint32_t        n2n_ae:1;
+                uint32_t        fw_started:1;
+                uint32_t        fw_init_done:1;
         } flags;
 
         /* This spinlock is used to protect "io transactions", you must
@@ -3432,7 +3472,6 @@ struct qla_hw_data {
 #define P2P_LOOP  3
         uint8_t         interrupts_on;
         uint32_t        isp_abort_cnt;
-
 #define PCI_DEVICE_ID_QLOGIC_ISP2532    0x2532
 #define PCI_DEVICE_ID_QLOGIC_ISP8432    0x8432
 #define PCI_DEVICE_ID_QLOGIC_ISP8001    0x8001
@@ -3913,6 +3952,7 @@ typedef struct scsi_qla_host {
         struct list_head vp_fcports;    /* list of fcports */
         struct list_head work_list;
         spinlock_t work_lock;
+        struct work_struct iocb_work;
 
         /* Commonly used flags and state information. */
         struct Scsi_Host *host;
@@ -4076,6 +4116,7 @@ typedef struct scsi_qla_host {
         /* Count of active session/fcport */
         int fcport_count;
         wait_queue_head_t fcport_waitQ;
+        wait_queue_head_t vref_waitq;
 } scsi_qla_host_t;
 
 struct qla27xx_image_status {
@@ -4131,14 +4172,17 @@ struct qla2_sgx {
         mb();                                           \
         if (__vha->flags.delete_progress) {             \
                 atomic_dec(&__vha->vref_count);         \
+                wake_up(&__vha->vref_waitq);            \
                 __bail = 1;                             \
         } else {                                        \
                 __bail = 0;                             \
         }                                               \
 } while (0)
 
-#define QLA_VHA_MARK_NOT_BUSY(__vha)                    \
+#define QLA_VHA_MARK_NOT_BUSY(__vha) do {               \
         atomic_dec(&__vha->vref_count);                 \
+        wake_up(&__vha->vref_waitq);                    \
+} while (0)                                             \
 
 #define QLA_QPAIR_MARK_BUSY(__qpair, __bail) do {       \
         atomic_inc(&__qpair->ref_count);                \
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c
index b48cce696bac..989e17b0758c 100644
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -19,11 +19,11 @@ qla2x00_dfs_tgt_sess_show(struct seq_file *s, void *unused)
         struct qla_hw_data *ha = vha->hw;
         unsigned long flags;
         struct fc_port *sess = NULL;
-        struct qla_tgt *tgt= vha->vha_tgt.qla_tgt;
+        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
 
-        seq_printf(s, "%s\n",vha->host_str);
+        seq_printf(s, "%s\n", vha->host_str);
         if (tgt) {
-                seq_printf(s, "Port ID   Port Name                Handle\n");
+                seq_puts(s, "Port ID   Port Name                Handle\n");
 
                 spin_lock_irqsave(&ha->tgt.sess_lock, flags);
                 list_for_each_entry(sess, &vha->vp_fcports, list)
@@ -44,7 +44,6 @@ qla2x00_dfs_tgt_sess_open(struct inode *inode, struct file *file)
         return single_open(file, qla2x00_dfs_tgt_sess_show, vha);
 }
 
-
 static const struct file_operations dfs_tgt_sess_ops = {
         .open           = qla2x00_dfs_tgt_sess_open,
         .read           = seq_read,
@@ -53,6 +52,78 @@ static const struct file_operations dfs_tgt_sess_ops = {
 };
 
 static int
+qla2x00_dfs_tgt_port_database_show(struct seq_file *s, void *unused)
+{
+        scsi_qla_host_t *vha = s->private;
+        struct qla_hw_data *ha = vha->hw;
+        struct gid_list_info *gid_list;
+        dma_addr_t gid_list_dma;
+        fc_port_t fc_port;
+        char *id_iter;
+        int rc, i;
+        uint16_t entries, loop_id;
+        struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+
+        seq_printf(s, "%s\n", vha->host_str);
+        if (tgt) {
+                gid_list = dma_alloc_coherent(&ha->pdev->dev,
+                    qla2x00_gid_list_size(ha),
+                    &gid_list_dma, GFP_KERNEL);
+                if (!gid_list) {
+                        ql_dbg(ql_dbg_user, vha, 0x705c,
+                            "DMA allocation failed for %u\n",
+                             qla2x00_gid_list_size(ha));
+                        return 0;
+                }
+
+                rc = qla24xx_gidlist_wait(vha, gid_list, gid_list_dma,
+                    &entries);
+                if (rc != QLA_SUCCESS)
+                        goto out_free_id_list;
+
+                id_iter = (char *)gid_list;
+
+                seq_puts(s, "Port Name  Port ID         Loop ID\n");
+
+                for (i = 0; i < entries; i++) {
+                        struct gid_list_info *gid =
+                            (struct gid_list_info *)id_iter;
+                        loop_id = le16_to_cpu(gid->loop_id);
+                        memset(&fc_port, 0, sizeof(fc_port_t));
+
+                        fc_port.loop_id = loop_id;
+
+                        rc = qla24xx_gpdb_wait(vha, &fc_port, 0);
+                        seq_printf(s, "%8phC  %02x%02x%02x  %d\n",
+                                fc_port.port_name, fc_port.d_id.b.domain,
+                                fc_port.d_id.b.area, fc_port.d_id.b.al_pa,
+                                fc_port.loop_id);
+                        id_iter += ha->gid_list_info_size;
+                }
+out_free_id_list:
+                dma_free_coherent(&ha->pdev->dev, qla2x00_gid_list_size(ha),
+                    gid_list, gid_list_dma);
+        }
+
+        return 0;
+}
+
+static int
+qla2x00_dfs_tgt_port_database_open(struct inode *inode, struct file *file)
+{
+        scsi_qla_host_t *vha = inode->i_private;
+
+        return single_open(file, qla2x00_dfs_tgt_port_database_show, vha);
+}
+
+static const struct file_operations dfs_tgt_port_database_ops = {
+        .open           = qla2x00_dfs_tgt_port_database_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int
 qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused)
 {
         struct scsi_qla_host *vha = s->private;
@@ -114,6 +185,21 @@ qla_dfs_tgt_counters_show(struct seq_file *s, void *unused)
         seq_printf(s, "num Q full sent = %lld\n",
                 vha->tgt_counters.num_q_full_sent);
 
+        /* DIF stats */
+        seq_printf(s, "DIF Inp Bytes = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_input_bytes);
+        seq_printf(s, "DIF Outp Bytes = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_output_bytes);
+        seq_printf(s, "DIF Inp Req = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_input_requests);
+        seq_printf(s, "DIF Outp Req = %lld\n",
+                vha->qla_stats.qla_dif_stats.dif_output_requests);
+        seq_printf(s, "DIF Guard err = %d\n",
+                vha->qla_stats.qla_dif_stats.dif_guard_err);
+        seq_printf(s, "DIF Ref tag err = %d\n",
+                vha->qla_stats.qla_dif_stats.dif_ref_tag_err);
+        seq_printf(s, "DIF App tag err = %d\n",
+                vha->qla_stats.qla_dif_stats.dif_app_tag_err);
         return 0;
 }
 
@@ -281,6 +367,14 @@ create_nodes:
                 goto out;
         }
 
+        ha->tgt.dfs_tgt_port_database = debugfs_create_file("tgt_port_database",
+            S_IRUSR,  ha->dfs_dir, vha, &dfs_tgt_port_database_ops);
+        if (!ha->tgt.dfs_tgt_port_database) {
+                ql_log(ql_log_warn, vha, 0xffff,
+                    "Unable to create debugFS tgt_port_database node.\n");
+                goto out;
+        }
+
         ha->dfs_fce = debugfs_create_file("fce", S_IRUSR, ha->dfs_dir, vha,
             &dfs_fce_ops);
         if (!ha->dfs_fce) {
@@ -311,6 +405,11 @@ qla2x00_dfs_remove(scsi_qla_host_t *vha)
                 ha->tgt.dfs_tgt_sess = NULL;
         }
 
+        if (ha->tgt.dfs_tgt_port_database) {
+                debugfs_remove(ha->tgt.dfs_tgt_port_database);
+                ha->tgt.dfs_tgt_port_database = NULL;
+        }
+
         if (ha->dfs_fw_resource_cnt) {
                 debugfs_remove(ha->dfs_fw_resource_cnt);
                 ha->dfs_fw_resource_cnt = NULL;
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index b3d6441d1d90..5b2451745e9f 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -193,6 +193,7 @@ extern int qla24xx_post_upd_fcport_work(struct scsi_qla_host *, fc_port_t *);
 void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *,
         uint16_t *);
 int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *);
+int qla24xx_async_abort_cmd(srb_t *);
 
 /*
  * Global Functions in qla_mid.c source file.
@@ -256,11 +257,11 @@ extern unsigned long qla2x00_get_async_timeout(struct scsi_qla_host *);
 extern void *qla2x00_alloc_iocbs(scsi_qla_host_t *, srb_t *);
 extern int qla2x00_issue_marker(scsi_qla_host_t *, int);
 extern int qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *, srb_t *,
-        uint32_t *, uint16_t, struct qla_tgt_cmd *);
+        uint32_t *, uint16_t, struct qla_tc_param *);
 extern int qla24xx_walk_and_build_sglist(struct qla_hw_data *, srb_t *,
-        uint32_t *, uint16_t, struct qla_tgt_cmd *);
+        uint32_t *, uint16_t, struct qla_tc_param *);
 extern int qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *, srb_t *,
-        uint32_t *, uint16_t, struct qla_tgt_cmd *);
+        uint32_t *, uint16_t, struct qla_tc_param *);
 extern int qla24xx_get_one_block_sg(uint32_t, struct qla2_sgx *, uint32_t *);
 extern int qla24xx_configure_prot_mode(srb_t *, uint16_t *);
 extern int qla24xx_build_scsi_crc_2_iocbs(srb_t *,
@@ -368,7 +369,7 @@ qla2x00_get_link_status(scsi_qla_host_t *, uint16_t, struct link_statistics *,
 
 extern int
 qla24xx_get_isp_stats(scsi_qla_host_t *, struct link_statistics *,
-    dma_addr_t, uint);
+    dma_addr_t, uint16_t);
 
 extern int qla24xx_abort_command(srb_t *);
 extern int qla24xx_async_abort_command(srb_t *);
@@ -472,6 +473,13 @@ qla2x00_dump_mctp_data(scsi_qla_host_t *, dma_addr_t, uint32_t, uint32_t);
 extern int
 qla26xx_dport_diagnostics(scsi_qla_host_t *, void *, uint, uint);
 
+int qla24xx_send_mb_cmd(struct scsi_qla_host *, mbx_cmd_t *);
+int qla24xx_gpdb_wait(struct scsi_qla_host *, fc_port_t *, u8);
+int qla24xx_gidlist_wait(struct scsi_qla_host *, void *, dma_addr_t,
+    uint16_t *);
+int __qla24xx_parse_gpdb(struct scsi_qla_host *, fc_port_t *,
+        struct port_database_24xx *);
+
 /*
  * Global Function Prototypes in qla_isr.c source file.
  */
@@ -846,5 +854,7 @@ extern struct fc_port *qlt_find_sess_invalidate_other(scsi_qla_host_t *,
         uint64_t wwn, port_id_t port_id, uint16_t loop_id, struct fc_port **);
 void qla24xx_delete_sess_fn(struct work_struct *);
 void qlt_unknown_atio_work_fn(struct work_struct *);
+void qlt_update_host_map(struct scsi_qla_host *, port_id_t);
+void qlt_remove_target_resources(struct qla_hw_data *);
 
 #endif /* _QLA_GBL_H */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 32fb9007f137..f9d2fe7b1ade 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -629,7 +629,6 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
         struct srb *sp = s;
         struct scsi_qla_host *vha = sp->vha;
         struct qla_hw_data *ha = vha->hw;
-        uint64_t zero = 0;
         struct port_database_24xx *pd;
         fc_port_t *fcport = sp->fcport;
         u16 *mb = sp->u.iocb_cmd.u.mbx.in_mb;
@@ -649,48 +648,7 @@ void qla24xx_async_gpdb_sp_done(void *s, int res)
 
         pd = (struct port_database_24xx *)sp->u.iocb_cmd.u.mbx.in;
 
-        /* Check for logged in state. */
-        if (pd->current_login_state != PDS_PRLI_COMPLETE &&
-            pd->last_login_state != PDS_PRLI_COMPLETE) {
-                ql_dbg(ql_dbg_mbx, vha, 0xffff,
-                    "Unable to verify login-state (%x/%x) for "
-                    "loop_id %x.\n", pd->current_login_state,
-                    pd->last_login_state, fcport->loop_id);
-                rval = QLA_FUNCTION_FAILED;
-                goto gpd_error_out;
-        }
-
-        if (fcport->loop_id == FC_NO_LOOP_ID ||
-            (memcmp(fcport->port_name, (uint8_t *)&zero, 8) &&
-                memcmp(fcport->port_name, pd->port_name, 8))) {
-                /* We lost the device mid way. */
-                rval = QLA_NOT_LOGGED_IN;
-                goto gpd_error_out;
-        }
-
-        /* Names are little-endian. */
-        memcpy(fcport->node_name, pd->node_name, WWN_SIZE);
-
-        /* Get port_id of device. */
-        fcport->d_id.b.domain = pd->port_id[0];
-        fcport->d_id.b.area = pd->port_id[1];
-        fcport->d_id.b.al_pa = pd->port_id[2];
-        fcport->d_id.b.rsvd_1 = 0;
-
-        /* If not target must be initiator or unknown type. */
-        if ((pd->prli_svc_param_word_3[0] & BIT_4) == 0)
-                fcport->port_type = FCT_INITIATOR;
-        else
-                fcport->port_type = FCT_TARGET;
-
-        /* Passback COS information. */
-        fcport->supported_classes = (pd->flags & PDF_CLASS_2) ?
-                FC_COS_CLASS2 : FC_COS_CLASS3;
-
-        if (pd->prli_svc_param_word_3[0] & BIT_7) {
-                fcport->flags |= FCF_CONF_COMP_SUPPORTED;
-                fcport->conf_compl_supported = 1;
-        }
+        rval = __qla24xx_parse_gpdb(vha, fcport, pd);
 
 gpd_error_out:
         memset(&ea, 0, sizeof(ea));
@@ -876,10 +834,14 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
         fcport->login_retry--;
 
         if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
-            (fcport->fw_login_state == DSC_LS_PLOGI_COMP) ||
             (fcport->fw_login_state == DSC_LS_PRLI_PEND))
                 return 0;
 
+        if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
+                if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline))
+                        return 0;
+        }
+
         /* for pure Target Mode. Login will not be initiated */
         if (vha->host->active_mode == MODE_TARGET)
                 return 0;
@@ -1041,10 +1003,14 @@ void qla24xx_handle_relogin_event(scsi_qla_host_t *vha,
                 fcport->flags);
 
         if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND) ||
-            (fcport->fw_login_state == DSC_LS_PLOGI_COMP) ||
             (fcport->fw_login_state == DSC_LS_PRLI_PEND))
                 return;
 
+        if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
+                if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline))
+                        return;
+        }
+
         if (fcport->flags & FCF_ASYNC_SENT) {
                 fcport->login_retry++;
                 set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
@@ -1258,7 +1224,7 @@ qla24xx_abort_sp_done(void *ptr, int res)
         complete(&abt->u.abt.comp);
 }
 
-static int
+int
 qla24xx_async_abort_cmd(srb_t *cmd_sp)
 {
         scsi_qla_host_t *vha = cmd_sp->vha;
@@ -3212,6 +3178,7 @@ next_check:
         } else {
                 ql_dbg(ql_dbg_init, vha, 0x00d3,
                     "Init Firmware -- success.\n");
+                ha->flags.fw_started = 1;
         }
 
         return (rval);
@@ -3374,8 +3341,8 @@ qla2x00_configure_hba(scsi_qla_host_t *vha)
         uint8_t       domain;
         char            connect_type[22];
         struct qla_hw_data *ha = vha->hw;
-        unsigned long flags;
         scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
+        port_id_t id;
 
         /* Get host addresses. */
         rval = qla2x00_get_adapter_id(vha,
@@ -3453,13 +3420,11 @@ qla2x00_configure_hba(scsi_qla_host_t *vha)
 
         /* Save Host port and loop ID. */
         /* byte order - Big Endian */
-        vha->d_id.b.domain = domain;
-        vha->d_id.b.area = area;
-        vha->d_id.b.al_pa = al_pa;
-
-        spin_lock_irqsave(&ha->vport_slock, flags);
-        qlt_update_vp_map(vha, SET_AL_PA);
-        spin_unlock_irqrestore(&ha->vport_slock, flags);
+        id.b.domain = domain;
+        id.b.area = area;
+        id.b.al_pa = al_pa;
+        id.b.rsvd_1 = 0;
+        qlt_update_host_map(vha, id);
 
         if (!vha->flags.init_done)
                 ql_log(ql_log_info, vha, 0x2010,
@@ -4036,6 +4001,7 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
                         atomic_set(&vha->loop_state, LOOP_READY);
                         ql_dbg(ql_dbg_disc, vha, 0x2069,
                             "LOOP READY.\n");
+                        ha->flags.fw_init_done = 1;
 
                         /*
                          * Process any ATIO queue entries that came in
@@ -5148,6 +5114,7 @@ qla2x00_update_fcports(scsi_qla_host_t *base_vha)
                         }
                 }
                 atomic_dec(&vha->vref_count);
+                wake_up(&vha->vref_waitq);
         }
         spin_unlock_irqrestore(&ha->vport_slock, flags);
 }
@@ -5526,6 +5493,11 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
         if (!(IS_P3P_TYPE(ha)))
                 ha->isp_ops->reset_chip(vha);
 
+        ha->flags.n2n_ae = 0;
+        ha->flags.lip_ae = 0;
+        ha->current_topology = 0;
+        ha->flags.fw_started = 0;
+        ha->flags.fw_init_done = 0;
         ha->chip_reset++;
 
         atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
@@ -6802,6 +6774,8 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *vha)
                 return;
         if (!ha->fw_major_version)
                 return;
+        if (!ha->flags.fw_started)
+                return;
 
         ret = qla2x00_stop_firmware(vha);
         for (retries = 5; ret != QLA_SUCCESS && ret != QLA_FUNCTION_TIMEOUT &&
@@ -6815,6 +6789,9 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *vha)
                     "Attempting retry of stop-firmware command.\n");
                 ret = qla2x00_stop_firmware(vha);
         }
+
+        ha->flags.fw_started = 0;
+        ha->flags.fw_init_done = 0;
 }
 
 int
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 535079280288..ea027f6a7fd4 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -889,7 +889,7 @@ qla24xx_get_one_block_sg(uint32_t blk_sz, struct qla2_sgx *sgx,
 
 int
 qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *ha, srb_t *sp,
-        uint32_t *dsd, uint16_t tot_dsds, struct qla_tgt_cmd *tc)
+        uint32_t *dsd, uint16_t tot_dsds, struct qla_tc_param *tc)
 {
         void *next_dsd;
         uint8_t avail_dsds = 0;
@@ -898,7 +898,6 @@ qla24xx_walk_and_build_sglist_no_difb(struct qla_hw_data *ha, srb_t *sp,
         struct scatterlist *sg_prot;
         uint32_t *cur_dsd = dsd;
         uint16_t        used_dsds = tot_dsds;
-
         uint32_t        prot_int; /* protection interval */
         uint32_t        partial;
         struct qla2_sgx sgx;
@@ -966,7 +965,7 @@ alloc_and_fill:
                         } else {
                                 list_add_tail(&dsd_ptr->list,
                                     &(tc->ctx->dsd_list));
-                                tc->ctx_dsd_alloced = 1;
+                                *tc->ctx_dsd_alloced = 1;
                         }
 
 
@@ -1005,7 +1004,7 @@ alloc_and_fill:
 
 int
 qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
-        uint16_t tot_dsds, struct qla_tgt_cmd *tc)
+        uint16_t tot_dsds, struct qla_tc_param *tc)
 {
         void *next_dsd;
         uint8_t avail_dsds = 0;
@@ -1066,7 +1065,7 @@ qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
                         } else {
                                 list_add_tail(&dsd_ptr->list,
                                     &(tc->ctx->dsd_list));
-                                tc->ctx_dsd_alloced = 1;
+                                *tc->ctx_dsd_alloced = 1;
                         }
 
                         /* add new list to cmd iocb or last list */
@@ -1092,7 +1091,7 @@ qla24xx_walk_and_build_sglist(struct qla_hw_data *ha, srb_t *sp, uint32_t *dsd,
 
 int
 qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *ha, srb_t *sp,
-        uint32_t *dsd, uint16_t tot_dsds, struct qla_tgt_cmd *tc)
+        uint32_t *dsd, uint16_t tot_dsds, struct qla_tc_param *tc)
 {
         void *next_dsd;
         uint8_t avail_dsds = 0;
@@ -1158,7 +1157,7 @@ qla24xx_walk_and_build_prot_sglist(struct qla_hw_data *ha, srb_t *sp,
                         } else {
                                 list_add_tail(&dsd_ptr->list,
                                     &(tc->ctx->dsd_list));
-                                tc->ctx_dsd_alloced = 1;
+                                *tc->ctx_dsd_alloced = 1;
                         }
 
                         /* add new list to cmd iocb or last list */
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 3c66ea29de27..3203367a4f42 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -708,6 +708,8 @@ skip_rio:
                     "mbx7=%xh.\n", mb[1], mb[2], mb[3], mbx);
 
                 ha->isp_ops->fw_dump(vha, 1);
+                ha->flags.fw_init_done = 0;
+                ha->flags.fw_started = 0;
 
                 if (IS_FWI2_CAPABLE(ha)) {
                         if (mb[1] == 0 && mb[2] == 0) {
@@ -761,6 +763,9 @@ skip_rio:
                 break;
 
         case MBA_LIP_OCCURRED:          /* Loop Initialization Procedure */
+                ha->flags.lip_ae = 1;
+                ha->flags.n2n_ae = 0;
+
                 ql_dbg(ql_dbg_async, vha, 0x5009,
                     "LIP occurred (%x).\n", mb[1]);
 
@@ -797,6 +802,10 @@ skip_rio:
                 break;
 
         case MBA_LOOP_DOWN:             /* Loop Down Event */
+                ha->flags.n2n_ae = 0;
+                ha->flags.lip_ae = 0;
+                ha->current_topology = 0;
+
                 mbx = (IS_QLA81XX(ha) || IS_QLA8031(ha))
                         ? RD_REG_WORD(&reg24->mailbox4) : 0;
                 mbx = (IS_P3P_TYPE(ha)) ? RD_REG_WORD(&reg82->mailbox_out[4])
@@ -866,6 +875,9 @@ skip_rio:
 
         /* case MBA_DCBX_COMPLETE: */
         case MBA_POINT_TO_POINT:        /* Point-to-Point */
+                ha->flags.lip_ae = 0;
+                ha->flags.n2n_ae = 1;
+
                 if (IS_QLA2100(ha))
                         break;
 
@@ -1620,9 +1632,9 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
                 QLA_LOGIO_LOGIN_RETRIED : 0;
         if (logio->entry_status) {
                 ql_log(ql_log_warn, fcport->vha, 0x5034,
-                    "Async-%s error entry - hdl=%x"
+                    "Async-%s error entry - %8phC hdl=%x"
                     "portid=%02x%02x%02x entry-status=%x.\n",
-                    type, sp->handle, fcport->d_id.b.domain,
+                    type, fcport->port_name, sp->handle, fcport->d_id.b.domain,
                     fcport->d_id.b.area, fcport->d_id.b.al_pa,
                     logio->entry_status);
                 ql_dump_buffer(ql_dbg_async + ql_dbg_buffer, vha, 0x504d,
@@ -1633,8 +1645,9 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
 
         if (le16_to_cpu(logio->comp_status) == CS_COMPLETE) {
                 ql_dbg(ql_dbg_async, fcport->vha, 0x5036,
-                    "Async-%s complete - hdl=%x portid=%02x%02x%02x "
-                    "iop0=%x.\n", type, sp->handle, fcport->d_id.b.domain,
+                    "Async-%s complete - %8phC hdl=%x portid=%02x%02x%02x "
+                    "iop0=%x.\n", type, fcport->port_name, sp->handle,
+                    fcport->d_id.b.domain,
                     fcport->d_id.b.area, fcport->d_id.b.al_pa,
                     le32_to_cpu(logio->io_parameter[0]));
 
@@ -1674,6 +1687,17 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
         case LSC_SCODE_NPORT_USED:
                 data[0] = MBS_LOOP_ID_USED;
                 break;
+        case LSC_SCODE_CMD_FAILED:
+                if (iop[1] == 0x0606) {
+                        /*
+                         * PLOGI/PRLI Completed. We must have Recv PLOGI/PRLI,
+                         * Target side acked.
+                         */
+                        data[0] = MBS_COMMAND_COMPLETE;
+                        goto logio_done;
+                }
+                data[0] = MBS_COMMAND_ERROR;
+                break;
         case LSC_SCODE_NOXCB:
                 vha->hw->exch_starvation++;
                 if (vha->hw->exch_starvation > 5) {
@@ -1695,8 +1719,9 @@ qla24xx_logio_entry(scsi_qla_host_t *vha, struct req_que *req,
         }
 
         ql_dbg(ql_dbg_async, fcport->vha, 0x5037,
-            "Async-%s failed - hdl=%x portid=%02x%02x%02x comp=%x "
-            "iop0=%x iop1=%x.\n", type, sp->handle, fcport->d_id.b.domain,
+            "Async-%s failed - %8phC hdl=%x portid=%02x%02x%02x comp=%x "
+            "iop0=%x iop1=%x.\n", type, fcport->port_name,
+                sp->handle, fcport->d_id.b.domain,
             fcport->d_id.b.area, fcport->d_id.b.al_pa,
             le16_to_cpu(logio->comp_status),
             le32_to_cpu(logio->io_parameter[0]),
@@ -2679,7 +2704,7 @@ qla24xx_abort_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
                 return;
 
         abt = &sp->u.iocb_cmd;
-        abt->u.abt.comp_status = le32_to_cpu(pkt->nport_handle);
+        abt->u.abt.comp_status = le16_to_cpu(pkt->nport_handle);
         sp->done(sp, 0);
 }
 
@@ -2693,7 +2718,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
         struct sts_entry_24xx *pkt;
         struct qla_hw_data *ha = vha->hw;
 
-        if (!vha->flags.online)
+        if (!ha->flags.fw_started)
                 return;
 
         while (rsp->ring_ptr->signature != RESPONSE_PROCESSED) {
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 35079f417417..a113ab3592a7 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -10,6 +10,28 @@
 #include <linux/delay.h>
 #include <linux/gfp.h>
 
+static struct mb_cmd_name {
+        uint16_t cmd;
+        const char *str;
+} mb_str[] = {
+        {MBC_GET_PORT_DATABASE,         "GPDB"},
+        {MBC_GET_ID_LIST,               "GIDList"},
+        {MBC_GET_LINK_PRIV_STATS,       "Stats"},
+};
+
+static const char *mb_to_str(uint16_t cmd)
+{
+        int i;
+        struct mb_cmd_name *e;
+
+        for (i = 0; i < ARRAY_SIZE(mb_str); i++) {
+                e = mb_str + i;
+                if (cmd == e->cmd)
+                        return e->str;
+        }
+        return "unknown";
+}
+
 static struct rom_cmd {
         uint16_t cmd;
 } rom_cmds[] = {
@@ -2818,7 +2840,7 @@ qla2x00_get_link_status(scsi_qla_host_t *vha, uint16_t loop_id,
 
 int
 qla24xx_get_isp_stats(scsi_qla_host_t *vha, struct link_statistics *stats,
-    dma_addr_t stats_dma, uint options)
+    dma_addr_t stats_dma, uint16_t options)
 {
         int rval;
         mbx_cmd_t mc;
@@ -2828,19 +2850,17 @@ qla24xx_get_isp_stats(scsi_qla_host_t *vha, struct link_statistics *stats,
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x1088,
             "Entered %s.\n", __func__);
 
-        mcp->mb[0] = MBC_GET_LINK_PRIV_STATS;
-        mcp->mb[2] = MSW(stats_dma);
-        mcp->mb[3] = LSW(stats_dma);
-        mcp->mb[6] = MSW(MSD(stats_dma));
-        mcp->mb[7] = LSW(MSD(stats_dma));
-        mcp->mb[8] = sizeof(struct link_statistics) / 4;
-        mcp->mb[9] = vha->vp_idx;
-        mcp->mb[10] = options;
-        mcp->out_mb = MBX_10|MBX_9|MBX_8|MBX_7|MBX_6|MBX_3|MBX_2|MBX_0;
-        mcp->in_mb = MBX_2|MBX_1|MBX_0;
-        mcp->tov = MBX_TOV_SECONDS;
-        mcp->flags = IOCTL_CMD;
-        rval = qla2x00_mailbox_command(vha, mcp);
+        memset(&mc, 0, sizeof(mc));
+        mc.mb[0] = MBC_GET_LINK_PRIV_STATS;
+        mc.mb[2] = MSW(stats_dma);
+        mc.mb[3] = LSW(stats_dma);
+        mc.mb[6] = MSW(MSD(stats_dma));
+        mc.mb[7] = LSW(MSD(stats_dma));
+        mc.mb[8] = sizeof(struct link_statistics) / 4;
+        mc.mb[9] = cpu_to_le16(vha->vp_idx);
+        mc.mb[10] = cpu_to_le16(options);
+
+        rval = qla24xx_send_mb_cmd(vha, &mc);
 
         if (rval == QLA_SUCCESS) {
                 if (mcp->mb[0] != MBS_COMMAND_COMPLETE) {
@@ -3603,6 +3623,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
         scsi_qla_host_t *vp = NULL;
         unsigned long   flags;
         int found;
+        port_id_t id;
 
         ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b6,
             "Entered %s.\n", __func__);
@@ -3610,28 +3631,27 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
         if (rptid_entry->entry_status != 0)
                 return;
 
+        id.b.domain = rptid_entry->port_id[2];
+        id.b.area   = rptid_entry->port_id[1];
+        id.b.al_pa  = rptid_entry->port_id[0];
+        id.b.rsvd_1 = 0;
+
         if (rptid_entry->format == 0) {
                 /* loop */
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b7,
+                ql_dbg(ql_dbg_async, vha, 0x10b7,
                     "Format 0 : Number of VPs setup %d, number of "
                     "VPs acquired %d.\n", rptid_entry->vp_setup,
                     rptid_entry->vp_acquired);
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b8,
+                ql_dbg(ql_dbg_async, vha, 0x10b8,
                     "Primary port id %02x%02x%02x.\n",
                     rptid_entry->port_id[2], rptid_entry->port_id[1],
                     rptid_entry->port_id[0]);
 
-                vha->d_id.b.domain = rptid_entry->port_id[2];
-                vha->d_id.b.area = rptid_entry->port_id[1];
-                vha->d_id.b.al_pa = rptid_entry->port_id[0];
-
-                spin_lock_irqsave(&ha->vport_slock, flags);
-                qlt_update_vp_map(vha, SET_AL_PA);
-                spin_unlock_irqrestore(&ha->vport_slock, flags);
+                qlt_update_host_map(vha, id);
 
         } else if (rptid_entry->format == 1) {
                 /* fabric */
-                ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x10b9,
+                ql_dbg(ql_dbg_async, vha, 0x10b9,
                     "Format 1: VP[%d] enabled - status %d - with "
                     "port id %02x%02x%02x.\n", rptid_entry->vp_idx,
                         rptid_entry->vp_status,
@@ -3653,12 +3673,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                                             WWN_SIZE);
                                 }
 
-                                vha->d_id.b.domain = rptid_entry->port_id[2];
-                                vha->d_id.b.area = rptid_entry->port_id[1];
-                                vha->d_id.b.al_pa = rptid_entry->port_id[0];
-                                spin_lock_irqsave(&ha->vport_slock, flags);
-                                qlt_update_vp_map(vha, SET_AL_PA);
-                                spin_unlock_irqrestore(&ha->vport_slock, flags);
+                                qlt_update_host_map(vha, id);
                         }
 
                         fc_host_port_name(vha->host) =
@@ -3694,12 +3709,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
                         if (!found)
                                 return;
 
-                        vp->d_id.b.domain = rptid_entry->port_id[2];
-                        vp->d_id.b.area =  rptid_entry->port_id[1];
-                        vp->d_id.b.al_pa = rptid_entry->port_id[0];
-                        spin_lock_irqsave(&ha->vport_slock, flags);
-                        qlt_update_vp_map(vp, SET_AL_PA);
-                        spin_unlock_irqrestore(&ha->vport_slock, flags);
+                        qlt_update_host_map(vp, id);
 
                         /*
                          * Cannot configure here as we are still sitting on the
@@ -5827,3 +5837,225 @@ qla26xx_dport_diagnostics(scsi_qla_host_t *vha,
 
         return rval;
 }
+
+static void qla2x00_async_mb_sp_done(void *s, int res)
+{
+        struct srb *sp = s;
+
+        sp->u.iocb_cmd.u.mbx.rc = res;
+
+        complete(&sp->u.iocb_cmd.u.mbx.comp);
+        /* don't free sp here. Let the caller do the free */
+}
+
+/*
+ * This mailbox uses the iocb interface to send MB command.
+ * This allows non-critial (non chip setup) command to go
+ * out in parrallel.
+ */
+int qla24xx_send_mb_cmd(struct scsi_qla_host *vha, mbx_cmd_t *mcp)
+{
+        int rval = QLA_FUNCTION_FAILED;
+        srb_t *sp;
+        struct srb_iocb *c;
+
+        if (!vha->hw->flags.fw_started)
+                goto done;
+
+        sp = qla2x00_get_sp(vha, NULL, GFP_KERNEL);
+        if (!sp)
+                goto done;
+
+        sp->type = SRB_MB_IOCB;
+        sp->name = mb_to_str(mcp->mb[0]);
+
+        qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+        memcpy(sp->u.iocb_cmd.u.mbx.out_mb, mcp->mb, SIZEOF_IOCB_MB_REG);
+
+        c = &sp->u.iocb_cmd;
+        c->timeout = qla2x00_async_iocb_timeout;
+        init_completion(&c->u.mbx.comp);
+
+        sp->done = qla2x00_async_mb_sp_done;
+
+        rval = qla2x00_start_sp(sp);
+        if (rval != QLA_SUCCESS) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                    "%s: %s Failed submission. %x.\n",
+                    __func__, sp->name, rval);
+                goto done_free_sp;
+        }
+
+        ql_dbg(ql_dbg_mbx, vha, 0xffff, "MB:%s hndl %x submitted\n",
+            sp->name, sp->handle);
+
+        wait_for_completion(&c->u.mbx.comp);
+        memcpy(mcp->mb, sp->u.iocb_cmd.u.mbx.in_mb, SIZEOF_IOCB_MB_REG);
+
+        rval = c->u.mbx.rc;
+        switch (rval) {
+        case QLA_FUNCTION_TIMEOUT:
+                ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %s Timeout. %x.\n",
+                    __func__, sp->name, rval);
+                break;
+        case  QLA_SUCCESS:
+                ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %s done.\n",
+                    __func__, sp->name);
+                sp->free(sp);
+                break;
+        default:
+                ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %s Failed. %x.\n",
+                    __func__, sp->name, rval);
+                sp->free(sp);
+                break;
+        }
+
+        return rval;
+
+done_free_sp:
+        sp->free(sp);
+done:
+        return rval;
+}
+
+/*
+ * qla24xx_gpdb_wait
+ * NOTE: Do not call this routine from DPC thread
+ */
+int qla24xx_gpdb_wait(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
+{
+        int rval = QLA_FUNCTION_FAILED;
+        dma_addr_t pd_dma;
+        struct port_database_24xx *pd;
+        struct qla_hw_data *ha = vha->hw;
+        mbx_cmd_t mc;
+
+        if (!vha->hw->flags.fw_started)
+                goto done;
+
+        pd = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &pd_dma);
+        if (pd  == NULL) {
+                ql_log(ql_log_warn, vha, 0xffff,
+                        "Failed to allocate port database structure.\n");
+                goto done_free_sp;
+        }
+        memset(pd, 0, max(PORT_DATABASE_SIZE, PORT_DATABASE_24XX_SIZE));
+
+        memset(&mc, 0, sizeof(mc));
+        mc.mb[0] = MBC_GET_PORT_DATABASE;
+        mc.mb[1] = cpu_to_le16(fcport->loop_id);
+        mc.mb[2] = MSW(pd_dma);
+        mc.mb[3] = LSW(pd_dma);
+        mc.mb[6] = MSW(MSD(pd_dma));
+        mc.mb[7] = LSW(MSD(pd_dma));
+        mc.mb[9] = cpu_to_le16(vha->vp_idx);
+        mc.mb[10] = cpu_to_le16((uint16_t)opt);
+
+        rval = qla24xx_send_mb_cmd(vha, &mc);
+        if (rval != QLA_SUCCESS) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                    "%s: %8phC fail\n", __func__, fcport->port_name);
+                goto done_free_sp;
+        }
+
+        rval = __qla24xx_parse_gpdb(vha, fcport, pd);
+
+        ql_dbg(ql_dbg_mbx, vha, 0xffff, "%s: %8phC done\n",
+            __func__, fcport->port_name);
+
+done_free_sp:
+        if (pd)
+                dma_pool_free(ha->s_dma_pool, pd, pd_dma);
+done:
+        return rval;
+}
+
+int __qla24xx_parse_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport,
+    struct port_database_24xx *pd)
+{
+        int rval = QLA_SUCCESS;
+        uint64_t zero = 0;
+
+        /* Check for logged in state. */
+        if (pd->current_login_state != PDS_PRLI_COMPLETE &&
+                pd->last_login_state != PDS_PRLI_COMPLETE) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                           "Unable to verify login-state (%x/%x) for "
+                           "loop_id %x.\n", pd->current_login_state,
+                           pd->last_login_state, fcport->loop_id);
+                rval = QLA_FUNCTION_FAILED;
+                goto gpd_error_out;
+        }
+
+        if (fcport->loop_id == FC_NO_LOOP_ID ||
+            (memcmp(fcport->port_name, (uint8_t *)&zero, 8) &&
+             memcmp(fcport->port_name, pd->port_name, 8))) {
+                /* We lost the device mid way. */
+                rval = QLA_NOT_LOGGED_IN;
+                goto gpd_error_out;
+        }
+
+        /* Names are little-endian. */
+        memcpy(fcport->node_name, pd->node_name, WWN_SIZE);
+        memcpy(fcport->port_name, pd->port_name, WWN_SIZE);
+
+        /* Get port_id of device. */
+        fcport->d_id.b.domain = pd->port_id[0];
+        fcport->d_id.b.area = pd->port_id[1];
+        fcport->d_id.b.al_pa = pd->port_id[2];
+        fcport->d_id.b.rsvd_1 = 0;
+
+        /* If not target must be initiator or unknown type. */
+        if ((pd->prli_svc_param_word_3[0] & BIT_4) == 0)
+                fcport->port_type = FCT_INITIATOR;
+        else
+                fcport->port_type = FCT_TARGET;
+
+        /* Passback COS information. */
+        fcport->supported_classes = (pd->flags & PDF_CLASS_2) ?
+                FC_COS_CLASS2 : FC_COS_CLASS3;
+
+        if (pd->prli_svc_param_word_3[0] & BIT_7) {
+                fcport->flags |= FCF_CONF_COMP_SUPPORTED;
+                fcport->conf_compl_supported = 1;
+        }
+
+gpd_error_out:
+        return rval;
+}
+
+/*
+ * qla24xx_gidlist__wait
+ * NOTE: don't call this routine from DPC thread.
+ */
+int qla24xx_gidlist_wait(struct scsi_qla_host *vha,
+        void *id_list, dma_addr_t id_list_dma, uint16_t *entries)
+{
+        int rval = QLA_FUNCTION_FAILED;
+        mbx_cmd_t mc;
+
+        if (!vha->hw->flags.fw_started)
+                goto done;
+
+        memset(&mc, 0, sizeof(mc));
+        mc.mb[0] = MBC_GET_ID_LIST;
+        mc.mb[2] = MSW(id_list_dma);
+        mc.mb[3] = LSW(id_list_dma);
+        mc.mb[6] = MSW(MSD(id_list_dma));
+        mc.mb[7] = LSW(MSD(id_list_dma));
+        mc.mb[8] = 0;
+        mc.mb[9] = cpu_to_le16(vha->vp_idx);
+
+        rval = qla24xx_send_mb_cmd(vha, &mc);
+        if (rval != QLA_SUCCESS) {
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                        "%s:  fail\n", __func__);
+        } else {
+                *entries = mc.mb[1];
+                ql_dbg(ql_dbg_mbx, vha, 0xffff,
+                        "%s:  done\n", __func__);
+        }
+done:
+        return rval;
+}
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index c6d6f0d912ff..09a490c98763 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -74,13 +74,14 @@ qla24xx_deallocate_vp_id(scsi_qla_host_t *vha)
          * ensures no active vp_list traversal while the vport is removed
          * from the queue)
          */
-        spin_lock_irqsave(&ha->vport_slock, flags);
-        while (atomic_read(&vha->vref_count)) {
-                spin_unlock_irqrestore(&ha->vport_slock, flags);
-
-                msleep(500);
+        wait_event_timeout(vha->vref_waitq, atomic_read(&vha->vref_count),
+            10*HZ);
 
-                spin_lock_irqsave(&ha->vport_slock, flags);
+        spin_lock_irqsave(&ha->vport_slock, flags);
+        if (atomic_read(&vha->vref_count)) {
+                ql_dbg(ql_dbg_vport, vha, 0xfffa,
+                    "vha->vref_count=%u timeout\n", vha->vref_count.counter);
+                vha->vref_count = (atomic_t)ATOMIC_INIT(0);
         }
         list_del(&vha->list);
         qlt_update_vp_map(vha, RESET_VP_IDX);
@@ -269,6 +270,7 @@ qla2x00_alert_all_vps(struct rsp_que *rsp, uint16_t *mb)
 
                         spin_lock_irqsave(&ha->vport_slock, flags);
                         atomic_dec(&vha->vref_count);
+                        wake_up(&vha->vref_waitq);
                 }
                 i++;
         }
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 1fed235a1b4a..83d61d2142e9 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1160,8 +1160,13 @@ static inline
 uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
 {
         struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+        struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
 
-        return ((RD_REG_DWORD(&reg->host_status)) == ISP_REG_DISCONNECT);
+        if (IS_P3P_TYPE(ha))
+                return ((RD_REG_DWORD(&reg82->host_int)) == ISP_REG_DISCONNECT);
+        else
+                return ((RD_REG_DWORD(&reg->host_status)) ==
+                        ISP_REG_DISCONNECT);
 }
 
 /**************************************************************************
@@ -1651,7 +1656,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                 /* Don't abort commands in adapter during EEH
                                  * recovery as it's not accessible/responding.
                                  */
-                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
+                                if (GET_CMD_SP(sp) && !ha->flags.eeh_busy &&
+                                    (sp->type == SRB_SCSI_CMD)) {
                                         /* Get a reference to the sp and drop the lock.
                                          * The reference ensures this sp->done() call
                                          * - and not the call in qla2xxx_eh_abort() -
@@ -2560,6 +2566,20 @@ qla2xxx_scan_finished(struct Scsi_Host *shost, unsigned long time)
         return atomic_read(&vha->loop_state) == LOOP_READY;
 }
 
+static void qla2x00_iocb_work_fn(struct work_struct *work)
+{
+        struct scsi_qla_host *vha = container_of(work,
+                struct scsi_qla_host, iocb_work);
+        int cnt = 0;
+
+        while (!list_empty(&vha->work_list)) {
+                qla2x00_do_work(vha);
+                cnt++;
+                if (cnt > 10)
+                        break;
+        }
+}
+
 /*
  * PCI driver interface
  */
@@ -3078,6 +3098,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
          */
         qla2xxx_wake_dpc(base_vha);
 
+        INIT_WORK(&base_vha->iocb_work, qla2x00_iocb_work_fn);
         INIT_WORK(&ha->board_disable, qla2x00_disable_board_on_pci_error);
 
         if (IS_QLA8031(ha) || IS_MCTP_CAPABLE(ha)) {
@@ -3469,6 +3490,7 @@ qla2x00_remove_one(struct pci_dev *pdev)
         qla2x00_free_sysfs_attr(base_vha, true);
 
         fc_remove_host(base_vha->host);
+        qlt_remove_target_resources(ha);
 
         scsi_remove_host(base_vha->host);
 
@@ -4268,6 +4290,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht,
         spin_lock_init(&vha->work_lock);
         spin_lock_init(&vha->cmd_list_lock);
         init_waitqueue_head(&vha->fcport_waitQ);
+        init_waitqueue_head(&vha->vref_waitq);
 
         vha->gnl.size = sizeof(struct get_name_list_extended) *
                         (ha->max_loop_id + 1);
@@ -4319,7 +4342,11 @@ qla2x00_post_work(struct scsi_qla_host *vha, struct qla_work_evt *e)
         spin_lock_irqsave(&vha->work_lock, flags);
         list_add_tail(&e->list, &vha->work_list);
         spin_unlock_irqrestore(&vha->work_lock, flags);
-        qla2xxx_wake_dpc(vha);
+
+        if (QLA_EARLY_LINKUP(vha->hw))
+                schedule_work(&vha->iocb_work);
+        else
+                qla2xxx_wake_dpc(vha);
 
         return QLA_SUCCESS;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 45f5077684f0..0e03ca2ab3e5 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -130,6 +130,9 @@ static void qlt_send_term_imm_notif(struct scsi_qla_host *vha,
 static struct fc_port *qlt_create_sess(struct scsi_qla_host *vha,
         fc_port_t *fcport, bool local);
 void qlt_unreg_sess(struct fc_port *sess);
+static void qlt_24xx_handle_abts(struct scsi_qla_host *,
+        struct abts_recv_from_24xx *);
+
 /*
  * Global Variables
  */
@@ -140,6 +143,20 @@ static struct workqueue_struct *qla_tgt_wq;
 static DEFINE_MUTEX(qla_tgt_mutex);
 static LIST_HEAD(qla_tgt_glist);
 
+static const char *prot_op_str(u32 prot_op)
+{
+        switch (prot_op) {
+        case TARGET_PROT_NORMAL:        return "NORMAL";
+        case TARGET_PROT_DIN_INSERT:    return "DIN_INSERT";
+        case TARGET_PROT_DOUT_INSERT:   return "DOUT_INSERT";
+        case TARGET_PROT_DIN_STRIP:     return "DIN_STRIP";
+        case TARGET_PROT_DOUT_STRIP:    return "DOUT_STRIP";
+        case TARGET_PROT_DIN_PASS:      return "DIN_PASS";
+        case TARGET_PROT_DOUT_PASS:     return "DOUT_PASS";
+        default:                        return "UNKNOWN";
+        }
+}
+
 /* This API intentionally takes dest as a parameter, rather than returning
  * int value to avoid caller forgetting to issue wmb() after the store */
 void qlt_do_generation_tick(struct scsi_qla_host *vha, int *dest)
@@ -170,21 +187,23 @@ static inline
 struct scsi_qla_host *qlt_find_host_by_d_id(struct scsi_qla_host *vha,
         uint8_t *d_id)
 {
-        struct qla_hw_data *ha = vha->hw;
-        uint8_t vp_idx;
-
-        if ((vha->d_id.b.area != d_id[1]) || (vha->d_id.b.domain != d_id[0]))
-                return NULL;
+        struct scsi_qla_host *host;
+        uint32_t key = 0;
 
-        if (vha->d_id.b.al_pa == d_id[2])
+        if ((vha->d_id.b.area == d_id[1]) && (vha->d_id.b.domain == d_id[0]) &&
+            (vha->d_id.b.al_pa == d_id[2]))
                 return vha;
 
-        BUG_ON(ha->tgt.tgt_vp_map == NULL);
-        vp_idx = ha->tgt.tgt_vp_map[d_id[2]].idx;
-        if (likely(test_bit(vp_idx, ha->vp_idx_map)))
-                return ha->tgt.tgt_vp_map[vp_idx].vha;
+        key  = (uint32_t)d_id[0] << 16;
+        key |= (uint32_t)d_id[1] <<  8;
+        key |= (uint32_t)d_id[2];
 
-        return NULL;
+        host = btree_lookup32(&vha->hw->tgt.host_map, key);
+        if (!host)
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                           "Unable to find host %06x\n", key);
+
+        return host;
 }
 
 static inline
@@ -389,6 +408,8 @@ static bool qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *vha,
                         (struct abts_recv_from_24xx *)atio;
                 struct scsi_qla_host *host = qlt_find_host_by_vp_idx(vha,
                         entry->vp_index);
+                unsigned long flags;
+
                 if (unlikely(!host)) {
                         ql_dbg(ql_dbg_tgt, vha, 0xffff,
                             "qla_target(%d): Response pkt (ABTS_RECV_24XX) "
@@ -396,9 +417,12 @@ static bool qlt_24xx_atio_pkt_all_vps(struct scsi_qla_host *vha,
                             vha->vp_idx, entry->vp_index);
                         break;
                 }
-                qlt_response_pkt(host, (response_t *)atio);
+                if (!ha_locked)
+                        spin_lock_irqsave(&host->hw->hardware_lock, flags);
+                qlt_24xx_handle_abts(host, (struct abts_recv_from_24xx *)atio);
+                if (!ha_locked)
+                        spin_unlock_irqrestore(&host->hw->hardware_lock, flags);
                 break;
-
         }
 
         /* case PUREX_IOCB_TYPE: ql2xmvasynctoatio */
@@ -554,6 +578,7 @@ void qla2x00_async_nack_sp_done(void *s, int res)
                 sp->fcport->login_gen++;
                 sp->fcport->fw_login_state = DSC_LS_PLOGI_COMP;
                 sp->fcport->logout_on_delete = 1;
+                sp->fcport->plogi_nack_done_deadline = jiffies + HZ;
                 break;
 
         case SRB_NACK_PRLI:
@@ -613,6 +638,7 @@ int qla24xx_async_notify_ack(scsi_qla_host_t *vha, fc_port_t *fcport,
                 break;
         case SRB_NACK_PRLI:
                 fcport->fw_login_state = DSC_LS_PRLI_PEND;
+                fcport->deleted = 0;
                 c = "PRLI";
                 break;
         case SRB_NACK_LOGO:
@@ -1215,7 +1241,7 @@ static int qla24xx_get_loop_id(struct scsi_qla_host *vha, const uint8_t *s_id,
         }
 
         /* Get list of logged in devices */
-        rc = qla2x00_get_id_list(vha, gid_list, gid_list_dma, &entries);
+        rc = qla24xx_gidlist_wait(vha, gid_list, gid_list_dma, &entries);
         if (rc != QLA_SUCCESS) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf045,
                     "qla_target(%d): get_id_list() failed: %x\n",
@@ -1551,6 +1577,9 @@ static void qlt_send_notify_ack(struct scsi_qla_host *vha,
         request_t *pkt;
         struct nack_to_isp *nack;
 
+        if (!ha->flags.fw_started)
+                return;
+
         ql_dbg(ql_dbg_tgt, vha, 0xe004, "Sending NOTIFY_ACK (ha=%p)\n", ha);
 
         /* Send marker if required */
@@ -2013,6 +2042,70 @@ void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *mcmd)
 }
 EXPORT_SYMBOL(qlt_free_mcmd);
 
+/*
+ * ha->hardware_lock supposed to be held on entry. Might drop it, then
+ * reacquire
+ */
+void qlt_send_resp_ctio(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
+    uint8_t scsi_status, uint8_t sense_key, uint8_t asc, uint8_t ascq)
+{
+        struct atio_from_isp *atio = &cmd->atio;
+        struct ctio7_to_24xx *ctio;
+        uint16_t temp;
+
+        ql_dbg(ql_dbg_tgt_dif, vha, 0x3066,
+            "Sending response CTIO7 (vha=%p, atio=%p, scsi_status=%02x, "
+            "sense_key=%02x, asc=%02x, ascq=%02x",
+            vha, atio, scsi_status, sense_key, asc, ascq);
+
+        ctio = (struct ctio7_to_24xx *)qla2x00_alloc_iocbs(vha, NULL);
+        if (!ctio) {
+                ql_dbg(ql_dbg_async, vha, 0x3067,
+                    "qla2x00t(%ld): %s failed: unable to allocate request packet",
+                    vha->host_no, __func__);
+                goto out;
+        }
+
+        ctio->entry_type = CTIO_TYPE7;
+        ctio->entry_count = 1;
+        ctio->handle = QLA_TGT_SKIP_HANDLE;
+        ctio->nport_handle = cmd->sess->loop_id;
+        ctio->timeout = cpu_to_le16(QLA_TGT_TIMEOUT);
+        ctio->vp_index = vha->vp_idx;
+        ctio->initiator_id[0] = atio->u.isp24.fcp_hdr.s_id[2];
+        ctio->initiator_id[1] = atio->u.isp24.fcp_hdr.s_id[1];
+        ctio->initiator_id[2] = atio->u.isp24.fcp_hdr.s_id[0];
+        ctio->exchange_addr = atio->u.isp24.exchange_addr;
+        ctio->u.status1.flags = (atio->u.isp24.attr << 9) |
+            cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_1 | CTIO7_FLAGS_SEND_STATUS);
+        temp = be16_to_cpu(atio->u.isp24.fcp_hdr.ox_id);
+        ctio->u.status1.ox_id = cpu_to_le16(temp);
+        ctio->u.status1.scsi_status =
+            cpu_to_le16(SS_RESPONSE_INFO_LEN_VALID | scsi_status);
+        ctio->u.status1.response_len = cpu_to_le16(18);
+        ctio->u.status1.residual = cpu_to_le32(get_datalen_for_atio(atio));
+
+        if (ctio->u.status1.residual != 0)
+                ctio->u.status1.scsi_status |=
+                    cpu_to_le16(SS_RESIDUAL_UNDER);
+
+        /* Response code and sense key */
+        put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
+            (&ctio->u.status1.sense_data)[0]);
+        /* Additional sense length */
+        put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
+        /* ASC and ASCQ */
+        put_unaligned_le32(((asc << 24) | (ascq << 16)),
+            (&ctio->u.status1.sense_data)[3]);
+
+        /* Memory Barrier */
+        wmb();
+
+        qla2x00_start_iocbs(vha, vha->req);
+out:
+        return;
+}
+
 /* callback from target fabric module code */
 void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
 {
@@ -2261,7 +2354,7 @@ static int qlt_24xx_build_ctio_pkt(struct qla_tgt_prm *prm,
                  */
                 return -EAGAIN;
         } else
-                ha->tgt.cmds[h-1] = prm->cmd;
+                ha->tgt.cmds[h - 1] = prm->cmd;
 
         pkt->handle = h | CTIO_COMPLETION_HANDLE_MARK;
         pkt->nport_handle = prm->cmd->loop_id;
@@ -2391,6 +2484,50 @@ static inline int qlt_has_data(struct qla_tgt_cmd *cmd)
         return cmd->bufflen > 0;
 }
 
+static void qlt_print_dif_err(struct qla_tgt_prm *prm)
+{
+        struct qla_tgt_cmd *cmd;
+        struct scsi_qla_host *vha;
+
+        /* asc 0x10=dif error */
+        if (prm->sense_buffer && (prm->sense_buffer[12] == 0x10)) {
+                cmd = prm->cmd;
+                vha = cmd->vha;
+                /* ASCQ */
+                switch (prm->sense_buffer[13]) {
+                case 1:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected Guard TAG ERR: lba[0x%llx|%lld] len[0x%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                case 2:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected APP TAG ERR: lba[0x%llx|%lld] len[0x%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                case 3:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected REF TAG ERR: lba[0x%llx|%lld] len[0x%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                default:
+                        ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                            "BE detected Dif ERR: lba[%llx|%lld] len[%x] "
+                            "se_cmd=%p tag[%x]",
+                            cmd->lba, cmd->lba, cmd->num_blks, &cmd->se_cmd,
+                            cmd->atio.u.isp24.exchange_addr);
+                        break;
+                }
+                ql_dump_buffer(ql_dbg_tgt_dif, vha, 0xffff, cmd->cdb, 16);
+        }
+}
+
 /*
  * Called without ha->hardware_lock held
  */
@@ -2512,18 +2649,9 @@ skip_explict_conf:
                 for (i = 0; i < prm->sense_buffer_len/4; i++)
                         ((uint32_t *)ctio->u.status1.sense_data)[i] =
                                 cpu_to_be32(((uint32_t *)prm->sense_buffer)[i]);
-#if 0
-                if (unlikely((prm->sense_buffer_len % 4) != 0)) {
-                        static int q;
-                        if (q < 10) {
-                                ql_dbg(ql_dbg_tgt, vha, 0xe04f,
-                                    "qla_target(%d): %d bytes of sense "
-                                    "lost", prm->tgt->ha->vp_idx,
-                                    prm->sense_buffer_len % 4);
-                                q++;
-                        }
-                }
-#endif
+
+                qlt_print_dif_err(prm);
+
         } else {
                 ctio->u.status1.flags &=
                     ~cpu_to_le16(CTIO7_FLAGS_STATUS_MODE_0);
@@ -2537,19 +2665,9 @@ skip_explict_conf:
         /* Sense with len > 24, is it possible ??? */
 }
 
-
-
-/* diff  */
 static inline int
 qlt_hba_err_chk_enabled(struct se_cmd *se_cmd)
 {
-        /*
-         * Uncomment when corresponding SCSI changes are done.
-         *
-         if (!sp->cmd->prot_chk)
-         return 0;
-         *
-         */
         switch (se_cmd->prot_op) {
         case TARGET_PROT_DOUT_INSERT:
         case TARGET_PROT_DIN_STRIP:
@@ -2570,16 +2688,38 @@ qlt_hba_err_chk_enabled(struct se_cmd *se_cmd)
         return 0;
 }
 
+static inline int
+qla_tgt_ref_mask_check(struct se_cmd *se_cmd)
+{
+        switch (se_cmd->prot_op) {
+        case TARGET_PROT_DIN_INSERT:
+        case TARGET_PROT_DOUT_INSERT:
+        case TARGET_PROT_DIN_STRIP:
+        case TARGET_PROT_DOUT_STRIP:
+        case TARGET_PROT_DIN_PASS:
+        case TARGET_PROT_DOUT_PASS:
+            return 1;
+        default:
+            return 0;
+        }
+        return 0;
+}
+
 /*
- * qla24xx_set_t10dif_tags_from_cmd - Extract Ref and App tags from SCSI command
- *
+ * qla_tgt_set_dif_tags - Extract Ref and App tags from SCSI command
  */
-static inline void
-qlt_set_t10dif_tags(struct se_cmd *se_cmd, struct crc_context *ctx)
+static void
+qla_tgt_set_dif_tags(struct qla_tgt_cmd *cmd, struct crc_context *ctx,
+    uint16_t *pfw_prot_opts)
 {
+        struct se_cmd *se_cmd = &cmd->se_cmd;
         uint32_t lba = 0xffffffff & se_cmd->t_task_lba;
+        scsi_qla_host_t *vha = cmd->tgt->vha;
+        struct qla_hw_data *ha = vha->hw;
+        uint32_t t32 = 0;
 
-        /* wait til Mode Sense/Select cmd, modepage Ah, subpage 2
+        /*
+         * wait till Mode Sense/Select cmd, modepage Ah, subpage 2
          * have been immplemented by TCM, before AppTag is avail.
          * Look for modesense_handlers[]
          */
@@ -2587,65 +2727,73 @@ qlt_set_t10dif_tags(struct se_cmd *se_cmd, struct crc_context *ctx)
         ctx->app_tag_mask[0] = 0x0;
         ctx->app_tag_mask[1] = 0x0;
 
+        if (IS_PI_UNINIT_CAPABLE(ha)) {
+                if ((se_cmd->prot_type == TARGET_DIF_TYPE1_PROT) ||
+                    (se_cmd->prot_type == TARGET_DIF_TYPE2_PROT))
+                        *pfw_prot_opts |= PO_DIS_VALD_APP_ESC;
+                else if (se_cmd->prot_type == TARGET_DIF_TYPE3_PROT)
+                        *pfw_prot_opts |= PO_DIS_VALD_APP_REF_ESC;
+        }
+
+        t32 = ha->tgt.tgt_ops->get_dif_tags(cmd, pfw_prot_opts);
+
         switch (se_cmd->prot_type) {
         case TARGET_DIF_TYPE0_PROT:
                 /*
-                 * No check for ql2xenablehba_err_chk, as it would be an
-                 * I/O error if hba tag generation is not done.
+                 * No check for ql2xenablehba_err_chk, as it
+                 * would be an I/O error if hba tag generation
+                 * is not done.
                  */
                 ctx->ref_tag = cpu_to_le32(lba);
-
-                if (!qlt_hba_err_chk_enabled(se_cmd))
-                        break;
-
                 /* enable ALL bytes of the ref tag */
                 ctx->ref_tag_mask[0] = 0xff;
                 ctx->ref_tag_mask[1] = 0xff;
                 ctx->ref_tag_mask[2] = 0xff;
                 ctx->ref_tag_mask[3] = 0xff;
                 break;
-        /*
-         * For TYpe 1 protection: 16 bit GUARD tag, 32 bit REF tag, and
-         * 16 bit app tag.
-         */
         case TARGET_DIF_TYPE1_PROT:
-                ctx->ref_tag = cpu_to_le32(lba);
-
-                if (!qlt_hba_err_chk_enabled(se_cmd))
-                        break;
-
-                /* enable ALL bytes of the ref tag */
-                ctx->ref_tag_mask[0] = 0xff;
-                ctx->ref_tag_mask[1] = 0xff;
-                ctx->ref_tag_mask[2] = 0xff;
-                ctx->ref_tag_mask[3] = 0xff;
-                break;
-        /*
-         * For TYPE 2 protection: 16 bit GUARD + 32 bit REF tag has to
-         * match LBA in CDB + N
-         */
+            /*
+             * For TYPE 1 protection: 16 bit GUARD tag, 32 bit
+             * REF tag, and 16 bit app tag.
+             */
+            ctx->ref_tag = cpu_to_le32(lba);
+            if (!qla_tgt_ref_mask_check(se_cmd) ||
+                !(ha->tgt.tgt_ops->chk_dif_tags(t32))) {
+                    *pfw_prot_opts |= PO_DIS_REF_TAG_VALD;
+                    break;
+            }
+            /* enable ALL bytes of the ref tag */
+            ctx->ref_tag_mask[0] = 0xff;
+            ctx->ref_tag_mask[1] = 0xff;
+            ctx->ref_tag_mask[2] = 0xff;
+            ctx->ref_tag_mask[3] = 0xff;
+            break;
         case TARGET_DIF_TYPE2_PROT:
-                ctx->ref_tag = cpu_to_le32(lba);
-
-                if (!qlt_hba_err_chk_enabled(se_cmd))
-                        break;
-
-                /* enable ALL bytes of the ref tag */
-                ctx->ref_tag_mask[0] = 0xff;
-                ctx->ref_tag_mask[1] = 0xff;
-                ctx->ref_tag_mask[2] = 0xff;
-                ctx->ref_tag_mask[3] = 0xff;
-                break;
-
-        /* For Type 3 protection: 16 bit GUARD only */
+            /*
+             * For TYPE 2 protection: 16 bit GUARD + 32 bit REF
+             * tag has to match LBA in CDB + N
+             */
+            ctx->ref_tag = cpu_to_le32(lba);
+            if (!qla_tgt_ref_mask_check(se_cmd) ||
+                !(ha->tgt.tgt_ops->chk_dif_tags(t32))) {
+                    *pfw_prot_opts |= PO_DIS_REF_TAG_VALD;
+                    break;
+            }
+            /* enable ALL bytes of the ref tag */
+            ctx->ref_tag_mask[0] = 0xff;
+            ctx->ref_tag_mask[1] = 0xff;
+            ctx->ref_tag_mask[2] = 0xff;
+            ctx->ref_tag_mask[3] = 0xff;
+            break;
         case TARGET_DIF_TYPE3_PROT:
-                ctx->ref_tag_mask[0] = ctx->ref_tag_mask[1] =
-                        ctx->ref_tag_mask[2] = ctx->ref_tag_mask[3] = 0x00;
-                break;
+            /* For TYPE 3 protection: 16 bit GUARD only */
+            *pfw_prot_opts |= PO_DIS_REF_TAG_VALD;
+            ctx->ref_tag_mask[0] = ctx->ref_tag_mask[1] =
+                ctx->ref_tag_mask[2] = ctx->ref_tag_mask[3] = 0x00;
+            break;
         }
 }
 
-
 static inline int
 qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
 {
@@ -2664,6 +2812,7 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         struct se_cmd           *se_cmd = &cmd->se_cmd;
         uint32_t h;
         struct atio_from_isp *atio = &prm->cmd->atio;
+        struct qla_tc_param     tc;
         uint16_t t16;
 
         ha = vha->hw;
@@ -2689,16 +2838,15 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         case TARGET_PROT_DIN_INSERT:
         case TARGET_PROT_DOUT_STRIP:
                 transfer_length = data_bytes;
-                data_bytes += dif_bytes;
+                if (cmd->prot_sg_cnt)
+                        data_bytes += dif_bytes;
                 break;
-
         case TARGET_PROT_DIN_STRIP:
         case TARGET_PROT_DOUT_INSERT:
         case TARGET_PROT_DIN_PASS:
         case TARGET_PROT_DOUT_PASS:
                 transfer_length = data_bytes + dif_bytes;
                 break;
-
         default:
                 BUG();
                 break;
@@ -2734,7 +2882,6 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
                 break;
         }
 
-
         /* ---- PKT ---- */
         /* Update entry type to indicate Command Type CRC_2 IOCB */
         pkt->entry_type  = CTIO_CRC2;
@@ -2752,9 +2899,8 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         } else
                 ha->tgt.cmds[h-1] = prm->cmd;
 
-
         pkt->handle  = h | CTIO_COMPLETION_HANDLE_MARK;
-        pkt->nport_handle = prm->cmd->loop_id;
+        pkt->nport_handle = cpu_to_le16(prm->cmd->loop_id);
         pkt->timeout = cpu_to_le16(QLA_TGT_TIMEOUT);
         pkt->initiator_id[0] = atio->u.isp24.fcp_hdr.s_id[2];
         pkt->initiator_id[1] = atio->u.isp24.fcp_hdr.s_id[1];
@@ -2775,12 +2921,10 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         else if (cmd->dma_data_direction == DMA_FROM_DEVICE)
                 pkt->flags = cpu_to_le16(CTIO7_FLAGS_DATA_OUT);
 
-
         pkt->dseg_count = prm->tot_dsds;
         /* Fibre channel byte count */
         pkt->transfer_length = cpu_to_le32(transfer_length);
 
-
         /* ----- CRC context -------- */
 
         /* Allocate CRC context from global pool */
@@ -2800,13 +2944,12 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         /* Set handle */
         crc_ctx_pkt->handle = pkt->handle;
 
-        qlt_set_t10dif_tags(se_cmd, crc_ctx_pkt);
+        qla_tgt_set_dif_tags(cmd, crc_ctx_pkt, &fw_prot_opts);
 
         pkt->crc_context_address[0] = cpu_to_le32(LSD(crc_ctx_dma));
         pkt->crc_context_address[1] = cpu_to_le32(MSD(crc_ctx_dma));
         pkt->crc_context_len = CRC_CONTEXT_LEN_FW;
 
-
         if (!bundling) {
                 cur_dsd = (uint32_t *) &crc_ctx_pkt->u.nobundling.data_address;
         } else {
@@ -2827,16 +2970,24 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
         crc_ctx_pkt->byte_count = cpu_to_le32(data_bytes);
         crc_ctx_pkt->guard_seed = cpu_to_le16(0);
 
+        memset((uint8_t *)&tc, 0 , sizeof(tc));
+        tc.vha = vha;
+        tc.blk_sz = cmd->blk_sz;
+        tc.bufflen = cmd->bufflen;
+        tc.sg = cmd->sg;
+        tc.prot_sg = cmd->prot_sg;
+        tc.ctx = crc_ctx_pkt;
+        tc.ctx_dsd_alloced = &cmd->ctx_dsd_alloced;
 
         /* Walks data segments */
         pkt->flags |= cpu_to_le16(CTIO7_FLAGS_DSD_PTR);
 
         if (!bundling && prm->prot_seg_cnt) {
                 if (qla24xx_walk_and_build_sglist_no_difb(ha, NULL, cur_dsd,
-                        prm->tot_dsds, cmd))
+                        prm->tot_dsds, &tc))
                         goto crc_queuing_error;
         } else if (qla24xx_walk_and_build_sglist(ha, NULL, cur_dsd,
-                (prm->tot_dsds - prm->prot_seg_cnt), cmd))
+                (prm->tot_dsds - prm->prot_seg_cnt), &tc))
                 goto crc_queuing_error;
 
         if (bundling && prm->prot_seg_cnt) {
@@ -2845,18 +2996,18 @@ qlt_build_ctio_crc2_pkt(struct qla_tgt_prm *prm, scsi_qla_host_t *vha)
 
                 cur_dsd = (uint32_t *) &crc_ctx_pkt->u.bundling.dif_address;
                 if (qla24xx_walk_and_build_prot_sglist(ha, NULL, cur_dsd,
-                        prm->prot_seg_cnt, cmd))
+                        prm->prot_seg_cnt, &tc))
                         goto crc_queuing_error;
         }
         return QLA_SUCCESS;
 
 crc_queuing_error:
         /* Cleanup will be performed by the caller */
+        vha->hw->tgt.cmds[h - 1] = NULL;
 
         return QLA_FUNCTION_FAILED;
 }
 
-
 /*
  * Callback to setup response of xmit_type of QLA_TGT_XMIT_DATA and *
  * QLA_TGT_XMIT_STATUS for >= 24xx silicon
@@ -2906,7 +3057,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
         else
                 vha->tgt_counters.core_qla_que_buf++;
 
-        if (!vha->flags.online || cmd->reset_count != ha->chip_reset) {
+        if (!ha->flags.fw_started || cmd->reset_count != ha->chip_reset) {
                 /*
                  * Either the port is not online or this request was from
                  * previous life, just abort the processing.
@@ -3047,7 +3198,7 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
 
         spin_lock_irqsave(&ha->hardware_lock, flags);
 
-        if (!vha->flags.online || (cmd->reset_count != ha->chip_reset) ||
+        if (!ha->flags.fw_started || (cmd->reset_count != ha->chip_reset) ||
             (cmd->sess && cmd->sess->deleted)) {
                 /*
                  * Either the port is not online or this request was from
@@ -3104,139 +3255,113 @@ EXPORT_SYMBOL(qlt_rdy_to_xfer);
 
 
 /*
- * Checks the guard or meta-data for the type of error
- * detected by the HBA.
+ * it is assumed either hardware_lock or qpair lock is held.
  */
-static inline int
+static void
 qlt_handle_dif_error(struct scsi_qla_host *vha, struct qla_tgt_cmd *cmd,
-                struct ctio_crc_from_fw *sts)
+        struct ctio_crc_from_fw *sts)
 {
         uint8_t         *ap = &sts->actual_dif[0];
         uint8_t         *ep = &sts->expected_dif[0];
-        uint32_t        e_ref_tag, a_ref_tag;
-        uint16_t        e_app_tag, a_app_tag;
-        uint16_t        e_guard, a_guard;
         uint64_t        lba = cmd->se_cmd.t_task_lba;
+        uint8_t scsi_status, sense_key, asc, ascq;
+        unsigned long flags;
 
-        a_guard   = be16_to_cpu(*(uint16_t *)(ap + 0));
-        a_app_tag = be16_to_cpu(*(uint16_t *)(ap + 2));
-        a_ref_tag = be32_to_cpu(*(uint32_t *)(ap + 4));
-
-        e_guard   = be16_to_cpu(*(uint16_t *)(ep + 0));
-        e_app_tag = be16_to_cpu(*(uint16_t *)(ep + 2));
-        e_ref_tag = be32_to_cpu(*(uint32_t *)(ep + 4));
-
-        ql_dbg(ql_dbg_tgt, vha, 0xe075,
-            "iocb(s) %p Returned STATUS.\n", sts);
-
-        ql_dbg(ql_dbg_tgt, vha, 0xf075,
-            "dif check TGT cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x]\n",
-            cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-            a_ref_tag, e_ref_tag, a_app_tag, e_app_tag, a_guard, e_guard);
-
-        /*
-         * Ignore sector if:
-         * For type     3: ref & app tag is all 'f's
-         * For type 0,1,2: app tag is all 'f's
-         */
-        if ((a_app_tag == 0xffff) &&
-            ((cmd->se_cmd.prot_type != TARGET_DIF_TYPE3_PROT) ||
-             (a_ref_tag == 0xffffffff))) {
-                uint32_t blocks_done;
-
-                /* 2TB boundary case covered automatically with this */
-                blocks_done = e_ref_tag - (uint32_t)lba + 1;
-                cmd->se_cmd.bad_sector = e_ref_tag;
-                cmd->se_cmd.pi_err = 0;
-                ql_dbg(ql_dbg_tgt, vha, 0xf074,
-                        "need to return scsi good\n");
-
-                /* Update protection tag */
-                if (cmd->prot_sg_cnt) {
-                        uint32_t i, k = 0, num_ent;
-                        struct scatterlist *sg, *sgl;
-
-
-                        sgl = cmd->prot_sg;
-
-                        /* Patch the corresponding protection tags */
-                        for_each_sg(sgl, sg, cmd->prot_sg_cnt, i) {
-                                num_ent = sg_dma_len(sg) / 8;
-                                if (k + num_ent < blocks_done) {
-                                        k += num_ent;
-                                        continue;
-                                }
-                                k = blocks_done;
-                                break;
-                        }
+        cmd->trc_flags |= TRC_DIF_ERR;
 
-                        if (k != blocks_done) {
-                                ql_log(ql_log_warn, vha, 0xf076,
-                                    "unexpected tag values tag:lba=%u:%llu)\n",
-                                    e_ref_tag, (unsigned long long)lba);
-                                goto out;
-                        }
+        cmd->a_guard   = be16_to_cpu(*(uint16_t *)(ap + 0));
+        cmd->a_app_tag = be16_to_cpu(*(uint16_t *)(ap + 2));
+        cmd->a_ref_tag = be32_to_cpu(*(uint32_t *)(ap + 4));
 
-#if 0
-                        struct sd_dif_tuple *spt;
-                        /* TODO:
-                         * This section came from initiator. Is it valid here?
-                         * should ulp be override with actual val???
-                         */
-                        spt = page_address(sg_page(sg)) + sg->offset;
-                        spt += j;
+        cmd->e_guard   = be16_to_cpu(*(uint16_t *)(ep + 0));
+        cmd->e_app_tag = be16_to_cpu(*(uint16_t *)(ep + 2));
+        cmd->e_ref_tag = be32_to_cpu(*(uint32_t *)(ep + 4));
 
-                        spt->app_tag = 0xffff;
-                        if (cmd->se_cmd.prot_type == SCSI_PROT_DIF_TYPE3)
-                                spt->ref_tag = 0xffffffff;
-#endif
-                }
+        ql_dbg(ql_dbg_tgt_dif, vha, 0xf075,
+            "%s: aborted %d state %d\n", __func__, cmd->aborted, cmd->state);
 
-                return 0;
-        }
+        scsi_status = sense_key = asc = ascq = 0;
 
-        /* check guard */
-        if (e_guard != a_guard) {
-                cmd->se_cmd.pi_err = TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED;
-                cmd->se_cmd.bad_sector = cmd->se_cmd.t_task_lba;
-
-                ql_log(ql_log_warn, vha, 0xe076,
-                    "Guard ERR: cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x] cmd=%p\n",
-                    cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-                    a_ref_tag, e_ref_tag, a_app_tag, e_app_tag,
-                    a_guard, e_guard, cmd);
-                goto out;
+        /* check appl tag */
+        if (cmd->e_app_tag != cmd->a_app_tag) {
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                        "App Tag ERR: cdb[%x] lba[%llx %llx] blks[%x] [Actual|Expected] "
+                        "Ref[%x|%x], App[%x|%x], "
+                        "Guard [%x|%x] cmd=%p ox_id[%04x]",
+                        cmd->cdb[0], lba, (lba+cmd->num_blks), cmd->num_blks,
+                        cmd->a_ref_tag, cmd->e_ref_tag,
+                        cmd->a_app_tag, cmd->e_app_tag,
+                        cmd->a_guard, cmd->e_guard,
+                        cmd, cmd->atio.u.isp24.fcp_hdr.ox_id);
+
+                cmd->dif_err_code = DIF_ERR_APP;
+                scsi_status = SAM_STAT_CHECK_CONDITION;
+                sense_key = ABORTED_COMMAND;
+                asc = 0x10;
+                ascq = 0x2;
         }
 
         /* check ref tag */
-        if (e_ref_tag != a_ref_tag) {
-                cmd->se_cmd.pi_err = TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
-                cmd->se_cmd.bad_sector = e_ref_tag;
-
-                ql_log(ql_log_warn, vha, 0xe077,
-                        "Ref Tag ERR: cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x] cmd=%p\n",
-                        cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-                        a_ref_tag, e_ref_tag, a_app_tag, e_app_tag,
-                        a_guard, e_guard, cmd);
+        if (cmd->e_ref_tag != cmd->a_ref_tag) {
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                        "Ref Tag ERR: cdb[%x] lba[%llx %llx] blks[%x] [Actual|Expected] "
+                        "Ref[%x|%x], App[%x|%x], "
+                        "Guard[%x|%x] cmd=%p ox_id[%04x] ",
+                        cmd->cdb[0], lba, (lba+cmd->num_blks), cmd->num_blks,
+                        cmd->a_ref_tag, cmd->e_ref_tag,
+                        cmd->a_app_tag, cmd->e_app_tag,
+                        cmd->a_guard, cmd->e_guard,
+                        cmd, cmd->atio.u.isp24.fcp_hdr.ox_id);
+
+                cmd->dif_err_code = DIF_ERR_REF;
+                scsi_status = SAM_STAT_CHECK_CONDITION;
+                sense_key = ABORTED_COMMAND;
+                asc = 0x10;
+                ascq = 0x3;
                 goto out;
         }
 
-        /* check appl tag */
-        if (e_app_tag != a_app_tag) {
-                cmd->se_cmd.pi_err = TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED;
-                cmd->se_cmd.bad_sector = cmd->se_cmd.t_task_lba;
-
-                ql_log(ql_log_warn, vha, 0xe078,
-                        "App Tag ERR: cdb 0x%x lba 0x%llx: [Actual|Expected] Ref Tag[0x%x|0x%x], App Tag [0x%x|0x%x], Guard [0x%x|0x%x] cmd=%p\n",
-                        cmd->atio.u.isp24.fcp_cmnd.cdb[0], lba,
-                        a_ref_tag, e_ref_tag, a_app_tag, e_app_tag,
-                        a_guard, e_guard, cmd);
-                goto out;
+        /* check guard */
+        if (cmd->e_guard != cmd->a_guard) {
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                        "Guard ERR: cdb[%x] lba[%llx %llx] blks[%x] [Actual|Expected] "
+                        "Ref[%x|%x], App[%x|%x], "
+                        "Guard [%x|%x] cmd=%p ox_id[%04x]",
+                        cmd->cdb[0], lba, (lba+cmd->num_blks), cmd->num_blks,
+                        cmd->a_ref_tag, cmd->e_ref_tag,
+                        cmd->a_app_tag, cmd->e_app_tag,
+                        cmd->a_guard, cmd->e_guard,
+                        cmd, cmd->atio.u.isp24.fcp_hdr.ox_id);
+                cmd->dif_err_code = DIF_ERR_GRD;
+                scsi_status = SAM_STAT_CHECK_CONDITION;
+                sense_key = ABORTED_COMMAND;
+                asc = 0x10;
+                ascq = 0x1;
         }
 out:
-        return 1;
-}
+        switch (cmd->state) {
+        case QLA_TGT_STATE_NEED_DATA:
+                /* handle_data will load DIF error code  */
+                cmd->state = QLA_TGT_STATE_DATA_IN;
+                vha->hw->tgt.tgt_ops->handle_data(cmd);
+                break;
+        default:
+                spin_lock_irqsave(&cmd->cmd_lock, flags);
+                if (cmd->aborted) {
+                        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                        vha->hw->tgt.tgt_ops->free_cmd(cmd);
+                        break;
+                }
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
 
+                qlt_send_resp_ctio(vha, cmd, scsi_status, sense_key, asc, ascq);
+                /* assume scsi status gets out on the wire.
+                 * Will not wait for completion.
+                 */
+                vha->hw->tgt.tgt_ops->free_cmd(cmd);
+                break;
+        }
+}
 
 /* If hardware_lock held on entry, might drop it, then reaquire */
 /* This function sends the appropriate CTIO to ISP 2xxx or 24xx */
@@ -3251,7 +3376,7 @@ static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha,
         ql_dbg(ql_dbg_tgt_tmr, vha, 0xe01c,
             "Sending TERM ELS CTIO (ha=%p)\n", ha);
 
-        pkt = (request_t *)qla2x00_alloc_iocbs_ready(vha, NULL);
+        pkt = (request_t *)qla2x00_alloc_iocbs(vha, NULL);
         if (pkt == NULL) {
                 ql_dbg(ql_dbg_tgt, vha, 0xe080,
                     "qla_target(%d): %s failed: unable to allocate "
@@ -3543,6 +3668,16 @@ static int qlt_term_ctio_exchange(struct scsi_qla_host *vha, void *ctio,
 {
         int term = 0;
 
+        if (cmd->se_cmd.prot_op)
+                ql_dbg(ql_dbg_tgt_dif, vha, 0xffff,
+                    "Term DIF cmd: lba[0x%llx|%lld] len[0x%x] "
+                    "se_cmd=%p tag[%x] op %#x/%s",
+                     cmd->lba, cmd->lba,
+                     cmd->num_blks, &cmd->se_cmd,
+                     cmd->atio.u.isp24.exchange_addr,
+                     cmd->se_cmd.prot_op,
+                     prot_op_str(cmd->se_cmd.prot_op));
+
         if (ctio != NULL) {
                 struct ctio7_from_24xx *c = (struct ctio7_from_24xx *)ctio;
                 term = !(c->flags &
@@ -3760,32 +3895,15 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                         struct ctio_crc_from_fw *crc =
                                 (struct ctio_crc_from_fw *)ctio;
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf073,
-                            "qla_target(%d): CTIO with DIF_ERROR status %x received (state %x, se_cmd %p) actual_dif[0x%llx] expect_dif[0x%llx]\n",
+                            "qla_target(%d): CTIO with DIF_ERROR status %x "
+                            "received (state %x, ulp_cmd %p) actual_dif[0x%llx] "
+                            "expect_dif[0x%llx]\n",
                             vha->vp_idx, status, cmd->state, se_cmd,
                             *((u64 *)&crc->actual_dif[0]),
                             *((u64 *)&crc->expected_dif[0]));
 
-                        if (qlt_handle_dif_error(vha, cmd, ctio)) {
-                                if (cmd->state == QLA_TGT_STATE_NEED_DATA) {
-                                        /* scsi Write/xfer rdy complete */
-                                        goto skip_term;
-                                } else {
-                                        /* scsi read/xmit respond complete
-                                         * call handle dif to send scsi status
-                                         * rather than terminate exchange.
-                                         */
-                                        cmd->state = QLA_TGT_STATE_PROCESSED;
-                                        ha->tgt.tgt_ops->handle_dif_err(cmd);
-                                        return;
-                                }
-                        } else {
-                                /* Need to generate a SCSI good completion.
-                                 * because FW did not send scsi status.
-                                 */
-                                status = 0;
-                                goto skip_term;
-                        }
-                        break;
+                        qlt_handle_dif_error(vha, cmd, ctio);
+                        return;
                 }
                 default:
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf05b,
@@ -3808,7 +3926,6 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                                 return;
                 }
         }
-skip_term:
 
         if (cmd->state == QLA_TGT_STATE_PROCESSED) {
                 cmd->trc_flags |= TRC_CTIO_DONE;
@@ -4584,7 +4701,8 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                 }
 
                 if (sess != NULL) {
-                        if (sess->fw_login_state == DSC_LS_PLOGI_PEND) {
+                        if (sess->fw_login_state != DSC_LS_PLOGI_PEND &&
+                            sess->fw_login_state != DSC_LS_PLOGI_COMP) {
                                 /*
                                  * Impatient initiator sent PRLI before last
                                  * PLOGI could finish. Will force him to re-try,
@@ -4623,15 +4741,23 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
 
                 /* Make session global (not used in fabric mode) */
                 if (ha->current_topology != ISP_CFG_F) {
-                        set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
-                        set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
-                        qla2xxx_wake_dpc(vha);
+                        if (sess) {
+                                ql_dbg(ql_dbg_disc, vha, 0xffff,
+                                    "%s %d %8phC post nack\n",
+                                    __func__, __LINE__, sess->port_name);
+                                qla24xx_post_nack_work(vha, sess, iocb,
+                                        SRB_NACK_PRLI);
+                                res = 0;
+                        } else {
+                                set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+                                set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+                                qla2xxx_wake_dpc(vha);
+                        }
                 } else {
                         if (sess) {
                                 ql_dbg(ql_dbg_disc, vha, 0xffff,
-                                           "%s %d %8phC post nack\n",
-                                           __func__, __LINE__, sess->port_name);
-
+                                    "%s %d %8phC post nack\n",
+                                    __func__, __LINE__, sess->port_name);
                                 qla24xx_post_nack_work(vha, sess, iocb,
                                         SRB_NACK_PRLI);
                                 res = 0;
@@ -4639,7 +4765,6 @@ static int qlt_24xx_handle_els(struct scsi_qla_host *vha,
                 }
                 break;
 
-
         case ELS_TPRLO:
                 if (le16_to_cpu(iocb->u.isp24.flags) &
                         NOTIFY24XX_FLAGS_GLOBAL_TPRLO) {
@@ -5079,16 +5204,22 @@ qlt_send_busy(struct scsi_qla_host *vha,
 
 static int
 qlt_chk_qfull_thresh_hold(struct scsi_qla_host *vha,
-        struct atio_from_isp *atio)
+        struct atio_from_isp *atio, bool ha_locked)
 {
         struct qla_hw_data *ha = vha->hw;
         uint16_t status;
+        unsigned long flags;
 
         if (ha->tgt.num_pend_cmds < Q_FULL_THRESH_HOLD(ha))
                 return 0;
 
+        if (!ha_locked)
+                spin_lock_irqsave(&ha->hardware_lock, flags);
         status = temp_sam_status;
         qlt_send_busy(vha, atio, status);
+        if (!ha_locked)
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
         return 1;
 }
 
@@ -5103,7 +5234,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
         unsigned long flags;
 
         if (unlikely(tgt == NULL)) {
-                ql_dbg(ql_dbg_io, vha, 0x3064,
+                ql_dbg(ql_dbg_tgt, vha, 0x3064,
                     "ATIO pkt, but no tgt (ha %p)", ha);
                 return;
         }
@@ -5133,7 +5264,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
 
 
                 if (likely(atio->u.isp24.fcp_cmnd.task_mgmt_flags == 0)) {
-                        rc = qlt_chk_qfull_thresh_hold(vha, atio);
+                        rc = qlt_chk_qfull_thresh_hold(vha, atio, ha_locked);
                         if (rc != 0) {
                                 tgt->atio_irq_cmd_count--;
                                 return;
@@ -5256,7 +5387,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
                         break;
                 }
 
-                rc = qlt_chk_qfull_thresh_hold(vha, atio);
+                rc = qlt_chk_qfull_thresh_hold(vha, atio, true);
                 if (rc != 0) {
                         tgt->irq_cmd_count--;
                         return;
@@ -5531,7 +5662,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha,
 
         fcport->loop_id = loop_id;
 
-        rc = qla2x00_get_port_database(vha, fcport, 0);
+        rc = qla24xx_gpdb_wait(vha, fcport, 0);
         if (rc != QLA_SUCCESS) {
                 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf070,
                     "qla_target(%d): Failed to retrieve fcport "
@@ -5713,30 +5844,23 @@ static void qlt_abort_work(struct qla_tgt *tgt,
                 }
         }
 
-        spin_lock_irqsave(&ha->hardware_lock, flags);
-
-        if (tgt->tgt_stop)
-                goto out_term;
-
         rc = __qlt_24xx_handle_abts(vha, &prm->abts, sess);
+        ha->tgt.tgt_ops->put_sess(sess);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
+
         if (rc != 0)
                 goto out_term;
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
-        if (sess)
-                ha->tgt.tgt_ops->put_sess(sess);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
         return;
 
 out_term2:
-        spin_lock_irqsave(&ha->hardware_lock, flags);
+        if (sess)
+                ha->tgt.tgt_ops->put_sess(sess);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
 
 out_term:
+        spin_lock_irqsave(&ha->hardware_lock, flags);
         qlt_24xx_send_abts_resp(vha, &prm->abts, FCP_TMF_REJECTED, false);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
-
-        if (sess)
-                ha->tgt.tgt_ops->put_sess(sess);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
 }
 
 static void qlt_tmr_work(struct qla_tgt *tgt,
@@ -5756,7 +5880,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
         spin_lock_irqsave(&ha->tgt.sess_lock, flags);
 
         if (tgt->tgt_stop)
-                goto out_term;
+                goto out_term2;
 
         s_id = prm->tm_iocb2.u.isp24.fcp_hdr.s_id;
         sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id);
@@ -5768,11 +5892,11 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
 
                 spin_lock_irqsave(&ha->tgt.sess_lock, flags);
                 if (!sess)
-                        goto out_term;
+                        goto out_term2;
         } else {
                 if (sess->deleted) {
                         sess = NULL;
-                        goto out_term;
+                        goto out_term2;
                 }
 
                 if (!kref_get_unless_zero(&sess->sess_kref)) {
@@ -5780,7 +5904,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
                             "%s: kref_get fail %8phC\n",
                              __func__, sess->port_name);
                         sess = NULL;
-                        goto out_term;
+                        goto out_term2;
                 }
         }
 
@@ -5790,17 +5914,19 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
         unpacked_lun = scsilun_to_int((struct scsi_lun *)&lun);
 
         rc = qlt_issue_task_mgmt(sess, unpacked_lun, fn, iocb, 0);
-        if (rc != 0)
-                goto out_term;
-
         ha->tgt.tgt_ops->put_sess(sess);
         spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
+
+        if (rc != 0)
+                goto out_term;
         return;
 
+out_term2:
+        if (sess)
+                ha->tgt.tgt_ops->put_sess(sess);
+        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
 out_term:
         qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 1, 0);
-        ha->tgt.tgt_ops->put_sess(sess);
-        spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
 }
 
 static void qlt_sess_work_fn(struct work_struct *work)
@@ -5893,13 +6019,13 @@ int qlt_add_target(struct qla_hw_data *ha, struct scsi_qla_host *base_vha)
         tgt->datasegs_per_cmd = QLA_TGT_DATASEGS_PER_CMD_24XX;
         tgt->datasegs_per_cont = QLA_TGT_DATASEGS_PER_CONT_24XX;
 
-        if (base_vha->fc_vport)
-                return 0;
-
         mutex_lock(&qla_tgt_mutex);
         list_add_tail(&tgt->tgt_list_entry, &qla_tgt_glist);
         mutex_unlock(&qla_tgt_mutex);
 
+        if (ha->tgt.tgt_ops && ha->tgt.tgt_ops->add_target)
+                ha->tgt.tgt_ops->add_target(base_vha);
+
         return 0;
 }
 
@@ -5928,6 +6054,17 @@ int qlt_remove_target(struct qla_hw_data *ha, struct scsi_qla_host *vha)
         return 0;
 }
 
+void qlt_remove_target_resources(struct qla_hw_data *ha)
+{
+        struct scsi_qla_host *node;
+        u32 key = 0;
+
+        btree_for_each_safe32(&ha->tgt.host_map, key, node)
+                btree_remove32(&ha->tgt.host_map, key);
+
+        btree_destroy32(&ha->tgt.host_map);
+}
+
 static void qlt_lport_dump(struct scsi_qla_host *vha, u64 wwpn,
         unsigned char *b)
 {
@@ -6234,7 +6371,7 @@ qlt_24xx_process_atio_queue(struct scsi_qla_host *vha, uint8_t ha_locked)
         struct atio_from_isp *pkt;
         int cnt, i;
 
-        if (!vha->flags.online)
+        if (!ha->flags.fw_started)
                 return;
 
         while ((ha->tgt.atio_ring_ptr->signature != ATIO_PROCESSED) ||
@@ -6581,6 +6718,8 @@ qlt_modify_vp_config(struct scsi_qla_host *vha,
 void
 qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha)
 {
+        int rc;
+
         if (!QLA_TGT_MODE_ENABLED())
                 return;
 
@@ -6600,6 +6739,13 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha)
             qlt_unknown_atio_work_fn);
 
         qlt_clear_mode(base_vha);
+
+        rc = btree_init32(&ha->tgt.host_map);
+        if (rc)
+                ql_log(ql_log_info, base_vha, 0xffff,
+                    "Unable to initialize ha->host_map btree\n");
+
+        qlt_update_vp_map(base_vha, SET_VP_IDX);
 }
 
 irqreturn_t
@@ -6642,6 +6788,8 @@ qlt_handle_abts_recv_work(struct work_struct *work)
         spin_lock_irqsave(&ha->hardware_lock, flags);
         qlt_response_pkt_all_vps(vha, (response_t *)&op->atio);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+        kfree(op);
 }
 
 void
@@ -6706,25 +6854,69 @@ qlt_mem_free(struct qla_hw_data *ha)
 void
 qlt_update_vp_map(struct scsi_qla_host *vha, int cmd)
 {
+        void *slot;
+        u32 key;
+        int rc;
+
         if (!QLA_TGT_MODE_ENABLED())
                 return;
 
+        key = vha->d_id.b24;
+
         switch (cmd) {
         case SET_VP_IDX:
                 vha->hw->tgt.tgt_vp_map[vha->vp_idx].vha = vha;
                 break;
         case SET_AL_PA:
-                vha->hw->tgt.tgt_vp_map[vha->d_id.b.al_pa].idx = vha->vp_idx;
+                slot = btree_lookup32(&vha->hw->tgt.host_map, key);
+                if (!slot) {
+                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                            "Save vha in host_map %p %06x\n", vha, key);
+                        rc = btree_insert32(&vha->hw->tgt.host_map,
+                                key, vha, GFP_ATOMIC);
+                        if (rc)
+                                ql_log(ql_log_info, vha, 0xffff,
+                                    "Unable to insert s_id into host_map: %06x\n",
+                                    key);
+                        return;
+                }
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                        "replace existing vha in host_map %p %06x\n", vha, key);
+                btree_update32(&vha->hw->tgt.host_map, key, vha);
                 break;
         case RESET_VP_IDX:
                 vha->hw->tgt.tgt_vp_map[vha->vp_idx].vha = NULL;
                 break;
         case RESET_AL_PA:
-                vha->hw->tgt.tgt_vp_map[vha->d_id.b.al_pa].idx = 0;
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                   "clear vha in host_map %p %06x\n", vha, key);
+                slot = btree_lookup32(&vha->hw->tgt.host_map, key);
+                if (slot)
+                        btree_remove32(&vha->hw->tgt.host_map, key);
+                vha->d_id.b24 = 0;
                 break;
         }
 }
 
+void qlt_update_host_map(struct scsi_qla_host *vha, port_id_t id)
+{
+        unsigned long flags;
+        struct qla_hw_data *ha = vha->hw;
+
+        if (!vha->d_id.b24) {
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                vha->d_id = id;
+                qlt_update_vp_map(vha, SET_AL_PA);
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+        } else if (vha->d_id.b24 != id.b24) {
+                spin_lock_irqsave(&ha->vport_slock, flags);
+                qlt_update_vp_map(vha, RESET_AL_PA);
+                vha->d_id = id;
+                qlt_update_vp_map(vha, SET_AL_PA);
+                spin_unlock_irqrestore(&ha->vport_slock, flags);
+        }
+}
+
 static int __init qlt_parse_ini_mode(void)
 {
         if (strcasecmp(qlini_mode, QLA2XXX_INI_MODE_STR_EXCLUSIVE) == 0)
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index a7f90dcaae37..d64420251194 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -378,6 +378,14 @@ static inline void adjust_corrupted_atio(struct atio_from_isp *atio)
         atio->u.isp24.fcp_cmnd.add_cdb_len = 0;
 }
 
+static inline int get_datalen_for_atio(struct atio_from_isp *atio)
+{
+        int len = atio->u.isp24.fcp_cmnd.add_cdb_len;
+
+        return (be32_to_cpu(get_unaligned((uint32_t *)
+            &atio->u.isp24.fcp_cmnd.add_cdb[len * 4])));
+}
+
 #define CTIO_TYPE7 0x12 /* Continue target I/O entry (for 24xx) */
 
 /*
@@ -667,7 +675,6 @@ struct qla_tgt_func_tmpl {
         int (*handle_cmd)(struct scsi_qla_host *, struct qla_tgt_cmd *,
                         unsigned char *, uint32_t, int, int, int);
         void (*handle_data)(struct qla_tgt_cmd *);
-        void (*handle_dif_err)(struct qla_tgt_cmd *);
         int (*handle_tmr)(struct qla_tgt_mgmt_cmd *, uint32_t, uint16_t,
                         uint32_t);
         void (*free_cmd)(struct qla_tgt_cmd *);
@@ -684,6 +691,9 @@ struct qla_tgt_func_tmpl {
         void (*clear_nacl_from_fcport_map)(struct fc_port *);
         void (*put_sess)(struct fc_port *);
         void (*shutdown_sess)(struct fc_port *);
+        int (*get_dif_tags)(struct qla_tgt_cmd *cmd, uint16_t *pfw_prot_opts);
+        int (*chk_dif_tags)(uint32_t tag);
+        void (*add_target)(struct scsi_qla_host *);
 };
 
 int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
@@ -720,8 +730,8 @@ int qla2x00_wait_for_hba_online(struct scsi_qla_host *);
 #define QLA_TGT_ABORT_ALL               0xFFFE
 #define QLA_TGT_NEXUS_LOSS_SESS         0xFFFD
 #define QLA_TGT_NEXUS_LOSS              0xFFFC
-#define QLA_TGT_ABTS                                    0xFFFB
-#define QLA_TGT_2G_ABORT_TASK                   0xFFFA
+#define QLA_TGT_ABTS                    0xFFFB
+#define QLA_TGT_2G_ABORT_TASK           0xFFFA
 
 /* Notify Acknowledge flags */
 #define NOTIFY_ACK_RES_COUNT        BIT_8
@@ -845,6 +855,7 @@ enum trace_flags {
         TRC_CMD_FREE = BIT_17,
         TRC_DATA_IN = BIT_18,
         TRC_ABORT = BIT_19,
+        TRC_DIF_ERR = BIT_20,
 };
 
 struct qla_tgt_cmd {
@@ -862,7 +873,6 @@ struct qla_tgt_cmd {
         unsigned int sg_mapped:1;
         unsigned int free_sg:1;
         unsigned int write_data_transferred:1;
-        unsigned int ctx_dsd_alloced:1;
         unsigned int q_full:1;
         unsigned int term_exchg:1;
         unsigned int cmd_sent_to_fw:1;
@@ -885,11 +895,25 @@ struct qla_tgt_cmd {
         struct list_head cmd_list;
 
         struct atio_from_isp atio;
-        /* t10dif */
+
+        uint8_t ctx_dsd_alloced;
+
+        /* T10-DIF */
+#define DIF_ERR_NONE 0
+#define DIF_ERR_GRD 1
+#define DIF_ERR_REF 2
+#define DIF_ERR_APP 3
+        int8_t dif_err_code;
         struct scatterlist *prot_sg;
         uint32_t prot_sg_cnt;
-        uint32_t blk_sz;
+        uint32_t blk_sz, num_blks;
+        uint8_t scsi_status, sense_key, asc, ascq;
+
         struct crc_context *ctx;
+        uint8_t         *cdb;
+        uint64_t        lba;
+        uint16_t        a_guard, e_guard, a_app_tag, e_app_tag;
+        uint32_t        a_ref_tag, e_ref_tag;
 
         uint64_t jiffies_at_alloc;
         uint64_t jiffies_at_free;
@@ -1053,4 +1077,7 @@ extern int qlt_free_qfull_cmds(struct scsi_qla_host *);
 extern void qlt_logo_completion_handler(fc_port_t *, int);
 extern void qlt_do_generation_tick(struct scsi_qla_host *, int *);
 
+void qlt_send_resp_ctio(scsi_qla_host_t *, struct qla_tgt_cmd *, uint8_t,
+    uint8_t, uint8_t, uint8_t);
+
 #endif /* __QLA_TARGET_H */
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 3cb1964b7786..45bc84e8e3bf 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,9 +7,9 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.07.00.38-k"
+#define QLA2XXX_VERSION      "9.00.00.00-k"
 
-#define QLA_DRIVER_MAJOR_VER    8
-#define QLA_DRIVER_MINOR_VER    7
+#define QLA_DRIVER_MAJOR_VER    9
+#define QLA_DRIVER_MINOR_VER    0
 #define QLA_DRIVER_PATCH_VER    0
 #define QLA_DRIVER_BETA_VER     0
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 8e8ab0fa9672..7443e4efa3ae 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -531,6 +531,24 @@ static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
                         return;
                 }
 
+                switch (cmd->dif_err_code) {
+                case DIF_ERR_GRD:
+                        cmd->se_cmd.pi_err =
+                            TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED;
+                        break;
+                case DIF_ERR_REF:
+                        cmd->se_cmd.pi_err =
+                            TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED;
+                        break;
+                case DIF_ERR_APP:
+                        cmd->se_cmd.pi_err =
+                            TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED;
+                        break;
+                case DIF_ERR_NONE:
+                default:
+                        break;
+                }
+
                 if (cmd->se_cmd.pi_err)
                         transport_generic_request_failure(&cmd->se_cmd,
                                 cmd->se_cmd.pi_err);
@@ -555,25 +573,23 @@ static void tcm_qla2xxx_handle_data(struct qla_tgt_cmd *cmd)
         queue_work_on(smp_processor_id(), tcm_qla2xxx_free_wq, &cmd->work);
 }
 
-static void tcm_qla2xxx_handle_dif_work(struct work_struct *work)
+static int tcm_qla2xxx_chk_dif_tags(uint32_t tag)
 {
-        struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
-
-        /* take an extra kref to prevent cmd free too early.
-         * need to wait for SCSI status/check condition to
-         * finish responding generate by transport_generic_request_failure.
-         */
-        kref_get(&cmd->se_cmd.cmd_kref);
-        transport_generic_request_failure(&cmd->se_cmd, cmd->se_cmd.pi_err);
+        return 0;
 }
 
-/*
- * Called from qla_target.c:qlt_do_ctio_completion()
- */
-static void tcm_qla2xxx_handle_dif_err(struct qla_tgt_cmd *cmd)
+static int tcm_qla2xxx_dif_tags(struct qla_tgt_cmd *cmd,
+    uint16_t *pfw_prot_opts)
 {
-        INIT_WORK(&cmd->work, tcm_qla2xxx_handle_dif_work);
-        queue_work(tcm_qla2xxx_free_wq, &cmd->work);
+        struct se_cmd *se_cmd = &cmd->se_cmd;
+
+        if (!(se_cmd->prot_checks & TARGET_DIF_CHECK_GUARD))
+                *pfw_prot_opts |= PO_DISABLE_GUARD_CHECK;
+
+        if (!(se_cmd->prot_checks & TARGET_DIF_CHECK_APPTAG))
+                *pfw_prot_opts |= PO_DIS_APP_TAG_VALD;
+
+        return 0;
 }
 
 /*
@@ -1610,7 +1626,6 @@ static void tcm_qla2xxx_update_sess(struct fc_port *sess, port_id_t s_id,
 static struct qla_tgt_func_tmpl tcm_qla2xxx_template = {
         .handle_cmd             = tcm_qla2xxx_handle_cmd,
         .handle_data            = tcm_qla2xxx_handle_data,
-        .handle_dif_err         = tcm_qla2xxx_handle_dif_err,
         .handle_tmr             = tcm_qla2xxx_handle_tmr,
         .free_cmd               = tcm_qla2xxx_free_cmd,
         .free_mcmd              = tcm_qla2xxx_free_mcmd,
@@ -1622,6 +1637,8 @@ static struct qla_tgt_func_tmpl tcm_qla2xxx_template = {
         .clear_nacl_from_fcport_map = tcm_qla2xxx_clear_nacl_from_fcport_map,
         .put_sess               = tcm_qla2xxx_put_sess,
         .shutdown_sess          = tcm_qla2xxx_shutdown_sess,
+        .get_dif_tags           = tcm_qla2xxx_dif_tags,
+        .chk_dif_tags           = tcm_qla2xxx_chk_dif_tags,
 };
 
 static int tcm_qla2xxx_init_lport(struct tcm_qla2xxx_lport *lport)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ba2286652ff6..e5a2d590a104 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -496,7 +496,7 @@ static void scsi_run_queue(struct request_queue *q)
                 scsi_starved_list_run(sdev->host);
 
         if (q->mq_ops)
-                blk_mq_start_stopped_hw_queues(q, false);
+                blk_mq_run_hw_queues(q, false);
         else
                 blk_run_queue(q);
 }
@@ -667,7 +667,7 @@ static bool scsi_end_request(struct request *req, int error,
                     !list_empty(&sdev->host->starved_list))
                         kblockd_schedule_work(&sdev->requeue_work);
                 else
-                        blk_mq_start_stopped_hw_queues(q, true);
+                        blk_mq_run_hw_queues(q, true);
         } else {
                 unsigned long flags;
 
@@ -1974,7 +1974,7 @@ out:
         case BLK_MQ_RQ_QUEUE_BUSY:
                 if (atomic_read(&sdev->device_busy) == 0 &&
                     !scsi_device_blocked(sdev))
-                        blk_mq_delay_queue(hctx, SCSI_QUEUE_DELAY);
+                        blk_mq_delay_run_hw_queue(hctx, SCSI_QUEUE_DELAY);
                 break;
         case BLK_MQ_RQ_QUEUE_ERROR:
                 /*
@@ -2932,6 +2932,8 @@ EXPORT_SYMBOL(scsi_target_resume);
 /**
  * scsi_internal_device_block - internal function to put a device temporarily into the SDEV_BLOCK state
  * @sdev:       device to block
+ * @wait:       Whether or not to wait until ongoing .queuecommand() /
+ *              .queue_rq() calls have finished.
  *
  * Block request made by scsi lld's to temporarily stop all
  * scsi commands on the specified device. May sleep.
@@ -2949,7 +2951,7 @@ EXPORT_SYMBOL(scsi_target_resume);
  * remove the rport mutex lock and unlock calls from srp_queuecommand().
  */
 int
-scsi_internal_device_block(struct scsi_device *sdev)
+scsi_internal_device_block(struct scsi_device *sdev, bool wait)
 {
         struct request_queue *q = sdev->request_queue;
         unsigned long flags;
@@ -2969,12 +2971,16 @@ scsi_internal_device_block(struct scsi_device *sdev)
          * request queue. 
          */
         if (q->mq_ops) {
-                blk_mq_quiesce_queue(q);
+                if (wait)
+                        blk_mq_quiesce_queue(q);
+                else
+                        blk_mq_stop_hw_queues(q);
         } else {
                 spin_lock_irqsave(q->queue_lock, flags);
                 blk_stop_queue(q);
                 spin_unlock_irqrestore(q->queue_lock, flags);
-                scsi_wait_for_queuecommand(sdev);
+                if (wait)
+                        scsi_wait_for_queuecommand(sdev);
         }
 
         return 0;
@@ -3036,7 +3042,7 @@ EXPORT_SYMBOL_GPL(scsi_internal_device_unblock);
 static void
 device_block(struct scsi_device *sdev, void *data)
 {
-        scsi_internal_device_block(sdev);
+        scsi_internal_device_block(sdev, true);
 }
 
 static int
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 99bfc985e190..f11bd102d6d5 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -188,8 +188,5 @@ static inline void scsi_dh_remove_device(struct scsi_device *sdev) { }
  */
 
 #define SCSI_DEVICE_BLOCK_MAX_TIMEOUT   600     /* units in seconds */
-extern int scsi_internal_device_block(struct scsi_device *sdev);
-extern int scsi_internal_device_unblock(struct scsi_device *sdev,
-                                        enum scsi_device_state new_state);
 
 #endif /* _SCSI_PRIV_H */
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index c7839f6c35cc..35ad5e8a31ab 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1783,6 +1783,8 @@ static int sd_done(struct scsi_cmnd *SCpnt)
 {
         int result = SCpnt->result;
         unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
+        unsigned int sector_size = SCpnt->device->sector_size;
+        unsigned int resid;
         struct scsi_sense_hdr sshdr;
         struct scsi_disk *sdkp = scsi_disk(SCpnt->request->rq_disk);
         struct request *req = SCpnt->request;
@@ -1813,6 +1815,21 @@ static int sd_done(struct scsi_cmnd *SCpnt)
                         scsi_set_resid(SCpnt, blk_rq_bytes(req));
                 }
                 break;
+        default:
+                /*
+                 * In case of bogus fw or device, we could end up having
+                 * an unaligned partial completion. Check this here and force
+                 * alignment.
+                 */
+                resid = scsi_get_resid(SCpnt);
+                if (resid & (sector_size - 1)) {
+                        sd_printk(KERN_INFO, sdkp,
+                                "Unaligned partial completion (resid=%u, sector_sz=%u)\n",
+                                resid, sector_size);
+                        resid = min(scsi_bufflen(SCpnt),
+                                    round_up(resid, sector_size));
+                        scsi_set_resid(SCpnt, resid);
+                }
         }
 
         if (result) {
@@ -2085,6 +2102,22 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp,
 
 #define READ_CAPACITY_RETRIES_ON_RESET  10
 
+/*
+ * Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set
+ * and the reported logical block size is bigger than 512 bytes. Note
+ * that last_sector is a u64 and therefore logical_to_sectors() is not
+ * applicable.
+ */
+static bool sd_addressable_capacity(u64 lba, unsigned int sector_size)
+{
+        u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9);
+
+        if (sizeof(sector_t) == 4 && last_sector > U32_MAX)
+                return false;
+
+        return true;
+}
+
 static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                                                 unsigned char *buffer)
 {
@@ -2150,7 +2183,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return -ENODEV;
         }
 
-        if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
+        if (!sd_addressable_capacity(lba, sector_size)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
                         "kernel compiled with support for large block "
                         "devices.\n");
@@ -2239,7 +2272,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
                 return sector_size;
         }
 
-        if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
+        if (!sd_addressable_capacity(lba, sector_size)) {
                 sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
                         "kernel compiled with support for large block "
                         "devices.\n");
@@ -2939,7 +2972,8 @@ static int sd_revalidate_disk(struct gendisk *disk)
                 q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
                 rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
         } else
-                rw_max = BLK_DEF_MAX_SECTORS;
+                rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
+                                      (sector_t)BLK_DEF_MAX_SECTORS);
 
         /* Combine with controller limits */
         q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
@@ -3075,23 +3109,6 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
         put_device(&sdkp->dev);
 }
 
-struct sd_devt {
-        int idx;
-        struct disk_devt disk_devt;
-};
-
-static void sd_devt_release(struct disk_devt *disk_devt)
-{
-        struct sd_devt *sd_devt = container_of(disk_devt, struct sd_devt,
-                        disk_devt);
-
-        spin_lock(&sd_index_lock);
-        ida_remove(&sd_index_ida, sd_devt->idx);
-        spin_unlock(&sd_index_lock);
-
-        kfree(sd_devt);
-}
-
 /**
  *      sd_probe - called during driver initialization and whenever a
  *      new scsi device is attached to the system. It is called once
@@ -3113,7 +3130,6 @@ static void sd_devt_release(struct disk_devt *disk_devt)
 static int sd_probe(struct device *dev)
 {
         struct scsi_device *sdp = to_scsi_device(dev);
-        struct sd_devt *sd_devt;
         struct scsi_disk *sdkp;
         struct gendisk *gd;
         int index;
@@ -3139,13 +3155,9 @@ static int sd_probe(struct device *dev)
         if (!sdkp)
                 goto out;
 
-        sd_devt = kzalloc(sizeof(*sd_devt), GFP_KERNEL);
-        if (!sd_devt)
-                goto out_free;
-
         gd = alloc_disk(SD_MINORS);
         if (!gd)
-                goto out_free_devt;
+                goto out_free;
 
         do {
                 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
@@ -3161,11 +3173,6 @@ static int sd_probe(struct device *dev)
                 goto out_put;
         }
 
-        atomic_set(&sd_devt->disk_devt.count, 1);
-        sd_devt->disk_devt.release = sd_devt_release;
-        sd_devt->idx = index;
-        gd->disk_devt = &sd_devt->disk_devt;
-
         error = sd_format_disk_name("sd", index, gd->disk_name, DISK_NAME_LEN);
         if (error) {
                 sdev_printk(KERN_WARNING, sdp, "SCSI disk (sd) name length exceeded.\n");
@@ -3205,12 +3212,11 @@ static int sd_probe(struct device *dev)
         return 0;
 
  out_free_index:
-        put_disk_devt(&sd_devt->disk_devt);
-        sd_devt = NULL;
+        spin_lock(&sd_index_lock);
+        ida_remove(&sd_index_ida, index);
+        spin_unlock(&sd_index_lock);
  out_put:
         put_disk(gd);
- out_free_devt:
-        kfree(sd_devt);
  out_free:
         kfree(sdkp);
  out:
@@ -3271,7 +3277,10 @@ static void scsi_disk_release(struct device *dev)
         struct scsi_disk *sdkp = to_scsi_disk(dev);
         struct gendisk *disk = sdkp->disk;
         
-        put_disk_devt(disk->disk_devt);
+        spin_lock(&sd_index_lock);
+        ida_remove(&sd_index_ida, sdkp->index);
+        spin_unlock(&sd_index_lock);
+
         disk->private_data = NULL;
         put_disk(disk);
         put_device(&sdkp->device->sdev_gendev);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 29b86505f796..225abaad4d1c 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -996,6 +996,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
                 result = get_user(val, ip);
                 if (result)
                         return result;
+                if (val > SG_MAX_CDB_SIZE)
+                        return -ENOMEM;
                 sfp->next_cmd_len = (val > 0) ? val : 0;
                 return 0;
         case SG_GET_VERSION_NUM:
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 0b29b9329b1c..a8f630213a1a 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -836,6 +836,7 @@ static void get_capabilities(struct scsi_cd *cd)
         unsigned char *buffer;
         struct scsi_mode_data data;
         struct scsi_sense_hdr sshdr;
+        unsigned int ms_len = 128;
         int rc, n;
 
         static const char *loadmech[] =
@@ -862,10 +863,11 @@ static void get_capabilities(struct scsi_cd *cd)
         scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
 
         /* ask for mode page 0x2a */
-        rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
+        rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
                              SR_TIMEOUT, 3, &data, NULL);
 
-        if (!scsi_status_is_good(rc)) {
+        if (!scsi_status_is_good(rc) || data.length > ms_len ||
+            data.header_length + data.block_descriptor_length > data.length) {
                 /* failed, drive doesn't have capabilities mode page */
                 cd->cdi.speed = 1;
                 cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 638e5f427c90..016639d7fef1 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -400,8 +400,6 @@ MODULE_PARM_DESC(storvsc_vcpus_per_sub_channel, "Ratio of VCPUs to subchannels")
  */
 static int storvsc_timeout = 180;
 
-static int msft_blist_flags = BLIST_TRY_VPD_PAGES;
-
 #if IS_ENABLED(CONFIG_SCSI_FC_ATTRS)
 static struct scsi_transport_template *fc_transport_template;
 #endif
@@ -1383,6 +1381,22 @@ static int storvsc_do_io(struct hv_device *device,
         return ret;
 }
 
+static int storvsc_device_alloc(struct scsi_device *sdevice)
+{
+        /*
+         * Set blist flag to permit the reading of the VPD pages even when
+         * the target may claim SPC-2 compliance. MSFT targets currently
+         * claim SPC-2 compliance while they implement post SPC-2 features.
+         * With this flag we can correctly handle WRITE_SAME_16 issues.
+         *
+         * Hypervisor reports SCSI_UNKNOWN type for DVD ROM device but
+         * still supports REPORT LUN.
+         */
+        sdevice->sdev_bflags = BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES;
+
+        return 0;
+}
+
 static int storvsc_device_configure(struct scsi_device *sdevice)
 {
 
@@ -1396,14 +1410,6 @@ static int storvsc_device_configure(struct scsi_device *sdevice)
         sdevice->no_write_same = 1;
 
         /*
-         * Add blist flags to permit the reading of the VPD pages even when
-         * the target may claim SPC-2 compliance. MSFT targets currently
-         * claim SPC-2 compliance while they implement post SPC-2 features.
-         * With this patch we can correctly handle WRITE_SAME_16 issues.
-         */
-        sdevice->sdev_bflags |= msft_blist_flags;
-
-        /*
          * If the host is WIN8 or WIN8 R2, claim conformance to SPC-3
          * if the device is a MSFT virtual device.  If the host is
          * WIN10 or newer, allow write_same.
@@ -1661,6 +1667,7 @@ static struct scsi_host_template scsi_driver = {
         .eh_host_reset_handler =        storvsc_host_reset_handler,
         .proc_name =            "storvsc_host",
         .eh_timed_out =         storvsc_eh_timed_out,
+        .slave_alloc =          storvsc_device_alloc,
         .slave_configure =      storvsc_device_configure,
         .cmd_per_lun =          255,
         .this_id =              -1,
diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
index 318e4a1f76c9..54deeb754db5 100644
--- a/drivers/scsi/ufs/ufs.h
+++ b/drivers/scsi/ufs/ufs.h
@@ -146,7 +146,7 @@ enum attr_idn {
 /* Descriptor idn for Query requests */
 enum desc_idn {
         QUERY_DESC_IDN_DEVICE           = 0x0,
-        QUERY_DESC_IDN_CONFIGURAION     = 0x1,
+        QUERY_DESC_IDN_CONFIGURATION    = 0x1,
         QUERY_DESC_IDN_UNIT             = 0x2,
         QUERY_DESC_IDN_RFU_0            = 0x3,
         QUERY_DESC_IDN_INTERCONNECT     = 0x4,
@@ -162,19 +162,13 @@ enum desc_header_offset {
         QUERY_DESC_DESC_TYPE_OFFSET     = 0x01,
 };
 
-enum ufs_desc_max_size {
-        QUERY_DESC_DEVICE_MAX_SIZE              = 0x40,
-        QUERY_DESC_CONFIGURAION_MAX_SIZE        = 0x90,
-        QUERY_DESC_UNIT_MAX_SIZE                = 0x23,
-        QUERY_DESC_INTERCONNECT_MAX_SIZE        = 0x06,
-        /*
-         * Max. 126 UNICODE characters (2 bytes per character) plus 2 bytes
-         * of descriptor header.
-         */
-        QUERY_DESC_STRING_MAX_SIZE              = 0xFE,
-        QUERY_DESC_GEOMETRY_MAX_SIZE            = 0x44,
-        QUERY_DESC_POWER_MAX_SIZE               = 0x62,
-        QUERY_DESC_RFU_MAX_SIZE                 = 0x00,
+enum ufs_desc_def_size {
+        QUERY_DESC_DEVICE_DEF_SIZE              = 0x40,
+        QUERY_DESC_CONFIGURATION_DEF_SIZE       = 0x90,
+        QUERY_DESC_UNIT_DEF_SIZE                = 0x23,
+        QUERY_DESC_INTERCONNECT_DEF_SIZE        = 0x06,
+        QUERY_DESC_GEOMETRY_DEF_SIZE            = 0x44,
+        QUERY_DESC_POWER_DEF_SIZE               = 0x62,
 };
 
 /* Unit descriptor parameters offsets in bytes*/
diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index a72a4ba78125..8e5e6c04c035 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -309,8 +309,8 @@ int ufshcd_pltfrm_init(struct platform_device *pdev,
 
         mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mmio_base = devm_ioremap_resource(dev, mem_res);
-        if (IS_ERR(*(void **)&mmio_base)) {
-                err = PTR_ERR(*(void **)&mmio_base);
+        if (IS_ERR(mmio_base)) {
+                err = PTR_ERR(mmio_base);
                 goto out;
         }
 
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index dc6efbd1be8e..096e95b911bd 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -100,19 +100,6 @@
 #define ufshcd_hex_dump(prefix_str, buf, len) \
 print_hex_dump(KERN_ERR, prefix_str, DUMP_PREFIX_OFFSET, 16, 4, buf, len, false)
 
-static u32 ufs_query_desc_max_size[] = {
-        QUERY_DESC_DEVICE_MAX_SIZE,
-        QUERY_DESC_CONFIGURAION_MAX_SIZE,
-        QUERY_DESC_UNIT_MAX_SIZE,
-        QUERY_DESC_RFU_MAX_SIZE,
-        QUERY_DESC_INTERCONNECT_MAX_SIZE,
-        QUERY_DESC_STRING_MAX_SIZE,
-        QUERY_DESC_RFU_MAX_SIZE,
-        QUERY_DESC_GEOMETRY_MAX_SIZE,
-        QUERY_DESC_POWER_MAX_SIZE,
-        QUERY_DESC_RFU_MAX_SIZE,
-};
-
 enum {
         UFSHCD_MAX_CHANNEL      = 0,
         UFSHCD_MAX_ID           = 1,
@@ -2857,7 +2844,7 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba,
                 goto out;
         }
 
-        if (*buf_len <= QUERY_DESC_MIN_SIZE || *buf_len > QUERY_DESC_MAX_SIZE) {
+        if (*buf_len < QUERY_DESC_MIN_SIZE || *buf_len > QUERY_DESC_MAX_SIZE) {
                 dev_err(hba->dev, "%s: descriptor buffer size (%d) is out of range\n",
                                 __func__, *buf_len);
                 err = -EINVAL;
@@ -2938,6 +2925,92 @@ static int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
 }
 
 /**
+ * ufshcd_read_desc_length - read the specified descriptor length from header
+ * @hba: Pointer to adapter instance
+ * @desc_id: descriptor idn value
+ * @desc_index: descriptor index
+ * @desc_length: pointer to variable to read the length of descriptor
+ *
+ * Return 0 in case of success, non-zero otherwise
+ */
+static int ufshcd_read_desc_length(struct ufs_hba *hba,
+        enum desc_idn desc_id,
+        int desc_index,
+        int *desc_length)
+{
+        int ret;
+        u8 header[QUERY_DESC_HDR_SIZE];
+        int header_len = QUERY_DESC_HDR_SIZE;
+
+        if (desc_id >= QUERY_DESC_IDN_MAX)
+                return -EINVAL;
+
+        ret = ufshcd_query_descriptor_retry(hba, UPIU_QUERY_OPCODE_READ_DESC,
+                                        desc_id, desc_index, 0, header,
+                                        &header_len);
+
+        if (ret) {
+                dev_err(hba->dev, "%s: Failed to get descriptor header id %d",
+                        __func__, desc_id);
+                return ret;
+        } else if (desc_id != header[QUERY_DESC_DESC_TYPE_OFFSET]) {
+                dev_warn(hba->dev, "%s: descriptor header id %d and desc_id %d mismatch",
+                        __func__, header[QUERY_DESC_DESC_TYPE_OFFSET],
+                        desc_id);
+                ret = -EINVAL;
+        }
+
+        *desc_length = header[QUERY_DESC_LENGTH_OFFSET];
+        return ret;
+
+}
+
+/**
+ * ufshcd_map_desc_id_to_length - map descriptor IDN to its length
+ * @hba: Pointer to adapter instance
+ * @desc_id: descriptor idn value
+ * @desc_len: mapped desc length (out)
+ *
+ * Return 0 in case of success, non-zero otherwise
+ */
+int ufshcd_map_desc_id_to_length(struct ufs_hba *hba,
+        enum desc_idn desc_id, int *desc_len)
+{
+        switch (desc_id) {
+        case QUERY_DESC_IDN_DEVICE:
+                *desc_len = hba->desc_size.dev_desc;
+                break;
+        case QUERY_DESC_IDN_POWER:
+                *desc_len = hba->desc_size.pwr_desc;
+                break;
+        case QUERY_DESC_IDN_GEOMETRY:
+                *desc_len = hba->desc_size.geom_desc;
+                break;
+        case QUERY_DESC_IDN_CONFIGURATION:
+                *desc_len = hba->desc_size.conf_desc;
+                break;
+        case QUERY_DESC_IDN_UNIT:
+                *desc_len = hba->desc_size.unit_desc;
+                break;
+        case QUERY_DESC_IDN_INTERCONNECT:
+                *desc_len = hba->desc_size.interc_desc;
+                break;
+        case QUERY_DESC_IDN_STRING:
+                *desc_len = QUERY_DESC_MAX_SIZE;
+                break;
+        case QUERY_DESC_IDN_RFU_0:
+        case QUERY_DESC_IDN_RFU_1:
+                *desc_len = 0;
+                break;
+        default:
+                *desc_len = 0;
+                return -EINVAL;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ufshcd_map_desc_id_to_length);
+
+/**
  * ufshcd_read_desc_param - read the specified descriptor parameter
  * @hba: Pointer to adapter instance
  * @desc_id: descriptor idn value
@@ -2951,42 +3024,49 @@ static int ufshcd_query_descriptor_retry(struct ufs_hba *hba,
 static int ufshcd_read_desc_param(struct ufs_hba *hba,
                                   enum desc_idn desc_id,
                                   int desc_index,
-                                  u32 param_offset,
+                                  u8 param_offset,
                                   u8 *param_read_buf,
-                                  u32 param_size)
+                                  u8 param_size)
 {
         int ret;
         u8 *desc_buf;
-        u32 buff_len;
+        int buff_len;
         bool is_kmalloc = true;
 
-        /* safety checks */
-        if (desc_id >= QUERY_DESC_IDN_MAX)
+        /* Safety check */
+        if (desc_id >= QUERY_DESC_IDN_MAX || !param_size)
                 return -EINVAL;
 
-        buff_len = ufs_query_desc_max_size[desc_id];
-        if ((param_offset + param_size) > buff_len)
-                return -EINVAL;
+        /* Get the max length of descriptor from structure filled up at probe
+         * time.
+         */
+        ret = ufshcd_map_desc_id_to_length(hba, desc_id, &buff_len);
 
-        if (!param_offset && (param_size == buff_len)) {
-                /* memory space already available to hold full descriptor */
-                desc_buf = param_read_buf;
-                is_kmalloc = false;
-        } else {
-                /* allocate memory to hold full descriptor */
+        /* Sanity checks */
+        if (ret || !buff_len) {
+                dev_err(hba->dev, "%s: Failed to get full descriptor length",
+                        __func__);
+                return ret;
+        }
+
+        /* Check whether we need temp memory */
+        if (param_offset != 0 || param_size < buff_len) {
                 desc_buf = kmalloc(buff_len, GFP_KERNEL);
                 if (!desc_buf)
                         return -ENOMEM;
+        } else {
+                desc_buf = param_read_buf;
+                is_kmalloc = false;
         }
 
+        /* Request for full descriptor */
         ret = ufshcd_query_descriptor_retry(hba, UPIU_QUERY_OPCODE_READ_DESC,
-                                        desc_id, desc_index, 0, desc_buf,
-                                        &buff_len);
+                                        desc_id, desc_index, 0,
+                                        desc_buf, &buff_len);
 
         if (ret) {
                 dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d",
                         __func__, desc_id, desc_index, param_offset, ret);
-
                 goto out;
         }
 
@@ -2998,25 +3078,9 @@ static int ufshcd_read_desc_param(struct ufs_hba *hba,
                 goto out;
         }
 
-        /*
-         * While reading variable size descriptors (like string descriptor),
-         * some UFS devices may report the "LENGTH" (field in "Transaction
-         * Specific fields" of Query Response UPIU) same as what was requested
-         * in Query Request UPIU instead of reporting the actual size of the
-         * variable size descriptor.
-         * Although it's safe to ignore the "LENGTH" field for variable size
-         * descriptors as we can always derive the length of the descriptor from
-         * the descriptor header fields. Hence this change impose the length
-         * match check only for fixed size descriptors (for which we always
-         * request the correct size as part of Query Request UPIU).
-         */
-        if ((desc_id != QUERY_DESC_IDN_STRING) &&
-            (buff_len != desc_buf[QUERY_DESC_LENGTH_OFFSET])) {
-                dev_err(hba->dev, "%s: desc_buf length mismatch: buff_len %d, buff_len(desc_header) %d",
-                        __func__, buff_len, desc_buf[QUERY_DESC_LENGTH_OFFSET]);
-                ret = -EINVAL;
-                goto out;
-        }
+        /* Check wherher we will not copy more data, than available */
+        if (is_kmalloc && param_size > buff_len)
+                param_size = buff_len;
 
         if (is_kmalloc)
                 memcpy(param_read_buf, &desc_buf[param_offset], param_size);
@@ -4598,8 +4662,6 @@ static void __ufshcd_transfer_req_compl(struct ufs_hba *hba,
                 }
                 if (ufshcd_is_clkscaling_supported(hba))
                         hba->clk_scaling.active_reqs--;
-                if (ufshcd_is_clkscaling_supported(hba))
-                        hba->clk_scaling.active_reqs--;
         }
 
         /* clear corresponding bits of completed commands */
@@ -5919,8 +5981,8 @@ static int ufshcd_set_icc_levels_attr(struct ufs_hba *hba, u32 icc_level)
 static void ufshcd_init_icc_levels(struct ufs_hba *hba)
 {
         int ret;
-        int buff_len = QUERY_DESC_POWER_MAX_SIZE;
-        u8 desc_buf[QUERY_DESC_POWER_MAX_SIZE];
+        int buff_len = hba->desc_size.pwr_desc;
+        u8 desc_buf[hba->desc_size.pwr_desc];
 
         ret = ufshcd_read_power_desc(hba, desc_buf, buff_len);
         if (ret) {
@@ -6017,11 +6079,10 @@ static int ufs_get_device_desc(struct ufs_hba *hba,
 {
         int err;
         u8 model_index;
-        u8 str_desc_buf[QUERY_DESC_STRING_MAX_SIZE + 1] = {0};
-        u8 desc_buf[QUERY_DESC_DEVICE_MAX_SIZE];
+        u8 str_desc_buf[QUERY_DESC_MAX_SIZE + 1] = {0};
+        u8 desc_buf[hba->desc_size.dev_desc];
 
-        err = ufshcd_read_device_desc(hba, desc_buf,
-                                        QUERY_DESC_DEVICE_MAX_SIZE);
+        err = ufshcd_read_device_desc(hba, desc_buf, hba->desc_size.dev_desc);
         if (err) {
                 dev_err(hba->dev, "%s: Failed reading Device Desc. err = %d\n",
                         __func__, err);
@@ -6038,14 +6099,14 @@ static int ufs_get_device_desc(struct ufs_hba *hba,
         model_index = desc_buf[DEVICE_DESC_PARAM_PRDCT_NAME];
 
         err = ufshcd_read_string_desc(hba, model_index, str_desc_buf,
-                                        QUERY_DESC_STRING_MAX_SIZE, ASCII_STD);
+                                QUERY_DESC_MAX_SIZE, ASCII_STD);
         if (err) {
                 dev_err(hba->dev, "%s: Failed reading Product Name. err = %d\n",
                         __func__, err);
                 goto out;
         }
 
-        str_desc_buf[QUERY_DESC_STRING_MAX_SIZE] = '\0';
+        str_desc_buf[QUERY_DESC_MAX_SIZE] = '\0';
         strlcpy(dev_desc->model, (str_desc_buf + QUERY_DESC_HDR_SIZE),
                 min_t(u8, str_desc_buf[QUERY_DESC_LENGTH_OFFSET],
                       MAX_MODEL_LEN));
@@ -6251,6 +6312,51 @@ static void ufshcd_clear_dbg_ufs_stats(struct ufs_hba *hba)
         hba->req_abort_count = 0;
 }
 
+static void ufshcd_init_desc_sizes(struct ufs_hba *hba)
+{
+        int err;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_DEVICE, 0,
+                &hba->desc_size.dev_desc);
+        if (err)
+                hba->desc_size.dev_desc = QUERY_DESC_DEVICE_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_POWER, 0,
+                &hba->desc_size.pwr_desc);
+        if (err)
+                hba->desc_size.pwr_desc = QUERY_DESC_POWER_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_INTERCONNECT, 0,
+                &hba->desc_size.interc_desc);
+        if (err)
+                hba->desc_size.interc_desc = QUERY_DESC_INTERCONNECT_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_CONFIGURATION, 0,
+                &hba->desc_size.conf_desc);
+        if (err)
+                hba->desc_size.conf_desc = QUERY_DESC_CONFIGURATION_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_UNIT, 0,
+                &hba->desc_size.unit_desc);
+        if (err)
+                hba->desc_size.unit_desc = QUERY_DESC_UNIT_DEF_SIZE;
+
+        err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_GEOMETRY, 0,
+                &hba->desc_size.geom_desc);
+        if (err)
+                hba->desc_size.geom_desc = QUERY_DESC_GEOMETRY_DEF_SIZE;
+}
+
+static void ufshcd_def_desc_sizes(struct ufs_hba *hba)
+{
+        hba->desc_size.dev_desc = QUERY_DESC_DEVICE_DEF_SIZE;
+        hba->desc_size.pwr_desc = QUERY_DESC_POWER_DEF_SIZE;
+        hba->desc_size.interc_desc = QUERY_DESC_INTERCONNECT_DEF_SIZE;
+        hba->desc_size.conf_desc = QUERY_DESC_CONFIGURATION_DEF_SIZE;
+        hba->desc_size.unit_desc = QUERY_DESC_UNIT_DEF_SIZE;
+        hba->desc_size.geom_desc = QUERY_DESC_GEOMETRY_DEF_SIZE;
+}
+
 /**
  * ufshcd_probe_hba - probe hba to detect device and initialize
  * @hba: per-adapter instance
@@ -6285,6 +6391,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
         if (ret)
                 goto out;
 
+        /* Init check for device descriptor sizes */
+        ufshcd_init_desc_sizes(hba);
+
         ret = ufs_get_device_desc(hba, &card);
         if (ret) {
                 dev_err(hba->dev, "%s: Failed getting device info. err = %d\n",
@@ -6320,6 +6429,7 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
 
         /* set the state as operational after switching to desired gear */
         hba->ufshcd_state = UFSHCD_STATE_OPERATIONAL;
+
         /*
          * If we are in error handling context or in power management callbacks
          * context, no need to scan the host
@@ -7530,7 +7640,7 @@ static inline ssize_t ufshcd_pm_lvl_store(struct device *dev,
         if (kstrtoul(buf, 0, &value))
                 return -EINVAL;
 
-        if ((value < UFS_PM_LVL_0) || (value >= UFS_PM_LVL_MAX))
+        if (value >= UFS_PM_LVL_MAX)
                 return -EINVAL;
 
         spin_lock_irqsave(hba->host->host_lock, flags);
@@ -7774,6 +7884,9 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
         hba->mmio_base = mmio_base;
         hba->irq = irq;
 
+        /* Set descriptor lengths to specification defaults */
+        ufshcd_def_desc_sizes(hba);
+
         err = ufshcd_hba_init(hba);
         if (err)
                 goto out_error;
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 7630600217a2..cdc8bd05f7df 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -220,6 +220,15 @@ struct ufs_dev_cmd {
         struct ufs_query query;
 };
 
+struct ufs_desc_size {
+        int dev_desc;
+        int pwr_desc;
+        int geom_desc;
+        int interc_desc;
+        int unit_desc;
+        int conf_desc;
+};
+
 /**
  * struct ufs_clk_info - UFS clock related info
  * @list: list headed by hba->clk_list_head
@@ -483,6 +492,7 @@ struct ufs_stats {
  * @clk_list_head: UFS host controller clocks list node head
  * @pwr_info: holds current power mode
  * @max_pwr_info: keeps the device max valid pwm
+ * @desc_size: descriptor sizes reported by device
  * @urgent_bkops_lvl: keeps track of urgent bkops level for device
  * @is_urgent_bkops_lvl_checked: keeps track if the urgent bkops level for
  *  device is known or not.
@@ -666,6 +676,7 @@ struct ufs_hba {
         bool is_urgent_bkops_lvl_checked;
 
         struct rw_semaphore clk_scaling_lock;
+        struct ufs_desc_size desc_size;
 };
 
 /* Returns true if clocks can be gated. Otherwise false */
@@ -832,6 +843,10 @@ int ufshcd_query_flag(struct ufs_hba *hba, enum query_opcode opcode,
         enum flag_idn idn, bool *flag_res);
 int ufshcd_hold(struct ufs_hba *hba, bool async);
 void ufshcd_release(struct ufs_hba *hba);
+
+int ufshcd_map_desc_id_to_length(struct ufs_hba *hba, enum desc_idn desc_id,
+        int *desc_length);
+
 u32 ufshcd_get_local_unipro_ver(struct ufs_hba *hba);
 
 /* Wrapper functions for safely calling variant operations */
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index ef474a748744..c374e3b5c678 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -1487,7 +1487,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 irq_flag &= ~PCI_IRQ_MSI;
 
         error = pci_alloc_irq_vectors(adapter->dev, 1, 1, irq_flag);
-        if (error)
+        if (error < 0)
                 goto out_reset_adapter;
 
         adapter->use_req_threshold = pvscsi_setup_req_threshold(adapter, true);
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 7cbad0d45b9c..6ba270e0494d 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -409,6 +409,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
                         ret = PTR_ERR(vmfile);
                         goto out;
                 }
+                vmfile->f_mode |= FMODE_LSEEK;
                 asma->file = vmfile;
         }
         get_file(asma->file);
diff --git a/drivers/staging/lustre/lnet/lnet/lib-socket.c b/drivers/staging/lustre/lnet/lnet/lib-socket.c
index b7b87ecefcdf..9fca8d225ee0 100644
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@ -532,7 +532,7 @@ lnet_sock_accept(struct socket **newsockp, struct socket *sock)
 
         newsock->ops = sock->ops;
 
-        rc = sock->ops->accept(sock, newsock, O_NONBLOCK);
+        rc = sock->ops->accept(sock, newsock, O_NONBLOCK, false);
         if (rc == -EAGAIN) {
                 /* Nothing ready, so wait for activity */
                 init_waitqueue_entry(&wait, current);
@@ -540,7 +540,7 @@ lnet_sock_accept(struct socket **newsockp, struct socket *sock)
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule();
                 remove_wait_queue(sk_sleep(sock->sk), &wait);
-                rc = sock->ops->accept(sock, newsock, O_NONBLOCK);
+                rc = sock->ops->accept(sock, newsock, O_NONBLOCK, false);
         }
 
         if (rc)
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 7f8cf875157c..65a285631994 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -336,7 +336,6 @@ static int cvm_oct_poll(struct oct_rx_group *rx_group, int budget)
                 if (likely((port < TOTAL_NUMBER_OF_PORTS) &&
                            cvm_oct_device[port])) {
                         struct net_device *dev = cvm_oct_device[port];
-                        struct octeon_ethernet *priv = netdev_priv(dev);
 
                         /*
                          * Only accept packets for devices that are
diff --git a/drivers/staging/vc04_services/Kconfig b/drivers/staging/vc04_services/Kconfig
index e61e4ca064a8..74094fff4367 100644
--- a/drivers/staging/vc04_services/Kconfig
+++ b/drivers/staging/vc04_services/Kconfig
@@ -1,6 +1,7 @@
 config BCM2835_VCHIQ
         tristate "Videocore VCHIQ"
         depends on HAS_DMA
+        depends on OF
         depends on RASPBERRYPI_FIRMWARE || (COMPILE_TEST && !RASPBERRYPI_FIRMWARE)
         default y
         help
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index a91802432f2f..e3f9ed3690b7 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -485,8 +485,7 @@ static void iscsit_get_rx_pdu(struct iscsi_conn *);
 
 int iscsit_queue_rsp(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
 {
-        iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
-        return 0;
+        return iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
 }
 EXPORT_SYMBOL(iscsit_queue_rsp);
 
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index bf40f03755dd..344e8448869c 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -1398,11 +1398,10 @@ static u32 lio_sess_get_initiator_sid(
 static int lio_queue_data_in(struct se_cmd *se_cmd)
 {
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+        struct iscsi_conn *conn = cmd->conn;
 
         cmd->i_state = ISTATE_SEND_DATAIN;
-        cmd->conn->conn_transport->iscsit_queue_data_in(cmd->conn, cmd);
-
-        return 0;
+        return conn->conn_transport->iscsit_queue_data_in(conn, cmd);
 }
 
 static int lio_write_pending(struct se_cmd *se_cmd)
@@ -1431,16 +1430,14 @@ static int lio_write_pending_status(struct se_cmd *se_cmd)
 static int lio_queue_status(struct se_cmd *se_cmd)
 {
         struct iscsi_cmd *cmd = container_of(se_cmd, struct iscsi_cmd, se_cmd);
+        struct iscsi_conn *conn = cmd->conn;
 
         cmd->i_state = ISTATE_SEND_STATUS;
 
         if (cmd->se_cmd.scsi_status || cmd->sense_reason) {
-                iscsit_add_cmd_to_response_queue(cmd, cmd->conn, cmd->i_state);
-                return 0;
+                return iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state);
         }
-        cmd->conn->conn_transport->iscsit_queue_status(cmd->conn, cmd);
-
-        return 0;
+        return conn->conn_transport->iscsit_queue_status(conn, cmd);
 }
 
 static void lio_queue_tm_rsp(struct se_cmd *se_cmd)
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index e65bf78ceef3..fce627628200 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -782,22 +782,6 @@ static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param)
                 if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH))
                         SET_PSTATE_REPLY_OPTIONAL(param);
                 /*
-                 * The GlobalSAN iSCSI Initiator for MacOSX does
-                 * not respond to MaxBurstLength, FirstBurstLength,
-                 * DefaultTime2Wait or DefaultTime2Retain parameter keys.
-                 * So, we set them to 'reply optional' here, and assume the
-                 * the defaults from iscsi_parameters.h if the initiator
-                 * is not RFC compliant and the keys are not negotiated.
-                 */
-                if (!strcmp(param->name, MAXBURSTLENGTH))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, FIRSTBURSTLENGTH))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, DEFAULTTIME2WAIT))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                if (!strcmp(param->name, DEFAULTTIME2RETAIN))
-                        SET_PSTATE_REPLY_OPTIONAL(param);
-                /*
                  * Required for gPXE iSCSI boot client
                  */
                 if (!strcmp(param->name, MAXCONNECTIONS))
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index 5041a9c8bdcb..7d3e2fcc26a0 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -567,7 +567,7 @@ static void iscsit_remove_cmd_from_immediate_queue(
         }
 }
 
-void iscsit_add_cmd_to_response_queue(
+int iscsit_add_cmd_to_response_queue(
         struct iscsi_cmd *cmd,
         struct iscsi_conn *conn,
         u8 state)
@@ -578,7 +578,7 @@ void iscsit_add_cmd_to_response_queue(
         if (!qr) {
                 pr_err("Unable to allocate memory for"
                         " struct iscsi_queue_req\n");
-                return;
+                return -ENOMEM;
         }
         INIT_LIST_HEAD(&qr->qr_list);
         qr->cmd = cmd;
@@ -590,6 +590,7 @@ void iscsit_add_cmd_to_response_queue(
         spin_unlock_bh(&conn->response_queue_lock);
 
         wake_up(&conn->queues_wq);
+        return 0;
 }
 
 struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *conn)
@@ -737,21 +738,23 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
 {
         struct se_cmd *se_cmd = NULL;
         int rc;
+        bool op_scsi = false;
         /*
          * Determine if a struct se_cmd is associated with
          * this struct iscsi_cmd.
          */
         switch (cmd->iscsi_opcode) {
         case ISCSI_OP_SCSI_CMD:
-                se_cmd = &cmd->se_cmd;
-                __iscsit_free_cmd(cmd, true, shutdown);
+                op_scsi = true;
                 /*
                  * Fallthrough
                  */
         case ISCSI_OP_SCSI_TMFUNC:
-                rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
-                if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
-                        __iscsit_free_cmd(cmd, true, shutdown);
+                se_cmd = &cmd->se_cmd;
+                __iscsit_free_cmd(cmd, op_scsi, shutdown);
+                rc = transport_generic_free_cmd(se_cmd, shutdown);
+                if (!rc && shutdown && se_cmd->se_sess) {
+                        __iscsit_free_cmd(cmd, op_scsi, shutdown);
                         target_put_sess_cmd(se_cmd);
                 }
                 break;
diff --git a/drivers/target/iscsi/iscsi_target_util.h b/drivers/target/iscsi/iscsi_target_util.h
index 8ff08856516a..9e4197af8708 100644
--- a/drivers/target/iscsi/iscsi_target_util.h
+++ b/drivers/target/iscsi/iscsi_target_util.h
@@ -31,7 +31,7 @@ extern int iscsit_find_cmd_for_recovery(struct iscsi_session *, struct iscsi_cmd
                         struct iscsi_conn_recovery **, itt_t);
 extern void iscsit_add_cmd_to_immediate_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_immediate_queue(struct iscsi_conn *);
-extern void iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
+extern int iscsit_add_cmd_to_response_queue(struct iscsi_cmd *, struct iscsi_conn *, u8);
 extern struct iscsi_queue_req *iscsit_get_cmd_from_response_queue(struct iscsi_conn *);
 extern void iscsit_remove_cmd_from_tx_queues(struct iscsi_cmd *, struct iscsi_conn *);
 extern bool iscsit_conn_all_queues_empty(struct iscsi_conn *);
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index f5e330099bfc..fc4a9c303d55 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -43,7 +43,7 @@
 #include "target_core_ua.h"
 
 static sense_reason_t core_alua_check_transition(int state, int valid,
-                                                 int *primary);
+                                                 int *primary, int explicit);
 static int core_alua_set_tg_pt_secondary_state(
                 struct se_lun *lun, int explicit, int offline);
 
@@ -197,8 +197,7 @@ target_emulate_report_target_port_groups(struct se_cmd *cmd)
                 /*
                  * Set the ASYMMETRIC ACCESS State
                  */
-                buf[off++] |= (atomic_read(
-                        &tg_pt_gp->tg_pt_gp_alua_access_state) & 0xff);
+                buf[off++] |= tg_pt_gp->tg_pt_gp_alua_access_state & 0xff;
                 /*
                  * Set supported ASYMMETRIC ACCESS State bits
                  */
@@ -335,8 +334,8 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
                  * the state is a primary or secondary target port asymmetric
                  * access state.
                  */
-                rc = core_alua_check_transition(alua_access_state,
-                                                valid_states, &primary);
+                rc = core_alua_check_transition(alua_access_state, valid_states,
+                                                &primary, 1);
                 if (rc) {
                         /*
                          * If the SET TARGET PORT GROUPS attempts to establish
@@ -691,7 +690,7 @@ target_alua_state_check(struct se_cmd *cmd)
 
         if (dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE)
                 return 0;
-        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
+        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA)
                 return 0;
 
         /*
@@ -710,7 +709,7 @@ target_alua_state_check(struct se_cmd *cmd)
 
         spin_lock(&lun->lun_tg_pt_gp_lock);
         tg_pt_gp = lun->lun_tg_pt_gp;
-        out_alua_state = atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
+        out_alua_state = tg_pt_gp->tg_pt_gp_alua_access_state;
         nonop_delay_msecs = tg_pt_gp->tg_pt_gp_nonop_delay_msecs;
 
         // XXX: keeps using tg_pt_gp witout reference after unlock
@@ -762,7 +761,7 @@ target_alua_state_check(struct se_cmd *cmd)
  * Check implicit and explicit ALUA state change request.
  */
 static sense_reason_t
-core_alua_check_transition(int state, int valid, int *primary)
+core_alua_check_transition(int state, int valid, int *primary, int explicit)
 {
         /*
          * OPTIMIZED, NON-OPTIMIZED, STANDBY and UNAVAILABLE are
@@ -804,11 +803,14 @@ core_alua_check_transition(int state, int valid, int *primary)
                 *primary = 0;
                 break;
         case ALUA_ACCESS_STATE_TRANSITION:
-                /*
-                 * Transitioning is set internally, and
-                 * cannot be selected manually.
-                 */
-                goto not_supported;
+                if (!(valid & ALUA_T_SUP) || explicit)
+                        /*
+                         * Transitioning is set internally and by tcmu daemon,
+                         * and cannot be selected through a STPG.
+                         */
+                        goto not_supported;
+                *primary = 0;
+                break;
         default:
                 pr_err("Unknown ALUA access state: 0x%02x\n", state);
                 return TCM_INVALID_PARAMETER_LIST;
@@ -908,7 +910,7 @@ static int core_alua_write_tpg_metadata(
 }
 
 /*
- * Called with tg_pt_gp->tg_pt_gp_md_mutex held
+ * Called with tg_pt_gp->tg_pt_gp_transition_mutex held
  */
 static int core_alua_update_tpg_primary_metadata(
         struct t10_alua_tg_pt_gp *tg_pt_gp)
@@ -931,7 +933,7 @@ static int core_alua_update_tpg_primary_metadata(
                         "alua_access_state=0x%02x\n"
                         "alua_access_status=0x%02x\n",
                         tg_pt_gp->tg_pt_gp_id,
-                        tg_pt_gp->tg_pt_gp_alua_pending_state,
+                        tg_pt_gp->tg_pt_gp_alua_access_state,
                         tg_pt_gp->tg_pt_gp_alua_access_status);
 
         snprintf(path, ALUA_METADATA_PATH_LEN,
@@ -1010,100 +1012,42 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp)
         spin_unlock(&tg_pt_gp->tg_pt_gp_lock);
 }
 
-static void core_alua_do_transition_tg_pt_work(struct work_struct *work)
-{
-        struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work,
-                struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work.work);
-        struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
-        bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status ==
-                         ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG);
-
-        /*
-         * Update the ALUA metadata buf that has been allocated in
-         * core_alua_do_port_transition(), this metadata will be written
-         * to struct file.
-         *
-         * Note that there is the case where we do not want to update the
-         * metadata when the saved metadata is being parsed in userspace
-         * when setting the existing port access state and access status.
-         *
-         * Also note that the failure to write out the ALUA metadata to
-         * struct file does NOT affect the actual ALUA transition.
-         */
-        if (tg_pt_gp->tg_pt_gp_write_metadata) {
-                mutex_lock(&tg_pt_gp->tg_pt_gp_md_mutex);
-                core_alua_update_tpg_primary_metadata(tg_pt_gp);
-                mutex_unlock(&tg_pt_gp->tg_pt_gp_md_mutex);
-        }
-        /*
-         * Set the current primary ALUA access state to the requested new state
-         */
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                   tg_pt_gp->tg_pt_gp_alua_pending_state);
-
-        pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
-                " from primary access state %s to %s\n", (explicit) ? "explicit" :
-                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
-                tg_pt_gp->tg_pt_gp_id,
-                core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_previous_state),
-                core_alua_dump_state(tg_pt_gp->tg_pt_gp_alua_pending_state));
-
-        core_alua_queue_state_change_ua(tg_pt_gp);
-
-        spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-        atomic_dec(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
-
-        if (tg_pt_gp->tg_pt_gp_transition_complete)
-                complete(tg_pt_gp->tg_pt_gp_transition_complete);
-}
-
 static int core_alua_do_transition_tg_pt(
         struct t10_alua_tg_pt_gp *tg_pt_gp,
         int new_state,
         int explicit)
 {
-        struct se_device *dev = tg_pt_gp->tg_pt_gp_dev;
-        DECLARE_COMPLETION_ONSTACK(wait);
+        int prev_state;
 
+        mutex_lock(&tg_pt_gp->tg_pt_gp_transition_mutex);
         /* Nothing to be done here */
-        if (atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) == new_state)
+        if (tg_pt_gp->tg_pt_gp_alua_access_state == new_state) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return 0;
+        }
 
-        if (new_state == ALUA_ACCESS_STATE_TRANSITION)
+        if (explicit && new_state == ALUA_ACCESS_STATE_TRANSITION) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
                 return -EAGAIN;
-
-        /*
-         * Flush any pending transitions
-         */
-        if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs &&
-            atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) ==
-            ALUA_ACCESS_STATE_TRANSITION) {
-                /* Just in case */
-                tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
-                tg_pt_gp->tg_pt_gp_transition_complete = &wait;
-                flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work);
-                wait_for_completion(&wait);
-                tg_pt_gp->tg_pt_gp_transition_complete = NULL;
-                return 0;
         }
 
         /*
          * Save the old primary ALUA access state, and set the current state
          * to ALUA_ACCESS_STATE_TRANSITION.
          */
-        tg_pt_gp->tg_pt_gp_alua_previous_state =
-                atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state);
-        tg_pt_gp->tg_pt_gp_alua_pending_state = new_state;
-
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                        ALUA_ACCESS_STATE_TRANSITION);
+        prev_state = tg_pt_gp->tg_pt_gp_alua_access_state;
+        tg_pt_gp->tg_pt_gp_alua_access_state = ALUA_ACCESS_STATE_TRANSITION;
         tg_pt_gp->tg_pt_gp_alua_access_status = (explicit) ?
                                 ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG :
                                 ALUA_STATUS_ALTERED_BY_IMPLICIT_ALUA;
 
         core_alua_queue_state_change_ua(tg_pt_gp);
 
+        if (new_state == ALUA_ACCESS_STATE_TRANSITION) {
+                mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
+                return 0;
+        }
+
         /*
          * Check for the optional ALUA primary state transition delay
          */
@@ -1111,27 +1055,36 @@ static int core_alua_do_transition_tg_pt(
                 msleep_interruptible(tg_pt_gp->tg_pt_gp_trans_delay_msecs);
 
         /*
-         * Take a reference for workqueue item
+         * Set the current primary ALUA access state to the requested new state
          */
-        spin_lock(&dev->t10_alua.tg_pt_gps_lock);
-        atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt);
-        spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
+        tg_pt_gp->tg_pt_gp_alua_access_state = new_state;
 
-        if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs) {
-                unsigned long transition_tmo;
-
-                transition_tmo = tg_pt_gp->tg_pt_gp_implicit_trans_secs * HZ;
-                queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq,
-                                   &tg_pt_gp->tg_pt_gp_transition_work,
-                                   transition_tmo);
-        } else {
-                tg_pt_gp->tg_pt_gp_transition_complete = &wait;
-                queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq,
-                                   &tg_pt_gp->tg_pt_gp_transition_work, 0);
-                wait_for_completion(&wait);
-                tg_pt_gp->tg_pt_gp_transition_complete = NULL;
+        /*
+         * Update the ALUA metadata buf that has been allocated in
+         * core_alua_do_port_transition(), this metadata will be written
+         * to struct file.
+         *
+         * Note that there is the case where we do not want to update the
+         * metadata when the saved metadata is being parsed in userspace
+         * when setting the existing port access state and access status.
+         *
+         * Also note that the failure to write out the ALUA metadata to
+         * struct file does NOT affect the actual ALUA transition.
+         */
+        if (tg_pt_gp->tg_pt_gp_write_metadata) {
+                core_alua_update_tpg_primary_metadata(tg_pt_gp);
         }
 
+        pr_debug("Successful %s ALUA transition TG PT Group: %s ID: %hu"
+                " from primary access state %s to %s\n", (explicit) ? "explicit" :
+                "implicit", config_item_name(&tg_pt_gp->tg_pt_gp_group.cg_item),
+                tg_pt_gp->tg_pt_gp_id,
+                core_alua_dump_state(prev_state),
+                core_alua_dump_state(new_state));
+
+        core_alua_queue_state_change_ua(tg_pt_gp);
+
+        mutex_unlock(&tg_pt_gp->tg_pt_gp_transition_mutex);
         return 0;
 }
 
@@ -1149,8 +1102,12 @@ int core_alua_do_port_transition(
         struct t10_alua_tg_pt_gp *tg_pt_gp;
         int primary, valid_states, rc = 0;
 
+        if (l_dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA)
+                return -ENODEV;
+
         valid_states = l_tg_pt_gp->tg_pt_gp_alua_supported_states;
-        if (core_alua_check_transition(new_state, valid_states, &primary) != 0)
+        if (core_alua_check_transition(new_state, valid_states, &primary,
+                                       explicit) != 0)
                 return -EINVAL;
 
         local_lu_gp_mem = l_dev->dev_alua_lu_gp_mem;
@@ -1692,14 +1649,12 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev,
         }
         INIT_LIST_HEAD(&tg_pt_gp->tg_pt_gp_list);
         INIT_LIST_HEAD(&tg_pt_gp->tg_pt_gp_lun_list);
-        mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex);
+        mutex_init(&tg_pt_gp->tg_pt_gp_transition_mutex);
         spin_lock_init(&tg_pt_gp->tg_pt_gp_lock);
         atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0);
-        INIT_DELAYED_WORK(&tg_pt_gp->tg_pt_gp_transition_work,
-                          core_alua_do_transition_tg_pt_work);
         tg_pt_gp->tg_pt_gp_dev = dev;
-        atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state,
-                ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED);
+        tg_pt_gp->tg_pt_gp_alua_access_state =
+                        ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED;
         /*
          * Enable both explicit and implicit ALUA support by default
          */
@@ -1804,8 +1759,6 @@ void core_alua_free_tg_pt_gp(
         dev->t10_alua.alua_tg_pt_gps_counter--;
         spin_unlock(&dev->t10_alua.tg_pt_gps_lock);
 
-        flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work);
-
         /*
          * Allow a struct t10_alua_tg_pt_gp_member * referenced by
          * core_alua_get_tg_pt_gp_by_name() in
@@ -1945,8 +1898,8 @@ ssize_t core_alua_show_tg_pt_gp_info(struct se_lun *lun, char *page)
                         "Primary Access Status: %s\nTG Port Secondary Access"
                         " State: %s\nTG Port Secondary Access Status: %s\n",
                         config_item_name(tg_pt_ci), tg_pt_gp->tg_pt_gp_id,
-                        core_alua_dump_state(atomic_read(
-                                        &tg_pt_gp->tg_pt_gp_alua_access_state)),
+                        core_alua_dump_state(
+                                tg_pt_gp->tg_pt_gp_alua_access_state),
                         core_alua_dump_status(
                                 tg_pt_gp->tg_pt_gp_alua_access_status),
                         atomic_read(&lun->lun_tg_pt_secondary_offline) ?
@@ -1973,7 +1926,7 @@ ssize_t core_alua_store_tg_pt_gp_info(
         unsigned char buf[TG_PT_GROUP_NAME_BUF];
         int move = 0;
 
-        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH ||
+        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA ||
             (dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 return -ENODEV;
 
@@ -2230,7 +2183,7 @@ ssize_t core_alua_store_offline_bit(
         unsigned long tmp;
         int ret;
 
-        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH ||
+        if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA ||
             (dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 return -ENODEV;
 
@@ -2316,7 +2269,8 @@ ssize_t core_alua_store_secondary_write_metadata(
 
 int core_setup_alua(struct se_device *dev)
 {
-        if (!(dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH) &&
+        if (!(dev->transport->transport_flags &
+             TRANSPORT_FLAG_PASSTHROUGH_ALUA) &&
             !(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE)) {
                 struct t10_alua_lu_gp_member *lu_gp_mem;
 
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 54b36c9835be..70657fd56440 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -421,6 +421,10 @@ static int target_fabric_tf_ops_check(const struct target_core_fabric_ops *tfo)
                 pr_err("Missing tfo->aborted_task()\n");
                 return -EINVAL;
         }
+        if (!tfo->check_stop_free) {
+                pr_err("Missing tfo->check_stop_free()\n");
+                return -EINVAL;
+        }
         /*
          * We at least require tfo->fabric_make_wwn(), tfo->fabric_drop_wwn()
          * tfo->fabric_make_tpg() and tfo->fabric_drop_tpg() in
@@ -2388,7 +2392,7 @@ static ssize_t target_tg_pt_gp_alua_access_state_show(struct config_item *item,
                 char *page)
 {
         return sprintf(page, "%d\n",
-                atomic_read(&to_tg_pt_gp(item)->tg_pt_gp_alua_access_state));
+                       to_tg_pt_gp(item)->tg_pt_gp_alua_access_state);
 }
 
 static ssize_t target_tg_pt_gp_alua_access_state_store(struct config_item *item,
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index d8a16ca6baa5..d1e6cab8e3d3 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -92,6 +92,11 @@ static int target_fabric_mappedlun_link(
                 pr_err("Source se_lun->lun_se_dev does not exist\n");
                 return -EINVAL;
         }
+        if (lun->lun_shutdown) {
+                pr_err("Unable to create mappedlun symlink because"
+                        " lun->lun_shutdown=true\n");
+                return -EINVAL;
+        }
         se_tpg = lun->lun_tpg;
 
         nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index a8f8e53f2f57..94cda7991e80 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -154,7 +154,7 @@ static void pscsi_tape_read_blocksize(struct se_device *dev,
 
         buf = kzalloc(12, GFP_KERNEL);
         if (!buf)
-                return;
+                goto out_free;
 
         memset(cdb, 0, MAX_COMMAND_SIZE);
         cdb[0] = MODE_SENSE;
@@ -169,9 +169,10 @@ static void pscsi_tape_read_blocksize(struct se_device *dev,
          * If MODE_SENSE still returns zero, set the default value to 1024.
          */
         sdev->sector_size = (buf[9] << 16) | (buf[10] << 8) | (buf[11]);
+out_free:
         if (!sdev->sector_size)
                 sdev->sector_size = 1024;
-out_free:
+
         kfree(buf);
 }
 
@@ -314,9 +315,10 @@ static int pscsi_add_device_to_list(struct se_device *dev,
                                 sd->lun, sd->queue_depth);
         }
 
-        dev->dev_attrib.hw_block_size = sd->sector_size;
+        dev->dev_attrib.hw_block_size =
+                min_not_zero((int)sd->sector_size, 512);
         dev->dev_attrib.hw_max_sectors =
-                min_t(int, sd->host->max_sectors, queue_max_hw_sectors(q));
+                min_not_zero(sd->host->max_sectors, queue_max_hw_sectors(q));
         dev->dev_attrib.hw_queue_depth = sd->queue_depth;
 
         /*
@@ -339,8 +341,10 @@ static int pscsi_add_device_to_list(struct se_device *dev,
         /*
          * For TYPE_TAPE, attempt to determine blocksize with MODE_SENSE.
          */
-        if (sd->type == TYPE_TAPE)
+        if (sd->type == TYPE_TAPE) {
                 pscsi_tape_read_blocksize(dev, sd);
+                dev->dev_attrib.hw_block_size = sd->sector_size;
+        }
         return 0;
 }
 
@@ -406,7 +410,7 @@ static int pscsi_create_type_disk(struct se_device *dev, struct scsi_device *sd)
 /*
  * Called with struct Scsi_Host->host_lock called.
  */
-static int pscsi_create_type_rom(struct se_device *dev, struct scsi_device *sd)
+static int pscsi_create_type_nondisk(struct se_device *dev, struct scsi_device *sd)
         __releases(sh->host_lock)
 {
         struct pscsi_hba_virt *phv = dev->se_hba->hba_ptr;
@@ -433,28 +437,6 @@ static int pscsi_create_type_rom(struct se_device *dev, struct scsi_device *sd)
         return 0;
 }
 
-/*
- * Called with struct Scsi_Host->host_lock called.
- */
-static int pscsi_create_type_other(struct se_device *dev,
-                struct scsi_device *sd)
-        __releases(sh->host_lock)
-{
-        struct pscsi_hba_virt *phv = dev->se_hba->hba_ptr;
-        struct Scsi_Host *sh = sd->host;
-        int ret;
-
-        spin_unlock_irq(sh->host_lock);
-        ret = pscsi_add_device_to_list(dev, sd);
-        if (ret)
-                return ret;
-
-        pr_debug("CORE_PSCSI[%d] - Added Type: %s for %d:%d:%d:%llu\n",
-                phv->phv_host_id, scsi_device_type(sd->type), sh->host_no,
-                sd->channel, sd->id, sd->lun);
-        return 0;
-}
-
 static int pscsi_configure_device(struct se_device *dev)
 {
         struct se_hba *hba = dev->se_hba;
@@ -542,11 +524,8 @@ static int pscsi_configure_device(struct se_device *dev)
                 case TYPE_DISK:
                         ret = pscsi_create_type_disk(dev, sd);
                         break;
-                case TYPE_ROM:
-                        ret = pscsi_create_type_rom(dev, sd);
-                        break;
                 default:
-                        ret = pscsi_create_type_other(dev, sd);
+                        ret = pscsi_create_type_nondisk(dev, sd);
                         break;
                 }
 
@@ -611,8 +590,7 @@ static void pscsi_free_device(struct se_device *dev)
                 else if (pdv->pdv_lld_host)
                         scsi_host_put(pdv->pdv_lld_host);
 
-                if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
-                        scsi_device_put(sd);
+                scsi_device_put(sd);
 
                 pdv->pdv_sd = NULL;
         }
@@ -1064,7 +1042,6 @@ static sector_t pscsi_get_blocks(struct se_device *dev)
         if (pdv->pdv_bd && pdv->pdv_bd->bd_part)
                 return pdv->pdv_bd->bd_part->nr_sects;
 
-        dump_stack();
         return 0;
 }
 
@@ -1103,7 +1080,8 @@ static void pscsi_req_done(struct request *req, int uptodate)
 static const struct target_backend_ops pscsi_ops = {
         .name                   = "pscsi",
         .owner                  = THIS_MODULE,
-        .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH,
+        .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH |
+                                  TRANSPORT_FLAG_PASSTHROUGH_ALUA,
         .attach_hba             = pscsi_attach_hba,
         .detach_hba             = pscsi_detach_hba,
         .pmode_enable_hba       = pscsi_pmode_enable_hba,
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 68d8aef7ab78..c194063f169b 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -1105,9 +1105,15 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
                         return ret;
                 break;
         case VERIFY:
+        case VERIFY_16:
                 size = 0;
-                sectors = transport_get_sectors_10(cdb);
-                cmd->t_task_lba = transport_lba_32(cdb);
+                if (cdb[0] == VERIFY) {
+                        sectors = transport_get_sectors_10(cdb);
+                        cmd->t_task_lba = transport_lba_32(cdb);
+                } else {
+                        sectors = transport_get_sectors_16(cdb);
+                        cmd->t_task_lba = transport_lba_64(cdb);
+                }
                 cmd->execute_cmd = sbc_emulate_noop;
                 goto check_lba;
         case REZERO_UNIT:
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index c0dbfa016575..dfaef4d3b2d2 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -602,7 +602,8 @@ int core_tpg_add_lun(
         if (ret)
                 goto out_kill_ref;
 
-        if (!(dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH) &&
+        if (!(dev->transport->transport_flags &
+             TRANSPORT_FLAG_PASSTHROUGH_ALUA) &&
             !(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 target_attach_tg_pt_gp(lun, dev->t10_alua.default_tg_pt_gp);
 
@@ -641,6 +642,8 @@ void core_tpg_remove_lun(
          */
         struct se_device *dev = rcu_dereference_raw(lun->lun_se_dev);
 
+        lun->lun_shutdown = true;
+
         core_clear_lun_from_tpg(lun, tpg);
         /*
          * Wait for any active I/O references to percpu se_lun->lun_ref to
@@ -662,6 +665,8 @@ void core_tpg_remove_lun(
         }
         if (!(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
                 hlist_del_rcu(&lun->link);
+
+        lun->lun_shutdown = false;
         mutex_unlock(&tpg->tpg_lun_mutex);
 
         percpu_ref_exit(&lun->lun_ref);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 434d9d693989..a0cd56ee5fe9 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -64,8 +64,9 @@ struct kmem_cache *t10_alua_lba_map_cache;
 struct kmem_cache *t10_alua_lba_map_mem_cache;
 
 static void transport_complete_task_attr(struct se_cmd *cmd);
+static int translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason);
 static void transport_handle_queue_full(struct se_cmd *cmd,
-                struct se_device *dev);
+                struct se_device *dev, int err, bool write_pending);
 static int transport_put_cmd(struct se_cmd *cmd);
 static void target_complete_ok_work(struct work_struct *work);
 
@@ -636,8 +637,7 @@ static int transport_cmd_check_stop_to_fabric(struct se_cmd *cmd)
          * Fabric modules are expected to return '1' here if the se_cmd being
          * passed is released at this point, or zero if not being released.
          */
-        return cmd->se_tfo->check_stop_free ? cmd->se_tfo->check_stop_free(cmd)
-                : 0;
+        return cmd->se_tfo->check_stop_free(cmd);
 }
 
 static void transport_lun_remove_cmd(struct se_cmd *cmd)
@@ -805,7 +805,8 @@ void target_qf_do_work(struct work_struct *work)
 
                 if (cmd->t_state == TRANSPORT_COMPLETE_QF_WP)
                         transport_write_pending_qf(cmd);
-                else if (cmd->t_state == TRANSPORT_COMPLETE_QF_OK)
+                else if (cmd->t_state == TRANSPORT_COMPLETE_QF_OK ||
+                         cmd->t_state == TRANSPORT_COMPLETE_QF_ERR)
                         transport_complete_qf(cmd);
         }
 }
@@ -1720,7 +1721,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
                 }
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 goto check_stop;
         default:
@@ -1731,7 +1732,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
         }
 
         ret = transport_send_check_condition_and_sense(cmd, sense_reason, 0);
-        if (ret == -EAGAIN || ret == -ENOMEM)
+        if (ret)
                 goto queue_full;
 
 check_stop:
@@ -1740,8 +1741,7 @@ check_stop:
         return;
 
 queue_full:
-        cmd->t_state = TRANSPORT_COMPLETE_QF_OK;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 EXPORT_SYMBOL(transport_generic_request_failure);
 
@@ -1978,13 +1978,29 @@ static void transport_complete_qf(struct se_cmd *cmd)
         int ret = 0;
 
         transport_complete_task_attr(cmd);
+        /*
+         * If a fabric driver ->write_pending() or ->queue_data_in() callback
+         * has returned neither -ENOMEM or -EAGAIN, assume it's fatal and
+         * the same callbacks should not be retried.  Return CHECK_CONDITION
+         * if a scsi_status is not already set.
+         *
+         * If a fabric driver ->queue_status() has returned non zero, always
+         * keep retrying no matter what..
+         */
+        if (cmd->t_state == TRANSPORT_COMPLETE_QF_ERR) {
+                if (cmd->scsi_status)
+                        goto queue_status;
 
-        if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
-                trace_target_cmd_complete(cmd);
-                ret = cmd->se_tfo->queue_status(cmd);
-                goto out;
+                cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
+                cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+                cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+                translate_sense_reason(cmd, TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE);
+                goto queue_status;
         }
 
+        if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE)
+                goto queue_status;
+
         switch (cmd->data_direction) {
         case DMA_FROM_DEVICE:
                 if (cmd->scsi_status)
@@ -2008,19 +2024,33 @@ queue_status:
                 break;
         }
 
-out:
         if (ret < 0) {
-                transport_handle_queue_full(cmd, cmd->se_dev);
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
                 return;
         }
         transport_lun_remove_cmd(cmd);
         transport_cmd_check_stop_to_fabric(cmd);
 }
 
-static void transport_handle_queue_full(
-        struct se_cmd *cmd,
-        struct se_device *dev)
+static void transport_handle_queue_full(struct se_cmd *cmd, struct se_device *dev,
+                                        int err, bool write_pending)
 {
+        /*
+         * -EAGAIN or -ENOMEM signals retry of ->write_pending() and/or
+         * ->queue_data_in() callbacks from new process context.
+         *
+         * Otherwise for other errors, transport_complete_qf() will send
+         * CHECK_CONDITION via ->queue_status() instead of attempting to
+         * retry associated fabric driver data-transfer callbacks.
+         */
+        if (err == -EAGAIN || err == -ENOMEM) {
+                cmd->t_state = (write_pending) ? TRANSPORT_COMPLETE_QF_WP :
+                                                 TRANSPORT_COMPLETE_QF_OK;
+        } else {
+                pr_warn_ratelimited("Got unknown fabric queue status: %d\n", err);
+                cmd->t_state = TRANSPORT_COMPLETE_QF_ERR;
+        }
+
         spin_lock_irq(&dev->qf_cmd_lock);
         list_add_tail(&cmd->se_qf_node, &cmd->se_dev->qf_cmd_list);
         atomic_inc_mb(&dev->dev_qf_count);
@@ -2084,7 +2114,7 @@ static void target_complete_ok_work(struct work_struct *work)
                 WARN_ON(!cmd->scsi_status);
                 ret = transport_send_check_condition_and_sense(
                                         cmd, 0, 1);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
 
                 transport_lun_remove_cmd(cmd);
@@ -2110,7 +2140,7 @@ static void target_complete_ok_work(struct work_struct *work)
                 } else if (rc) {
                         ret = transport_send_check_condition_and_sense(cmd,
                                                 rc, 0);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
 
                         transport_lun_remove_cmd(cmd);
@@ -2135,7 +2165,7 @@ queue_rsp:
                 if (target_read_prot_action(cmd)) {
                         ret = transport_send_check_condition_and_sense(cmd,
                                                 cmd->pi_err, 0);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
 
                         transport_lun_remove_cmd(cmd);
@@ -2145,7 +2175,7 @@ queue_rsp:
 
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_data_in(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 break;
         case DMA_TO_DEVICE:
@@ -2158,7 +2188,7 @@ queue_rsp:
                         atomic_long_add(cmd->data_length,
                                         &cmd->se_lun->lun_stats.tx_data_octets);
                         ret = cmd->se_tfo->queue_data_in(cmd);
-                        if (ret == -EAGAIN || ret == -ENOMEM)
+                        if (ret)
                                 goto queue_full;
                         break;
                 }
@@ -2167,7 +2197,7 @@ queue_rsp:
 queue_status:
                 trace_target_cmd_complete(cmd);
                 ret = cmd->se_tfo->queue_status(cmd);
-                if (ret == -EAGAIN || ret == -ENOMEM)
+                if (ret)
                         goto queue_full;
                 break;
         default:
@@ -2181,8 +2211,8 @@ queue_status:
 queue_full:
         pr_debug("Handling complete_ok QUEUE_FULL: se_cmd: %p,"
                 " data_direction: %d\n", cmd, cmd->data_direction);
-        cmd->t_state = TRANSPORT_COMPLETE_QF_OK;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 
 void target_free_sgl(struct scatterlist *sgl, int nents)
@@ -2450,18 +2480,14 @@ transport_generic_new_cmd(struct se_cmd *cmd)
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
         ret = cmd->se_tfo->write_pending(cmd);
-        if (ret == -EAGAIN || ret == -ENOMEM)
+        if (ret)
                 goto queue_full;
 
-        /* fabric drivers should only return -EAGAIN or -ENOMEM as error */
-        WARN_ON(ret);
-
-        return (!ret) ? 0 : TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+        return 0;
 
 queue_full:
         pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n", cmd);
-        cmd->t_state = TRANSPORT_COMPLETE_QF_WP;
-        transport_handle_queue_full(cmd, cmd->se_dev);
+        transport_handle_queue_full(cmd, cmd->se_dev, ret, true);
         return 0;
 }
 EXPORT_SYMBOL(transport_generic_new_cmd);
@@ -2471,10 +2497,10 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
         int ret;
 
         ret = cmd->se_tfo->write_pending(cmd);
-        if (ret == -EAGAIN || ret == -ENOMEM) {
+        if (ret) {
                 pr_debug("Handling write_pending QUEUE__FULL: se_cmd: %p\n",
                          cmd);
-                transport_handle_queue_full(cmd, cmd->se_dev);
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, true);
         }
 }
 
@@ -3012,6 +3038,8 @@ static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
         __releases(&cmd->t_state_lock)
         __acquires(&cmd->t_state_lock)
 {
+        int ret;
+
         assert_spin_locked(&cmd->t_state_lock);
         WARN_ON_ONCE(!irqs_disabled());
 
@@ -3035,7 +3063,9 @@ static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
         trace_target_cmd_complete(cmd);
 
         spin_unlock_irq(&cmd->t_state_lock);
-        cmd->se_tfo->queue_status(cmd);
+        ret = cmd->se_tfo->queue_status(cmd);
+        if (ret)
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
         spin_lock_irq(&cmd->t_state_lock);
 
         return 1;
@@ -3056,6 +3086,7 @@ EXPORT_SYMBOL(transport_check_aborted_status);
 void transport_send_task_abort(struct se_cmd *cmd)
 {
         unsigned long flags;
+        int ret;
 
         spin_lock_irqsave(&cmd->t_state_lock, flags);
         if (cmd->se_cmd_flags & (SCF_SENT_CHECK_CONDITION)) {
@@ -3091,7 +3122,9 @@ send_abort:
                  cmd->t_task_cdb[0], cmd->tag);
 
         trace_target_cmd_complete(cmd);
-        cmd->se_tfo->queue_status(cmd);
+        ret = cmd->se_tfo->queue_status(cmd);
+        if (ret)
+                transport_handle_queue_full(cmd, cmd->se_dev, ret, false);
 }
 
 static void target_tmr_work(struct work_struct *work)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c3adefe95e50..f615c3bbb73e 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -28,6 +28,7 @@
 #include <linux/stringify.h>
 #include <linux/bitops.h>
 #include <linux/highmem.h>
+#include <linux/configfs.h>
 #include <net/genetlink.h>
 #include <scsi/scsi_common.h>
 #include <scsi/scsi_proto.h>
@@ -112,6 +113,7 @@ struct tcmu_dev {
         spinlock_t commands_lock;
 
         struct timer_list timeout;
+        unsigned int cmd_time_out;
 
         char dev_config[TCMU_CONFIG_LEN];
 };
@@ -172,7 +174,9 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
 
         tcmu_cmd->se_cmd = se_cmd;
         tcmu_cmd->tcmu_dev = udev;
-        tcmu_cmd->deadline = jiffies + msecs_to_jiffies(TCMU_TIME_OUT);
+        if (udev->cmd_time_out)
+                tcmu_cmd->deadline = jiffies +
+                                        msecs_to_jiffies(udev->cmd_time_out);
 
         idr_preload(GFP_KERNEL);
         spin_lock_irq(&udev->commands_lock);
@@ -307,24 +311,50 @@ static void free_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd)
                    DATA_BLOCK_BITS);
 }
 
-static void gather_data_area(struct tcmu_dev *udev, unsigned long *cmd_bitmap,
-                struct scatterlist *data_sg, unsigned int data_nents)
+static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
+                             bool bidi)
 {
+        struct se_cmd *se_cmd = cmd->se_cmd;
         int i, block;
         int block_remaining = 0;
         void *from, *to;
         size_t copy_bytes, from_offset;
-        struct scatterlist *sg;
+        struct scatterlist *sg, *data_sg;
+        unsigned int data_nents;
+        DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
+
+        bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
+
+        if (!bidi) {
+                data_sg = se_cmd->t_data_sg;
+                data_nents = se_cmd->t_data_nents;
+        } else {
+                uint32_t count;
+
+                /*
+                 * For bidi case, the first count blocks are for Data-Out
+                 * buffer blocks, and before gathering the Data-In buffer
+                 * the Data-Out buffer blocks should be discarded.
+                 */
+                count = DIV_ROUND_UP(se_cmd->data_length, DATA_BLOCK_SIZE);
+                while (count--) {
+                        block = find_first_bit(bitmap, DATA_BLOCK_BITS);
+                        clear_bit(block, bitmap);
+                }
+
+                data_sg = se_cmd->t_bidi_data_sg;
+                data_nents = se_cmd->t_bidi_data_nents;
+        }
 
         for_each_sg(data_sg, sg, data_nents, i) {
                 int sg_remaining = sg->length;
                 to = kmap_atomic(sg_page(sg)) + sg->offset;
                 while (sg_remaining > 0) {
                         if (block_remaining == 0) {
-                                block = find_first_bit(cmd_bitmap,
+                                block = find_first_bit(bitmap,
                                                 DATA_BLOCK_BITS);
                                 block_remaining = DATA_BLOCK_SIZE;
-                                clear_bit(block, cmd_bitmap);
+                                clear_bit(block, bitmap);
                         }
                         copy_bytes = min_t(size_t, sg_remaining,
                                         block_remaining);
@@ -390,6 +420,27 @@ static bool is_ring_space_avail(struct tcmu_dev *udev, size_t cmd_size, size_t d
         return true;
 }
 
+static inline size_t tcmu_cmd_get_data_length(struct tcmu_cmd *tcmu_cmd)
+{
+        struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+        size_t data_length = round_up(se_cmd->data_length, DATA_BLOCK_SIZE);
+
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
+                data_length += round_up(se_cmd->t_bidi_data_sg->length,
+                                DATA_BLOCK_SIZE);
+        }
+
+        return data_length;
+}
+
+static inline uint32_t tcmu_cmd_get_block_cnt(struct tcmu_cmd *tcmu_cmd)
+{
+        size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
+
+        return data_length / DATA_BLOCK_SIZE;
+}
+
 static sense_reason_t
 tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 {
@@ -403,7 +454,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         uint32_t cmd_head;
         uint64_t cdb_off;
         bool copy_to_data_area;
-        size_t data_length;
+        size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
         DECLARE_BITMAP(old_bitmap, DATA_BLOCK_BITS);
 
         if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags))
@@ -417,8 +468,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
          * expensive to tell how many regions are freed in the bitmap
         */
         base_command_size = max(offsetof(struct tcmu_cmd_entry,
-                                req.iov[se_cmd->t_bidi_data_nents +
-                                        se_cmd->t_data_nents]),
+                                req.iov[tcmu_cmd_get_block_cnt(tcmu_cmd)]),
                                 sizeof(struct tcmu_cmd_entry));
         command_size = base_command_size
                 + round_up(scsi_command_size(se_cmd->t_task_cdb), TCMU_OP_ALIGN_SIZE);
@@ -429,11 +479,6 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 
         mb = udev->mb_addr;
         cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
-        data_length = se_cmd->data_length;
-        if (se_cmd->se_cmd_flags & SCF_BIDI) {
-                BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
-                data_length += se_cmd->t_bidi_data_sg->length;
-        }
         if ((command_size > (udev->cmdr_size / 2)) ||
             data_length > udev->data_size) {
                 pr_warn("TCMU: Request of size %zu/%zu is too big for %u/%zu "
@@ -451,7 +496,11 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
 
                 pr_debug("sleeping for ring space\n");
                 spin_unlock_irq(&udev->cmdr_lock);
-                ret = schedule_timeout(msecs_to_jiffies(TCMU_TIME_OUT));
+                if (udev->cmd_time_out)
+                        ret = schedule_timeout(
+                                        msecs_to_jiffies(udev->cmd_time_out));
+                else
+                        ret = schedule_timeout(msecs_to_jiffies(TCMU_TIME_OUT));
                 finish_wait(&udev->wait_cmdr, &__wait);
                 if (!ret) {
                         pr_warn("tcmu: command timed out\n");
@@ -503,11 +552,14 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         entry->req.iov_dif_cnt = 0;
 
         /* Handle BIDI commands */
-        iov_cnt = 0;
-        alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
-                se_cmd->t_bidi_data_nents, &iov, &iov_cnt, false);
-        entry->req.iov_bidi_cnt = iov_cnt;
-
+        if (se_cmd->se_cmd_flags & SCF_BIDI) {
+                iov_cnt = 0;
+                iov++;
+                alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
+                                se_cmd->t_bidi_data_nents, &iov, &iov_cnt,
+                                false);
+                entry->req.iov_bidi_cnt = iov_cnt;
+        }
         /* cmd's data_bitmap is what changed in process */
         bitmap_xor(tcmu_cmd->data_bitmap, old_bitmap, udev->data_bitmap,
                         DATA_BLOCK_BITS);
@@ -526,8 +578,9 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
         /* TODO: only if FLUSH and FUA? */
         uio_event_notify(&udev->uio_info);
 
-        mod_timer(&udev->timeout,
-                round_jiffies_up(jiffies + msecs_to_jiffies(TCMU_TIME_OUT)));
+        if (udev->cmd_time_out)
+                mod_timer(&udev->timeout, round_jiffies_up(jiffies +
+                          msecs_to_jiffies(udev->cmd_time_out)));
 
         return TCM_NO_SENSE;
 }
@@ -583,19 +636,11 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                                se_cmd->scsi_sense_length);
                 free_data_area(udev, cmd);
         } else if (se_cmd->se_cmd_flags & SCF_BIDI) {
-                DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
-
                 /* Get Data-In buffer before clean up */
-                bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
-                gather_data_area(udev, bitmap,
-                        se_cmd->t_bidi_data_sg, se_cmd->t_bidi_data_nents);
+                gather_data_area(udev, cmd, true);
                 free_data_area(udev, cmd);
         } else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
-                DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
-
-                bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
-                gather_data_area(udev, bitmap,
-                        se_cmd->t_data_sg, se_cmd->t_data_nents);
+                gather_data_area(udev, cmd, false);
                 free_data_area(udev, cmd);
         } else if (se_cmd->data_direction == DMA_TO_DEVICE) {
                 free_data_area(udev, cmd);
@@ -742,6 +787,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
         }
 
         udev->hba = hba;
+        udev->cmd_time_out = TCMU_TIME_OUT;
 
         init_waitqueue_head(&udev->wait_cmdr);
         spin_lock_init(&udev->cmdr_lock);
@@ -960,7 +1006,8 @@ static int tcmu_configure_device(struct se_device *dev)
         if (dev->dev_attrib.hw_block_size == 0)
                 dev->dev_attrib.hw_block_size = 512;
         /* Other attributes can be configured in userspace */
-        dev->dev_attrib.hw_max_sectors = 128;
+        if (!dev->dev_attrib.hw_max_sectors)
+                dev->dev_attrib.hw_max_sectors = 128;
         dev->dev_attrib.hw_queue_depth = 128;
 
         ret = tcmu_netlink_event(TCMU_CMD_ADDED_DEVICE, udev->uio_info.name,
@@ -997,6 +1044,11 @@ static void tcmu_dev_call_rcu(struct rcu_head *p)
         kfree(udev);
 }
 
+static bool tcmu_dev_configured(struct tcmu_dev *udev)
+{
+        return udev->uio_info.uio_dev ? true : false;
+}
+
 static void tcmu_free_device(struct se_device *dev)
 {
         struct tcmu_dev *udev = TCMU_DEV(dev);
@@ -1018,8 +1070,7 @@ static void tcmu_free_device(struct se_device *dev)
         spin_unlock_irq(&udev->commands_lock);
         WARN_ON(!all_expired);
 
-        /* Device was configured */
-        if (udev->uio_info.uio_dev) {
+        if (tcmu_dev_configured(udev)) {
                 tcmu_netlink_event(TCMU_CMD_REMOVED_DEVICE, udev->uio_info.name,
                                    udev->uio_info.uio_dev->minor);
 
@@ -1031,16 +1082,42 @@ static void tcmu_free_device(struct se_device *dev)
 }
 
 enum {
-        Opt_dev_config, Opt_dev_size, Opt_hw_block_size, Opt_err,
+        Opt_dev_config, Opt_dev_size, Opt_hw_block_size, Opt_hw_max_sectors,
+        Opt_err,
 };
 
 static match_table_t tokens = {
         {Opt_dev_config, "dev_config=%s"},
         {Opt_dev_size, "dev_size=%u"},
         {Opt_hw_block_size, "hw_block_size=%u"},
+        {Opt_hw_max_sectors, "hw_max_sectors=%u"},
         {Opt_err, NULL}
 };
 
+static int tcmu_set_dev_attrib(substring_t *arg, u32 *dev_attrib)
+{
+        unsigned long tmp_ul;
+        char *arg_p;
+        int ret;
+
+        arg_p = match_strdup(arg);
+        if (!arg_p)
+                return -ENOMEM;
+
+        ret = kstrtoul(arg_p, 0, &tmp_ul);
+        kfree(arg_p);
+        if (ret < 0) {
+                pr_err("kstrtoul() failed for dev attrib\n");
+                return ret;
+        }
+        if (!tmp_ul) {
+                pr_err("dev attrib must be nonzero\n");
+                return -EINVAL;
+        }
+        *dev_attrib = tmp_ul;
+        return 0;
+}
+
 static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
                 const char *page, ssize_t count)
 {
@@ -1048,7 +1125,6 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
         char *orig, *ptr, *opts, *arg_p;
         substring_t args[MAX_OPT_ARGS];
         int ret = 0, token;
-        unsigned long tmp_ul;
 
         opts = kstrdup(page, GFP_KERNEL);
         if (!opts)
@@ -1082,26 +1158,19 @@ static ssize_t tcmu_set_configfs_dev_params(struct se_device *dev,
                                 pr_err("kstrtoul() failed for dev_size=\n");
                         break;
                 case Opt_hw_block_size:
-                        arg_p = match_strdup(&args[0]);
-                        if (!arg_p) {
-                                ret = -ENOMEM;
-                                break;
-                        }
-                        ret = kstrtoul(arg_p, 0, &tmp_ul);
-                        kfree(arg_p);
-                        if (ret < 0) {
-                                pr_err("kstrtoul() failed for hw_block_size=\n");
-                                break;
-                        }
-                        if (!tmp_ul) {
-                                pr_err("hw_block_size must be nonzero\n");
-                                break;
-                        }
-                        dev->dev_attrib.hw_block_size = tmp_ul;
+                        ret = tcmu_set_dev_attrib(&args[0],
+                                        &(dev->dev_attrib.hw_block_size));
+                        break;
+                case Opt_hw_max_sectors:
+                        ret = tcmu_set_dev_attrib(&args[0],
+                                        &(dev->dev_attrib.hw_max_sectors));
                         break;
                 default:
                         break;
                 }
+
+                if (ret)
+                        break;
         }
 
         kfree(orig);
@@ -1134,7 +1203,43 @@ tcmu_parse_cdb(struct se_cmd *cmd)
         return passthrough_parse_cdb(cmd, tcmu_queue_cmd);
 }
 
-static const struct target_backend_ops tcmu_ops = {
+static ssize_t tcmu_cmd_time_out_show(struct config_item *item, char *page)
+{
+        struct se_dev_attrib *da = container_of(to_config_group(item),
+                                        struct se_dev_attrib, da_group);
+        struct tcmu_dev *udev = container_of(da->da_dev,
+                                        struct tcmu_dev, se_dev);
+
+        return snprintf(page, PAGE_SIZE, "%lu\n", udev->cmd_time_out / MSEC_PER_SEC);
+}
+
+static ssize_t tcmu_cmd_time_out_store(struct config_item *item, const char *page,
+                                       size_t count)
+{
+        struct se_dev_attrib *da = container_of(to_config_group(item),
+                                        struct se_dev_attrib, da_group);
+        struct tcmu_dev *udev = container_of(da->da_dev,
+                                        struct tcmu_dev, se_dev);
+        u32 val;
+        int ret;
+
+        if (da->da_dev->export_count) {
+                pr_err("Unable to set tcmu cmd_time_out while exports exist\n");
+                return -EINVAL;
+        }
+
+        ret = kstrtou32(page, 0, &val);
+        if (ret < 0)
+                return ret;
+
+        udev->cmd_time_out = val * MSEC_PER_SEC;
+        return count;
+}
+CONFIGFS_ATTR(tcmu_, cmd_time_out);
+
+static struct configfs_attribute **tcmu_attrs;
+
+static struct target_backend_ops tcmu_ops = {
         .name                   = "user",
         .owner                  = THIS_MODULE,
         .transport_flags        = TRANSPORT_FLAG_PASSTHROUGH,
@@ -1148,12 +1253,12 @@ static const struct target_backend_ops tcmu_ops = {
         .show_configfs_dev_params = tcmu_show_configfs_dev_params,
         .get_device_type        = sbc_get_device_type,
         .get_blocks             = tcmu_get_blocks,
-        .tb_dev_attrib_attrs    = passthrough_attrib_attrs,
+        .tb_dev_attrib_attrs    = NULL,
 };
 
 static int __init tcmu_module_init(void)
 {
-        int ret;
+        int ret, i, len = 0;
 
         BUILD_BUG_ON((sizeof(struct tcmu_cmd_entry) % TCMU_OP_ALIGN_SIZE) != 0);
 
@@ -1175,12 +1280,31 @@ static int __init tcmu_module_init(void)
                 goto out_unreg_device;
         }
 
+        for (i = 0; passthrough_attrib_attrs[i] != NULL; i++) {
+                len += sizeof(struct configfs_attribute *);
+        }
+        len += sizeof(struct configfs_attribute *) * 2;
+
+        tcmu_attrs = kzalloc(len, GFP_KERNEL);
+        if (!tcmu_attrs) {
+                ret = -ENOMEM;
+                goto out_unreg_genl;
+        }
+
+        for (i = 0; passthrough_attrib_attrs[i] != NULL; i++) {
+                tcmu_attrs[i] = passthrough_attrib_attrs[i];
+        }
+        tcmu_attrs[i] = &tcmu_attr_cmd_time_out;
+        tcmu_ops.tb_dev_attrib_attrs = tcmu_attrs;
+
         ret = transport_backend_register(&tcmu_ops);
         if (ret)
-                goto out_unreg_genl;
+                goto out_attrs;
 
         return 0;
 
+out_attrs:
+        kfree(tcmu_attrs);
 out_unreg_genl:
         genl_unregister_family(&tcmu_genl_family);
 out_unreg_device:
@@ -1194,6 +1318,7 @@ out_free_cache:
 static void __exit tcmu_module_exit(void)
 {
         target_backend_unregister(&tcmu_ops);
+        kfree(tcmu_attrs);
         genl_unregister_family(&tcmu_genl_family);
         root_device_unregister(tcmu_root_device);
         kmem_cache_destroy(tcmu_cmd_cache);
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 91048eeca28b..69d0f430b2d1 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -107,8 +107,6 @@ struct cpufreq_cooling_device {
 };
 static DEFINE_IDA(cpufreq_ida);
 
-static unsigned int cpufreq_dev_count;
-
 static DEFINE_MUTEX(cooling_list_lock);
 static LIST_HEAD(cpufreq_dev_list);
 
@@ -395,13 +393,20 @@ static int get_static_power(struct cpufreq_cooling_device *cpufreq_device,
 
         opp = dev_pm_opp_find_freq_exact(cpufreq_device->cpu_dev, freq_hz,
                                          true);
+        if (IS_ERR(opp)) {
+                dev_warn_ratelimited(cpufreq_device->cpu_dev,
+                                     "Failed to find OPP for frequency %lu: %ld\n",
+                                     freq_hz, PTR_ERR(opp));
+                return -EINVAL;
+        }
+
         voltage = dev_pm_opp_get_voltage(opp);
         dev_pm_opp_put(opp);
 
         if (voltage == 0) {
-                dev_warn_ratelimited(cpufreq_device->cpu_dev,
-                                     "Failed to get voltage for frequency %lu: %ld\n",
-                                     freq_hz, IS_ERR(opp) ? PTR_ERR(opp) : 0);
+                dev_err_ratelimited(cpufreq_device->cpu_dev,
+                                    "Failed to get voltage for frequency %lu\n",
+                                    freq_hz);
                 return -EINVAL;
         }
 
@@ -693,9 +698,9 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
 
         *state = cpufreq_cooling_get_level(cpu, target_freq);
         if (*state == THERMAL_CSTATE_INVALID) {
-                dev_warn_ratelimited(&cdev->device,
-                                     "Failed to convert %dKHz for cpu %d into a cdev state\n",
-                                     target_freq, cpu);
+                dev_err_ratelimited(&cdev->device,
+                                    "Failed to convert %dKHz for cpu %d into a cdev state\n",
+                                    target_freq, cpu);
                 return -EINVAL;
         }
 
@@ -771,6 +776,7 @@ __cpufreq_cooling_register(struct device_node *np,
         unsigned int freq, i, num_cpus;
         int ret;
         struct thermal_cooling_device_ops *cooling_ops;
+        bool first;
 
         if (!alloc_cpumask_var(&temp_mask, GFP_KERNEL))
                 return ERR_PTR(-ENOMEM);
@@ -874,13 +880,14 @@ __cpufreq_cooling_register(struct device_node *np,
         cpufreq_dev->cool_dev = cool_dev;
 
         mutex_lock(&cooling_list_lock);
+        /* Register the notifier for first cpufreq cooling device */
+        first = list_empty(&cpufreq_dev_list);
         list_add(&cpufreq_dev->node, &cpufreq_dev_list);
+        mutex_unlock(&cooling_list_lock);
 
-        /* Register the notifier for first cpufreq cooling device */
-        if (!cpufreq_dev_count++)
+        if (first)
                 cpufreq_register_notifier(&thermal_cpufreq_notifier_block,
                                           CPUFREQ_POLICY_NOTIFIER);
-        mutex_unlock(&cooling_list_lock);
 
         goto put_policy;
 
@@ -1021,6 +1028,7 @@ EXPORT_SYMBOL(of_cpufreq_power_cooling_register);
 void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
 {
         struct cpufreq_cooling_device *cpufreq_dev;
+        bool last;
 
         if (!cdev)
                 return;
@@ -1028,14 +1036,15 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
         cpufreq_dev = cdev->devdata;
 
         mutex_lock(&cooling_list_lock);
+        list_del(&cpufreq_dev->node);
         /* Unregister the notifier for the last cpufreq cooling device */
-        if (!--cpufreq_dev_count)
+        last = list_empty(&cpufreq_dev_list);
+        mutex_unlock(&cooling_list_lock);
+
+        if (last)
                 cpufreq_unregister_notifier(&thermal_cpufreq_notifier_block,
                                             CPUFREQ_POLICY_NOTIFIER);
 
-        list_del(&cpufreq_dev->node);
-        mutex_unlock(&cooling_list_lock);
-
         thermal_cooling_device_unregister(cpufreq_dev->cool_dev);
         ida_simple_remove(&cpufreq_ida, cpufreq_dev->id);
         kfree(cpufreq_dev->dyn_power_table);
diff --git a/drivers/thermal/devfreq_cooling.c b/drivers/thermal/devfreq_cooling.c
index 7743a78d4723..4bf4ad58cffd 100644
--- a/drivers/thermal/devfreq_cooling.c
+++ b/drivers/thermal/devfreq_cooling.c
@@ -186,16 +186,22 @@ get_static_power(struct devfreq_cooling_device *dfc, unsigned long freq)
                 return 0;
 
         opp = dev_pm_opp_find_freq_exact(dev, freq, true);
-        if (IS_ERR(opp) && (PTR_ERR(opp) == -ERANGE))
+        if (PTR_ERR(opp) == -ERANGE)
                 opp = dev_pm_opp_find_freq_exact(dev, freq, false);
 
+        if (IS_ERR(opp)) {
+                dev_err_ratelimited(dev, "Failed to find OPP for frequency %lu: %ld\n",
+                                    freq, PTR_ERR(opp));
+                return 0;
+        }
+
         voltage = dev_pm_opp_get_voltage(opp) / 1000; /* mV */
         dev_pm_opp_put(opp);
 
         if (voltage == 0) {
-                dev_warn_ratelimited(dev,
-                                     "Failed to get voltage for frequency %lu: %ld\n",
-                                     freq, IS_ERR(opp) ? PTR_ERR(opp) : 0);
+                dev_err_ratelimited(dev,
+                                    "Failed to get voltage for frequency %lu\n",
+                                    freq);
                 return 0;
         }
 
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 1bacbc3b19a0..e94aea8c0d05 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -114,7 +114,7 @@
 #define DEFAULT_TX_BUF_COUNT 3
 
 struct n_hdlc_buf {
-        struct n_hdlc_buf *link;
+        struct list_head  list_item;
         int               count;
         char              buf[1];
 };
@@ -122,8 +122,7 @@ struct n_hdlc_buf {
 #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe)
 
 struct n_hdlc_buf_list {
-        struct n_hdlc_buf *head;
-        struct n_hdlc_buf *tail;
+        struct list_head  list;
         int               count;
         spinlock_t        spinlock;
 };
@@ -136,7 +135,6 @@ struct n_hdlc_buf_list {
  * @backup_tty - TTY to use if tty gets closed
  * @tbusy - reentrancy flag for tx wakeup code
  * @woke_up - FIXME: describe this field
- * @tbuf - currently transmitting tx buffer
  * @tx_buf_list - list of pending transmit frame buffers
  * @rx_buf_list - list of received frame buffers
  * @tx_free_buf_list - list unused transmit frame buffers
@@ -149,7 +147,6 @@ struct n_hdlc {
         struct tty_struct       *backup_tty;
         int                     tbusy;
         int                     woke_up;
-        struct n_hdlc_buf       *tbuf;
         struct n_hdlc_buf_list  tx_buf_list;
         struct n_hdlc_buf_list  rx_buf_list;
         struct n_hdlc_buf_list  tx_free_buf_list;
@@ -159,6 +156,8 @@ struct n_hdlc {
 /*
  * HDLC buffer list manipulation functions
  */
+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
+                                                struct n_hdlc_buf *buf);
 static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
                            struct n_hdlc_buf *buf);
 static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list);
@@ -208,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty)
 {
         struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
         struct n_hdlc_buf *buf;
-        unsigned long flags;
 
         while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list)))
                 n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf);
-        spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags);
-        if (n_hdlc->tbuf) {
-                n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf);
-                n_hdlc->tbuf = NULL;
-        }
-        spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
 }
 
 static struct tty_ldisc_ops n_hdlc_ldisc = {
@@ -283,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc)
                 } else
                         break;
         }
-        kfree(n_hdlc->tbuf);
         kfree(n_hdlc);
         
 }       /* end of n_hdlc_release() */
@@ -402,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
         n_hdlc->woke_up = 0;
         spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags);
 
-        /* get current transmit buffer or get new transmit */
-        /* buffer from list of pending transmit buffers */
-                
-        tbuf = n_hdlc->tbuf;
-        if (!tbuf)
-                tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
-                
+        tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list);
         while (tbuf) {
                 if (debuglevel >= DEBUG_LEVEL_INFO)     
                         printk("%s(%d)sending frame %p, count=%d\n",
@@ -420,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
 
                 /* rollback was possible and has been done */
                 if (actual == -ERESTARTSYS) {
-                        n_hdlc->tbuf = tbuf;
+                        n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
                         break;
                 }
                 /* if transmit error, throw frame away by */
@@ -435,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
                                         
                         /* free current transmit buffer */
                         n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf);
-                        
-                        /* this tx buffer is done */
-                        n_hdlc->tbuf = NULL;
-                        
+
                         /* wait up sleeping writers */
                         wake_up_interruptible(&tty->write_wait);
         
@@ -448,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty)
                         if (debuglevel >= DEBUG_LEVEL_INFO)     
                                 printk("%s(%d)frame %p pending\n",
                                         __FILE__,__LINE__,tbuf);
-                                        
-                        /* buffer not accepted by driver */
-                        /* set this buffer as pending buffer */
-                        n_hdlc->tbuf = tbuf;
+
+                        /*
+                         * the buffer was not accepted by driver,
+                         * return it back into tx queue
+                         */
+                        n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf);
                         break;
                 }
         }
@@ -749,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
         int error = 0;
         int count;
         unsigned long flags;
-        
+        struct n_hdlc_buf *buf = NULL;
+
         if (debuglevel >= DEBUG_LEVEL_INFO)     
                 printk("%s(%d)n_hdlc_tty_ioctl() called %d\n",
                         __FILE__,__LINE__,cmd);
@@ -763,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 /* report count of read data available */
                 /* in next available frame (if any) */
                 spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags);
-                if (n_hdlc->rx_buf_list.head)
-                        count = n_hdlc->rx_buf_list.head->count;
+                buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list,
+                                                struct n_hdlc_buf, list_item);
+                if (buf)
+                        count = buf->count;
                 else
                         count = 0;
                 spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags);
@@ -776,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file,
                 count = tty_chars_in_buffer(tty);
                 /* add size of next output frame in queue */
                 spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags);
-                if (n_hdlc->tx_buf_list.head)
-                        count += n_hdlc->tx_buf_list.head->count;
+                buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list,
+                                                struct n_hdlc_buf, list_item);
+                if (buf)
+                        count += buf->count;
                 spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags);
                 error = put_user(count, (int __user *)arg);
                 break;
@@ -825,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp,
                 poll_wait(filp, &tty->write_wait, wait);
 
                 /* set bits for operations that won't block */
-                if (n_hdlc->rx_buf_list.head)
+                if (!list_empty(&n_hdlc->rx_buf_list.list))
                         mask |= POLLIN | POLLRDNORM;    /* readable */
                 if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
                         mask |= POLLHUP;
                 if (tty_hung_up_p(filp))
                         mask |= POLLHUP;
                 if (!tty_is_writelocked(tty) &&
-                                n_hdlc->tx_free_buf_list.head)
+                                !list_empty(&n_hdlc->tx_free_buf_list.list))
                         mask |= POLLOUT | POLLWRNORM;   /* writable */
         }
         return mask;
@@ -856,7 +845,12 @@ static struct n_hdlc *n_hdlc_alloc(void)
         spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock);
         spin_lock_init(&n_hdlc->rx_buf_list.spinlock);
         spin_lock_init(&n_hdlc->tx_buf_list.spinlock);
-        
+
+        INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list);
+        INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list);
+
         /* allocate free rx buffer list */
         for(i=0;i<DEFAULT_RX_BUF_COUNT;i++) {
                 buf = kmalloc(N_HDLC_BUF_SIZE, GFP_KERNEL);
@@ -884,53 +878,65 @@ static struct n_hdlc *n_hdlc_alloc(void)
 }       /* end of n_hdlc_alloc() */
 
 /**
+ * n_hdlc_buf_return - put the HDLC buffer after the head of the specified list
+ * @buf_list - pointer to the buffer list
+ * @buf - pointer to the buffer
+ */
+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list,
+                                                struct n_hdlc_buf *buf)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        list_add(&buf->list_item, &buf_list->list);
+        buf_list->count++;
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
+}
+
+/**
  * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list
- * @list - pointer to buffer list
+ * @buf_list - pointer to buffer list
  * @buf - pointer to buffer
  */
-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list,
+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list,
                            struct n_hdlc_buf *buf)
 {
         unsigned long flags;
-        spin_lock_irqsave(&list->spinlock,flags);
-        
-        buf->link=NULL;
-        if (list->tail)
-                list->tail->link = buf;
-        else
-                list->head = buf;
-        list->tail = buf;
-        (list->count)++;
-        
-        spin_unlock_irqrestore(&list->spinlock,flags);
-        
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        list_add_tail(&buf->list_item, &buf_list->list);
+        buf_list->count++;
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
 }       /* end of n_hdlc_buf_put() */
 
 /**
  * n_hdlc_buf_get - remove and return an HDLC buffer from list
- * @list - pointer to HDLC buffer list
+ * @buf_list - pointer to HDLC buffer list
  * 
  * Remove and return an HDLC buffer from the head of the specified HDLC buffer
  * list.
  * Returns a pointer to HDLC buffer if available, otherwise %NULL.
  */
-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list)
+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list)
 {
         unsigned long flags;
         struct n_hdlc_buf *buf;
-        spin_lock_irqsave(&list->spinlock,flags);
-        
-        buf = list->head;
+
+        spin_lock_irqsave(&buf_list->spinlock, flags);
+
+        buf = list_first_entry_or_null(&buf_list->list,
+                                                struct n_hdlc_buf, list_item);
         if (buf) {
-                list->head = buf->link;
-                (list->count)--;
+                list_del(&buf->list_item);
+                buf_list->count--;
         }
-        if (!list->head)
-                list->tail = NULL;
-        
-        spin_unlock_irqrestore(&list->spinlock,flags);
+
+        spin_unlock_irqrestore(&buf_list->spinlock, flags);
         return buf;
-        
 }       /* end of n_hdlc_buf_get() */
 
 static char hdlc_banner[] __initdata =
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 6ee55a2d47bb..e65808c482f1 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -257,7 +257,7 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios,
 {
         unsigned int baud = tty_termios_baud_rate(termios);
         struct dw8250_data *d = p->private_data;
-        unsigned int rate;
+        long rate;
         int ret;
 
         if (IS_ERR(d->clk) || !old)
@@ -265,7 +265,12 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios,
 
         clk_disable_unprepare(d->clk);
         rate = clk_round_rate(d->clk, baud * 16);
-        ret = clk_set_rate(d->clk, rate);
+        if (rate < 0)
+                ret = rate;
+        else if (rate == 0)
+                ret = -ENOENT;
+        else
+                ret = clk_set_rate(d->clk, rate);
         clk_prepare_enable(d->clk);
 
         if (!ret)
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index a65fb8197aec..0e3f529d50e9 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -128,9 +128,13 @@ config SERIAL_8250_PCI
           by the parport_serial driver, enabled with CONFIG_PARPORT_SERIAL.
 
 config SERIAL_8250_EXAR
-        tristate "8250/16550 PCI device support"
-        depends on SERIAL_8250_PCI
+        tristate "8250/16550 Exar/Commtech PCI/PCIe device support"
+        depends on SERIAL_8250_PCI
         default SERIAL_8250
+        help
+          This builds support for XR17C1xx, XR17V3xx and some Commtech
+          422x PCIe serial cards that are not covered by the more generic
+          SERIAL_8250_PCI option.
 
 config SERIAL_8250_HP300
         tristate
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 8789ea423ccf..b0a377725d63 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2373,7 +2373,7 @@ static int __init pl011_console_match(struct console *co, char *name, int idx,
         if (strcmp(name, "qdf2400_e44") == 0) {
                 pr_info_once("UART: Working around QDF2400 SoC erratum 44");
                 qdf2400_e44_present = true;
-        } else if (strcmp(name, "pl011") != 0 || strcmp(name, "ttyAMA") != 0) {
+        } else if (strcmp(name, "pl011") != 0) {
                 return -ENODEV;
         }
 
@@ -2452,18 +2452,37 @@ static void pl011_early_write(struct console *con, const char *s, unsigned n)
         uart_console_write(&dev->port, s, n, pl011_putc);
 }
 
+/*
+ * On non-ACPI systems, earlycon is enabled by specifying
+ * "earlycon=pl011,<address>" on the kernel command line.
+ *
+ * On ACPI ARM64 systems, an "early" console is enabled via the SPCR table,
+ * by specifying only "earlycon" on the command line.  Because it requires
+ * SPCR, the console starts after ACPI is parsed, which is later than a
+ * traditional early console.
+ *
+ * To get the traditional early console that starts before ACPI is parsed,
+ * specify the full "earlycon=pl011,<address>" option.
+ */
 static int __init pl011_early_console_setup(struct earlycon_device *device,
                                             const char *opt)
 {
         if (!device->port.membase)
                 return -ENODEV;
 
-        device->con->write = qdf2400_e44_present ?
-                                qdf2400_e44_early_write : pl011_early_write;
+        /* On QDF2400 SOCs affected by Erratum 44, the "qdf2400_e44" must
+         * also be specified, e.g. "earlycon=pl011,<address>,qdf2400_e44".
+         */
+        if (!strcmp(device->options, "qdf2400_e44"))
+                device->con->write = qdf2400_e44_early_write;
+        else
+                device->con->write = pl011_early_write;
+
         return 0;
 }
 OF_EARLYCON_DECLARE(pl011, "arm,pl011", pl011_early_console_setup);
 OF_EARLYCON_DECLARE(pl011, "arm,sbsa-uart", pl011_early_console_setup);
+EARLYCON_DECLARE(qdf2400_e44, pl011_early_console_setup);
 
 #else
 #define AMBA_CONSOLE    NULL
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index dcebb28ffbc4..1f50a83ef958 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1951,6 +1951,11 @@ static void atmel_flush_buffer(struct uart_port *port)
                 atmel_uart_writel(port, ATMEL_PDC_TCR, 0);
                 atmel_port->pdc_tx.ofs = 0;
         }
+        /*
+         * in uart_flush_buffer(), the xmit circular buffer has just
+         * been cleared, so we have to reset tx_len accordingly.
+         */
+        atmel_port->tx_len = 0;
 }
 
 /*
@@ -2483,6 +2488,9 @@ static void atmel_console_write(struct console *co, const char *s, u_int count)
         pdc_tx = atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN;
         atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS);
 
+        /* Make sure that tx path is actually able to send characters */
+        atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN);
+
         uart_console_write(port, s, count, atmel_console_putchar);
 
         /*
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 6989b227d134..be94246b6fcc 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -1088,7 +1088,7 @@ static void mxs_auart_settermios(struct uart_port *u,
                                         AUART_LINECTRL_BAUD_DIV_MAX);
                 baud_max = u->uartclk * 32 / AUART_LINECTRL_BAUD_DIV_MIN;
                 baud = uart_get_baud_rate(u, termios, old, baud_min, baud_max);
-                div = u->uartclk * 32 / baud;
+                div = DIV_ROUND_CLOSEST(u->uartclk * 32, baud);
         }
 
         ctrl |= AUART_LINECTRL_BAUD_DIVFRAC(div & 0x3F);
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index b4f86c219db1..7a17aedbf902 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1031,8 +1031,10 @@ static int s3c64xx_serial_startup(struct uart_port *port)
         if (ourport->dma) {
                 ret = s3c24xx_serial_request_dma(ourport);
                 if (ret < 0) {
-                        dev_warn(port->dev, "DMA request failed\n");
-                        return ret;
+                        dev_warn(port->dev,
+                                 "DMA request failed, DMA will not be used\n");
+                        devm_kfree(port->dev, ourport->dma);
+                        ourport->dma = NULL;
                 }
         }
 
diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
index bcf1d33e6ffe..c334bcc59c64 100644
--- a/drivers/tty/serial/st-asc.c
+++ b/drivers/tty/serial/st-asc.c
@@ -575,12 +575,13 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,
                         pinctrl_select_state(ascport->pinctrl,
                                              ascport->states[NO_HW_FLOWCTRL]);
 
-                        gpiod = devm_get_gpiod_from_child(port->dev, "rts",
-                                                          &np->fwnode);
-                        if (!IS_ERR(gpiod)) {
-                                gpiod_direction_output(gpiod, 0);
+                        gpiod = devm_fwnode_get_gpiod_from_child(port->dev,
+                                                                 "rts",
+                                                                 &np->fwnode,
+                                                                 GPIOD_OUT_LOW,
+                                                                 np->name);
+                        if (!IS_ERR(gpiod))
                                 ascport->rts = gpiod;
-                        }
                 }
         }
 
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 68947f6de5ad..e4603b09863a 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -271,10 +271,13 @@ const struct file_operations tty_ldiscs_proc_fops = {
 
 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
 {
+        struct tty_ldisc *ld;
+
         ldsem_down_read(&tty->ldisc_sem, MAX_SCHEDULE_TIMEOUT);
-        if (!tty->ldisc)
+        ld = tty->ldisc;
+        if (!ld)
                 ldsem_up_read(&tty->ldisc_sem);
-        return tty->ldisc;
+        return ld;
 }
 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
 
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index c5f0fc906136..8af8d9542663 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 #include <linux/sched/signal.h>
 #include <linux/sched/debug.h>
-#include <linux/sched/debug.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/mm.h>
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index f03692ec5520..8fb309a0ff6b 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1381,7 +1381,7 @@ static int usbtmc_probe(struct usb_interface *intf,
 
         dev_dbg(&intf->dev, "%s called\n", __func__);
 
-        data = kmalloc(sizeof(*data), GFP_KERNEL);
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
 
@@ -1444,6 +1444,13 @@ static int usbtmc_probe(struct usb_interface *intf,
                         break;
                 }
         }
+
+        if (!data->bulk_out || !data->bulk_in) {
+                dev_err(&intf->dev, "bulk endpoints not found\n");
+                retcode = -ENODEV;
+                goto err_put;
+        }
+
         /* Find int endpoint */
         for (n = 0; n < iface_desc->desc.bNumEndpoints; n++) {
                 endpoint = &iface_desc->endpoint[n].desc;
@@ -1469,8 +1476,10 @@ static int usbtmc_probe(struct usb_interface *intf,
         if (data->iin_ep_present) {
                 /* allocate int urb */
                 data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
-                if (!data->iin_urb)
+                if (!data->iin_urb) {
+                        retcode = -ENOMEM;
                         goto error_register;
+                }
 
                 /* Protect interrupt in endpoint data until iin_urb is freed */
                 kref_get(&data->kref);
@@ -1478,8 +1487,10 @@ static int usbtmc_probe(struct usb_interface *intf,
                 /* allocate buffer for interrupt in */
                 data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
                                         GFP_KERNEL);
-                if (!data->iin_buffer)
+                if (!data->iin_buffer) {
+                        retcode = -ENOMEM;
                         goto error_register;
+                }
 
                 /* fill interrupt urb */
                 usb_fill_int_urb(data->iin_urb, data->usb_dev,
@@ -1512,6 +1523,7 @@ error_register:
         sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
         sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
         usbtmc_free_int(data);
+err_put:
         kref_put(&data->kref, usbtmc_delete);
         return retcode;
 }
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 25dbd8c7aec7..4be52c602e9b 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -280,6 +280,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
 
                         /*
                          * Adjust bInterval for quirked devices.
+                         */
+                        /*
+                         * This quirk fixes bIntervals reported in ms.
+                         */
+                        if (to_usb_device(ddev)->quirks &
+                                USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) {
+                                n = clamp(fls(d->bInterval) + 3, i, j);
+                                i = j = n;
+                        }
+                        /*
                          * This quirk fixes bIntervals reported in
                          * linear microframes.
                          */
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 612fab6e54fb..79bdca5cb9c7 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -520,8 +520,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb)
          */
         tbuf_size =  max_t(u16, sizeof(struct usb_hub_descriptor), wLength);
         tbuf = kzalloc(tbuf_size, GFP_KERNEL);
-        if (!tbuf)
-                return -ENOMEM;
+        if (!tbuf) {
+                status = -ENOMEM;
+                goto err_alloc;
+        }
 
         bufp = tbuf;
 
@@ -734,6 +736,7 @@ error:
         }
 
         kfree(tbuf);
+ err_alloc:
 
         /* any errors get returned through the urb completion */
         spin_lock_irq(&hcd_root_hub_lock);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f0dd08198d74..5286bf67869a 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4275,7 +4275,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev)
         struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent);
         int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN;
 
-        if (!udev->usb2_hw_lpm_capable)
+        if (!udev->usb2_hw_lpm_capable || !udev->bos)
                 return;
 
         if (hub)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 24f9f98968a5..96b21b0dac1e 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -170,6 +170,14 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* M-Systems Flash Disk Pioneers */
         { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Baum Vario Ultra */
+        { USB_DEVICE(0x0904, 0x6101), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+        { USB_DEVICE(0x0904, 0x6102), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+        { USB_DEVICE(0x0904, 0x6103), .driver_info =
+                        USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL },
+
         /* Keytouch QWERTY Panel keyboard */
         { USB_DEVICE(0x0926, 0x3333), .driver_info =
                         USB_QUIRK_CONFIG_INTF_STRINGS },
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2092e46b1380..f8d0747810e7 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap,
                 val = dwc3_omap_read_utmi_ctrl(omap);
                 val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
                 dwc3_omap_write_utmi_ctrl(omap, val);
+                break;
 
         case OMAP_DWC3_VBUS_OFF:
                 val = dwc3_omap_read_utmi_ctrl(omap);
@@ -392,7 +393,7 @@ static void dwc3_omap_set_utmi_mode(struct dwc3_omap *omap)
 {
         u32                     reg;
         struct device_node      *node = omap->dev->of_node;
-        int                     utmi_mode = 0;
+        u32                     utmi_mode = 0;
 
         reg = dwc3_omap_read_utmi_ctrl(omap);
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 4db97ecae885..79e7a3480d51 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -171,6 +171,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
                 int status)
 {
         struct dwc3                     *dwc = dep->dwc;
+        unsigned int                    unmap_after_complete = false;
 
         req->started = false;
         list_del(&req->list);
@@ -180,11 +181,19 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         if (req->request.status == -EINPROGRESS)
                 req->request.status = status;
 
-        if (dwc->ep0_bounced && dep->number <= 1)
+        /*
+         * NOTICE we don't want to unmap before calling ->complete() if we're
+         * dealing with a bounced ep0 request. If we unmap it here, we would end
+         * up overwritting the contents of req->buf and this could confuse the
+         * gadget driver.
+         */
+        if (dwc->ep0_bounced && dep->number <= 1) {
                 dwc->ep0_bounced = false;
-
-        usb_gadget_unmap_request_by_dev(dwc->sysdev,
-                        &req->request, req->direction);
+                unmap_after_complete = true;
+        } else {
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                &req->request, req->direction);
+        }
 
         trace_dwc3_gadget_giveback(req);
 
@@ -192,6 +201,10 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
         usb_gadget_giveback_request(&dep->endpoint, &req->request);
         spin_lock(&dwc->lock);
 
+        if (unmap_after_complete)
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                &req->request, req->direction);
+
         if (dep->number > 1)
                 pm_runtime_put(dwc->dev);
 }
@@ -1342,6 +1355,68 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                 if (r == req) {
                         /* wait until it is processed */
                         dwc3_stop_active_transfer(dwc, dep->number, true);
+
+                        /*
+                         * If request was already started, this means we had to
+                         * stop the transfer. With that we also need to ignore
+                         * all TRBs used by the request, however TRBs can only
+                         * be modified after completion of END_TRANSFER
+                         * command. So what we do here is that we wait for
+                         * END_TRANSFER completion and only after that, we jump
+                         * over TRBs by clearing HWO and incrementing dequeue
+                         * pointer.
+                         *
+                         * Note that we have 2 possible types of transfers here:
+                         *
+                         * i) Linear buffer request
+                         * ii) SG-list based request
+                         *
+                         * SG-list based requests will have r->num_pending_sgs
+                         * set to a valid number (> 0). Linear requests,
+                         * normally use a single TRB.
+                         *
+                         * For each of these two cases, if r->unaligned flag is
+                         * set, one extra TRB has been used to align transfer
+                         * size to wMaxPacketSize.
+                         *
+                         * All of these cases need to be taken into
+                         * consideration so we don't mess up our TRB ring
+                         * pointers.
+                         */
+                        wait_event_lock_irq(dep->wait_end_transfer,
+                                        !(dep->flags & DWC3_EP_END_TRANSFER_PENDING),
+                                        dwc->lock);
+
+                        if (!r->trb)
+                                goto out1;
+
+                        if (r->num_pending_sgs) {
+                                struct dwc3_trb *trb;
+                                int i = 0;
+
+                                for (i = 0; i < r->num_pending_sgs; i++) {
+                                        trb = r->trb + i;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+
+                                if (r->unaligned) {
+                                        trb = r->trb + r->num_pending_sgs + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        } else {
+                                struct dwc3_trb *trb = r->trb;
+
+                                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                dwc3_ep_inc_deq(dep);
+
+                                if (r->unaligned) {
+                                        trb = r->trb + 1;
+                                        trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+                                        dwc3_ep_inc_deq(dep);
+                                }
+                        }
                         goto out1;
                 }
                 dev_err(dwc->dev, "request %p was not queued to %s\n",
@@ -1352,6 +1427,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
 
 out1:
         /* giveback the request */
+        dep->queued_requests--;
         dwc3_gadget_giveback(dep, req, -ECONNRESET);
 
 out0:
@@ -2126,12 +2202,12 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                 return 1;
         }
 
-        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                return 1;
-
         count = trb->size & DWC3_TRB_SIZE_MASK;
         req->remaining += count;
 
+        if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
+                return 1;
+
         if (dep->direction) {
                 if (count) {
                         trb_status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -3228,15 +3304,10 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
 
 int dwc3_gadget_suspend(struct dwc3 *dwc)
 {
-        int ret;
-
         if (!dwc->gadget_driver)
                 return 0;
 
-        ret = dwc3_gadget_run_stop(dwc, false, false);
-        if (ret < 0)
-                return ret;
-
+        dwc3_gadget_run_stop(dwc, false, false);
         dwc3_disconnect_gadget(dwc);
         __dwc3_gadget_stop(dwc);
 
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 3129bcf74d7d..265e223ab645 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -28,23 +28,23 @@ struct dwc3;
 #define gadget_to_dwc(g)        (container_of(g, struct dwc3, gadget))
 
 /* DEPCFG parameter 1 */
-#define DWC3_DEPCFG_INT_NUM(n)          ((n) << 0)
+#define DWC3_DEPCFG_INT_NUM(n)          (((n) & 0x1f) << 0)
 #define DWC3_DEPCFG_XFER_COMPLETE_EN    (1 << 8)
 #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9)
 #define DWC3_DEPCFG_XFER_NOT_READY_EN   (1 << 10)
 #define DWC3_DEPCFG_FIFO_ERROR_EN       (1 << 11)
 #define DWC3_DEPCFG_STREAM_EVENT_EN     (1 << 13)
-#define DWC3_DEPCFG_BINTERVAL_M1(n)     ((n) << 16)
+#define DWC3_DEPCFG_BINTERVAL_M1(n)     (((n) & 0xff) << 16)
 #define DWC3_DEPCFG_STREAM_CAPABLE      (1 << 24)
-#define DWC3_DEPCFG_EP_NUMBER(n)        ((n) << 25)
+#define DWC3_DEPCFG_EP_NUMBER(n)        (((n) & 0x1f) << 25)
 #define DWC3_DEPCFG_BULK_BASED          (1 << 30)
 #define DWC3_DEPCFG_FIFO_BASED          (1 << 31)
 
 /* DEPCFG parameter 0 */
-#define DWC3_DEPCFG_EP_TYPE(n)          ((n) << 1)
-#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  ((n) << 3)
-#define DWC3_DEPCFG_FIFO_NUMBER(n)      ((n) << 17)
-#define DWC3_DEPCFG_BURST_SIZE(n)       ((n) << 22)
+#define DWC3_DEPCFG_EP_TYPE(n)          (((n) & 0x3) << 1)
+#define DWC3_DEPCFG_MAX_PACKET_SIZE(n)  (((n) & 0x7ff) << 3)
+#define DWC3_DEPCFG_FIFO_NUMBER(n)      (((n) & 0x1f) << 17)
+#define DWC3_DEPCFG_BURST_SIZE(n)       (((n) & 0xf) << 22)
 #define DWC3_DEPCFG_DATA_SEQ_NUM(n)     ((n) << 26)
 /* This applies for core versions earlier than 1.94a */
 #define DWC3_DEPCFG_IGN_SEQ_NUM         (1 << 31)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 78c44979dde3..cbff3b02840d 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -269,6 +269,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item,
                 ret = unregister_gadget(gi);
                 if (ret)
                         goto err;
+                kfree(name);
         } else {
                 if (gi->composite.gadget_driver.udc_name) {
                         ret = -EBUSY;
diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
index a30766ca4226..5e3828d9dac7 100644
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -535,13 +535,15 @@ static int acm_notify_serial_state(struct f_acm *acm)
 {
         struct usb_composite_dev *cdev = acm->port.func.config->cdev;
         int                     status;
+        __le16                  serial_state;
 
         spin_lock(&acm->lock);
         if (acm->notify_req) {
                 dev_dbg(&cdev->gadget->dev, "acm ttyGS%d serial state %04x\n",
                         acm->port_num, acm->serial_state);
+                serial_state = cpu_to_le16(acm->serial_state);
                 status = acm_cdc_notify(acm, USB_CDC_NOTIFY_SERIAL_STATE,
-                                0, &acm->serial_state, sizeof(acm->serial_state));
+                                0, &serial_state, sizeof(acm->serial_state));
         } else {
                 acm->pending = true;
                 status = 0;
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index a5b7cd615698..a0085571824d 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1834,11 +1834,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
         spin_lock_irqsave(&func->ffs->eps_lock, flags);
         while(count--) {
                 struct usb_endpoint_descriptor *ds;
+                struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+                int needs_comp_desc = false;
                 int desc_idx;
 
-                if (ffs->gadget->speed == USB_SPEED_SUPER)
+                if (ffs->gadget->speed == USB_SPEED_SUPER) {
                         desc_idx = 2;
-                else if (ffs->gadget->speed == USB_SPEED_HIGH)
+                        needs_comp_desc = true;
+                } else if (ffs->gadget->speed == USB_SPEED_HIGH)
                         desc_idx = 1;
                 else
                         desc_idx = 0;
@@ -1855,6 +1858,14 @@ static int ffs_func_eps_enable(struct ffs_function *func)
 
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
+
+                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                USB_DT_ENDPOINT_SIZE);
+                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+
+                if (needs_comp_desc)
+                        ep->ep->comp_desc = comp_desc;
+
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
                         epfile->ep = ep;
@@ -2253,7 +2264,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
 
                 if (len < sizeof(*d) ||
                     d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                    d->Reserved1)
+                    !d->Reserved1)
                         return -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                         if (d->Reserved2[i])
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 89b48bcc377a..5eea44823ca0 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -367,7 +367,7 @@ try_again:
         count  = min_t(unsigned, count, hidg->report_length);
 
         spin_unlock_irqrestore(&hidg->write_spinlock, flags);
-        status = copy_from_user(hidg->req->buf, buffer, count);
+        status = copy_from_user(req->buf, buffer, count);
 
         if (status != 0) {
                 ERROR(hidg->func.config->cdev,
@@ -378,9 +378,9 @@ try_again:
 
         spin_lock_irqsave(&hidg->write_spinlock, flags);
 
-        /* we our function has been disabled by host */
+        /* when our function has been disabled by host */
         if (!hidg->req) {
-                free_ep_req(hidg->in_ep, hidg->req);
+                free_ep_req(hidg->in_ep, req);
                 /*
                  * TODO
                  * Should we fail with error here?
@@ -394,7 +394,7 @@ try_again:
         req->complete = f_hidg_req_complete;
         req->context  = hidg;
 
-        status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
+        status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC);
         if (status < 0) {
                 ERROR(hidg->func.config->cdev,
                         "usb_ep_queue error on int endpoint %zd\n", status);
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index d2351139342f..a82e2bd5ea34 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -373,7 +373,7 @@ static void bot_cleanup_old_alt(struct f_uas *fu)
         usb_ep_free_request(fu->ep_in, fu->bot_req_in);
         usb_ep_free_request(fu->ep_out, fu->bot_req_out);
         usb_ep_free_request(fu->ep_out, fu->cmd.req);
-        usb_ep_free_request(fu->ep_out, fu->bot_status.req);
+        usb_ep_free_request(fu->ep_in, fu->bot_status.req);
 
         kfree(fu->cmd.buf);
 
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index 27ed51b5082f..f8a1881609a2 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -258,13 +258,6 @@ uvc_function_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
         memcpy(&uvc_event->req, ctrl, sizeof(uvc_event->req));
         v4l2_event_queue(&uvc->vdev, &v4l2_event);
 
-        /* Pass additional setup data to userspace */
-        if (uvc->event_setup_out && uvc->event_length) {
-                uvc->control_req->length = uvc->event_length;
-                return usb_ep_queue(uvc->func.config->cdev->gadget->ep0,
-                        uvc->control_req, GFP_ATOMIC);
-        }
-
         return 0;
 }
 
@@ -601,6 +594,14 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         opts->streaming_maxpacket = clamp(opts->streaming_maxpacket, 1U, 3072U);
         opts->streaming_maxburst = min(opts->streaming_maxburst, 15U);
 
+        /* For SS, wMaxPacketSize has to be 1024 if bMaxBurst is not 0 */
+        if (opts->streaming_maxburst &&
+            (opts->streaming_maxpacket % 1024) != 0) {
+                opts->streaming_maxpacket = roundup(opts->streaming_maxpacket, 1024);
+                INFO(cdev, "overriding streaming_maxpacket to %d\n",
+                     opts->streaming_maxpacket);
+        }
+
         /* Fill in the FS/HS/SS Video Streaming specific descriptors from the
          * module parameters.
          *
@@ -632,7 +633,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
         uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst;
         uvc_ss_streaming_comp.wBytesPerInterval =
                 cpu_to_le16(max_packet_size * max_packet_mult *
-                            opts->streaming_maxburst);
+                            (opts->streaming_maxburst + 1));
 
         /* Allocate endpoints. */
         ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep);
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index a2615d64d07c..a2c916869293 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -84,8 +84,7 @@ static int ep_open(struct inode *, struct file *);
 
 /* /dev/gadget/$CHIP represents ep0 and the whole device */
 enum ep0_state {
-        /* DISBLED is the initial state.
-         */
+        /* DISABLED is the initial state. */
         STATE_DEV_DISABLED = 0,
 
         /* Only one open() of /dev/gadget/$CHIP; only one file tracks
@@ -1782,8 +1781,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
         spin_lock_irq (&dev->lock);
         value = -EINVAL;
-        if (dev->buf)
+        if (dev->buf) {
+                kfree(kbuf);
                 goto fail;
+        }
         dev->buf = kbuf;
 
         /* full or low speed config */
diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
index 11bbce28bc23..2035906b8ced 100644
--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
@@ -610,7 +610,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 {
         struct usba_ep *ep = to_usba_ep(_ep);
         struct usba_udc *udc = ep->udc;
-        unsigned long flags, ept_cfg, maxpacket;
+        unsigned long flags, maxpacket;
         unsigned int nr_trans;
 
         DBG(DBG_GADGET, "%s: ep_enable: desc=%p\n", ep->ep.name, desc);
@@ -630,7 +630,7 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
         ep->is_in = 0;
 
         DBG(DBG_ERR, "%s: EPT_CFG = 0x%lx (maxpacket = %lu)\n",
-                        ep->ep.name, ept_cfg, maxpacket);
+                        ep->ep.name, ep->ept_cfg, maxpacket);
 
         if (usb_endpoint_dir_in(desc)) {
                 ep->is_in = 1;
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c60abe3a68f9..8cabc5944d5f 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -1031,6 +1031,8 @@ static int dummy_udc_probe(struct platform_device *pdev)
         int             rc;
 
         dum = *((void **)dev_get_platdata(&pdev->dev));
+        /* Clear usb_gadget region for new registration to udc-core */
+        memzero_explicit(&dum->gadget, sizeof(struct usb_gadget));
         dum->gadget.name = gadget_name;
         dum->gadget.ops = &dummy_ops;
         dum->gadget.max_speed = USB_SPEED_SUPER;
diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
index 85504419ab31..3828c2ec8623 100644
--- a/drivers/usb/gadget/udc/net2280.c
+++ b/drivers/usb/gadget/udc/net2280.c
@@ -1146,15 +1146,15 @@ static int scan_dma_completions(struct net2280_ep *ep)
          */
         while (!list_empty(&ep->queue)) {
                 struct net2280_request  *req;
-                u32                     tmp;
+                u32 req_dma_count;
 
                 req = list_entry(ep->queue.next,
                                 struct net2280_request, queue);
                 if (!req->valid)
                         break;
                 rmb();
-                tmp = le32_to_cpup(&req->td->dmacount);
-                if ((tmp & BIT(VALID_BIT)) != 0)
+                req_dma_count = le32_to_cpup(&req->td->dmacount);
+                if ((req_dma_count & BIT(VALID_BIT)) != 0)
                         break;
 
                 /* SHORT_PACKET_TRANSFERRED_INTERRUPT handles "usb-short"
@@ -1163,40 +1163,41 @@ static int scan_dma_completions(struct net2280_ep *ep)
                  */
                 if (unlikely(req->td->dmadesc == 0)) {
                         /* paranoia */
-                        tmp = readl(&ep->dma->dmacount);
-                        if (tmp & DMA_BYTE_COUNT_MASK)
+                        u32 const ep_dmacount = readl(&ep->dma->dmacount);
+
+                        if (ep_dmacount & DMA_BYTE_COUNT_MASK)
                                 break;
                         /* single transfer mode */
-                        dma_done(ep, req, tmp, 0);
+                        dma_done(ep, req, req_dma_count, 0);
                         num_completed++;
                         break;
                 } else if (!ep->is_in &&
                            (req->req.length % ep->ep.maxpacket) &&
                            !(ep->dev->quirks & PLX_PCIE)) {
 
-                        tmp = readl(&ep->regs->ep_stat);
+                        u32 const ep_stat = readl(&ep->regs->ep_stat);
                         /* AVOID TROUBLE HERE by not issuing short reads from
                          * your gadget driver.  That helps avoids errata 0121,
                          * 0122, and 0124; not all cases trigger the warning.
                          */
-                        if ((tmp & BIT(NAK_OUT_PACKETS)) == 0) {
+                        if ((ep_stat & BIT(NAK_OUT_PACKETS)) == 0) {
                                 ep_warn(ep->dev, "%s lost packet sync!\n",
                                                 ep->ep.name);
                                 req->req.status = -EOVERFLOW;
                         } else {
-                                tmp = readl(&ep->regs->ep_avail);
-                                if (tmp) {
+                                u32 const ep_avail = readl(&ep->regs->ep_avail);
+                                if (ep_avail) {
                                         /* fifo gets flushed later */
                                         ep->out_overflow = 1;
                                         ep_dbg(ep->dev,
                                                 "%s dma, discard %d len %d\n",
-                                                ep->ep.name, tmp,
+                                                ep->ep.name, ep_avail,
                                                 req->req.length);
                                         req->req.status = -EOVERFLOW;
                                 }
                         }
                 }
-                dma_done(ep, req, tmp, 0);
+                dma_done(ep, req, req_dma_count, 0);
                 num_completed++;
         }
 
diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index a97da645c1b9..8a365aad66fe 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev,
                 td = phys_to_virt(addr);
                 addr2 = (dma_addr_t)td->next;
                 pci_pool_free(dev->data_requests, td, addr);
-                td->next = 0x00;
                 addr = addr2;
         }
         req->chain_len = 1;
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index e1335ad5bce9..832c4fdbe985 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2534,9 +2534,10 @@ static int pxa_udc_remove(struct platform_device *_dev)
         usb_del_gadget_udc(&udc->gadget);
         pxa_cleanup_debugfs(udc);
 
-        if (!IS_ERR_OR_NULL(udc->transceiver))
+        if (!IS_ERR_OR_NULL(udc->transceiver)) {
                 usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
-        usb_put_phy(udc->transceiver);
+                usb_put_phy(udc->transceiver);
+        }
 
         udc->transceiver = NULL;
         the_controller = NULL;
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 414e3c376dbb..5302f988e7e6 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                 case USB_PORT_FEAT_SUSPEND:
                         dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                 ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                        1);
                                 return 0;
@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 
                 case USB_PORT_FEAT_SUSPEND:
                         dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n");
-                        if (valid_port(wIndex)) {
+                        if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
                                 ohci_at91_port_suspend(ohci_at91->sfr_regmap,
                                                        0);
                                 return 0;
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index 363d125300ea..2b4a00fa735d 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -109,7 +109,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci)
         xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK);
 
         /* xhci 1.1 controllers have the HCCPARAMS2 register */
-        if (hci_version > 100) {
+        if (hci_version > 0x100) {
                 temp = readl(&xhci->cap_regs->hcc_params2);
                 xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp);
                 xhci_dbg(xhci, "  HC %s Force save context capability",
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index 9066ec9e0c2e..67d5dc79b6b5 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -382,7 +382,6 @@ static int usb_wakeup_of_property_parse(struct xhci_hcd_mtk *mtk,
 
 static int xhci_mtk_setup(struct usb_hcd *hcd);
 static const struct xhci_driver_overrides xhci_mtk_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
         .reset = xhci_mtk_setup,
 };
 
@@ -678,13 +677,13 @@ static int xhci_mtk_probe(struct platform_device *pdev)
                 goto power_off_phys;
         }
 
-        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
-                xhci->shared_hcd->can_do_streams = 1;
-
         ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (ret)
                 goto put_usb3_hcd;
 
+        if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
+                xhci->shared_hcd->can_do_streams = 1;
+
         ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
         if (ret)
                 goto dealloc_usb2_hcd;
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 6d33b42ffcf5..6ed468fa7d5e 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -286,6 +286,8 @@ static int xhci_plat_remove(struct platform_device *dev)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         struct clk *clk = xhci->clk;
 
+        xhci->xhc_state |= XHCI_STATE_REMOVING;
+
         usb_remove_hcd(xhci->shared_hcd);
         usb_phy_shutdown(hcd->usb_phy);
 
@@ -342,6 +344,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
 static struct platform_driver usb_xhci_driver = {
         .probe  = xhci_plat_probe,
         .remove = xhci_plat_remove,
+        .shutdown       = usb_hcd_platform_shutdown,
         .driver = {
                 .name = "xhci-hcd",
                 .pm = DEV_PM_OPS,
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index d9936c771fa0..a3309aa02993 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1989,6 +1989,9 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 case TRB_NORMAL:
                         td->urb->actual_length = requested - remaining;
                         goto finish_td;
+                case TRB_STATUS:
+                        td->urb->actual_length = requested;
+                        goto finish_td;
                 default:
                         xhci_warn(xhci, "WARN: unexpected TRB Type %d\n",
                                   trb_type);
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index a59fafb4b329..74436f8ca538 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1308,7 +1308,6 @@ static int tegra_xhci_setup(struct usb_hcd *hcd)
 }
 
 static const struct xhci_driver_overrides tegra_xhci_overrides __initconst = {
-        .extra_priv_size = sizeof(struct xhci_hcd),
         .reset = tegra_xhci_setup,
 };
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6d6c46000e56..953fd8f62df0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -868,7 +868,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
 
         spin_lock_irqsave(&xhci->lock, flags);
 
-        /* disble usb3 ports Wake bits*/
+        /* disable usb3 ports Wake bits */
         port_index = xhci->num_usb3_ports;
         port_array = xhci->usb3_ports;
         while (port_index--) {
@@ -879,7 +879,7 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
                         writel(t2, port_array[port_index]);
         }
 
-        /* disble usb2 ports Wake bits*/
+        /* disable usb2 ports Wake bits */
         port_index = xhci->num_usb2_ports;
         port_array = xhci->usb2_ports;
         while (port_index--) {
@@ -1477,6 +1477,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         struct xhci_ring *ep_ring;
         struct xhci_virt_ep *ep;
         struct xhci_command *command;
+        struct xhci_virt_device *vdev;
 
         xhci = hcd_to_xhci(hcd);
         spin_lock_irqsave(&xhci->lock, flags);
@@ -1485,15 +1486,27 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 
         /* Make sure the URB hasn't completed or been unlinked already */
         ret = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (ret || !urb->hcpriv)
+        if (ret)
                 goto done;
+
+        /* give back URB now if we can't queue it for cancel */
+        vdev = xhci->devs[urb->dev->slot_id];
+        urb_priv = urb->hcpriv;
+        if (!vdev || !urb_priv)
+                goto err_giveback;
+
+        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
+        ep = &vdev->eps[ep_index];
+        ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
+        if (!ep || !ep_ring)
+                goto err_giveback;
+
         temp = readl(&xhci->op_regs->status);
         if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "HW died, freeing TD.");
-                urb_priv = urb->hcpriv;
                 for (i = urb_priv->num_tds_done;
-                     i < urb_priv->num_tds && xhci->devs[urb->dev->slot_id];
+                     i < urb_priv->num_tds;
                      i++) {
                         td = &urb_priv->td[i];
                         if (!list_empty(&td->td_list))
@@ -1501,23 +1514,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         if (!list_empty(&td->cancelled_td_list))
                                 list_del_init(&td->cancelled_td_list);
                 }
-
-                usb_hcd_unlink_urb_from_ep(hcd, urb);
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
-                xhci_urb_free_priv(urb_priv);
-                return ret;
+                goto err_giveback;
         }
 
-        ep_index = xhci_get_endpoint_index(&urb->ep->desc);
-        ep = &xhci->devs[urb->dev->slot_id]->eps[ep_index];
-        ep_ring = xhci_urb_to_transfer_ring(xhci, urb);
-        if (!ep_ring) {
-                ret = -EINVAL;
-                goto done;
-        }
-
-        urb_priv = urb->hcpriv;
         i = urb_priv->num_tds_done;
         if (i < urb_priv->num_tds)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
@@ -1554,6 +1553,14 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 done:
         spin_unlock_irqrestore(&xhci->lock, flags);
         return ret;
+
+err_giveback:
+        if (urb_priv)
+                xhci_urb_free_priv(urb_priv);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
+        spin_unlock_irqrestore(&xhci->lock, flags);
+        usb_hcd_giveback_urb(hcd, urb, -ESHUTDOWN);
+        return ret;
 }
 
 /* Drop an endpoint from a new bandwidth configuration for this device.
diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c
index 8b9fd7534f69..502bfe30a077 100644
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -347,6 +347,9 @@ static int idmouse_probe(struct usb_interface *interface,
         if (iface_desc->desc.bInterfaceClass != 0x0A)
                 return -ENODEV;
 
+        if (iface_desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         /* allocate memory for our device state and initialize it */
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (dev == NULL)
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 095778ff984d..37c63cb39714 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_interface *interface,
         iface_desc = interface->cur_altsetting;
         dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
-        if (iface_desc->desc.bNumEndpoints < 1) {
-                dev_err(&interface->dev, "Invalid number of endpoints\n");
-                retval = -EINVAL;
-                goto error;
-        }
-
         /* set up the endpoint information */
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                 endpoint = &iface_desc->endpoint[i].desc;
@@ -797,6 +791,21 @@ static int iowarrior_probe(struct usb_interface *interface,
                         /* this one will match for the IOWarrior56 only */
                         dev->int_out_endpoint = endpoint;
         }
+
+        if (!dev->int_in_endpoint) {
+                dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+                retval = -ENODEV;
+                goto error;
+        }
+
+        if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
+                if (!dev->int_out_endpoint) {
+                        dev_err(&interface->dev, "no interrupt-out endpoint found\n");
+                        retval = -ENODEV;
+                        goto error;
+                }
+        }
+
         /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
         dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
         if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c
index 77176511658f..d3d124753266 100644
--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -366,6 +366,10 @@ static int lvs_rh_probe(struct usb_interface *intf,
 
         hdev = interface_to_usbdev(intf);
         desc = intf->cur_altsetting;
+
+        if (desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         endpoint = &desc->endpoint[0].desc;
 
         /* valid only for SS root hub */
diff --git a/drivers/usb/misc/usb251xb.c b/drivers/usb/misc/usb251xb.c
index 4e18600dc9b4..91f66d68bcb7 100644
--- a/drivers/usb/misc/usb251xb.c
+++ b/drivers/usb/misc/usb251xb.c
@@ -375,18 +375,24 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
         if (of_get_property(np, "dynamic-power-switching", NULL))
                 hub->conf_data2 |= BIT(7);
 
-        if (of_get_property(np, "oc-delay-100us", NULL)) {
-                hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 &= ~BIT(4);
-        } else if (of_get_property(np, "oc-delay-4ms", NULL)) {
-                hub->conf_data2 &= ~BIT(5);
-                hub->conf_data2 |= BIT(4);
-        } else if (of_get_property(np, "oc-delay-8ms", NULL)) {
-                hub->conf_data2 |= BIT(5);
-                hub->conf_data2 &= ~BIT(4);
-        } else if (of_get_property(np, "oc-delay-16ms", NULL)) {
-                hub->conf_data2 |= BIT(5);
-                hub->conf_data2 |= BIT(4);
+        if (!of_property_read_u32(np, "oc-delay-us", property_u32)) {
+                if (*property_u32 == 100) {
+                        /* 100 us*/
+                        hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                } else if (*property_u32 == 4000) {
+                        /* 4 ms */
+                        hub->conf_data2 &= ~BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else if (*property_u32 == 16000) {
+                        /* 16 ms */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 |= BIT(4);
+                } else {
+                        /* 8 ms (DEFAULT) */
+                        hub->conf_data2 |= BIT(5);
+                        hub->conf_data2 &= ~BIT(4);
+                }
         }
 
         if (of_get_property(np, "compound-device", NULL))
@@ -432,30 +438,9 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
                 }
         }
 
-        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
-        if (!of_property_read_u32(np, "max-sp-power", property_u32))
-                hub->max_power_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-
-        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
-        if (!of_property_read_u32(np, "max-bp-power", property_u32))
-                hub->max_power_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                          250);
-
-        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
-        if (!of_property_read_u32(np, "max-sp-current", property_u32))
-                hub->max_current_sp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-
-        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
-        if (!of_property_read_u32(np, "max-bp-current", property_u32))
-                hub->max_current_bp = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                            250);
-
         hub->power_on_time = USB251XB_DEF_POWER_ON_TIME;
-        if (!of_property_read_u32(np, "power-on-time", property_u32))
-                hub->power_on_time = min_t(u8, be32_to_cpu(*property_u32) / 2,
-                                           255);
+        if (!of_property_read_u32(np, "power-on-time-ms", property_u32))
+                hub->power_on_time = min_t(u8, *property_u32 / 2, 255);
 
         if (of_property_read_u16_array(np, "language-id", &hub->lang_id, 1))
                 hub->lang_id = USB251XB_DEF_LANGUAGE_ID;
@@ -492,6 +477,10 @@ static int usb251xb_get_ofdata(struct usb251xb *hub,
         /* The following parameters are currently not exposed to devicetree, but
          * may be as soon as needed.
          */
+        hub->max_power_sp = USB251XB_DEF_MAX_POWER_SELF;
+        hub->max_power_bp = USB251XB_DEF_MAX_POWER_BUS;
+        hub->max_current_sp = USB251XB_DEF_MAX_CURRENT_SELF;
+        hub->max_current_bp = USB251XB_DEF_MAX_CURRENT_BUS;
         hub->bat_charge_en = USB251XB_DEF_BATTERY_CHARGING_ENABLE;
         hub->boost_up = USB251XB_DEF_BOOST_UP;
         hub->boost_x = USB251XB_DEF_BOOST_X;
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index e45a3a680db8..07014cad6dbe 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -709,6 +709,11 @@ static int uss720_probe(struct usb_interface *intf,
 
         interface = intf->cur_altsetting;
 
+        if (interface->desc.bNumEndpoints < 3) {
+                usb_put_dev(usbdev);
+                return -ENODEV;
+        }
+
         /*
          * Allocate parport interface 
          */
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index d8bae6ca8904..0c3664ab705e 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2490,8 +2490,8 @@ static int musb_remove(struct platform_device *pdev)
         musb_host_cleanup(musb);
         musb_gadget_cleanup(musb);
 
-        spin_lock_irqsave(&musb->lock, flags);
         musb_platform_disable(musb);
+        spin_lock_irqsave(&musb->lock, flags);
         musb_disable_interrupts(musb);
         musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
         spin_unlock_irqrestore(&musb->lock, flags);
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index 00e272bfee39..355655f8a3fb 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -238,8 +238,27 @@ static void cppi41_dma_callback(void *private_data,
                         transferred < cppi41_channel->packet_sz)
                 cppi41_channel->prog_len = 0;
 
-        if (cppi41_channel->is_tx)
-                empty = musb_is_tx_fifo_empty(hw_ep);
+        if (cppi41_channel->is_tx) {
+                u8 type;
+
+                if (is_host_active(musb))
+                        type = hw_ep->out_qh->type;
+                else
+                        type = hw_ep->ep_in.type;
+
+                if (type == USB_ENDPOINT_XFER_ISOC)
+                        /*
+                         * Don't use the early-TX-interrupt workaround below
+                         * for Isoch transfter. Since Isoch are periodic
+                         * transfer, by the time the next transfer is
+                         * scheduled, the current one should be done already.
+                         *
+                         * This avoids audio playback underrun issue.
+                         */
+                        empty = true;
+                else
+                        empty = musb_is_tx_fifo_empty(hw_ep);
+        }
 
         if (!cppi41_channel->is_tx || empty) {
                 cppi41_trans_done(cppi41_channel);
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 7c047c4a2565..9c7ee26ef388 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -933,7 +933,7 @@ static int dsps_probe(struct platform_device *pdev)
         if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
                 ret = dsps_setup_optional_vbus_irq(pdev, glue);
                 if (ret)
-                        return ret;
+                        goto err_iounmap;
         }
 
         platform_set_drvdata(pdev, glue);
@@ -946,6 +946,8 @@ static int dsps_probe(struct platform_device *pdev)
 
 err:
         pm_runtime_disable(&pdev->dev);
+err_iounmap:
+        iounmap(glue->usbss_base);
         return ret;
 }
 
@@ -956,6 +958,7 @@ static int dsps_remove(struct platform_device *pdev)
         platform_device_unregister(glue->musb);
 
         pm_runtime_disable(&pdev->dev);
+        iounmap(glue->usbss_base);
 
         return 0;
 }
diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c
index db68156568e6..f333024660b4 100644
--- a/drivers/usb/phy/phy-isp1301.c
+++ b/drivers/usb/phy/phy-isp1301.c
@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, isp1301_id);
 
+static const struct of_device_id isp1301_of_match[] = {
+        {.compatible = "nxp,isp1301" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, isp1301_of_match);
+
 static struct i2c_client *isp1301_i2c_client;
 
 static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear)
@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client)
 static struct i2c_driver isp1301_driver = {
         .driver = {
                 .name = DRV_NAME,
+                .of_match_table = isp1301_of_match,
         },
         .probe = isp1301_probe,
         .remove = isp1301_remove,
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index ab78111e0968..6537d3ca2797 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1500,7 +1500,7 @@ static int digi_read_oob_callback(struct urb *urb)
                 return -1;
 
         /* handle each oob command */
-        for (i = 0; i < urb->actual_length - 4; i += 4) {
+        for (i = 0; i < urb->actual_length - 3; i += 4) {
                 opcode = buf[i];
                 line = buf[i + 1];
                 status = buf[i + 2];
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index ceaeebaa6f90..a76b95d32157 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb)
         function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);
         dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
                 port_number, function, data[1]);
+
+        if (port_number >= edge_serial->serial->num_ports) {
+                dev_err(dev, "bad port number %d\n", port_number);
+                goto exit;
+        }
+
         port = edge_serial->serial->port[port_number];
         edge_port = usb_get_serial_port_data(port);
         if (!edge_port) {
@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb)
 
         port_number = edge_port->port->port_number;
 
-        if (edge_port->lsr_event) {
+        if (urb->actual_length > 0 && edge_port->lsr_event) {
                 edge_port->lsr_event = 0;
                 dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
                         __func__, port_number, edge_port->lsr_mask, *data);
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index a180b17d2432..dd706953b466 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -31,7 +31,6 @@
 #define BT_IGNITIONPRO_ID       0x2000
 
 /* function prototypes */
-static int  omninet_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void omninet_process_read_urb(struct urb *urb);
 static void omninet_write_bulk_callback(struct urb *urb);
 static int  omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
@@ -60,7 +59,6 @@ static struct usb_serial_driver zyxel_omninet_device = {
         .attach =               omninet_attach,
         .port_probe =           omninet_port_probe,
         .port_remove =          omninet_port_remove,
-        .open =                 omninet_open,
         .write =                omninet_write,
         .write_room =           omninet_write_room,
         .write_bulk_callback =  omninet_write_bulk_callback,
@@ -140,17 +138,6 @@ static int omninet_port_remove(struct usb_serial_port *port)
         return 0;
 }
 
-static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
-{
-        struct usb_serial       *serial = port->serial;
-        struct usb_serial_port  *wport;
-
-        wport = serial->port[1];
-        tty_port_tty_set(&wport->port, tty);
-
-        return usb_serial_generic_open(tty, port);
-}
-
 #define OMNINET_HEADERLEN       4
 #define OMNINET_BULKOUTSIZE     64
 #define OMNINET_PAYLOADSIZE     (OMNINET_BULKOUTSIZE - OMNINET_HEADERLEN)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 42cc72e54c05..af67a0de6b5d 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -233,6 +233,14 @@ static void option_instat_callback(struct urb *urb);
 #define BANDRICH_PRODUCT_1012                   0x1012
 
 #define QUALCOMM_VENDOR_ID                      0x05C6
+/* These Quectel products use Qualcomm's vendor ID */
+#define QUECTEL_PRODUCT_UC20                    0x9003
+#define QUECTEL_PRODUCT_UC15                    0x9090
+
+#define QUECTEL_VENDOR_ID                       0x2c7c
+/* These Quectel products use Quectel's vendor ID */
+#define QUECTEL_PRODUCT_EC21                    0x0121
+#define QUECTEL_PRODUCT_EC25                    0x0125
 
 #define CMOTECH_VENDOR_ID                       0x16d8
 #define CMOTECH_PRODUCT_6001                    0x6001
@@ -1161,7 +1169,14 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
         { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
-        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */
+        /* Quectel products using Qualcomm vendor ID */
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+        { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        /* Quectel products using Quectel vendor ID */
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
         { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 696458db7e3c..38b3f0d8cd58 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -169,6 +169,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x413c, 0x81a9)},   /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b1)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81b3)},   /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */
+        {DEVICE_SWI(0x413c, 0x81b5)},   /* Dell Wireless 5811e QDL */
+        {DEVICE_SWI(0x413c, 0x81b6)},   /* Dell Wireless 5811e QDL */
 
         /* Huawei devices */
         {DEVICE_HWI(0x03f0, 0x581d)},   /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index 93c6c9b08daa..8a069aa154ed 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -200,6 +200,11 @@ static void safe_process_read_urb(struct urb *urb)
         if (!safe)
                 goto out;
 
+        if (length < 2) {
+                dev_err(&port->dev, "malformed packet\n");
+                return;
+        }
+
         fcs = fcs_compute10(data, length, CRC10_INITFCS);
         if (fcs) {
                 dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 16cc18369111..9129f6cb8230 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2071,6 +2071,20 @@ UNUSUAL_DEV(  0x1370, 0x6828, 0x0110, 0x0110,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/*
+ * Reported by Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+ * The INIC-3619 bridge is used in the StarTech SLSODDU33B
+ * SATA-USB enclosure for slimline optical drives.
+ *
+ * The quirk enables MakeMKV to properly exchange keys with
+ * an installed BD drive.
+ */
+UNUSUAL_DEV(  0x13fd, 0x3609, 0x0209, 0x0209,
+                "Initio Corporation",
+                "INIC-3619",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Qinglin Ye <yestyle@gmail.com> */
 UNUSUAL_DEV(  0x13fe, 0x3600, 0x0100, 0x0100,
                 "Kingston",
diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c
index 252c7bd9218a..d01496fd27fe 100644
--- a/drivers/usb/wusbcore/wa-hc.c
+++ b/drivers/usb/wusbcore/wa-hc.c
@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface,
         int result;
         struct device *dev = &iface->dev;
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 3)
+                return -ENODEV;
+
         result = wa_rpipes_create(wa);
         if (result < 0)
                 goto error_rpipes_create;
diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
index 0aa6c3c29d17..35a1e777b449 100644
--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
@@ -823,6 +823,9 @@ static int hwarc_probe(struct usb_interface *iface,
         struct hwarc *hwarc;
         struct device *dev = &iface->dev;
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         result = -ENOMEM;
         uwb_rc = uwb_rc_alloc();
         if (uwb_rc == NULL) {
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 2bfc846ac071..6345e85822a4 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -362,6 +362,9 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                                  result);
         }
 
+        if (iface->cur_altsetting->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         result = -ENOMEM;
         i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL);
         if (i1480_usb == NULL) {
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index 609f4f982c74..561084ab387f 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -403,6 +403,7 @@ static void vfio_group_release(struct kref *kref)
         struct iommu_group *iommu_group = group->iommu_group;
 
         WARN_ON(!list_empty(&group->device_list));
+        WARN_ON(group->notifier.head);
 
         list_for_each_entry_safe(unbound, tmp,
                                  &group->unbound_list, unbound_next) {
@@ -1573,6 +1574,10 @@ static int vfio_group_fops_open(struct inode *inode, struct file *filep)
                 return -EBUSY;
         }
 
+        /* Warn if previous user didn't cleanup and re-init to drop them */
+        if (WARN_ON(group->notifier.head))
+                BLOCKING_INIT_NOTIFIER_HEAD(&group->notifier);
+
         filep->private_data = group;
 
         return 0;
@@ -1584,9 +1589,6 @@ static int vfio_group_fops_release(struct inode *inode, struct file *filep)
 
         filep->private_data = NULL;
 
-        /* Any user didn't unregister? */
-        WARN_ON(group->notifier.head);
-
         vfio_group_try_dissolve_container(group);
 
         atomic_dec(&group->opened);
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index c26fa1f3ed86..32d2633092a3 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -1182,8 +1182,7 @@ static struct vfio_group *find_iommu_group(struct vfio_domain *domain,
         return NULL;
 }
 
-static bool vfio_iommu_has_resv_msi(struct iommu_group *group,
-                                    phys_addr_t *base)
+static bool vfio_iommu_has_sw_msi(struct iommu_group *group, phys_addr_t *base)
 {
         struct list_head group_resv_regions;
         struct iommu_resv_region *region, *next;
@@ -1192,7 +1191,7 @@ static bool vfio_iommu_has_resv_msi(struct iommu_group *group,
         INIT_LIST_HEAD(&group_resv_regions);
         iommu_get_group_resv_regions(group, &group_resv_regions);
         list_for_each_entry(region, &group_resv_regions, list) {
-                if (region->type & IOMMU_RESV_MSI) {
+                if (region->type == IOMMU_RESV_SW_MSI) {
                         *base = region->start;
                         ret = true;
                         goto out;
@@ -1283,7 +1282,7 @@ static int vfio_iommu_type1_attach_group(void *iommu_data,
         if (ret)
                 goto out_domain;
 
-        resv_msi = vfio_iommu_has_resv_msi(iommu_group, &resv_msi_base);
+        resv_msi = vfio_iommu_has_sw_msi(iommu_group, &resv_msi_base);
 
         INIT_LIST_HEAD(&domain->group_list);
         list_add(&group->next, &domain->group_list);
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index ce5e63d2c66a..44eed8eb0725 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -223,6 +223,46 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         return len;
 }
 
+static int
+vhost_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        struct vhost_vsock *vsock;
+        struct virtio_vsock_pkt *pkt, *n;
+        int cnt = 0;
+        LIST_HEAD(freeme);
+
+        /* Find the vhost_vsock according to guest context id  */
+        vsock = vhost_vsock_get(vsk->remote_addr.svm_cid);
+        if (!vsock)
+                return -ENODEV;
+
+        spin_lock_bh(&vsock->send_pkt_list_lock);
+        list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+                if (pkt->vsk != vsk)
+                        continue;
+                list_move(&pkt->list, &freeme);
+        }
+        spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+        list_for_each_entry_safe(pkt, n, &freeme, list) {
+                if (pkt->reply)
+                        cnt++;
+                list_del(&pkt->list);
+                virtio_transport_free_pkt(pkt);
+        }
+
+        if (cnt) {
+                struct vhost_virtqueue *tx_vq = &vsock->vqs[VSOCK_VQ_TX];
+                int new_cnt;
+
+                new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
+                if (new_cnt + cnt >= tx_vq->num && new_cnt < tx_vq->num)
+                        vhost_poll_queue(&tx_vq->poll);
+        }
+
+        return 0;
+}
+
 static struct virtio_vsock_pkt *
 vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq,
                       unsigned int out, unsigned int in)
@@ -675,6 +715,7 @@ static struct virtio_transport vhost_transport = {
                 .release                  = virtio_transport_release,
                 .connect                  = virtio_transport_connect,
                 .shutdown                 = virtio_transport_shutdown,
+                .cancel_pkt               = vhost_transport_cancel_pkt,
 
                 .dgram_enqueue            = virtio_transport_dgram_enqueue,
                 .dgram_dequeue            = virtio_transport_dgram_dequeue,
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index d7efcb632f7d..002f1ce22bd0 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -297,14 +297,15 @@ static int pwm_backlight_probe(struct platform_device *pdev)
         }
 
         /*
-         * If the GPIO is configured as input, change the direction to output
-         * and set the GPIO as active.
+         * If the GPIO is not known to be already configured as output, that
+         * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL,
+         * change the direction to output and set the GPIO as active.
          * Do not force the GPIO to active when it was already output as it
          * could cause backlight flickering or we would enable the backlight too
          * early. Leave the decision of the initial backlight state for later.
          */
         if (pb->enable_gpio &&
-            gpiod_get_direction(pb->enable_gpio) == GPIOF_DIR_IN)
+            gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT)
                 gpiod_direction_output(pb->enable_gpio, 1);
 
         pb->power_supply = devm_regulator_get(&pdev->dev, "power");
diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
index 8c4dc1e1f94f..b827a8113e26 100644
--- a/drivers/video/fbdev/efifb.c
+++ b/drivers/video/fbdev/efifb.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/errno.h>
 #include <linux/fb.h>
+#include <linux/pci.h>
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
 #include <video/vga.h>
@@ -143,6 +144,8 @@ static struct attribute *efifb_attrs[] = {
 };
 ATTRIBUTE_GROUPS(efifb);
 
+static bool pci_dev_disabled;   /* FB base matches BAR of a disabled device */
+
 static int efifb_probe(struct platform_device *dev)
 {
         struct fb_info *info;
@@ -152,7 +155,7 @@ static int efifb_probe(struct platform_device *dev)
         unsigned int size_total;
         char *option = NULL;
 
-        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+        if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || pci_dev_disabled)
                 return -ENODEV;
 
         if (fb_get_options("efifb", &option))
@@ -360,3 +363,64 @@ static struct platform_driver efifb_driver = {
 };
 
 builtin_platform_driver(efifb_driver);
+
+#if defined(CONFIG_PCI) && !defined(CONFIG_X86)
+
+static bool pci_bar_found;      /* did we find a BAR matching the efifb base? */
+
+static void claim_efifb_bar(struct pci_dev *dev, int idx)
+{
+        u16 word;
+
+        pci_bar_found = true;
+
+        pci_read_config_word(dev, PCI_COMMAND, &word);
+        if (!(word & PCI_COMMAND_MEMORY)) {
+                pci_dev_disabled = true;
+                dev_err(&dev->dev,
+                        "BAR %d: assigned to efifb but device is disabled!\n",
+                        idx);
+                return;
+        }
+
+        if (pci_claim_resource(dev, idx)) {
+                pci_dev_disabled = true;
+                dev_err(&dev->dev,
+                        "BAR %d: failed to claim resource for efifb!\n", idx);
+                return;
+        }
+
+        dev_info(&dev->dev, "BAR %d: assigned to efifb\n", idx);
+}
+
+static void efifb_fixup_resources(struct pci_dev *dev)
+{
+        u64 base = screen_info.lfb_base;
+        u64 size = screen_info.lfb_size;
+        int i;
+
+        if (pci_bar_found || screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+                return;
+
+        if (screen_info.capabilities & VIDEO_CAPABILITY_64BIT_BASE)
+                base |= (u64)screen_info.ext_lfb_base << 32;
+
+        if (!base)
+                return;
+
+        for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
+                struct resource *res = &dev->resource[i];
+
+                if (!(res->flags & IORESOURCE_MEM))
+                        continue;
+
+                if (res->start <= base && res->end >= base + size - 1) {
+                        claim_efifb_bar(dev, i);
+                        break;
+                }
+        }
+}
+DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, PCI_BASE_CLASS_DISPLAY,
+                               16, efifb_fixup_resources);
+
+#endif
diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
index 1abba07b84b3..f4cbfb3b8a09 100644
--- a/drivers/video/fbdev/omap/omapfb_main.c
+++ b/drivers/video/fbdev/omap/omapfb_main.c
@@ -1608,19 +1608,6 @@ static int omapfb_find_ctrl(struct omapfb_device *fbdev)
         return 0;
 }
 
-static void check_required_callbacks(struct omapfb_device *fbdev)
-{
-#define _C(x) (fbdev->ctrl->x != NULL)
-#define _P(x) (fbdev->panel->x != NULL)
-        BUG_ON(fbdev->ctrl == NULL || fbdev->panel == NULL);
-        BUG_ON(!(_C(init) && _C(cleanup) && _C(get_caps) &&
-                 _C(set_update_mode) && _C(setup_plane) && _C(enable_plane) &&
-                 _P(init) && _P(cleanup) && _P(enable) && _P(disable) &&
-                 _P(get_caps)));
-#undef _P
-#undef _C
-}
-
 /*
  * Called by LDM binding to probe and attach a new device.
  * Initialization sequence:
@@ -1705,8 +1692,6 @@ static int omapfb_do_probe(struct platform_device *pdev,
                 omapfb_ops.fb_mmap = omapfb_mmap;
         init_state++;
 
-        check_required_callbacks(fbdev);
-
         r = planes_init(fbdev);
         if (r)
                 goto cleanup;
diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
index bd017b57c47f..f599520374dd 100644
--- a/drivers/video/fbdev/ssd1307fb.c
+++ b/drivers/video/fbdev/ssd1307fb.c
@@ -578,10 +578,14 @@ static int ssd1307fb_probe(struct i2c_client *client,
 
         par->vbat_reg = devm_regulator_get_optional(&client->dev, "vbat");
         if (IS_ERR(par->vbat_reg)) {
-                dev_err(&client->dev, "failed to get VBAT regulator: %ld\n",
-                        PTR_ERR(par->vbat_reg));
                 ret = PTR_ERR(par->vbat_reg);
-                goto fb_alloc_error;
+                if (ret == -ENODEV) {
+                        par->vbat_reg = NULL;
+                } else {
+                        dev_err(&client->dev, "failed to get VBAT regulator: %d\n",
+                                ret);
+                        goto fb_alloc_error;
+                }
         }
 
         if (of_property_read_u32(node, "solomon,width", &par->width))
@@ -668,10 +672,13 @@ static int ssd1307fb_probe(struct i2c_client *client,
                 udelay(4);
         }
 
-        ret = regulator_enable(par->vbat_reg);
-        if (ret) {
-                dev_err(&client->dev, "failed to enable VBAT: %d\n", ret);
-                goto reset_oled_error;
+        if (par->vbat_reg) {
+                ret = regulator_enable(par->vbat_reg);
+                if (ret) {
+                        dev_err(&client->dev, "failed to enable VBAT: %d\n",
+                                ret);
+                        goto reset_oled_error;
+                }
         }
 
         ret = ssd1307fb_init(par);
@@ -710,7 +717,8 @@ panel_init_error:
                 pwm_put(par->pwm);
         };
 regulator_enable_error:
-        regulator_disable(par->vbat_reg);
+        if (par->vbat_reg)
+                regulator_disable(par->vbat_reg);
 reset_oled_error:
         fb_deferred_io_cleanup(info);
 fb_alloc_error:
diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
index d0115a7af0a9..3ee309c50b2d 100644
--- a/drivers/video/fbdev/xen-fbfront.c
+++ b/drivers/video/fbdev/xen-fbfront.c
@@ -643,7 +643,6 @@ static void xenfb_backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateInitWait:
-InitWait:
                 xenbus_switch_state(dev, XenbusStateConnected);
                 break;
 
@@ -654,7 +653,8 @@ InitWait:
                  * get Connected twice here.
                  */
                 if (dev->state != XenbusStateConnected)
-                        goto InitWait; /* no InitWait seen yet, fudge it */
+                        /* no InitWait seen yet, fudge it */
+                        xenbus_switch_state(dev, XenbusStateConnected);
 
                 if (xenbus_read_unsigned(info->xbdev->otherend,
                                          "request-update", 0))
diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 400d70b69379..48230a5e12f2 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -232,6 +232,12 @@ static int virtio_dev_probe(struct device *_d)
                 if (device_features & (1ULL << i))
                         __virtio_set_bit(dev, i);
 
+        if (drv->validate) {
+                err = drv->validate(dev);
+                if (err)
+                        goto err;
+        }
+
         err = virtio_finalize_features(dev);
         if (err)
                 goto err;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 4e1191508228..34adf9b9c053 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -242,11 +242,11 @@ static inline void update_stat(struct virtio_balloon *vb, int idx,
 
 #define pages_to_bytes(x) ((u64)(x) << PAGE_SHIFT)
 
-static void update_balloon_stats(struct virtio_balloon *vb)
+static unsigned int update_balloon_stats(struct virtio_balloon *vb)
 {
         unsigned long events[NR_VM_EVENT_ITEMS];
         struct sysinfo i;
-        int idx = 0;
+        unsigned int idx = 0;
         long available;
 
         all_vm_events(events);
@@ -254,18 +254,22 @@ static void update_balloon_stats(struct virtio_balloon *vb)
 
         available = si_mem_available();
 
+#ifdef CONFIG_VM_EVENT_COUNTERS
         update_stat(vb, idx++, VIRTIO_BALLOON_S_SWAP_IN,
                                 pages_to_bytes(events[PSWPIN]));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_SWAP_OUT,
                                 pages_to_bytes(events[PSWPOUT]));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MAJFLT, events[PGMAJFAULT]);
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MINFLT, events[PGFAULT]);
+#endif
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MEMFREE,
                                 pages_to_bytes(i.freeram));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_MEMTOT,
                                 pages_to_bytes(i.totalram));
         update_stat(vb, idx++, VIRTIO_BALLOON_S_AVAIL,
                                 pages_to_bytes(available));
+
+        return idx;
 }
 
 /*
@@ -291,14 +295,14 @@ static void stats_handle_request(struct virtio_balloon *vb)
 {
         struct virtqueue *vq;
         struct scatterlist sg;
-        unsigned int len;
+        unsigned int len, num_stats;
 
-        update_balloon_stats(vb);
+        num_stats = update_balloon_stats(vb);
 
         vq = vb->stats_vq;
         if (!virtqueue_get_buf(vq, &len))
                 return;
-        sg_init_one(&sg, vb->stats, sizeof(vb->stats));
+        sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
         virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
         virtqueue_kick(vq);
 }
@@ -423,13 +427,16 @@ static int init_vqs(struct virtio_balloon *vb)
         vb->deflate_vq = vqs[1];
         if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) {
                 struct scatterlist sg;
+                unsigned int num_stats;
                 vb->stats_vq = vqs[2];
 
                 /*
                  * Prime this virtqueue with one buffer so the hypervisor can
                  * use it to signal us later (it can't be broken yet!).
                  */
-                sg_init_one(&sg, vb->stats, sizeof vb->stats);
+                num_stats = update_balloon_stats(vb);
+
+                sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
                 if (virtqueue_add_outbuf(vb->stats_vq, &sg, 1, vb, GFP_KERNEL)
                     < 0)
                         BUG();
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index df548a6fb844..698d5d06fa03 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -33,8 +33,10 @@ void vp_synchronize_vectors(struct virtio_device *vdev)
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         int i;
 
-        synchronize_irq(pci_irq_vector(vp_dev->pci_dev, 0));
-        for (i = 1; i < vp_dev->msix_vectors; i++)
+        if (vp_dev->intx_enabled)
+                synchronize_irq(vp_dev->pci_dev->irq);
+
+        for (i = 0; i < vp_dev->msix_vectors; ++i)
                 synchronize_irq(pci_irq_vector(vp_dev->pci_dev, i));
 }
 
@@ -60,13 +62,16 @@ static irqreturn_t vp_config_changed(int irq, void *opaque)
 static irqreturn_t vp_vring_interrupt(int irq, void *opaque)
 {
         struct virtio_pci_device *vp_dev = opaque;
+        struct virtio_pci_vq_info *info;
         irqreturn_t ret = IRQ_NONE;
-        struct virtqueue *vq;
+        unsigned long flags;
 
-        list_for_each_entry(vq, &vp_dev->vdev.vqs, list) {
-                if (vq->callback && vring_interrupt(irq, vq) == IRQ_HANDLED)
+        spin_lock_irqsave(&vp_dev->lock, flags);
+        list_for_each_entry(info, &vp_dev->virtqueues, node) {
+                if (vring_interrupt(irq, info->vq) == IRQ_HANDLED)
                         ret = IRQ_HANDLED;
         }
+        spin_unlock_irqrestore(&vp_dev->lock, flags);
 
         return ret;
 }
@@ -97,185 +102,244 @@ static irqreturn_t vp_interrupt(int irq, void *opaque)
         return vp_vring_interrupt(irq, opaque);
 }
 
-static void vp_remove_vqs(struct virtio_device *vdev)
+static int vp_request_msix_vectors(struct virtio_device *vdev, int nvectors,
+                                   bool per_vq_vectors, struct irq_affinity *desc)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        struct virtqueue *vq, *n;
+        const char *name = dev_name(&vp_dev->vdev.dev);
+        unsigned i, v;
+        int err = -ENOMEM;
 
-        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
-                if (vp_dev->msix_vector_map) {
-                        int v = vp_dev->msix_vector_map[vq->index];
+        vp_dev->msix_vectors = nvectors;
 
-                        if (v != VIRTIO_MSI_NO_VECTOR)
-                                free_irq(pci_irq_vector(vp_dev->pci_dev, v),
-                                        vq);
-                }
-                vp_dev->del_vq(vq);
+        vp_dev->msix_names = kmalloc(nvectors * sizeof *vp_dev->msix_names,
+                                     GFP_KERNEL);
+        if (!vp_dev->msix_names)
+                goto error;
+        vp_dev->msix_affinity_masks
+                = kzalloc(nvectors * sizeof *vp_dev->msix_affinity_masks,
+                          GFP_KERNEL);
+        if (!vp_dev->msix_affinity_masks)
+                goto error;
+        for (i = 0; i < nvectors; ++i)
+                if (!alloc_cpumask_var(&vp_dev->msix_affinity_masks[i],
+                                        GFP_KERNEL))
+                        goto error;
+
+        err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
+                                             nvectors, PCI_IRQ_MSIX |
+                                             (desc ? PCI_IRQ_AFFINITY : 0),
+                                             desc);
+        if (err < 0)
+                goto error;
+        vp_dev->msix_enabled = 1;
+
+        /* Set the vector used for configuration */
+        v = vp_dev->msix_used_vectors;
+        snprintf(vp_dev->msix_names[v], sizeof *vp_dev->msix_names,
+                 "%s-config", name);
+        err = request_irq(pci_irq_vector(vp_dev->pci_dev, v),
+                          vp_config_changed, 0, vp_dev->msix_names[v],
+                          vp_dev);
+        if (err)
+                goto error;
+        ++vp_dev->msix_used_vectors;
+
+        v = vp_dev->config_vector(vp_dev, v);
+        /* Verify we had enough resources to assign the vector */
+        if (v == VIRTIO_MSI_NO_VECTOR) {
+                err = -EBUSY;
+                goto error;
         }
+
+        if (!per_vq_vectors) {
+                /* Shared vector for all VQs */
+                v = vp_dev->msix_used_vectors;
+                snprintf(vp_dev->msix_names[v], sizeof *vp_dev->msix_names,
+                         "%s-virtqueues", name);
+                err = request_irq(pci_irq_vector(vp_dev->pci_dev, v),
+                                  vp_vring_interrupt, 0, vp_dev->msix_names[v],
+                                  vp_dev);
+                if (err)
+                        goto error;
+                ++vp_dev->msix_used_vectors;
+        }
+        return 0;
+error:
+        return err;
+}
+
+static struct virtqueue *vp_setup_vq(struct virtio_device *vdev, unsigned index,
+                                     void (*callback)(struct virtqueue *vq),
+                                     const char *name,
+                                     u16 msix_vec)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtio_pci_vq_info *info = kmalloc(sizeof *info, GFP_KERNEL);
+        struct virtqueue *vq;
+        unsigned long flags;
+
+        /* fill out our structure that represents an active queue */
+        if (!info)
+                return ERR_PTR(-ENOMEM);
+
+        vq = vp_dev->setup_vq(vp_dev, info, index, callback, name,
+                              msix_vec);
+        if (IS_ERR(vq))
+                goto out_info;
+
+        info->vq = vq;
+        if (callback) {
+                spin_lock_irqsave(&vp_dev->lock, flags);
+                list_add(&info->node, &vp_dev->virtqueues);
+                spin_unlock_irqrestore(&vp_dev->lock, flags);
+        } else {
+                INIT_LIST_HEAD(&info->node);
+        }
+
+        vp_dev->vqs[index] = info;
+        return vq;
+
+out_info:
+        kfree(info);
+        return vq;
+}
+
+static void vp_del_vq(struct virtqueue *vq)
+{
+        struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
+        struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+        unsigned long flags;
+
+        spin_lock_irqsave(&vp_dev->lock, flags);
+        list_del(&info->node);
+        spin_unlock_irqrestore(&vp_dev->lock, flags);
+
+        vp_dev->del_vq(info);
+        kfree(info);
 }
 
 /* the config->del_vqs() implementation */
 void vp_del_vqs(struct virtio_device *vdev)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtqueue *vq, *n;
         int i;
 
-        if (WARN_ON_ONCE(list_empty_careful(&vdev->vqs)))
-                return;
+        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
+                if (vp_dev->per_vq_vectors) {
+                        int v = vp_dev->vqs[vq->index]->msix_vector;
 
-        vp_remove_vqs(vdev);
+                        if (v != VIRTIO_MSI_NO_VECTOR) {
+                                int irq = pci_irq_vector(vp_dev->pci_dev, v);
+
+                                irq_set_affinity_hint(irq, NULL);
+                                free_irq(irq, vq);
+                        }
+                }
+                vp_del_vq(vq);
+        }
+        vp_dev->per_vq_vectors = false;
+
+        if (vp_dev->intx_enabled) {
+                free_irq(vp_dev->pci_dev->irq, vp_dev);
+                vp_dev->intx_enabled = 0;
+        }
 
-        if (vp_dev->pci_dev->msix_enabled) {
-                for (i = 0; i < vp_dev->msix_vectors; i++)
+        for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+                free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+        for (i = 0; i < vp_dev->msix_vectors; i++)
+                if (vp_dev->msix_affinity_masks[i])
                         free_cpumask_var(vp_dev->msix_affinity_masks[i]);
 
+        if (vp_dev->msix_enabled) {
                 /* Disable the vector used for configuration */
                 vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
 
-                kfree(vp_dev->msix_affinity_masks);
-                kfree(vp_dev->msix_names);
-                kfree(vp_dev->msix_vector_map);
+                pci_free_irq_vectors(vp_dev->pci_dev);
+                vp_dev->msix_enabled = 0;
         }
 
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
-        pci_free_irq_vectors(vp_dev->pci_dev);
+        vp_dev->msix_vectors = 0;
+        vp_dev->msix_used_vectors = 0;
+        kfree(vp_dev->msix_names);
+        vp_dev->msix_names = NULL;
+        kfree(vp_dev->msix_affinity_masks);
+        vp_dev->msix_affinity_masks = NULL;
+        kfree(vp_dev->vqs);
+        vp_dev->vqs = NULL;
 }
 
 static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
                 struct virtqueue *vqs[], vq_callback_t *callbacks[],
-                const char * const names[], struct irq_affinity *desc)
+                const char * const names[], bool per_vq_vectors,
+                struct irq_affinity *desc)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        const char *name = dev_name(&vp_dev->vdev.dev);
-        int i, err = -ENOMEM, allocated_vectors, nvectors;
-        unsigned flags = PCI_IRQ_MSIX;
-        bool shared = false;
         u16 msix_vec;
+        int i, err, nvectors, allocated_vectors;
 
-        if (desc) {
-                flags |= PCI_IRQ_AFFINITY;
-                desc->pre_vectors++; /* virtio config vector */
-        }
-
-        nvectors = 1;
-        for (i = 0; i < nvqs; i++)
-                if (callbacks[i])
-                        nvectors++;
-
-        /* Try one vector per queue first. */
-        err = pci_alloc_irq_vectors_affinity(vp_dev->pci_dev, nvectors,
-                        nvectors, flags, desc);
-        if (err < 0) {
-                /* Fallback to one vector for config, one shared for queues. */
-                shared = true;
-                err = pci_alloc_irq_vectors(vp_dev->pci_dev, 2, 2,
-                                PCI_IRQ_MSIX);
-                if (err < 0)
-                        return err;
-        }
-        if (err < 0)
-                return err;
-
-        vp_dev->msix_vectors = nvectors;
-        vp_dev->msix_names = kmalloc_array(nvectors,
-                        sizeof(*vp_dev->msix_names), GFP_KERNEL);
-        if (!vp_dev->msix_names)
-                goto out_free_irq_vectors;
-
-        vp_dev->msix_affinity_masks = kcalloc(nvectors,
-                        sizeof(*vp_dev->msix_affinity_masks), GFP_KERNEL);
-        if (!vp_dev->msix_affinity_masks)
-                goto out_free_msix_names;
+        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
+        if (!vp_dev->vqs)
+                return -ENOMEM;
 
-        for (i = 0; i < nvectors; ++i) {
-                if (!alloc_cpumask_var(&vp_dev->msix_affinity_masks[i],
-                                GFP_KERNEL))
-                        goto out_free_msix_affinity_masks;
+        if (per_vq_vectors) {
+                /* Best option: one for change interrupt, one per vq. */
+                nvectors = 1;
+                for (i = 0; i < nvqs; ++i)
+                        if (callbacks[i])
+                                ++nvectors;
+        } else {
+                /* Second best: one for change, shared for all vqs. */
+                nvectors = 2;
         }
 
-        /* Set the vector used for configuration */
-        snprintf(vp_dev->msix_names[0], sizeof(*vp_dev->msix_names),
-                 "%s-config", name);
-        err = request_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_config_changed,
-                        0, vp_dev->msix_names[0], vp_dev);
+        err = vp_request_msix_vectors(vdev, nvectors, per_vq_vectors,
+                                      per_vq_vectors ? desc : NULL);
         if (err)
-                goto out_free_msix_affinity_masks;
+                goto error_find;
 
-        /* Verify we had enough resources to assign the vector */
-        if (vp_dev->config_vector(vp_dev, 0) == VIRTIO_MSI_NO_VECTOR) {
-                err = -EBUSY;
-                goto out_free_config_irq;
-        }
-
-        vp_dev->msix_vector_map = kmalloc_array(nvqs,
-                        sizeof(*vp_dev->msix_vector_map), GFP_KERNEL);
-        if (!vp_dev->msix_vector_map)
-                goto out_disable_config_irq;
-
-        allocated_vectors = 1; /* vector 0 is the config interrupt */
+        vp_dev->per_vq_vectors = per_vq_vectors;
+        allocated_vectors = vp_dev->msix_used_vectors;
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
                         continue;
                 }
 
-                if (callbacks[i])
-                        msix_vec = allocated_vectors;
-                else
+                if (!callbacks[i])
                         msix_vec = VIRTIO_MSI_NO_VECTOR;
-
-                vqs[i] = vp_dev->setup_vq(vp_dev, i, callbacks[i], names[i],
-                                msix_vec);
+                else if (vp_dev->per_vq_vectors)
+                        msix_vec = allocated_vectors++;
+                else
+                        msix_vec = VP_MSIX_VQ_VECTOR;
+                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                                     msix_vec);
                 if (IS_ERR(vqs[i])) {
                         err = PTR_ERR(vqs[i]);
-                        goto out_remove_vqs;
+                        goto error_find;
                 }
 
-                if (msix_vec == VIRTIO_MSI_NO_VECTOR) {
-                        vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
+                if (!vp_dev->per_vq_vectors || msix_vec == VIRTIO_MSI_NO_VECTOR)
                         continue;
-                }
 
-                snprintf(vp_dev->msix_names[i + 1],
-                         sizeof(*vp_dev->msix_names), "%s-%s",
+                /* allocate per-vq irq if available and necessary */
+                snprintf(vp_dev->msix_names[msix_vec],
+                         sizeof *vp_dev->msix_names,
+                         "%s-%s",
                          dev_name(&vp_dev->vdev.dev), names[i]);
                 err = request_irq(pci_irq_vector(vp_dev->pci_dev, msix_vec),
-                                  vring_interrupt, IRQF_SHARED,
-                                  vp_dev->msix_names[i + 1], vqs[i]);
-                if (err) {
-                        /* don't free this irq on error */
-                        vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
-                        goto out_remove_vqs;
-                }
-                vp_dev->msix_vector_map[i] = msix_vec;
-
-                /*
-                 * Use a different vector for each queue if they are available,
-                 * else share the same vector for all VQs.
-                 */
-                if (!shared)
-                        allocated_vectors++;
+                                  vring_interrupt, 0,
+                                  vp_dev->msix_names[msix_vec],
+                                  vqs[i]);
+                if (err)
+                        goto error_find;
         }
-
         return 0;
 
-out_remove_vqs:
-        vp_remove_vqs(vdev);
-        kfree(vp_dev->msix_vector_map);
-out_disable_config_irq:
-        vp_dev->config_vector(vp_dev, VIRTIO_MSI_NO_VECTOR);
-out_free_config_irq:
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
-out_free_msix_affinity_masks:
-        for (i = 0; i < nvectors; i++) {
-                if (vp_dev->msix_affinity_masks[i])
-                        free_cpumask_var(vp_dev->msix_affinity_masks[i]);
-        }
-        kfree(vp_dev->msix_affinity_masks);
-out_free_msix_names:
-        kfree(vp_dev->msix_names);
-out_free_irq_vectors:
-        pci_free_irq_vectors(vp_dev->pci_dev);
+error_find:
+        vp_del_vqs(vdev);
         return err;
 }
 
@@ -286,29 +350,33 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned nvqs,
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
         int i, err;
 
+        vp_dev->vqs = kcalloc(nvqs, sizeof(*vp_dev->vqs), GFP_KERNEL);
+        if (!vp_dev->vqs)
+                return -ENOMEM;
+
         err = request_irq(vp_dev->pci_dev->irq, vp_interrupt, IRQF_SHARED,
                         dev_name(&vdev->dev), vp_dev);
         if (err)
-                return err;
+                goto out_del_vqs;
 
+        vp_dev->intx_enabled = 1;
+        vp_dev->per_vq_vectors = false;
         for (i = 0; i < nvqs; ++i) {
                 if (!names[i]) {
                         vqs[i] = NULL;
                         continue;
                 }
-                vqs[i] = vp_dev->setup_vq(vp_dev, i, callbacks[i], names[i],
-                                VIRTIO_MSI_NO_VECTOR);
+                vqs[i] = vp_setup_vq(vdev, i, callbacks[i], names[i],
+                                     VIRTIO_MSI_NO_VECTOR);
                 if (IS_ERR(vqs[i])) {
                         err = PTR_ERR(vqs[i]);
-                        goto out_remove_vqs;
+                        goto out_del_vqs;
                 }
         }
 
         return 0;
-
-out_remove_vqs:
-        vp_remove_vqs(vdev);
-        free_irq(pci_irq_vector(vp_dev->pci_dev, 0), vp_dev);
+out_del_vqs:
+        vp_del_vqs(vdev);
         return err;
 }
 
@@ -319,9 +387,15 @@ int vp_find_vqs(struct virtio_device *vdev, unsigned nvqs,
 {
         int err;
 
-        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, desc);
+        /* Try MSI-X with one vector per queue. */
+        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, true, desc);
         if (!err)
                 return 0;
+        /* Fallback: MSI-X with one vector for config, one shared for queues. */
+        err = vp_find_vqs_msix(vdev, nvqs, vqs, callbacks, names, false, desc);
+        if (!err)
+                return 0;
+        /* Finally fall back to regular interrupts. */
         return vp_find_vqs_intx(vdev, nvqs, vqs, callbacks, names);
 }
 
@@ -341,15 +415,16 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
 {
         struct virtio_device *vdev = vq->vdev;
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+        struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+        struct cpumask *mask;
+        unsigned int irq;
 
         if (!vq->callback)
                 return -EINVAL;
 
-        if (vp_dev->pci_dev->msix_enabled) {
-                int vec = vp_dev->msix_vector_map[vq->index];
-                struct cpumask *mask = vp_dev->msix_affinity_masks[vec];
-                unsigned int irq = pci_irq_vector(vp_dev->pci_dev, vec);
-
+        if (vp_dev->msix_enabled) {
+                mask = vp_dev->msix_affinity_masks[info->msix_vector];
+                irq = pci_irq_vector(vp_dev->pci_dev, info->msix_vector);
                 if (cpu == -1)
                         irq_set_affinity_hint(irq, NULL);
                 else {
@@ -364,12 +439,13 @@ int vp_set_vq_affinity(struct virtqueue *vq, int cpu)
 const struct cpumask *vp_get_vq_affinity(struct virtio_device *vdev, int index)
 {
         struct virtio_pci_device *vp_dev = to_vp_device(vdev);
-        unsigned int *map = vp_dev->msix_vector_map;
 
-        if (!map || map[index] == VIRTIO_MSI_NO_VECTOR)
+        if (!vp_dev->per_vq_vectors ||
+            vp_dev->vqs[index]->msix_vector == VIRTIO_MSI_NO_VECTOR)
                 return NULL;
 
-        return pci_irq_get_affinity(vp_dev->pci_dev, map[index]);
+        return pci_irq_get_affinity(vp_dev->pci_dev,
+                                    vp_dev->vqs[index]->msix_vector);
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -440,6 +516,8 @@ static int virtio_pci_probe(struct pci_dev *pci_dev,
         vp_dev->vdev.dev.parent = &pci_dev->dev;
         vp_dev->vdev.dev.release = virtio_pci_release_dev;
         vp_dev->pci_dev = pci_dev;
+        INIT_LIST_HEAD(&vp_dev->virtqueues);
+        spin_lock_init(&vp_dev->lock);
 
         /* enable the device */
         rc = pci_enable_device(pci_dev);
diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
index ac8c9d788964..e96334aec1e0 100644
--- a/drivers/virtio/virtio_pci_common.h
+++ b/drivers/virtio/virtio_pci_common.h
@@ -31,6 +31,17 @@
 #include <linux/highmem.h>
 #include <linux/spinlock.h>
 
+struct virtio_pci_vq_info {
+        /* the actual virtqueue */
+        struct virtqueue *vq;
+
+        /* the list node for the virtqueues list */
+        struct list_head node;
+
+        /* MSI-X vector (or none) */
+        unsigned msix_vector;
+};
+
 /* Our device structure */
 struct virtio_pci_device {
         struct virtio_device vdev;
@@ -64,25 +75,47 @@ struct virtio_pci_device {
         /* the IO mapping for the PCI config space */
         void __iomem *ioaddr;
 
+        /* a list of queues so we can dispatch IRQs */
+        spinlock_t lock;
+        struct list_head virtqueues;
+
+        /* array of all queues for house-keeping */
+        struct virtio_pci_vq_info **vqs;
+
+        /* MSI-X support */
+        int msix_enabled;
+        int intx_enabled;
         cpumask_var_t *msix_affinity_masks;
         /* Name strings for interrupts. This size should be enough,
          * and I'm too lazy to allocate each name separately. */
         char (*msix_names)[256];
-        /* Total Number of MSI-X vectors (including per-VQ ones). */
-        int msix_vectors;
-        /* Map of per-VQ MSI-X vectors, may be NULL */
-        unsigned *msix_vector_map;
+        /* Number of available vectors */
+        unsigned msix_vectors;
+        /* Vectors allocated, excluding per-vq vectors if any */
+        unsigned msix_used_vectors;
+
+        /* Whether we have vector per vq */
+        bool per_vq_vectors;
 
         struct virtqueue *(*setup_vq)(struct virtio_pci_device *vp_dev,
+                                      struct virtio_pci_vq_info *info,
                                       unsigned idx,
                                       void (*callback)(struct virtqueue *vq),
                                       const char *name,
                                       u16 msix_vec);
-        void (*del_vq)(struct virtqueue *vq);
+        void (*del_vq)(struct virtio_pci_vq_info *info);
 
         u16 (*config_vector)(struct virtio_pci_device *vp_dev, u16 vector);
 };
 
+/* Constants for MSI-X */
+/* Use first vector for configuration changes, second and the rest for
+ * virtqueues Thus, we need at least 2 vectors for MSI. */
+enum {
+        VP_MSIX_CONFIG_VECTOR = 0,
+        VP_MSIX_VQ_VECTOR = 1,
+};
+
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c
index f7362c5fe18a..4bfa48fb1324 100644
--- a/drivers/virtio/virtio_pci_legacy.c
+++ b/drivers/virtio/virtio_pci_legacy.c
@@ -112,6 +112,7 @@ static u16 vp_config_vector(struct virtio_pci_device *vp_dev, u16 vector)
 }
 
 static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+                                  struct virtio_pci_vq_info *info,
                                   unsigned index,
                                   void (*callback)(struct virtqueue *vq),
                                   const char *name,
@@ -129,6 +130,8 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
         if (!num || ioread32(vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN))
                 return ERR_PTR(-ENOENT);
 
+        info->msix_vector = msix_vec;
+
         /* create the vring */
         vq = vring_create_virtqueue(index, num,
                                     VIRTIO_PCI_VRING_ALIGN, &vp_dev->vdev,
@@ -159,13 +162,14 @@ out_deactivate:
         return ERR_PTR(err);
 }
 
-static void del_vq(struct virtqueue *vq)
+static void del_vq(struct virtio_pci_vq_info *info)
 {
+        struct virtqueue *vq = info->vq;
         struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
 
         iowrite16(vq->index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL);
 
-        if (vp_dev->pci_dev->msix_enabled) {
+        if (vp_dev->msix_enabled) {
                 iowrite16(VIRTIO_MSI_NO_VECTOR,
                           vp_dev->ioaddr + VIRTIO_MSI_QUEUE_VECTOR);
                 /* Flush the write out to device */
diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
index 7bc3004b840e..8978f109d2d7 100644
--- a/drivers/virtio/virtio_pci_modern.c
+++ b/drivers/virtio/virtio_pci_modern.c
@@ -293,6 +293,7 @@ static u16 vp_config_vector(struct virtio_pci_device *vp_dev, u16 vector)
 }
 
 static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
+                                  struct virtio_pci_vq_info *info,
                                   unsigned index,
                                   void (*callback)(struct virtqueue *vq),
                                   const char *name,
@@ -322,6 +323,8 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,
         /* get offset of notification word for this vq */
         off = vp_ioread16(&cfg->queue_notify_off);
 
+        info->msix_vector = msix_vec;
+
         /* create the vring */
         vq = vring_create_virtqueue(index, num,
                                     SMP_CACHE_BYTES, &vp_dev->vdev,
@@ -405,13 +408,14 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         return 0;
 }
 
-static void del_vq(struct virtqueue *vq)
+static void del_vq(struct virtio_pci_vq_info *info)
 {
+        struct virtqueue *vq = info->vq;
         struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
 
         vp_iowrite16(vq->index, &vp_dev->common->queue_select);
 
-        if (vp_dev->pci_dev->msix_enabled) {
+        if (vp_dev->msix_enabled) {
                 vp_iowrite16(VIRTIO_MSI_NO_VECTOR,
                              &vp_dev->common->queue_msix_vector);
                 /* Flush the write out to device */
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index c77a0751a311..f3bf8f4e2d6c 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -36,6 +36,7 @@
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/highmem.h>
+#include <linux/refcount.h>
 
 #include <xen/xen.h>
 #include <xen/grant_table.h>
@@ -86,7 +87,7 @@ struct grant_map {
         int index;
         int count;
         int flags;
-        atomic_t users;
+        refcount_t users;
         struct unmap_notify notify;
         struct ioctl_gntdev_grant_ref *grants;
         struct gnttab_map_grant_ref   *map_ops;
@@ -166,7 +167,7 @@ static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)
 
         add->index = 0;
         add->count = count;
-        atomic_set(&add->users, 1);
+        refcount_set(&add->users, 1);
 
         return add;
 
@@ -212,7 +213,7 @@ static void gntdev_put_map(struct gntdev_priv *priv, struct grant_map *map)
         if (!map)
                 return;
 
-        if (!atomic_dec_and_test(&map->users))
+        if (!refcount_dec_and_test(&map->users))
                 return;
 
         atomic_sub(map->count, &pages_mapped);
@@ -400,7 +401,7 @@ static void gntdev_vma_open(struct vm_area_struct *vma)
         struct grant_map *map = vma->vm_private_data;
 
         pr_debug("gntdev_vma_open %p\n", vma);
-        atomic_inc(&map->users);
+        refcount_inc(&map->users);
 }
 
 static void gntdev_vma_close(struct vm_area_struct *vma)
@@ -1004,7 +1005,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
                 goto unlock_out;
         }
 
-        atomic_inc(&map->users);
+        refcount_inc(&map->users);
 
         vma->vm_ops = &gntdev_vmops;
 
diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
index f8afc6dcc29f..e8cef1ad0fe3 100644
--- a/drivers/xen/swiotlb-xen.c
+++ b/drivers/xen/swiotlb-xen.c
@@ -681,3 +681,50 @@ xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask)
         return 0;
 }
 EXPORT_SYMBOL_GPL(xen_swiotlb_set_dma_mask);
+
+/*
+ * Create userspace mapping for the DMA-coherent memory.
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                     unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+        if (__generic_dma_ops(dev)->mmap)
+                return __generic_dma_ops(dev)->mmap(dev, vma, cpu_addr,
+                                                    dma_addr, size, attrs);
+#endif
+        return dma_common_mmap(dev, vma, cpu_addr, dma_addr, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_dma_mmap);
+
+/*
+ * This function should be called with the pages from the current domain only,
+ * passing pages mapped from other domains would lead to memory corruption.
+ */
+int
+xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
+                        void *cpu_addr, dma_addr_t handle, size_t size,
+                        unsigned long attrs)
+{
+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+        if (__generic_dma_ops(dev)->get_sgtable) {
+#if 0
+        /*
+         * This check verifies that the page belongs to the current domain and
+         * is not one mapped from another domain.
+         * This check is for debug only, and should not go to production build
+         */
+                unsigned long bfn = PHYS_PFN(dma_to_phys(dev, handle));
+                BUG_ON (!page_is_ram(bfn));
+#endif
+                return __generic_dma_ops(dev)->get_sgtable(dev, sgt, cpu_addr,
+                                                           handle, size, attrs);
+        }
+#endif
+        return dma_common_get_sgtable(dev, sgt, cpu_addr, handle, size);
+}
+EXPORT_SYMBOL_GPL(xen_swiotlb_get_sgtable);
diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
index 4ce10bcca18b..23e391d3ec01 100644
--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -27,10 +27,10 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/syscore_ops.h>
 #include <linux/acpi.h>
 #include <acpi/processor.h>
 #include <xen/xen.h>
-#include <xen/xen-ops.h>
 #include <xen/interface/platform.h>
 #include <asm/xen/hypercall.h>
 
@@ -408,7 +408,7 @@ static int check_acpi_ids(struct acpi_processor *pr_backup)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             read_acpi_id, NULL, NULL, NULL);
-        acpi_get_devices("ACPI0007", read_acpi_id, NULL, NULL);
+        acpi_get_devices(ACPI_PROCESSOR_DEVICE_HID, read_acpi_id, NULL, NULL);
 
 upload:
         if (!bitmap_equal(acpi_id_present, acpi_ids_done, nr_acpi_bits)) {
@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(void)
         return rc;
 }
 
-static int xen_acpi_processor_resume(struct notifier_block *nb,
-                                     unsigned long action, void *data)
+static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
 {
+        int rc;
+
         bitmap_zero(acpi_ids_done, nr_acpi_bits);
-        return xen_upload_processor_pm_data();
+
+        rc = xen_upload_processor_pm_data();
+        if (rc != 0)
+                pr_info("ACPI data upload failed, error = %d\n", rc);
+}
+
+static void xen_acpi_processor_resume(void)
+{
+        static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
+
+        /*
+         * xen_upload_processor_pm_data() calls non-atomic code.
+         * However, the context for xen_acpi_processor_resume is syscore
+         * with only the boot CPU online and in an atomic context.
+         *
+         * So defer the upload for some point safer.
+         */
+        schedule_work(&wq);
 }
 
-struct notifier_block xen_acpi_processor_resume_nb = {
-        .notifier_call = xen_acpi_processor_resume,
+static struct syscore_ops xap_syscore_ops = {
+        .resume = xen_acpi_processor_resume,
 };
 
 static int __init xen_acpi_processor_init(void)
@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_init(void)
         if (rc)
                 goto err_unregister;
 
-        xen_resume_notifier_register(&xen_acpi_processor_resume_nb);
+        register_syscore_ops(&xap_syscore_ops);
 
         return 0;
 err_unregister:
@@ -544,7 +562,7 @@ static void __exit xen_acpi_processor_exit(void)
 {
         int i;
 
-        xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb);
+        unregister_syscore_ops(&xap_syscore_ops);
         kfree(acpi_ids_done);
         kfree(acpi_id_present);
         kfree(acpi_id_cst_present);
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 4d343eed08f5..f3b089b7c0b6 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -55,7 +55,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/miscdevice.h>
-#include <linux/init.h>
 
 #include <xen/xenbus.h>
 #include <xen/xen.h>
@@ -443,8 +442,10 @@ static int xenbus_write_transaction(unsigned msg_type,
                 return xenbus_command_reply(u, XS_ERROR, "ENOENT");
 
         rc = xenbus_dev_request_and_reply(&u->u.msg, u);
-        if (rc)
+        if (rc && trans) {
+                list_del(&trans->list);
                 kfree(trans);
+        }
 
 out:
         return rc;
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index b29447e03ede..25d404d22cae 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -362,7 +362,7 @@ static void afs_callback_updater(struct work_struct *work)
 {
         struct afs_server *server;
         struct afs_vnode *vnode, *xvnode;
-        time_t now;
+        time64_t now;
         long timeout;
         int ret;
 
@@ -370,7 +370,7 @@ static void afs_callback_updater(struct work_struct *work)
 
         _enter("");
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
 
         /* find the first vnode to update */
         spin_lock(&server->cb_lock);
@@ -424,7 +424,8 @@ static void afs_callback_updater(struct work_struct *work)
 
         /* and then reschedule */
         _debug("reschedule");
-        vnode->update_at = get_seconds() + afs_vnode_update_timeout;
+        vnode->update_at = ktime_get_real_seconds() +
+                        afs_vnode_update_timeout;
 
         spin_lock(&server->cb_lock);
 
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 2edbdcbf6432..3062cceb5c2a 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -187,7 +187,6 @@ static int afs_deliver_cb_callback(struct afs_call *call)
         struct afs_callback *cb;
         struct afs_server *server;
         __be32 *bp;
-        u32 tmp;
         int ret, loop;
 
         _enter("{%u}", call->unmarshall);
@@ -249,9 +248,9 @@ static int afs_deliver_cb_callback(struct afs_call *call)
                 if (ret < 0)
                         return ret;
 
-                tmp = ntohl(call->tmp);
-                _debug("CB count: %u", tmp);
-                if (tmp != call->count && tmp != 0)
+                call->count2 = ntohl(call->tmp);
+                _debug("CB count: %u", call->count2);
+                if (call->count2 != call->count && call->count2 != 0)
                         return -EBADMSG;
                 call->offset = 0;
                 call->unmarshall++;
@@ -259,14 +258,14 @@ static int afs_deliver_cb_callback(struct afs_call *call)
         case 4:
                 _debug("extract CB array");
                 ret = afs_extract_data(call, call->buffer,
-                                       call->count * 3 * 4, false);
+                                       call->count2 * 3 * 4, false);
                 if (ret < 0)
                         return ret;
 
                 _debug("unmarshall CB array");
                 cb = call->request;
                 bp = call->buffer;
-                for (loop = call->count; loop > 0; loop--, cb++) {
+                for (loop = call->count2; loop > 0; loop--, cb++) {
                         cb->version     = ntohl(*bp++);
                         cb->expiry      = ntohl(*bp++);
                         cb->type        = ntohl(*bp++);
diff --git a/fs/afs/file.c b/fs/afs/file.c
index ba7b71fba34b..0d5b8508869b 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -30,6 +30,7 @@ static int afs_readpages(struct file *filp, struct address_space *mapping,
 
 const struct file_operations afs_file_operations = {
         .open           = afs_open,
+        .flush          = afs_flush,
         .release        = afs_release,
         .llseek         = generic_file_llseek,
         .read_iter      = generic_file_read_iter,
@@ -184,10 +185,13 @@ int afs_page_filler(void *data, struct page *page)
                 if (!req)
                         goto enomem;
 
+                /* We request a full page.  If the page is a partial one at the
+                 * end of the file, the server will return a short read and the
+                 * unmarshalling code will clear the unfilled space.
+                 */
                 atomic_set(&req->usage, 1);
                 req->pos = (loff_t)page->index << PAGE_SHIFT;
-                req->len = min_t(size_t, i_size_read(inode) - req->pos,
-                                 PAGE_SIZE);
+                req->len = PAGE_SIZE;
                 req->nr_pages = 1;
                 req->pages[0] = page;
                 get_page(page);
@@ -208,7 +212,13 @@ int afs_page_filler(void *data, struct page *page)
                         fscache_uncache_page(vnode->cache, page);
 #endif
                         BUG_ON(PageFsCache(page));
-                        goto error;
+
+                        if (ret == -EINTR ||
+                            ret == -ENOMEM ||
+                            ret == -ERESTARTSYS ||
+                            ret == -EAGAIN)
+                                goto error;
+                        goto io_error;
                 }
 
                 SetPageUptodate(page);
@@ -227,10 +237,12 @@ int afs_page_filler(void *data, struct page *page)
         _leave(" = 0");
         return 0;
 
+io_error:
+        SetPageError(page);
+        goto error;
 enomem:
         ret = -ENOMEM;
 error:
-        SetPageError(page);
         unlock_page(page);
         _leave(" = %d", ret);
         return ret;
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index ac8e766978dc..19f76ae36982 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -17,6 +17,12 @@
 #include "afs_fs.h"
 
 /*
+ * We need somewhere to discard into in case the server helpfully returns more
+ * than we asked for in FS.FetchData{,64}.
+ */
+static u8 afs_discard_buffer[64];
+
+/*
  * decode an AFSFid block
  */
 static void xdr_decode_AFSFid(const __be32 **_bp, struct afs_fid *fid)
@@ -105,7 +111,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp,
                         vnode->vfs_inode.i_mode = mode;
                 }
 
-                vnode->vfs_inode.i_ctime.tv_sec = status->mtime_server;
+                vnode->vfs_inode.i_ctime.tv_sec = status->mtime_client;
                 vnode->vfs_inode.i_mtime        = vnode->vfs_inode.i_ctime;
                 vnode->vfs_inode.i_atime        = vnode->vfs_inode.i_ctime;
                 vnode->vfs_inode.i_version      = data_version;
@@ -139,7 +145,7 @@ static void xdr_decode_AFSCallBack(const __be32 **_bp, struct afs_vnode *vnode)
         vnode->cb_version       = ntohl(*bp++);
         vnode->cb_expiry        = ntohl(*bp++);
         vnode->cb_type          = ntohl(*bp++);
-        vnode->cb_expires       = vnode->cb_expiry + get_seconds();
+        vnode->cb_expires       = vnode->cb_expiry + ktime_get_real_seconds();
         *_bp = bp;
 }
 
@@ -315,7 +321,7 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
         void *buffer;
         int ret;
 
-        _enter("{%u,%zu/%u;%u/%llu}",
+        _enter("{%u,%zu/%u;%llu/%llu}",
                call->unmarshall, call->offset, call->count,
                req->remain, req->actual_len);
 
@@ -353,12 +359,6 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
 
                 req->actual_len |= ntohl(call->tmp);
                 _debug("DATA length: %llu", req->actual_len);
-                /* Check that the server didn't want to send us extra.  We
-                 * might want to just discard instead, but that requires
-                 * cooperation from AF_RXRPC.
-                 */
-                if (req->actual_len > req->len)
-                        return -EBADMSG;
 
                 req->remain = req->actual_len;
                 call->offset = req->pos & (PAGE_SIZE - 1);
@@ -368,6 +368,7 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
                 call->unmarshall++;
 
         begin_page:
+                ASSERTCMP(req->index, <, req->nr_pages);
                 if (req->remain > PAGE_SIZE - call->offset)
                         size = PAGE_SIZE - call->offset;
                 else
@@ -378,7 +379,7 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
 
                 /* extract the returned data */
         case 3:
-                _debug("extract data %u/%llu %zu/%u",
+                _debug("extract data %llu/%llu %zu/%u",
                        req->remain, req->actual_len, call->offset, call->count);
 
                 buffer = kmap(req->pages[req->index]);
@@ -389,19 +390,40 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
                 if (call->offset == PAGE_SIZE) {
                         if (req->page_done)
                                 req->page_done(call, req);
+                        req->index++;
                         if (req->remain > 0) {
-                                req->index++;
                                 call->offset = 0;
+                                if (req->index >= req->nr_pages) {
+                                        call->unmarshall = 4;
+                                        goto begin_discard;
+                                }
                                 goto begin_page;
                         }
                 }
+                goto no_more_data;
+
+                /* Discard any excess data the server gave us */
+        begin_discard:
+        case 4:
+                size = min_t(loff_t, sizeof(afs_discard_buffer), req->remain);
+                call->count = size;
+                _debug("extract discard %llu/%llu %zu/%u",
+                       req->remain, req->actual_len, call->offset, call->count);
+
+                call->offset = 0;
+                ret = afs_extract_data(call, afs_discard_buffer, call->count, true);
+                req->remain -= call->offset;
+                if (ret < 0)
+                        return ret;
+                if (req->remain > 0)
+                        goto begin_discard;
 
         no_more_data:
                 call->offset = 0;
-                call->unmarshall++;
+                call->unmarshall = 5;
 
                 /* extract the metadata */
-        case 4:
+        case 5:
                 ret = afs_extract_data(call, call->buffer,
                                        (21 + 3 + 6) * 4, false);
                 if (ret < 0)
@@ -416,16 +438,17 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
                 call->offset = 0;
                 call->unmarshall++;
 
-        case 5:
+        case 6:
                 break;
         }
 
-        if (call->count < PAGE_SIZE) {
-                buffer = kmap(req->pages[req->index]);
-                memset(buffer + call->count, 0, PAGE_SIZE - call->count);
-                kunmap(req->pages[req->index]);
+        for (; req->index < req->nr_pages; req->index++) {
+                if (call->count < PAGE_SIZE)
+                        zero_user_segment(req->pages[req->index],
+                                          call->count, PAGE_SIZE);
                 if (req->page_done)
                         req->page_done(call, req);
+                call->count = 0;
         }
 
         _leave(" = 0 [done]");
@@ -711,8 +734,8 @@ int afs_fs_create(struct afs_server *server,
                 memset(bp, 0, padsz);
                 bp = (void *) bp + padsz;
         }
-        *bp++ = htonl(AFS_SET_MODE);
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME);
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = htonl(mode & S_IALLUGO); /* unix mode */
@@ -980,8 +1003,8 @@ int afs_fs_symlink(struct afs_server *server,
                 memset(bp, 0, c_padsz);
                 bp = (void *) bp + c_padsz;
         }
-        *bp++ = htonl(AFS_SET_MODE);
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME);
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = htonl(S_IRWXUGO); /* unix mode */
@@ -1180,8 +1203,8 @@ static int afs_fs_store_data64(struct afs_server *server,
         *bp++ = htonl(vnode->fid.vnode);
         *bp++ = htonl(vnode->fid.unique);
 
-        *bp++ = 0; /* mask */
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MTIME); /* mask */
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = 0; /* unix mode */
@@ -1213,7 +1236,7 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb,
         _enter(",%x,{%x:%u},,",
                key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode);
 
-        size = to - offset;
+        size = (loff_t)to - (loff_t)offset;
         if (first != last)
                 size += (loff_t)(last - first) << PAGE_SHIFT;
         pos = (loff_t)first << PAGE_SHIFT;
@@ -1257,8 +1280,8 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb,
         *bp++ = htonl(vnode->fid.vnode);
         *bp++ = htonl(vnode->fid.unique);
 
-        *bp++ = 0; /* mask */
-        *bp++ = 0; /* mtime */
+        *bp++ = htonl(AFS_SET_MTIME); /* mask */
+        *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */
         *bp++ = 0; /* owner */
         *bp++ = 0; /* group */
         *bp++ = 0; /* unix mode */
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index 1e4897a048d2..aae55dd15108 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -54,8 +54,21 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key)
                 inode->i_fop    = &afs_dir_file_operations;
                 break;
         case AFS_FTYPE_SYMLINK:
-                inode->i_mode   = S_IFLNK | vnode->status.mode;
-                inode->i_op     = &page_symlink_inode_operations;
+                /* Symlinks with a mode of 0644 are actually mountpoints. */
+                if ((vnode->status.mode & 0777) == 0644) {
+                        inode->i_flags |= S_AUTOMOUNT;
+
+                        spin_lock(&vnode->lock);
+                        set_bit(AFS_VNODE_MOUNTPOINT, &vnode->flags);
+                        spin_unlock(&vnode->lock);
+
+                        inode->i_mode   = S_IFDIR | 0555;
+                        inode->i_op     = &afs_mntpt_inode_operations;
+                        inode->i_fop    = &afs_mntpt_file_operations;
+                } else {
+                        inode->i_mode   = S_IFLNK | vnode->status.mode;
+                        inode->i_op     = &page_symlink_inode_operations;
+                }
                 inode_nohighmem(inode);
                 break;
         default:
@@ -70,27 +83,15 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key)
 
         set_nlink(inode, vnode->status.nlink);
         inode->i_uid            = vnode->status.owner;
-        inode->i_gid            = GLOBAL_ROOT_GID;
+        inode->i_gid            = vnode->status.group;
         inode->i_size           = vnode->status.size;
-        inode->i_ctime.tv_sec   = vnode->status.mtime_server;
+        inode->i_ctime.tv_sec   = vnode->status.mtime_client;
         inode->i_ctime.tv_nsec  = 0;
         inode->i_atime          = inode->i_mtime = inode->i_ctime;
         inode->i_blocks         = 0;
         inode->i_generation     = vnode->fid.unique;
         inode->i_version        = vnode->status.data_version;
         inode->i_mapping->a_ops = &afs_fs_aops;
-
-        /* check to see whether a symbolic link is really a mountpoint */
-        if (vnode->status.type == AFS_FTYPE_SYMLINK) {
-                afs_mntpt_check_symlink(vnode, key);
-
-                if (test_bit(AFS_VNODE_MOUNTPOINT, &vnode->flags)) {
-                        inode->i_mode   = S_IFDIR | vnode->status.mode;
-                        inode->i_op     = &afs_mntpt_inode_operations;
-                        inode->i_fop    = &afs_mntpt_file_operations;
-                }
-        }
-
         return 0;
 }
 
@@ -245,12 +246,13 @@ struct inode *afs_iget(struct super_block *sb, struct key *key,
                         vnode->cb_version = 0;
                         vnode->cb_expiry = 0;
                         vnode->cb_type = 0;
-                        vnode->cb_expires = get_seconds();
+                        vnode->cb_expires = ktime_get_real_seconds();
                 } else {
                         vnode->cb_version = cb->version;
                         vnode->cb_expiry = cb->expiry;
                         vnode->cb_type = cb->type;
-                        vnode->cb_expires = vnode->cb_expiry + get_seconds();
+                        vnode->cb_expires = vnode->cb_expiry +
+                                ktime_get_real_seconds();
                 }
         }
 
@@ -323,7 +325,7 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
             !test_bit(AFS_VNODE_CB_BROKEN, &vnode->flags) &&
             !test_bit(AFS_VNODE_MODIFIED, &vnode->flags) &&
             !test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) {
-                if (vnode->cb_expires < get_seconds() + 10) {
+                if (vnode->cb_expires < ktime_get_real_seconds() + 10) {
                         _debug("callback expired");
                         set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags);
                 } else {
@@ -444,7 +446,7 @@ void afs_evict_inode(struct inode *inode)
 
         mutex_lock(&vnode->permits_lock);
         permits = vnode->permits;
-        rcu_assign_pointer(vnode->permits, NULL);
+        RCU_INIT_POINTER(vnode->permits, NULL);
         mutex_unlock(&vnode->permits_lock);
         if (permits)
                 call_rcu(&permits->rcu, afs_zap_permits);
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 5dfa56903a2d..a6901360fb81 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -11,6 +11,7 @@
 
 #include <linux/compiler.h>
 #include <linux/kernel.h>
+#include <linux/ktime.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/rxrpc.h>
@@ -90,7 +91,10 @@ struct afs_call {
         unsigned                request_size;   /* size of request data */
         unsigned                reply_max;      /* maximum size of reply */
         unsigned                first_offset;   /* offset into mapping[first] */
-        unsigned                last_to;        /* amount of mapping[last] */
+        union {
+                unsigned        last_to;        /* amount of mapping[last] */
+                unsigned        count2;         /* count used in unmarshalling */
+        };
         unsigned char           unmarshall;     /* unmarshalling phase */
         bool                    incoming;       /* T if incoming call */
         bool                    send_pages;     /* T if data from mapping should be sent */
@@ -127,12 +131,11 @@ struct afs_call_type {
  */
 struct afs_read {
         loff_t                  pos;            /* Where to start reading */
-        loff_t                  len;            /* How much to read */
+        loff_t                  len;            /* How much we're asking for */
         loff_t                  actual_len;     /* How much we're actually getting */
+        loff_t                  remain;         /* Amount remaining */
         atomic_t                usage;
-        unsigned int            remain;         /* Amount remaining */
         unsigned int            index;          /* Which page we're reading into */
-        unsigned int            pg_offset;      /* Offset in page we're at */
         unsigned int            nr_pages;
         void (*page_done)(struct afs_call *, struct afs_read *);
         struct page             *pages[];
@@ -247,7 +250,7 @@ struct afs_cache_vhash {
  */
 struct afs_vlocation {
         atomic_t                usage;
-        time_t                  time_of_death;  /* time at which put reduced usage to 0 */
+        time64_t                time_of_death;  /* time at which put reduced usage to 0 */
         struct list_head        link;           /* link in cell volume location list */
         struct list_head        grave;          /* link in master graveyard list */
         struct list_head        update;         /* link in master update list */
@@ -258,7 +261,7 @@ struct afs_vlocation {
         struct afs_cache_vlocation vldb;        /* volume information DB record */
         struct afs_volume       *vols[3];       /* volume access record pointer (index by type) */
         wait_queue_head_t       waitq;          /* status change waitqueue */
-        time_t                  update_at;      /* time at which record should be updated */
+        time64_t                update_at;      /* time at which record should be updated */
         spinlock_t              lock;           /* access lock */
         afs_vlocation_state_t   state;          /* volume location state */
         unsigned short          upd_rej_cnt;    /* ENOMEDIUM count during update */
@@ -271,7 +274,7 @@ struct afs_vlocation {
  */
 struct afs_server {
         atomic_t                usage;
-        time_t                  time_of_death;  /* time at which put reduced usage to 0 */
+        time64_t                time_of_death;  /* time at which put reduced usage to 0 */
         struct in_addr          addr;           /* server address */
         struct afs_cell         *cell;          /* cell in which server resides */
         struct list_head        link;           /* link in cell's server list */
@@ -374,8 +377,8 @@ struct afs_vnode {
         struct rb_node          server_rb;      /* link in server->fs_vnodes */
         struct rb_node          cb_promise;     /* link in server->cb_promises */
         struct work_struct      cb_broken_work; /* work to be done on callback break */
-        time_t                  cb_expires;     /* time at which callback expires */
-        time_t                  cb_expires_at;  /* time used to order cb_promise */
+        time64_t                cb_expires;     /* time at which callback expires */
+        time64_t                cb_expires_at;  /* time used to order cb_promise */
         unsigned                cb_version;     /* callback version */
         unsigned                cb_expiry;      /* callback expiry time */
         afs_callback_type_t     cb_type;        /* type of callback */
@@ -557,7 +560,6 @@ extern const struct inode_operations afs_autocell_inode_operations;
 extern const struct file_operations afs_mntpt_file_operations;
 
 extern struct vfsmount *afs_d_automount(struct path *);
-extern int afs_mntpt_check_symlink(struct afs_vnode *, struct key *);
 extern void afs_mntpt_kill_timer(void);
 
 /*
@@ -718,6 +720,7 @@ extern int afs_writepages(struct address_space *, struct writeback_control *);
 extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *);
 extern ssize_t afs_file_write(struct kiocb *, struct iov_iter *);
 extern int afs_writeback_all(struct afs_vnode *);
+extern int afs_flush(struct file *, fl_owner_t);
 extern int afs_fsync(struct file *, loff_t, loff_t, int);
 
 
diff --git a/fs/afs/misc.c b/fs/afs/misc.c
index 91ea1aa0d8b3..100b207efc9e 100644
--- a/fs/afs/misc.c
+++ b/fs/afs/misc.c
@@ -84,6 +84,8 @@ int afs_abort_to_error(u32 abort_code)
         case RXKADDATALEN:      return -EKEYREJECTED;
         case RXKADILLEGALLEVEL: return -EKEYREJECTED;
 
+        case RXGEN_OPCODE:      return -ENOTSUPP;
+
         default:                return -EREMOTEIO;
         }
 }
diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c
index d4fb0afc0097..bd3b65cde282 100644
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -47,59 +47,6 @@ static DECLARE_DELAYED_WORK(afs_mntpt_expiry_timer, afs_mntpt_expiry_timed_out);
 static unsigned long afs_mntpt_expiry_timeout = 10 * 60;
 
 /*
- * check a symbolic link to see whether it actually encodes a mountpoint
- * - sets the AFS_VNODE_MOUNTPOINT flag on the vnode appropriately
- */
-int afs_mntpt_check_symlink(struct afs_vnode *vnode, struct key *key)
-{
-        struct page *page;
-        size_t size;
-        char *buf;
-        int ret;
-
-        _enter("{%x:%u,%u}",
-               vnode->fid.vid, vnode->fid.vnode, vnode->fid.unique);
-
-        /* read the contents of the symlink into the pagecache */
-        page = read_cache_page(AFS_VNODE_TO_I(vnode)->i_mapping, 0,
-                               afs_page_filler, key);
-        if (IS_ERR(page)) {
-                ret = PTR_ERR(page);
-                goto out;
-        }
-
-        ret = -EIO;
-        if (PageError(page))
-                goto out_free;
-
-        buf = kmap(page);
-
-        /* examine the symlink's contents */
-        size = vnode->status.size;
-        _debug("symlink to %*.*s", (int) size, (int) size, buf);
-
-        if (size > 2 &&
-            (buf[0] == '%' || buf[0] == '#') &&
-            buf[size - 1] == '.'
-            ) {
-                _debug("symlink is a mountpoint");
-                spin_lock(&vnode->lock);
-                set_bit(AFS_VNODE_MOUNTPOINT, &vnode->flags);
-                vnode->vfs_inode.i_flags |= S_AUTOMOUNT;
-                spin_unlock(&vnode->lock);
-        }
-
-        ret = 0;
-
-        kunmap(page);
-out_free:
-        put_page(page);
-out:
-        _leave(" = %d", ret);
-        return ret;
-}
-
-/*
  * no valid lookup procedure on this sort of dir
  */
 static struct dentry *afs_mntpt_lookup(struct inode *dir,
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 419ef05dcb5e..8f76b13d5549 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -259,67 +259,74 @@ void afs_flat_call_destructor(struct afs_call *call)
         call->buffer = NULL;
 }
 
+#define AFS_BVEC_MAX 8
+
+/*
+ * Load the given bvec with the next few pages.
+ */
+static void afs_load_bvec(struct afs_call *call, struct msghdr *msg,
+                          struct bio_vec *bv, pgoff_t first, pgoff_t last,
+                          unsigned offset)
+{
+        struct page *pages[AFS_BVEC_MAX];
+        unsigned int nr, n, i, to, bytes = 0;
+
+        nr = min_t(pgoff_t, last - first + 1, AFS_BVEC_MAX);
+        n = find_get_pages_contig(call->mapping, first, nr, pages);
+        ASSERTCMP(n, ==, nr);
+
+        msg->msg_flags |= MSG_MORE;
+        for (i = 0; i < nr; i++) {
+                to = PAGE_SIZE;
+                if (first + i >= last) {
+                        to = call->last_to;
+                        msg->msg_flags &= ~MSG_MORE;
+                }
+                bv[i].bv_page = pages[i];
+                bv[i].bv_len = to - offset;
+                bv[i].bv_offset = offset;
+                bytes += to - offset;
+                offset = 0;
+        }
+
+        iov_iter_bvec(&msg->msg_iter, WRITE | ITER_BVEC, bv, nr, bytes);
+}
+
 /*
  * attach the data from a bunch of pages on an inode to a call
  */
 static int afs_send_pages(struct afs_call *call, struct msghdr *msg)
 {
-        struct page *pages[8];
-        unsigned count, n, loop, offset, to;
+        struct bio_vec bv[AFS_BVEC_MAX];
+        unsigned int bytes, nr, loop, offset;
         pgoff_t first = call->first, last = call->last;
         int ret;
 
-        _enter("");
-
         offset = call->first_offset;
         call->first_offset = 0;
 
         do {
-                _debug("attach %lx-%lx", first, last);
-
-                count = last - first + 1;
-                if (count > ARRAY_SIZE(pages))
-                        count = ARRAY_SIZE(pages);
-                n = find_get_pages_contig(call->mapping, first, count, pages);
-                ASSERTCMP(n, ==, count);
-
-                loop = 0;
-                do {
-                        struct bio_vec bvec = {.bv_page = pages[loop],
-                                               .bv_offset = offset};
-                        msg->msg_flags = 0;
-                        to = PAGE_SIZE;
-                        if (first + loop >= last)
-                                to = call->last_to;
-                        else
-                                msg->msg_flags = MSG_MORE;
-                        bvec.bv_len = to - offset;
-                        offset = 0;
-
-                        _debug("- range %u-%u%s",
-                               offset, to, msg->msg_flags ? " [more]" : "");
-                        iov_iter_bvec(&msg->msg_iter, WRITE | ITER_BVEC,
-                                      &bvec, 1, to - offset);
-
-                        /* have to change the state *before* sending the last
-                         * packet as RxRPC might give us the reply before it
-                         * returns from sending the request */
-                        if (first + loop >= last)
-                                call->state = AFS_CALL_AWAIT_REPLY;
-                        ret = rxrpc_kernel_send_data(afs_socket, call->rxcall,
-                                                     msg, to - offset);
-                        if (ret < 0)
-                                break;
-                } while (++loop < count);
-                first += count;
-
-                for (loop = 0; loop < count; loop++)
-                        put_page(pages[loop]);
+                afs_load_bvec(call, msg, bv, first, last, offset);
+                offset = 0;
+                bytes = msg->msg_iter.count;
+                nr = msg->msg_iter.nr_segs;
+
+                /* Have to change the state *before* sending the last
+                 * packet as RxRPC might give us the reply before it
+                 * returns from sending the request.
+                 */
+                if (first + nr - 1 >= last)
+                        call->state = AFS_CALL_AWAIT_REPLY;
+                ret = rxrpc_kernel_send_data(afs_socket, call->rxcall,
+                                             msg, bytes);
+                for (loop = 0; loop < nr; loop++)
+                        put_page(bv[loop].bv_page);
                 if (ret < 0)
                         break;
+
+                first += nr;
         } while (first <= last);
 
-        _leave(" = %d", ret);
         return ret;
 }
 
@@ -333,6 +340,8 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         struct rxrpc_call *rxcall;
         struct msghdr msg;
         struct kvec iov[1];
+        size_t offset;
+        u32 abort_code;
         int ret;
 
         _enter("%x,{%d},", addr->s_addr, ntohs(call->port));
@@ -381,9 +390,11 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         msg.msg_controllen      = 0;
         msg.msg_flags           = (call->send_pages ? MSG_MORE : 0);
 
-        /* have to change the state *before* sending the last packet as RxRPC
-         * might give us the reply before it returns from sending the
-         * request */
+        /* We have to change the state *before* sending the last packet as
+         * rxrpc might give us the reply before it returns from sending the
+         * request.  Further, if the send fails, we may already have been given
+         * a notification and may have collected it.
+         */
         if (!call->send_pages)
                 call->state = AFS_CALL_AWAIT_REPLY;
         ret = rxrpc_kernel_send_data(afs_socket, rxcall,
@@ -405,7 +416,17 @@ int afs_make_call(struct in_addr *addr, struct afs_call *call, gfp_t gfp,
         return afs_wait_for_call_to_complete(call);
 
 error_do_abort:
-        rxrpc_kernel_abort_call(afs_socket, rxcall, RX_USER_ABORT, -ret, "KSD");
+        call->state = AFS_CALL_COMPLETE;
+        if (ret != -ECONNABORTED) {
+                rxrpc_kernel_abort_call(afs_socket, rxcall, RX_USER_ABORT,
+                                        -ret, "KSD");
+        } else {
+                abort_code = 0;
+                offset = 0;
+                rxrpc_kernel_recv_data(afs_socket, rxcall, NULL, 0, &offset,
+                                       false, &abort_code);
+                ret = call->type->abort_to_error(abort_code);
+        }
 error_kill_call:
         afs_put_call(call);
         _leave(" = %d", ret);
@@ -452,16 +473,18 @@ static void afs_deliver_to_call(struct afs_call *call)
                 case -EINPROGRESS:
                 case -EAGAIN:
                         goto out;
+                case -ECONNABORTED:
+                        goto call_complete;
                 case -ENOTCONN:
                         abort_code = RX_CALL_DEAD;
                         rxrpc_kernel_abort_call(afs_socket, call->rxcall,
                                                 abort_code, -ret, "KNC");
-                        goto do_abort;
+                        goto save_error;
                 case -ENOTSUPP:
-                        abort_code = RX_INVALID_OPERATION;
+                        abort_code = RXGEN_OPCODE;
                         rxrpc_kernel_abort_call(afs_socket, call->rxcall,
                                                 abort_code, -ret, "KIV");
-                        goto do_abort;
+                        goto save_error;
                 case -ENODATA:
                 case -EBADMSG:
                 case -EMSGSIZE:
@@ -471,7 +494,7 @@ static void afs_deliver_to_call(struct afs_call *call)
                                 abort_code = RXGEN_SS_UNMARSHAL;
                         rxrpc_kernel_abort_call(afs_socket, call->rxcall,
                                                 abort_code, EBADMSG, "KUM");
-                        goto do_abort;
+                        goto save_error;
                 }
         }
 
@@ -482,8 +505,9 @@ out:
         _leave("");
         return;
 
-do_abort:
+save_error:
         call->error = ret;
+call_complete:
         call->state = AFS_CALL_COMPLETE;
         goto done;
 }
@@ -493,7 +517,6 @@ do_abort:
  */
 static int afs_wait_for_call_to_complete(struct afs_call *call)
 {
-        const char *abort_why;
         int ret;
 
         DECLARE_WAITQUEUE(myself, current);
@@ -512,13 +535,8 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
                         continue;
                 }
 
-                abort_why = "KWC";
-                ret = call->error;
-                if (call->state == AFS_CALL_COMPLETE)
-                        break;
-                abort_why = "KWI";
-                ret = -EINTR;
-                if (signal_pending(current))
+                if (call->state == AFS_CALL_COMPLETE ||
+                    signal_pending(current))
                         break;
                 schedule();
         }
@@ -526,13 +544,14 @@ static int afs_wait_for_call_to_complete(struct afs_call *call)
         remove_wait_queue(&call->waitq, &myself);
         __set_current_state(TASK_RUNNING);
 
-        /* kill the call */
+        /* Kill off the call if it's still live. */
         if (call->state < AFS_CALL_COMPLETE) {
-                _debug("call incomplete");
+                _debug("call interrupted");
                 rxrpc_kernel_abort_call(afs_socket, call->rxcall,
-                                        RX_CALL_DEAD, -ret, abort_why);
+                                        RX_USER_ABORT, -EINTR, "KWI");
         }
 
+        ret = call->error;
         _debug("call complete");
         afs_put_call(call);
         _leave(" = %d", ret);
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 8d010422dc89..ecb86a670180 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -114,7 +114,7 @@ void afs_clear_permits(struct afs_vnode *vnode)
 
         mutex_lock(&vnode->permits_lock);
         permits = vnode->permits;
-        rcu_assign_pointer(vnode->permits, NULL);
+        RCU_INIT_POINTER(vnode->permits, NULL);
         mutex_unlock(&vnode->permits_lock);
 
         if (permits)
@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask)
         } else {
                 if (!(access & AFS_ACE_LOOKUP))
                         goto permission_denied;
+                if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR))
+                        goto permission_denied;
                 if (mask & (MAY_EXEC | MAY_READ)) {
                         if (!(access & AFS_ACE_READ))
                                 goto permission_denied;
+                        if (!(inode->i_mode & S_IRUSR))
+                                goto permission_denied;
                 } else if (mask & MAY_WRITE) {
                         if (!(access & AFS_ACE_WRITE))
                                 goto permission_denied;
+                        if (!(inode->i_mode & S_IWUSR))
+                                goto permission_denied;
                 }
         }
 
         key_put(key);
-        ret = generic_permission(inode, mask);
         _leave(" = %d", ret);
         return ret;
 
diff --git a/fs/afs/server.c b/fs/afs/server.c
index d4066ab7dd55..c001b1f2455f 100644
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -242,7 +242,7 @@ void afs_put_server(struct afs_server *server)
         spin_lock(&afs_server_graveyard_lock);
         if (atomic_read(&server->usage) == 0) {
                 list_move_tail(&server->grave, &afs_server_graveyard);
-                server->time_of_death = get_seconds();
+                server->time_of_death = ktime_get_real_seconds();
                 queue_delayed_work(afs_wq, &afs_server_reaper,
                                    afs_server_timeout * HZ);
         }
@@ -277,9 +277,9 @@ static void afs_reap_server(struct work_struct *work)
         LIST_HEAD(corpses);
         struct afs_server *server;
         unsigned long delay, expiry;
-        time_t now;
+        time64_t now;
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
         spin_lock(&afs_server_graveyard_lock);
 
         while (!list_empty(&afs_server_graveyard)) {
diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c
index d7d8dd8c0b31..37b7c3b342a6 100644
--- a/fs/afs/vlocation.c
+++ b/fs/afs/vlocation.c
@@ -340,7 +340,8 @@ static void afs_vlocation_queue_for_updates(struct afs_vlocation *vl)
         struct afs_vlocation *xvl;
 
         /* wait at least 10 minutes before updating... */
-        vl->update_at = get_seconds() + afs_vlocation_update_timeout;
+        vl->update_at = ktime_get_real_seconds() +
+                        afs_vlocation_update_timeout;
 
         spin_lock(&afs_vlocation_updates_lock);
 
@@ -506,7 +507,7 @@ void afs_put_vlocation(struct afs_vlocation *vl)
         if (atomic_read(&vl->usage) == 0) {
                 _debug("buried");
                 list_move_tail(&vl->grave, &afs_vlocation_graveyard);
-                vl->time_of_death = get_seconds();
+                vl->time_of_death = ktime_get_real_seconds();
                 queue_delayed_work(afs_wq, &afs_vlocation_reap,
                                    afs_vlocation_timeout * HZ);
 
@@ -543,11 +544,11 @@ static void afs_vlocation_reaper(struct work_struct *work)
         LIST_HEAD(corpses);
         struct afs_vlocation *vl;
         unsigned long delay, expiry;
-        time_t now;
+        time64_t now;
 
         _enter("");
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
         spin_lock(&afs_vlocation_graveyard_lock);
 
         while (!list_empty(&afs_vlocation_graveyard)) {
@@ -622,13 +623,13 @@ static void afs_vlocation_updater(struct work_struct *work)
 {
         struct afs_cache_vlocation vldb;
         struct afs_vlocation *vl, *xvl;
-        time_t now;
+        time64_t now;
         long timeout;
         int ret;
 
         _enter("");
 
-        now = get_seconds();
+        now = ktime_get_real_seconds();
 
         /* find a record to update */
         spin_lock(&afs_vlocation_updates_lock);
@@ -684,7 +685,8 @@ static void afs_vlocation_updater(struct work_struct *work)
 
         /* and then reschedule */
         _debug("reschedule");
-        vl->update_at = get_seconds() + afs_vlocation_update_timeout;
+        vl->update_at = ktime_get_real_seconds() +
+                        afs_vlocation_update_timeout;
 
         spin_lock(&afs_vlocation_updates_lock);
 
diff --git a/fs/afs/write.c b/fs/afs/write.c
index c83c1a0e851f..2d2fccd5044b 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -84,10 +84,9 @@ void afs_put_writeback(struct afs_writeback *wb)
  * partly or wholly fill a page that's under preparation for writing
  */
 static int afs_fill_page(struct afs_vnode *vnode, struct key *key,
-                         loff_t pos, struct page *page)
+                         loff_t pos, unsigned int len, struct page *page)
 {
         struct afs_read *req;
-        loff_t i_size;
         int ret;
 
         _enter(",,%llu", (unsigned long long)pos);
@@ -99,14 +98,10 @@ static int afs_fill_page(struct afs_vnode *vnode, struct key *key,
 
         atomic_set(&req->usage, 1);
         req->pos = pos;
+        req->len = len;
         req->nr_pages = 1;
         req->pages[0] = page;
-
-        i_size = i_size_read(&vnode->vfs_inode);
-        if (pos + PAGE_SIZE > i_size)
-                req->len = i_size - pos;
-        else
-                req->len = PAGE_SIZE;
+        get_page(page);
 
         ret = afs_vnode_fetch_data(vnode, key, req);
         afs_put_read(req);
@@ -159,12 +154,12 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
                 kfree(candidate);
                 return -ENOMEM;
         }
-        *pagep = page;
-        /* page won't leak in error case: it eventually gets cleaned off LRU */
 
         if (!PageUptodate(page) && len != PAGE_SIZE) {
-                ret = afs_fill_page(vnode, key, index << PAGE_SHIFT, page);
+                ret = afs_fill_page(vnode, key, pos & PAGE_MASK, PAGE_SIZE, page);
                 if (ret < 0) {
+                        unlock_page(page);
+                        put_page(page);
                         kfree(candidate);
                         _leave(" = %d [prep]", ret);
                         return ret;
@@ -172,6 +167,9 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
                 SetPageUptodate(page);
         }
 
+        /* page won't leak in error case: it eventually gets cleaned off LRU */
+        *pagep = page;
+
 try_again:
         spin_lock(&vnode->writeback_lock);
 
@@ -233,7 +231,7 @@ flush_conflicting_wb:
         if (wb->state == AFS_WBACK_PENDING)
                 wb->state = AFS_WBACK_CONFLICTING;
         spin_unlock(&vnode->writeback_lock);
-        if (PageDirty(page)) {
+        if (clear_page_dirty_for_io(page)) {
                 ret = afs_write_back_from_locked_page(wb, page);
                 if (ret < 0) {
                         afs_put_writeback(candidate);
@@ -257,7 +255,9 @@ int afs_write_end(struct file *file, struct address_space *mapping,
                   struct page *page, void *fsdata)
 {
         struct afs_vnode *vnode = AFS_FS_I(file_inode(file));
+        struct key *key = file->private_data;
         loff_t i_size, maybe_i_size;
+        int ret;
 
         _enter("{%x:%u},{%lx}",
                vnode->fid.vid, vnode->fid.vnode, page->index);
@@ -273,6 +273,20 @@ int afs_write_end(struct file *file, struct address_space *mapping,
                 spin_unlock(&vnode->writeback_lock);
         }
 
+        if (!PageUptodate(page)) {
+                if (copied < len) {
+                        /* Try and load any missing data from the server.  The
+                         * unmarshalling routine will take care of clearing any
+                         * bits that are beyond the EOF.
+                         */
+                        ret = afs_fill_page(vnode, key, pos + copied,
+                                            len - copied, page);
+                        if (ret < 0)
+                                return ret;
+                }
+                SetPageUptodate(page);
+        }
+
         set_page_dirty(page);
         if (PageDirty(page))
                 _debug("dirtied");
@@ -307,10 +321,14 @@ static void afs_kill_pages(struct afs_vnode *vnode, bool error,
                 ASSERTCMP(pv.nr, ==, count);
 
                 for (loop = 0; loop < count; loop++) {
-                        ClearPageUptodate(pv.pages[loop]);
+                        struct page *page = pv.pages[loop];
+                        ClearPageUptodate(page);
                         if (error)
-                                SetPageError(pv.pages[loop]);
-                        end_page_writeback(pv.pages[loop]);
+                                SetPageError(page);
+                        if (PageWriteback(page))
+                                end_page_writeback(page);
+                        if (page->index >= first)
+                                first = page->index + 1;
                 }
 
                 __pagevec_release(&pv);
@@ -335,8 +353,6 @@ static int afs_write_back_from_locked_page(struct afs_writeback *wb,
         _enter(",%lx", primary_page->index);
 
         count = 1;
-        if (!clear_page_dirty_for_io(primary_page))
-                BUG();
         if (test_set_page_writeback(primary_page))
                 BUG();
 
@@ -502,17 +518,17 @@ static int afs_writepages_region(struct address_space *mapping,
                  */
                 lock_page(page);
 
-                if (page->mapping != mapping) {
+                if (page->mapping != mapping || !PageDirty(page)) {
                         unlock_page(page);
                         put_page(page);
                         continue;
                 }
 
-                if (wbc->sync_mode != WB_SYNC_NONE)
-                        wait_on_page_writeback(page);
-
-                if (PageWriteback(page) || !PageDirty(page)) {
+                if (PageWriteback(page)) {
                         unlock_page(page);
+                        if (wbc->sync_mode != WB_SYNC_NONE)
+                                wait_on_page_writeback(page);
+                        put_page(page);
                         continue;
                 }
 
@@ -523,6 +539,8 @@ static int afs_writepages_region(struct address_space *mapping,
                 wb->state = AFS_WBACK_WRITING;
                 spin_unlock(&wb->vnode->writeback_lock);
 
+                if (!clear_page_dirty_for_io(page))
+                        BUG();
                 ret = afs_write_back_from_locked_page(wb, page);
                 unlock_page(page);
                 put_page(page);
@@ -746,6 +764,20 @@ out:
 }
 
 /*
+ * Flush out all outstanding writes on a file opened for writing when it is
+ * closed.
+ */
+int afs_flush(struct file *file, fl_owner_t id)
+{
+        _enter("");
+
+        if ((file->f_mode & FMODE_WRITE) == 0)
+                return 0;
+
+        return vfs_fsync(file, 0);
+}
+
+/*
  * notification that a previously read-only page is about to become writable
  * - if it returns an error, the caller will deliver a bus error signal
  */
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 29b7fc28c607..c4115901d906 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1259,7 +1259,7 @@ struct btrfs_root {
         atomic_t will_be_snapshoted;
 
         /* For qgroup metadata space reserve */
-        atomic_t qgroup_meta_rsv;
+        atomic64_t qgroup_meta_rsv;
 };
 static inline u32 btrfs_inode_sectorsize(const struct inode *inode)
 {
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 08b74daf35d0..eb1ee7b6f532 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1342,7 +1342,7 @@ static void __setup_root(struct btrfs_root *root, struct btrfs_fs_info *fs_info,
         atomic_set(&root->orphan_inodes, 0);
         atomic_set(&root->refs, 1);
         atomic_set(&root->will_be_snapshoted, 0);
-        atomic_set(&root->qgroup_meta_rsv, 0);
+        atomic64_set(&root->qgroup_meta_rsv, 0);
         root->log_transid = 0;
         root->log_transid_committed = -1;
         root->last_log_commit = 0;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 28e81922a21c..27fdb250b446 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1714,7 +1714,8 @@ static int __process_pages_contig(struct address_space *mapping,
                          * can we find nothing at @index.
                          */
                         ASSERT(page_ops & PAGE_LOCK);
-                        return ret;
+                        err = -EAGAIN;
+                        goto out;
                 }
 
                 for (i = 0; i < ret; i++) {
@@ -2583,26 +2584,36 @@ static void end_bio_extent_readpage(struct bio *bio)
 
                 if (tree->ops) {
                         ret = tree->ops->readpage_io_failed_hook(page, mirror);
-                        if (!ret && !bio->bi_error)
-                                uptodate = 1;
-                } else {
+                        if (ret == -EAGAIN) {
+                                /*
+                                 * Data inode's readpage_io_failed_hook() always
+                                 * returns -EAGAIN.
+                                 *
+                                 * The generic bio_readpage_error handles errors
+                                 * the following way: If possible, new read
+                                 * requests are created and submitted and will
+                                 * end up in end_bio_extent_readpage as well (if
+                                 * we're lucky, not in the !uptodate case). In
+                                 * that case it returns 0 and we just go on with
+                                 * the next page in our bio. If it can't handle
+                                 * the error it will return -EIO and we remain
+                                 * responsible for that page.
+                                 */
+                                ret = bio_readpage_error(bio, offset, page,
+                                                         start, end, mirror);
+                                if (ret == 0) {
+                                        uptodate = !bio->bi_error;
+                                        offset += len;
+                                        continue;
+                                }
+                        }
+
                         /*
-                         * The generic bio_readpage_error handles errors the
-                         * following way: If possible, new read requests are
-                         * created and submitted and will end up in
-                         * end_bio_extent_readpage as well (if we're lucky, not
-                         * in the !uptodate case). In that case it returns 0 and
-                         * we just go on with the next page in our bio. If it
-                         * can't handle the error it will return -EIO and we
-                         * remain responsible for that page.
+                         * metadata's readpage_io_failed_hook() always returns
+                         * -EIO and fixes nothing.  -EIO is also returned if
+                         * data inode error could not be fixed.
                          */
-                        ret = bio_readpage_error(bio, offset, page, start, end,
-                                                 mirror);
-                        if (ret == 0) {
-                                uptodate = !bio->bi_error;
-                                offset += len;
-                                continue;
-                        }
+                        ASSERT(ret == -EIO);
                 }
 readpage_ok:
                 if (likely(uptodate)) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index c40060cc481f..5e71f1ea3391 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6709,6 +6709,20 @@ static noinline int uncompress_inline(struct btrfs_path *path,
         max_size = min_t(unsigned long, PAGE_SIZE, max_size);
         ret = btrfs_decompress(compress_type, tmp, page,
                                extent_offset, inline_size, max_size);
+
+        /*
+         * decompression code contains a memset to fill in any space between the end
+         * of the uncompressed data and the end of max_size in case the decompressed
+         * data ends up shorter than ram_bytes.  That doesn't cover the hole between
+         * the end of an inline extent and the beginning of the next block, so we
+         * cover that region here.
+         */
+
+        if (max_size + pg_offset < PAGE_SIZE) {
+                char *map = kmap(page);
+                memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset);
+                kunmap(page);
+        }
         kfree(tmp);
         return ret;
 }
@@ -7896,7 +7910,6 @@ struct btrfs_retry_complete {
 static void btrfs_retry_endio_nocsum(struct bio *bio)
 {
         struct btrfs_retry_complete *done = bio->bi_private;
-        struct inode *inode;
         struct bio_vec *bvec;
         int i;
 
@@ -7904,12 +7917,12 @@ static void btrfs_retry_endio_nocsum(struct bio *bio)
                 goto end;
 
         ASSERT(bio->bi_vcnt == 1);
-        inode = bio->bi_io_vec->bv_page->mapping->host;
-        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(inode));
+        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(done->inode));
 
         done->uptodate = 1;
         bio_for_each_segment_all(bvec, bio, i)
-        clean_io_failure(BTRFS_I(done->inode), done->start, bvec->bv_page, 0);
+                clean_io_failure(BTRFS_I(done->inode), done->start,
+                                 bvec->bv_page, 0);
 end:
         complete(&done->done);
         bio_put(bio);
@@ -7959,8 +7972,10 @@ next_block_or_try_again:
 
                 start += sectorsize;
 
-                if (nr_sectors--) {
+                nr_sectors--;
+                if (nr_sectors) {
                         pgoff += sectorsize;
+                        ASSERT(pgoff < PAGE_SIZE);
                         goto next_block_or_try_again;
                 }
         }
@@ -7972,9 +7987,7 @@ static void btrfs_retry_endio(struct bio *bio)
 {
         struct btrfs_retry_complete *done = bio->bi_private;
         struct btrfs_io_bio *io_bio = btrfs_io_bio(bio);
-        struct inode *inode;
         struct bio_vec *bvec;
-        u64 start;
         int uptodate;
         int ret;
         int i;
@@ -7984,11 +7997,8 @@ static void btrfs_retry_endio(struct bio *bio)
 
         uptodate = 1;
 
-        start = done->start;
-
         ASSERT(bio->bi_vcnt == 1);
-        inode = bio->bi_io_vec->bv_page->mapping->host;
-        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(inode));
+        ASSERT(bio->bi_io_vec->bv_len == btrfs_inode_sectorsize(done->inode));
 
         bio_for_each_segment_all(bvec, bio, i) {
                 ret = __readpage_endio_check(done->inode, io_bio, i,
@@ -8066,8 +8076,10 @@ next:
 
                 ASSERT(nr_sectors);
 
-                if (--nr_sectors) {
+                nr_sectors--;
+                if (nr_sectors) {
                         pgoff += sectorsize;
+                        ASSERT(pgoff < PAGE_SIZE);
                         goto next_block;
                 }
         }
@@ -10509,9 +10521,9 @@ out_inode:
 }
 
 __attribute__((const))
-static int dummy_readpage_io_failed_hook(struct page *page, int failed_mirror)
+static int btrfs_readpage_io_failed_hook(struct page *page, int failed_mirror)
 {
-        return 0;
+        return -EAGAIN;
 }
 
 static const struct inode_operations btrfs_dir_inode_operations = {
@@ -10556,7 +10568,7 @@ static const struct extent_io_ops btrfs_extent_io_ops = {
         .submit_bio_hook = btrfs_submit_bio_hook,
         .readpage_end_io_hook = btrfs_readpage_end_io_hook,
         .merge_bio_hook = btrfs_merge_bio_hook,
-        .readpage_io_failed_hook = dummy_readpage_io_failed_hook,
+        .readpage_io_failed_hook = btrfs_readpage_io_failed_hook,
 
         /* optional callbacks */
         .fill_delalloc = run_delalloc_range,
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index a5da750c1087..a59801dc2a34 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -2948,20 +2948,20 @@ int btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes,
         ret = qgroup_reserve(root, num_bytes, enforce);
         if (ret < 0)
                 return ret;
-        atomic_add(num_bytes, &root->qgroup_meta_rsv);
+        atomic64_add(num_bytes, &root->qgroup_meta_rsv);
         return ret;
 }
 
 void btrfs_qgroup_free_meta_all(struct btrfs_root *root)
 {
         struct btrfs_fs_info *fs_info = root->fs_info;
-        int reserved;
+        u64 reserved;
 
         if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) ||
             !is_fstree(root->objectid))
                 return;
 
-        reserved = atomic_xchg(&root->qgroup_meta_rsv, 0);
+        reserved = atomic64_xchg(&root->qgroup_meta_rsv, 0);
         if (reserved == 0)
                 return;
         btrfs_qgroup_free_refroot(fs_info, root->objectid, reserved);
@@ -2976,8 +2976,8 @@ void btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes)
                 return;
 
         BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize));
-        WARN_ON(atomic_read(&root->qgroup_meta_rsv) < num_bytes);
-        atomic_sub(num_bytes, &root->qgroup_meta_rsv);
+        WARN_ON(atomic64_read(&root->qgroup_meta_rsv) < num_bytes);
+        atomic64_sub(num_bytes, &root->qgroup_meta_rsv);
         btrfs_qgroup_free_refroot(fs_info, root->objectid, num_bytes);
 }
 
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index 456c8901489b..a60d5bfb8a49 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -6305,8 +6305,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
                 goto out;
         }
 
+        /*
+         * Check that we don't overflow at later allocations, we request
+         * clone_sources_count + 1 items, and compare to unsigned long inside
+         * access_ok.
+         */
         if (arg->clone_sources_count >
-            ULLONG_MAX / sizeof(*arg->clone_sources)) {
+            ULONG_MAX / sizeof(struct clone_root) - 1) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index da687dc79cce..9530a333d302 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -549,16 +549,19 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options,
                 case Opt_ssd:
                         btrfs_set_and_info(info, SSD,
                                            "use ssd allocation scheme");
+                        btrfs_clear_opt(info->mount_opt, NOSSD);
                         break;
                 case Opt_ssd_spread:
                         btrfs_set_and_info(info, SSD_SPREAD,
                                            "use spread ssd allocation scheme");
                         btrfs_set_opt(info->mount_opt, SSD);
+                        btrfs_clear_opt(info->mount_opt, NOSSD);
                         break;
                 case Opt_nossd:
                         btrfs_set_and_info(info, NOSSD,
                                              "not using ssd allocation scheme");
                         btrfs_clear_opt(info->mount_opt, SSD);
+                        btrfs_clear_opt(info->mount_opt, SSD_SPREAD);
                         break;
                 case Opt_barrier:
                         btrfs_clear_and_info(info, NOBARRIER,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 73d56eef5e60..ab8a66d852f9 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -6213,7 +6213,7 @@ int btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
         for (dev_nr = 0; dev_nr < total_devs; dev_nr++) {
                 dev = bbio->stripes[dev_nr].dev;
                 if (!dev || !dev->bdev ||
-                    (bio_op(bio) == REQ_OP_WRITE && !dev->writeable)) {
+                    (bio_op(first_bio) == REQ_OP_WRITE && !dev->writeable)) {
                         bbio_error(bbio, first_bio, logical);
                         continue;
                 }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 15e1db8738ae..dd3f5fabfdf6 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -972,6 +972,86 @@ out:
         return rc;
 }
 
+ssize_t cifs_file_copychunk_range(unsigned int xid,
+                                struct file *src_file, loff_t off,
+                                struct file *dst_file, loff_t destoff,
+                                size_t len, unsigned int flags)
+{
+        struct inode *src_inode = file_inode(src_file);
+        struct inode *target_inode = file_inode(dst_file);
+        struct cifsFileInfo *smb_file_src;
+        struct cifsFileInfo *smb_file_target;
+        struct cifs_tcon *src_tcon;
+        struct cifs_tcon *target_tcon;
+        ssize_t rc;
+
+        cifs_dbg(FYI, "copychunk range\n");
+
+        if (src_inode == target_inode) {
+                rc = -EINVAL;
+                goto out;
+        }
+
+        if (!src_file->private_data || !dst_file->private_data) {
+                rc = -EBADF;
+                cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
+                goto out;
+        }
+
+        rc = -EXDEV;
+        smb_file_target = dst_file->private_data;
+        smb_file_src = src_file->private_data;
+        src_tcon = tlink_tcon(smb_file_src->tlink);
+        target_tcon = tlink_tcon(smb_file_target->tlink);
+
+        if (src_tcon->ses != target_tcon->ses) {
+                cifs_dbg(VFS, "source and target of copy not on same server\n");
+                goto out;
+        }
+
+        /*
+         * Note: cifs case is easier than btrfs since server responsible for
+         * checks for proper open modes and file type and if it wants
+         * server could even support copy of range where source = target
+         */
+        lock_two_nondirectories(target_inode, src_inode);
+
+        cifs_dbg(FYI, "about to flush pages\n");
+        /* should we flush first and last page first */
+        truncate_inode_pages(&target_inode->i_data, 0);
+
+        if (target_tcon->ses->server->ops->copychunk_range)
+                rc = target_tcon->ses->server->ops->copychunk_range(xid,
+                        smb_file_src, smb_file_target, off, len, destoff);
+        else
+                rc = -EOPNOTSUPP;
+
+        /* force revalidate of size and timestamps of target file now
+         * that target is updated on the server
+         */
+        CIFS_I(target_inode)->time = 0;
+        /* although unlocking in the reverse order from locking is not
+         * strictly necessary here it is a little cleaner to be consistent
+         */
+        unlock_two_nondirectories(src_inode, target_inode);
+
+out:
+        return rc;
+}
+
+static ssize_t cifs_copy_file_range(struct file *src_file, loff_t off,
+                                struct file *dst_file, loff_t destoff,
+                                size_t len, unsigned int flags)
+{
+        unsigned int xid = get_xid();
+        ssize_t rc;
+
+        rc = cifs_file_copychunk_range(xid, src_file, off, dst_file, destoff,
+                                        len, flags);
+        free_xid(xid);
+        return rc;
+}
+
 const struct file_operations cifs_file_ops = {
         .read_iter = cifs_loose_read_iter,
         .write_iter = cifs_file_write_iter,
@@ -984,6 +1064,7 @@ const struct file_operations cifs_file_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1001,6 +1082,7 @@ const struct file_operations cifs_file_strict_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1018,6 +1100,7 @@ const struct file_operations cifs_file_direct_ops = {
         .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
@@ -1035,6 +1118,7 @@ const struct file_operations cifs_file_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1051,6 +1135,7 @@ const struct file_operations cifs_file_strict_nobrl_ops = {
         .splice_read = generic_file_splice_read,
         .llseek = cifs_llseek,
         .unlocked_ioctl = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .setlease = cifs_setlease,
         .fallocate = cifs_fallocate,
@@ -1067,6 +1152,7 @@ const struct file_operations cifs_file_direct_nobrl_ops = {
         .mmap = cifs_file_mmap,
         .splice_read = generic_file_splice_read,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = cifs_llseek,
         .setlease = cifs_setlease,
@@ -1078,6 +1164,7 @@ const struct file_operations cifs_dir_ops = {
         .release = cifs_closedir,
         .read    = generic_read_dir,
         .unlocked_ioctl  = cifs_ioctl,
+        .copy_file_range = cifs_copy_file_range,
         .clone_file_range = cifs_clone_file_range,
         .llseek = generic_file_llseek,
 };
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index da717fee3026..30bf89b1fd9a 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -139,6 +139,11 @@ extern ssize_t	cifs_listxattr(struct dentry *, char *, size_t);
 # define cifs_listxattr NULL
 #endif
 
+extern ssize_t cifs_file_copychunk_range(unsigned int xid,
+                                        struct file *src_file, loff_t off,
+                                        struct file *dst_file, loff_t destoff,
+                                        size_t len, unsigned int flags);
+
 extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_CIFS_NFSD_EXPORT
 extern const struct export_operations cifs_export_ops;
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index d42dd3288647..37f5a41cc50c 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -243,6 +243,7 @@ struct smb_version_operations {
         /* verify the message */
         int (*check_message)(char *, unsigned int, struct TCP_Server_Info *);
         bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+        int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
         void (*downgrade_oplock)(struct TCP_Server_Info *,
                                         struct cifsInodeInfo *, bool);
         /* process transaction2 response */
@@ -407,9 +408,10 @@ struct smb_version_operations {
         char * (*create_lease_buf)(u8 *, u8);
         /* parse lease context buffer and return oplock/epoch info */
         __u8 (*parse_lease_buf)(void *, unsigned int *);
-        int (*clone_range)(const unsigned int, struct cifsFileInfo *src_file,
-                        struct cifsFileInfo *target_file, u64 src_off, u64 len,
-                        u64 dest_off);
+        ssize_t (*copychunk_range)(const unsigned int,
+                        struct cifsFileInfo *src_file,
+                        struct cifsFileInfo *target_file,
+                        u64 src_off, u64 len, u64 dest_off);
         int (*duplicate_extents)(const unsigned int, struct cifsFileInfo *src,
                         struct cifsFileInfo *target_file, u64 src_off, u64 len,
                         u64 dest_off);
@@ -946,7 +948,6 @@ struct cifs_tcon {
         bool use_persistent:1; /* use persistent instead of durable handles */
 #ifdef CONFIG_CIFS_SMB2
         bool print:1;           /* set if connection to printer share */
-        bool bad_network_name:1; /* set if ret status STATUS_BAD_NETWORK_NAME */
         __le32 capabilities;
         __u32 share_flags;
         __u32 maximal_access;
@@ -1343,6 +1344,7 @@ struct mid_q_entry {
         void *callback_data;      /* general purpose pointer for callback */
         void *resp_buf;         /* pointer to received SMB header */
         int mid_state;  /* wish this were enum but can not pass to wait_event */
+        unsigned int mid_flags;
         __le16 command;         /* smb command code */
         bool large_buf:1;       /* if valid response, is pointer to large buf */
         bool multiRsp:1;        /* multiple trans2 responses for one request  */
@@ -1350,6 +1352,12 @@ struct mid_q_entry {
         bool decrypted:1;       /* decrypted entry */
 };
 
+struct close_cancelled_open {
+        struct cifs_fid         fid;
+        struct cifs_tcon        *tcon;
+        struct work_struct      work;
+};
+
 /*      Make code in transport.c a little cleaner by moving
         update of optional stats into function below */
 #ifdef CONFIG_CIFS_STATS2
@@ -1481,6 +1489,9 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param,
 #define   MID_RESPONSE_MALFORMED 0x10
 #define   MID_SHUTDOWN           0x20
 
+/* Flags */
+#define   MID_WAIT_CANCELLED     1 /* Cancelled while waiting for response */
+
 /* Types of response buffer returned from SendReceive2 */
 #define   CIFS_NO_BUFFER        0    /* Response buffer not returned */
 #define   CIFS_SMALL_BUFFER     1
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 066950671929..5d21f00ae341 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1428,6 +1428,8 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 
         length = cifs_discard_remaining_data(server);
         dequeue_mid(mid, rdata->result);
+        mid->resp_buf = server->smallbuf;
+        server->smallbuf = NULL;
         return length;
 }
 
@@ -1541,6 +1543,8 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
                 return cifs_readv_discard(server, mid);
 
         dequeue_mid(mid, false);
+        mid->resp_buf = server->smallbuf;
+        server->smallbuf = NULL;
         return length;
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 9ae695ae3ed7..d82467cfb0e2 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -904,10 +904,19 @@ cifs_demultiplex_thread(void *p)
 
                 server->lstrp = jiffies;
                 if (mid_entry != NULL) {
+                        if ((mid_entry->mid_flags & MID_WAIT_CANCELLED) &&
+                             mid_entry->mid_state == MID_RESPONSE_RECEIVED &&
+                                        server->ops->handle_cancelled_mid)
+                                server->ops->handle_cancelled_mid(
+                                                        mid_entry->resp_buf,
+                                                        server);
+
                         if (!mid_entry->multiRsp || mid_entry->multiEnd)
                                 mid_entry->callback(mid_entry);
-                } else if (!server->ops->is_oplock_break ||
-                           !server->ops->is_oplock_break(buf, server)) {
+                } else if (server->ops->is_oplock_break &&
+                           server->ops->is_oplock_break(buf, server)) {
+                        cifs_dbg(FYI, "Received oplock break\n");
+                } else {
                         cifs_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n",
                                  atomic_read(&midCount));
                         cifs_dump_mem("Received Data is: ", buf,
@@ -3744,6 +3753,9 @@ try_mount_again:
         if (IS_ERR(tcon)) {
                 rc = PTR_ERR(tcon);
                 tcon = NULL;
+                if (rc == -EACCES)
+                        goto mount_fail_check;
+
                 goto remote_path_check;
         }
 
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index aa3debbba826..21d404535739 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2597,7 +2597,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
                 wdata->credits = credits;
 
                 if (!wdata->cfile->invalidHandle ||
-                    !cifs_reopen_file(wdata->cfile, false))
+                    !(rc = cifs_reopen_file(wdata->cfile, false)))
                         rc = server->ops->async_writev(wdata,
                                         cifs_uncached_writedata_release);
                 if (rc) {
@@ -3022,7 +3022,7 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
                 rdata->credits = credits;
 
                 if (!rdata->cfile->invalidHandle ||
-                    !cifs_reopen_file(rdata->cfile, true))
+                    !(rc = cifs_reopen_file(rdata->cfile, true)))
                         rc = server->ops->async_readv(rdata);
 error:
                 if (rc) {
@@ -3617,7 +3617,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                 }
 
                 if (!rdata->cfile->invalidHandle ||
-                    !cifs_reopen_file(rdata->cfile, true))
+                    !(rc = cifs_reopen_file(rdata->cfile, true)))
                         rc = server->ops->async_readv(rdata);
                 if (rc) {
                         add_credits_and_wake_if(server, rdata->credits, 0);
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 001528781b6b..265c45fe4ea5 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -34,71 +34,14 @@
 #include "cifs_ioctl.h"
 #include <linux/btrfs.h>
 
-static int cifs_file_clone_range(unsigned int xid, struct file *src_file,
-                          struct file *dst_file)
-{
-        struct inode *src_inode = file_inode(src_file);
-        struct inode *target_inode = file_inode(dst_file);
-        struct cifsFileInfo *smb_file_src;
-        struct cifsFileInfo *smb_file_target;
-        struct cifs_tcon *src_tcon;
-        struct cifs_tcon *target_tcon;
-        int rc;
-
-        cifs_dbg(FYI, "ioctl clone range\n");
-
-        if (!src_file->private_data || !dst_file->private_data) {
-                rc = -EBADF;
-                cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
-                goto out;
-        }
-
-        rc = -EXDEV;
-        smb_file_target = dst_file->private_data;
-        smb_file_src = src_file->private_data;
-        src_tcon = tlink_tcon(smb_file_src->tlink);
-        target_tcon = tlink_tcon(smb_file_target->tlink);
-
-        if (src_tcon->ses != target_tcon->ses) {
-                cifs_dbg(VFS, "source and target of copy not on same server\n");
-                goto out;
-        }
-
-        /*
-         * Note: cifs case is easier than btrfs since server responsible for
-         * checks for proper open modes and file type and if it wants
-         * server could even support copy of range where source = target
-         */
-        lock_two_nondirectories(target_inode, src_inode);
-
-        cifs_dbg(FYI, "about to flush pages\n");
-        /* should we flush first and last page first */
-        truncate_inode_pages(&target_inode->i_data, 0);
-
-        if (target_tcon->ses->server->ops->clone_range)
-                rc = target_tcon->ses->server->ops->clone_range(xid,
-                        smb_file_src, smb_file_target, 0, src_inode->i_size, 0);
-        else
-                rc = -EOPNOTSUPP;
-
-        /* force revalidate of size and timestamps of target file now
-           that target is updated on the server */
-        CIFS_I(target_inode)->time = 0;
-        /* although unlocking in the reverse order from locking is not
-           strictly necessary here it is a little cleaner to be consistent */
-        unlock_two_nondirectories(src_inode, target_inode);
-out:
-        return rc;
-}
-
-static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
+static long cifs_ioctl_copychunk(unsigned int xid, struct file *dst_file,
                         unsigned long srcfd)
 {
         int rc;
         struct fd src_file;
         struct inode *src_inode;
 
-        cifs_dbg(FYI, "ioctl clone range\n");
+        cifs_dbg(FYI, "ioctl copychunk range\n");
         /* the destination must be opened for writing */
         if (!(dst_file->f_mode & FMODE_WRITE)) {
                 cifs_dbg(FYI, "file target not open for write\n");
@@ -129,7 +72,8 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
         if (S_ISDIR(src_inode->i_mode))
                 goto out_fput;
 
-        rc = cifs_file_clone_range(xid, src_file.file, dst_file);
+        rc = cifs_file_copychunk_range(xid, src_file.file, 0, dst_file, 0,
+                                        src_inode->i_size, 0);
 
 out_fput:
         fdput(src_file);
@@ -251,7 +195,7 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
                         }
                         break;
                 case CIFS_IOC_COPYCHUNK_FILE:
-                        rc = cifs_ioctl_clone(xid, filep, arg);
+                        rc = cifs_ioctl_copychunk(xid, filep, arg);
                         break;
                 case CIFS_IOC_SET_INTEGRITY:
                         if (pSMBFile == NULL)
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index cc93ba4da9b5..27bc360c7ffd 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -1015,6 +1015,15 @@ cifs_dir_needs_close(struct cifsFileInfo *cfile)
         return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle;
 }
 
+static bool
+cifs_can_echo(struct TCP_Server_Info *server)
+{
+        if (server->tcpStatus == CifsGood)
+                return true;
+
+        return false;
+}
+
 struct smb_version_operations smb1_operations = {
         .send_cancel = send_nt_cancel,
         .compare_fids = cifs_compare_fids,
@@ -1049,6 +1058,7 @@ struct smb_version_operations smb1_operations = {
         .get_dfs_refer = CIFSGetDFSRefer,
         .qfs_tcon = cifs_qfs_tcon,
         .is_path_accessible = cifs_is_path_accessible,
+        .can_echo = cifs_can_echo,
         .query_path_info = cifs_query_path_info,
         .query_file_info = cifs_query_file_info,
         .get_srv_inum = cifs_get_srv_inum,
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index fd516ea8b8f8..1a04b3a5beb1 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -659,3 +659,49 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
         cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n");
         return false;
 }
+
+void
+smb2_cancelled_close_fid(struct work_struct *work)
+{
+        struct close_cancelled_open *cancelled = container_of(work,
+                                        struct close_cancelled_open, work);
+
+        cifs_dbg(VFS, "Close unmatched open\n");
+
+        SMB2_close(0, cancelled->tcon, cancelled->fid.persistent_fid,
+                   cancelled->fid.volatile_fid);
+        cifs_put_tcon(cancelled->tcon);
+        kfree(cancelled);
+}
+
+int
+smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
+{
+        struct smb2_sync_hdr *sync_hdr = get_sync_hdr(buffer);
+        struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer;
+        struct cifs_tcon *tcon;
+        struct close_cancelled_open *cancelled;
+
+        if (sync_hdr->Command != SMB2_CREATE ||
+            sync_hdr->Status != STATUS_SUCCESS)
+                return 0;
+
+        cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
+        if (!cancelled)
+                return -ENOMEM;
+
+        tcon = smb2_find_smb_tcon(server, sync_hdr->SessionId,
+                                  sync_hdr->TreeId);
+        if (!tcon) {
+                kfree(cancelled);
+                return -ENOENT;
+        }
+
+        cancelled->fid.persistent_fid = rsp->PersistentFileId;
+        cancelled->fid.volatile_fid = rsp->VolatileFileId;
+        cancelled->tcon = tcon;
+        INIT_WORK(&cancelled->work, smb2_cancelled_close_fid);
+        queue_work(cifsiod_wq, &cancelled->work);
+
+        return 0;
+}
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 0231108d9387..152e37f2ad92 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -21,6 +21,7 @@
 #include <linux/vfs.h>
 #include <linux/falloc.h>
 #include <linux/scatterlist.h>
+#include <linux/uuid.h>
 #include <crypto/aead.h>
 #include "cifsglob.h"
 #include "smb2pdu.h"
@@ -592,8 +593,8 @@ req_res_key_exit:
         return rc;
 }
 
-static int
-smb2_clone_range(const unsigned int xid,
+static ssize_t
+smb2_copychunk_range(const unsigned int xid,
                         struct cifsFileInfo *srcfile,
                         struct cifsFileInfo *trgtfile, u64 src_off,
                         u64 len, u64 dest_off)
@@ -605,13 +606,14 @@ smb2_clone_range(const unsigned int xid,
         struct cifs_tcon *tcon;
         int chunks_copied = 0;
         bool chunk_sizes_updated = false;
+        ssize_t bytes_written, total_bytes_written = 0;
 
         pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL);
 
         if (pcchunk == NULL)
                 return -ENOMEM;
 
-        cifs_dbg(FYI, "in smb2_clone_range - about to call request res key\n");
+        cifs_dbg(FYI, "in smb2_copychunk_range - about to call request res key\n");
         /* Request a key from the server to identify the source of the copy */
         rc = SMB2_request_res_key(xid, tlink_tcon(srcfile->tlink),
                                 srcfile->fid.persistent_fid,
@@ -669,14 +671,16 @@ smb2_clone_range(const unsigned int xid,
                         }
                         chunks_copied++;
 
-                        src_off += le32_to_cpu(retbuf->TotalBytesWritten);
-                        dest_off += le32_to_cpu(retbuf->TotalBytesWritten);
-                        len -= le32_to_cpu(retbuf->TotalBytesWritten);
+                        bytes_written = le32_to_cpu(retbuf->TotalBytesWritten);
+                        src_off += bytes_written;
+                        dest_off += bytes_written;
+                        len -= bytes_written;
+                        total_bytes_written += bytes_written;
 
-                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %d\n",
+                        cifs_dbg(FYI, "Chunks %d PartialChunk %d Total %zu\n",
                                 le32_to_cpu(retbuf->ChunksWritten),
                                 le32_to_cpu(retbuf->ChunkBytesWritten),
-                                le32_to_cpu(retbuf->TotalBytesWritten));
+                                bytes_written);
                 } else if (rc == -EINVAL) {
                         if (ret_data_len != sizeof(struct copychunk_ioctl_rsp))
                                 goto cchunk_out;
@@ -713,7 +717,10 @@ smb2_clone_range(const unsigned int xid,
 cchunk_out:
         kfree(pcchunk);
         kfree(retbuf);
-        return rc;
+        if (rc)
+                return rc;
+        else
+                return total_bytes_written;
 }
 
 static int
@@ -2322,6 +2329,7 @@ struct smb_version_operations smb20_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2377,7 +2385,7 @@ struct smb_version_operations smb20_operations = {
         .set_oplock_level = smb2_set_oplock_level,
         .create_lease_buf = smb2_create_lease_buf,
         .parse_lease_buf = smb2_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .wp_retry_size = smb2_wp_retry_size,
         .dir_needs_close = smb2_dir_needs_close,
         .get_dfs_refer = smb2_get_dfs_refer,
@@ -2404,6 +2412,7 @@ struct smb_version_operations smb21_operations = {
         .clear_stats = smb2_clear_stats,
         .print_stats = smb2_print_stats,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2459,7 +2468,7 @@ struct smb_version_operations smb21_operations = {
         .set_oplock_level = smb21_set_oplock_level,
         .create_lease_buf = smb2_create_lease_buf,
         .parse_lease_buf = smb2_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .wp_retry_size = smb2_wp_retry_size,
         .dir_needs_close = smb2_dir_needs_close,
         .enum_snapshots = smb3_enum_snapshots,
@@ -2488,6 +2497,7 @@ struct smb_version_operations smb30_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2545,7 +2555,7 @@ struct smb_version_operations smb30_operations = {
         .set_oplock_level = smb3_set_oplock_level,
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .duplicate_extents = smb2_duplicate_extents,
         .validate_negotiate = smb3_validate_negotiate,
         .wp_retry_size = smb2_wp_retry_size,
@@ -2582,6 +2592,7 @@ struct smb_version_operations smb311_operations = {
         .print_stats = smb2_print_stats,
         .dump_share_caps = smb2_dump_share_caps,
         .is_oplock_break = smb2_is_valid_oplock_break,
+        .handle_cancelled_mid = smb2_handle_cancelled_mid,
         .downgrade_oplock = smb2_downgrade_oplock,
         .need_neg = smb2_need_neg,
         .negotiate = smb2_negotiate,
@@ -2639,7 +2650,7 @@ struct smb_version_operations smb311_operations = {
         .set_oplock_level = smb3_set_oplock_level,
         .create_lease_buf = smb3_create_lease_buf,
         .parse_lease_buf = smb3_parse_lease_buf,
-        .clone_range = smb2_clone_range,
+        .copychunk_range = smb2_copychunk_range,
         .duplicate_extents = smb2_duplicate_extents,
 /*      .validate_negotiate = smb3_validate_negotiate, */ /* not used in 3.11 */
         .wp_retry_size = smb2_wp_retry_size,
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 7446496850a3..02da648041fc 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -562,8 +562,10 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
          * but for time being this is our only auth choice so doesn't matter.
          * We just found a server which sets blob length to zero expecting raw.
          */
-        if (blob_length == 0)
+        if (blob_length == 0) {
                 cifs_dbg(FYI, "missing security blob on negprot\n");
+                server->sec_ntlmssp = true;
+        }
 
         rc = cifs_enable_signing(server, ses->sign);
         if (rc)
@@ -1171,9 +1173,6 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
         else
                 return -EIO;
 
-        if (tcon && tcon->bad_network_name)
-                return -ENOENT;
-
         unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
         if (unc_path == NULL)
                 return -ENOMEM;
@@ -1185,6 +1184,10 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
                 return -EINVAL;
         }
 
+        /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
+        if (tcon)
+                tcon->tid = 0;
+
         rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
         if (rc) {
                 kfree(unc_path);
@@ -1273,8 +1276,6 @@ tcon_exit:
 tcon_error_exit:
         if (rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
                 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
-                if (tcon)
-                        tcon->bad_network_name = true;
         }
         goto tcon_exit;
 }
@@ -2177,6 +2178,9 @@ void smb2_reconnect_server(struct work_struct *work)
         struct cifs_tcon *tcon, *tcon2;
         struct list_head tmp_list;
         int tcon_exist = false;
+        int rc;
+        int resched = false;
+
 
         /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
         mutex_lock(&server->reconnect_mutex);
@@ -2204,13 +2208,18 @@ void smb2_reconnect_server(struct work_struct *work)
         spin_unlock(&cifs_tcp_ses_lock);
 
         list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
-                if (!smb2_reconnect(SMB2_INTERNAL_CMD, tcon))
+                rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon);
+                if (!rc)
                         cifs_reopen_persistent_handles(tcon);
+                else
+                        resched = true;
                 list_del_init(&tcon->rlist);
                 cifs_put_tcon(tcon);
         }
 
         cifs_dbg(FYI, "Reconnecting tcons finished\n");
+        if (resched)
+                queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
         mutex_unlock(&server->reconnect_mutex);
 
         /* now we can safely release srv struct */
diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
index 69e35873b1de..6853454fc871 100644
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -48,6 +48,10 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses,
                               struct smb_rqst *rqst);
 extern struct mid_q_entry *smb2_setup_async_request(
                         struct TCP_Server_Info *server, struct smb_rqst *rqst);
+extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server,
+                                           __u64 ses_id);
+extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server,
+                                                __u64 ses_id, __u32  tid);
 extern int smb2_calc_signature(struct smb_rqst *rqst,
                                 struct TCP_Server_Info *server);
 extern int smb3_calc_signature(struct smb_rqst *rqst,
@@ -164,6 +168,9 @@ extern int SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
 extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
                              const u64 persistent_fid, const u64 volatile_fid,
                              const __u8 oplock_level);
+extern int smb2_handle_cancelled_mid(char *buffer,
+                                        struct TCP_Server_Info *server);
+void smb2_cancelled_close_fid(struct work_struct *work);
 extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
                          u64 persistent_file_id, u64 volatile_file_id,
                          struct kstatfs *FSData);
diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
index 7c3bb1bd7eed..506b67fc93d9 100644
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -115,23 +115,70 @@ smb3_crypto_shash_allocate(struct TCP_Server_Info *server)
         return 0;
 }
 
-struct cifs_ses *
-smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+static struct cifs_ses *
+smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)
 {
         struct cifs_ses *ses;
 
-        spin_lock(&cifs_tcp_ses_lock);
         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
                 if (ses->Suid != ses_id)
                         continue;
-                spin_unlock(&cifs_tcp_ses_lock);
                 return ses;
         }
+
+        return NULL;
+}
+
+struct cifs_ses *
+smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id)
+{
+        struct cifs_ses *ses;
+
+        spin_lock(&cifs_tcp_ses_lock);
+        ses = smb2_find_smb_ses_unlocked(server, ses_id);
         spin_unlock(&cifs_tcp_ses_lock);
 
+        return ses;
+}
+
+static struct cifs_tcon *
+smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32  tid)
+{
+        struct cifs_tcon *tcon;
+
+        list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
+                if (tcon->tid != tid)
+                        continue;
+                ++tcon->tc_count;
+                return tcon;
+        }
+
         return NULL;
 }
 
+/*
+ * Obtain tcon corresponding to the tid in the given
+ * cifs_ses
+ */
+
+struct cifs_tcon *
+smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32  tid)
+{
+        struct cifs_ses *ses;
+        struct cifs_tcon *tcon;
+
+        spin_lock(&cifs_tcp_ses_lock);
+        ses = smb2_find_smb_ses_unlocked(server, ses_id);
+        if (!ses) {
+                spin_unlock(&cifs_tcp_ses_lock);
+                return NULL;
+        }
+        tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
+        spin_unlock(&cifs_tcp_ses_lock);
+
+        return tcon;
+}
+
 int
 smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server)
 {
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 526f0533cb4e..f6e13a977fc8 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -752,9 +752,11 @@ cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
 
         rc = wait_for_response(ses->server, midQ);
         if (rc != 0) {
+                cifs_dbg(FYI, "Cancelling wait for mid %llu\n", midQ->mid);
                 send_cancel(ses->server, rqst, midQ);
                 spin_lock(&GlobalMid_Lock);
                 if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
+                        midQ->mid_flags |= MID_WAIT_CANCELLED;
                         midQ->callback = DeleteMidQEntry;
                         spin_unlock(&GlobalMid_Lock);
                         add_credits(ses->server, 1, optype);
diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c
index 02a7a9286449..6d6eca394d4d 100644
--- a/fs/crypto/crypto.c
+++ b/fs/crypto/crypto.c
@@ -327,7 +327,6 @@ EXPORT_SYMBOL(fscrypt_decrypt_page);
 static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
 {
         struct dentry *dir;
-        struct fscrypt_info *ci;
         int dir_has_key, cached_with_key;
 
         if (flags & LOOKUP_RCU)
@@ -339,18 +338,11 @@ static int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags)
                 return 0;
         }
 
-        ci = d_inode(dir)->i_crypt_info;
-        if (ci && ci->ci_keyring_key &&
-            (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                          (1 << KEY_FLAG_REVOKED) |
-                                          (1 << KEY_FLAG_DEAD))))
-                ci = NULL;
-
         /* this should eventually be an flag in d_flags */
         spin_lock(&dentry->d_lock);
         cached_with_key = dentry->d_flags & DCACHE_ENCRYPTED_WITH_KEY;
         spin_unlock(&dentry->d_lock);
-        dir_has_key = (ci != NULL);
+        dir_has_key = (d_inode(dir)->i_crypt_info != NULL);
         dput(dir);
 
         /*
diff --git a/fs/crypto/fname.c b/fs/crypto/fname.c
index 13052b85c393..37b49894c762 100644
--- a/fs/crypto/fname.c
+++ b/fs/crypto/fname.c
@@ -350,7 +350,7 @@ int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
                 fname->disk_name.len = iname->len;
                 return 0;
         }
-        ret = fscrypt_get_crypt_info(dir);
+        ret = fscrypt_get_encryption_info(dir);
         if (ret && ret != -EOPNOTSUPP)
                 return ret;
 
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index fdbb8af32eaf..e39696e64494 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -67,7 +67,6 @@ struct fscrypt_info {
         u8 ci_filename_mode;
         u8 ci_flags;
         struct crypto_skcipher *ci_ctfm;
-        struct key *ci_keyring_key;
         u8 ci_master_key[FS_KEY_DESCRIPTOR_SIZE];
 };
 
@@ -101,7 +100,4 @@ extern int fscrypt_do_page_crypto(const struct inode *inode,
 extern struct page *fscrypt_alloc_bounce_page(struct fscrypt_ctx *ctx,
                                               gfp_t gfp_flags);
 
-/* keyinfo.c */
-extern int fscrypt_get_crypt_info(struct inode *);
-
 #endif /* _FSCRYPT_PRIVATE_H */
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index d5d896fa5a71..8cdfddce2b34 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -95,6 +95,7 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
         kfree(description);
         if (IS_ERR(keyring_key))
                 return PTR_ERR(keyring_key);
+        down_read(&keyring_key->sem);
 
         if (keyring_key->type != &key_type_logon) {
                 printk_once(KERN_WARNING
@@ -102,11 +103,9 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                 res = -ENOKEY;
                 goto out;
         }
-        down_read(&keyring_key->sem);
         ukp = user_key_payload_locked(keyring_key);
         if (ukp->datalen != sizeof(struct fscrypt_key)) {
                 res = -EINVAL;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         master_key = (struct fscrypt_key *)ukp->data;
@@ -117,17 +116,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
                                 "%s: key size incorrect: %d\n",
                                 __func__, master_key->size);
                 res = -ENOKEY;
-                up_read(&keyring_key->sem);
                 goto out;
         }
         res = derive_key_aes(ctx->nonce, master_key->raw, raw_key);
-        up_read(&keyring_key->sem);
-        if (res)
-                goto out;
-
-        crypt_info->ci_keyring_key = keyring_key;
-        return 0;
 out:
+        up_read(&keyring_key->sem);
         key_put(keyring_key);
         return res;
 }
@@ -169,12 +162,11 @@ static void put_crypt_info(struct fscrypt_info *ci)
         if (!ci)
                 return;
 
-        key_put(ci->ci_keyring_key);
         crypto_free_skcipher(ci->ci_ctfm);
         kmem_cache_free(fscrypt_info_cachep, ci);
 }
 
-int fscrypt_get_crypt_info(struct inode *inode)
+int fscrypt_get_encryption_info(struct inode *inode)
 {
         struct fscrypt_info *crypt_info;
         struct fscrypt_context ctx;
@@ -184,21 +176,15 @@ int fscrypt_get_crypt_info(struct inode *inode)
         u8 *raw_key = NULL;
         int res;
 
+        if (inode->i_crypt_info)
+                return 0;
+
         res = fscrypt_initialize(inode->i_sb->s_cop->flags);
         if (res)
                 return res;
 
         if (!inode->i_sb->s_cop->get_context)
                 return -EOPNOTSUPP;
-retry:
-        crypt_info = ACCESS_ONCE(inode->i_crypt_info);
-        if (crypt_info) {
-                if (!crypt_info->ci_keyring_key ||
-                                key_validate(crypt_info->ci_keyring_key) == 0)
-                        return 0;
-                fscrypt_put_encryption_info(inode, crypt_info);
-                goto retry;
-        }
 
         res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
         if (res < 0) {
@@ -229,7 +215,6 @@ retry:
         crypt_info->ci_data_mode = ctx.contents_encryption_mode;
         crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
         crypt_info->ci_ctfm = NULL;
-        crypt_info->ci_keyring_key = NULL;
         memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
                                 sizeof(crypt_info->ci_master_key));
 
@@ -273,14 +258,8 @@ retry:
         if (res)
                 goto out;
 
-        kzfree(raw_key);
-        raw_key = NULL;
-        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) != NULL) {
-                put_crypt_info(crypt_info);
-                goto retry;
-        }
-        return 0;
-
+        if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL)
+                crypt_info = NULL;
 out:
         if (res == -ENOKEY)
                 res = 0;
@@ -288,6 +267,7 @@ out:
         kzfree(raw_key);
         return res;
 }
+EXPORT_SYMBOL(fscrypt_get_encryption_info);
 
 void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
 {
@@ -305,17 +285,3 @@ void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
         put_crypt_info(ci);
 }
 EXPORT_SYMBOL(fscrypt_put_encryption_info);
-
-int fscrypt_get_encryption_info(struct inode *inode)
-{
-        struct fscrypt_info *ci = inode->i_crypt_info;
-
-        if (!ci ||
-                (ci->ci_keyring_key &&
-                 (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
-                                               (1 << KEY_FLAG_REVOKED) |
-                                               (1 << KEY_FLAG_DEAD)))))
-                return fscrypt_get_crypt_info(inode);
-        return 0;
-}
-EXPORT_SYMBOL(fscrypt_get_encryption_info);
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 14b76da71269..4908906d54d5 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -33,17 +33,10 @@ static int create_encryption_context_from_policy(struct inode *inode,
                                 const struct fscrypt_policy *policy)
 {
         struct fscrypt_context ctx;
-        int res;
 
         if (!inode->i_sb->s_cop->set_context)
                 return -EOPNOTSUPP;
 
-        if (inode->i_sb->s_cop->prepare_context) {
-                res = inode->i_sb->s_cop->prepare_context(inode);
-                if (res)
-                        return res;
-        }
-
         ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1;
         memcpy(ctx.master_key_descriptor, policy->master_key_descriptor,
                                         FS_KEY_DESCRIPTOR_SIZE);
diff --git a/fs/dax.c b/fs/dax.c
index de622d4282a6..85abd741253d 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -373,6 +373,22 @@ restart:
                 }
                 spin_lock_irq(&mapping->tree_lock);
 
+                if (!entry) {
+                        /*
+                         * We needed to drop the page_tree lock while calling
+                         * radix_tree_preload() and we didn't have an entry to
+                         * lock.  See if another thread inserted an entry at
+                         * our index during this time.
+                         */
+                        entry = __radix_tree_lookup(&mapping->page_tree, index,
+                                        NULL, &slot);
+                        if (entry) {
+                                radix_tree_preload_end();
+                                spin_unlock_irq(&mapping->tree_lock);
+                                goto restart;
+                        }
+                }
+
                 if (pmd_downgrade) {
                         radix_tree_delete(&mapping->page_tree, index);
                         mapping->nrexceptional--;
@@ -388,19 +404,12 @@ restart:
                 if (err) {
                         spin_unlock_irq(&mapping->tree_lock);
                         /*
-                         * Someone already created the entry?  This is a
-                         * normal failure when inserting PMDs in a range
-                         * that already contains PTEs.  In that case we want
-                         * to return -EEXIST immediately.
-                         */
-                        if (err == -EEXIST && !(size_flag & RADIX_DAX_PMD))
-                                goto restart;
-                        /*
-                         * Our insertion of a DAX PMD entry failed, most
-                         * likely because it collided with a PTE sized entry
-                         * at a different index in the PMD range.  We haven't
-                         * inserted anything into the radix tree and have no
-                         * waiters to wake.
+                         * Our insertion of a DAX entry failed, most likely
+                         * because we were inserting a PMD entry and it
+                         * collided with a PTE sized entry at a different
+                         * index in the PMD range.  We haven't inserted
+                         * anything into the radix tree and have no waiters to
+                         * wake.
                          */
                         return ERR_PTR(err);
                 }
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 7d398d300e97..9382db998ec9 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -743,7 +743,7 @@ static int tcp_accept_from_sock(struct connection *con)
         newsock->type = con->sock->type;
         newsock->ops = con->sock->ops;
 
-        result = con->sock->ops->accept(con->sock, newsock, O_NONBLOCK);
+        result = con->sock->ops->accept(con->sock, newsock, O_NONBLOCK, true);
         if (result < 0)
                 goto accept_err;
 
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index f493af666591..fb69ee2388db 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2466,6 +2466,7 @@ extern int  ext4_setattr(struct dentry *, struct iattr *);
 extern int  ext4_getattr(const struct path *, struct kstat *, u32, unsigned int);
 extern void ext4_evict_inode(struct inode *);
 extern void ext4_clear_inode(struct inode *);
+extern int  ext4_file_getattr(const struct path *, struct kstat *, u32, unsigned int);
 extern int  ext4_sync_inode(handle_t *, struct inode *);
 extern void ext4_dirty_inode(struct inode *, int);
 extern int ext4_change_inode_journal_flag(struct inode *, int);
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 8210c1f43556..cefa9835f275 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -744,7 +744,7 @@ const struct file_operations ext4_file_operations = {
 
 const struct inode_operations ext4_file_inode_operations = {
         .setattr        = ext4_setattr,
-        .getattr        = ext4_getattr,
+        .getattr        = ext4_file_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 30a9f210d1e3..375fb1c05d49 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1169,10 +1169,9 @@ static int ext4_finish_convert_inline_dir(handle_t *handle,
         set_buffer_uptodate(dir_block);
         err = ext4_handle_dirty_dirent_node(handle, inode, dir_block);
         if (err)
-                goto out;
+                return err;
         set_buffer_verified(dir_block);
-out:
-        return err;
+        return ext4_mark_inode_dirty(handle, inode);
 }
 
 static int ext4_convert_inline_data_nolock(handle_t *handle,
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7385e6a6b6cb..b9ffa9f4191f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5390,17 +5390,52 @@ err_out:
 int ext4_getattr(const struct path *path, struct kstat *stat,
                  u32 request_mask, unsigned int query_flags)
 {
-        struct inode *inode;
-        unsigned long long delalloc_blocks;
+        struct inode *inode = d_inode(path->dentry);
+        struct ext4_inode *raw_inode;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned int flags;
+
+        if (EXT4_FITS_IN_INODE(raw_inode, ei, i_crtime)) {
+                stat->result_mask |= STATX_BTIME;
+                stat->btime.tv_sec = ei->i_crtime.tv_sec;
+                stat->btime.tv_nsec = ei->i_crtime.tv_nsec;
+        }
+
+        flags = ei->i_flags & EXT4_FL_USER_VISIBLE;
+        if (flags & EXT4_APPEND_FL)
+                stat->attributes |= STATX_ATTR_APPEND;
+        if (flags & EXT4_COMPR_FL)
+                stat->attributes |= STATX_ATTR_COMPRESSED;
+        if (flags & EXT4_ENCRYPT_FL)
+                stat->attributes |= STATX_ATTR_ENCRYPTED;
+        if (flags & EXT4_IMMUTABLE_FL)
+                stat->attributes |= STATX_ATTR_IMMUTABLE;
+        if (flags & EXT4_NODUMP_FL)
+                stat->attributes |= STATX_ATTR_NODUMP;
+
+        stat->attributes_mask |= (STATX_ATTR_APPEND |
+                                  STATX_ATTR_COMPRESSED |
+                                  STATX_ATTR_ENCRYPTED |
+                                  STATX_ATTR_IMMUTABLE |
+                                  STATX_ATTR_NODUMP);
 
-        inode = d_inode(path->dentry);
         generic_fillattr(inode, stat);
+        return 0;
+}
+
+int ext4_file_getattr(const struct path *path, struct kstat *stat,
+                      u32 request_mask, unsigned int query_flags)
+{
+        struct inode *inode = d_inode(path->dentry);
+        u64 delalloc_blocks;
+
+        ext4_getattr(path, stat, request_mask, query_flags);
 
         /*
          * If there is inline data in the inode, the inode will normally not
          * have data blocks allocated (it may have an external xattr block).
          * Report at least one sector for such files, so tools like tar, rsync,
-         * others doen't incorrectly think the file is completely sparse.
+         * others don't incorrectly think the file is completely sparse.
          */
         if (unlikely(ext4_has_inline_data(inode)))
                 stat->blocks += (stat->size + 511) >> 9;
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 578f8c33fb44..c992ef2c2f94 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -511,7 +511,7 @@ mext_check_arguments(struct inode *orig_inode,
         if ((orig_start & ~(PAGE_MASK >> orig_inode->i_blkbits)) !=
             (donor_start & ~(PAGE_MASK >> orig_inode->i_blkbits))) {
                 ext4_debug("ext4 move extent: orig and donor's start "
-                        "offset are not alligned [ino:orig %lu, donor %lu]\n",
+                        "offsets are not aligned [ino:orig %lu, donor %lu]\n",
                         orig_inode->i_ino, donor_inode->i_ino);
                 return -EINVAL;
         }
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 6ad612c576fc..07e5e1405771 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3912,6 +3912,7 @@ const struct inode_operations ext4_dir_inode_operations = {
         .tmpfile        = ext4_tmpfile,
         .rename         = ext4_rename2,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
@@ -3920,6 +3921,7 @@ const struct inode_operations ext4_dir_inode_operations = {
 
 const struct inode_operations ext4_special_inode_operations = {
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
         .get_acl        = ext4_get_acl,
         .set_acl        = ext4_set_acl,
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 2e03a0a88d92..a9448db1cf7e 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1120,17 +1120,16 @@ static int ext4_get_context(struct inode *inode, void *ctx, size_t len)
                                  EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, ctx, len);
 }
 
-static int ext4_prepare_context(struct inode *inode)
-{
-        return ext4_convert_inline_data(inode);
-}
-
 static int ext4_set_context(struct inode *inode, const void *ctx, size_t len,
                                                         void *fs_data)
 {
         handle_t *handle = fs_data;
         int res, res2, retries = 0;
 
+        res = ext4_convert_inline_data(inode);
+        if (res)
+                return res;
+
         /*
          * If a journal handle was specified, then the encryption context is
          * being set on a new inode via inheritance and is part of a larger
@@ -1196,7 +1195,6 @@ static unsigned ext4_max_namelen(struct inode *inode)
 static const struct fscrypt_operations ext4_cryptops = {
         .key_prefix             = "ext4:",
         .get_context            = ext4_get_context,
-        .prepare_context        = ext4_prepare_context,
         .set_context            = ext4_set_context,
         .dummy_context          = ext4_dummy_context,
         .is_encrypted           = ext4_encrypted_inode,
diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
index 73b184d161fc..5c8fc53cb0e5 100644
--- a/fs/ext4/symlink.c
+++ b/fs/ext4/symlink.c
@@ -85,17 +85,20 @@ errout:
 const struct inode_operations ext4_encrypted_symlink_inode_operations = {
         .get_link       = ext4_encrypted_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
 
 const struct inode_operations ext4_symlink_inode_operations = {
         .get_link       = page_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
 
 const struct inode_operations ext4_fast_symlink_inode_operations = {
         .get_link       = simple_get_link,
         .setattr        = ext4_setattr,
+        .getattr        = ext4_getattr,
         .listxattr      = ext4_listxattr,
 };
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 67636acf7624..996e7900d4c8 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -131,31 +131,26 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
 }
 
 static int ext4_xattr_block_csum_verify(struct inode *inode,
-                                        sector_t block_nr,
-                                        struct ext4_xattr_header *hdr)
+                                        struct buffer_head *bh)
 {
-        if (ext4_has_metadata_csum(inode->i_sb) &&
-            (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr)))
-                return 0;
-        return 1;
-}
-
-static void ext4_xattr_block_csum_set(struct inode *inode,
-                                      sector_t block_nr,
-                                      struct ext4_xattr_header *hdr)
-{
-        if (!ext4_has_metadata_csum(inode->i_sb))
-                return;
+        struct ext4_xattr_header *hdr = BHDR(bh);
+        int ret = 1;
 
-        hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr);
+        if (ext4_has_metadata_csum(inode->i_sb)) {
+                lock_buffer(bh);
+                ret = (hdr->h_checksum == ext4_xattr_block_csum(inode,
+                                                        bh->b_blocknr, hdr));
+                unlock_buffer(bh);
+        }
+        return ret;
 }
 
-static inline int ext4_handle_dirty_xattr_block(handle_t *handle,
-                                                struct inode *inode,
-                                                struct buffer_head *bh)
+static void ext4_xattr_block_csum_set(struct inode *inode,
+                                      struct buffer_head *bh)
 {
-        ext4_xattr_block_csum_set(inode, bh->b_blocknr, BHDR(bh));
-        return ext4_handle_dirty_metadata(handle, inode, bh);
+        if (ext4_has_metadata_csum(inode->i_sb))
+                BHDR(bh)->h_checksum = ext4_xattr_block_csum(inode,
+                                                bh->b_blocknr, BHDR(bh));
 }
 
 static inline const struct xattr_handler *
@@ -233,7 +228,7 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh)
         if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
             BHDR(bh)->h_blocks != cpu_to_le32(1))
                 return -EFSCORRUPTED;
-        if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh)))
+        if (!ext4_xattr_block_csum_verify(inode, bh))
                 return -EFSBADCRC;
         error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size,
                                        bh->b_data);
@@ -618,23 +613,22 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
                         }
                 }
 
+                ext4_xattr_block_csum_set(inode, bh);
                 /*
                  * Beware of this ugliness: Releasing of xattr block references
                  * from different inodes can race and so we have to protect
                  * from a race where someone else frees the block (and releases
                  * its journal_head) before we are done dirtying the buffer. In
                  * nojournal mode this race is harmless and we actually cannot
-                 * call ext4_handle_dirty_xattr_block() with locked buffer as
+                 * call ext4_handle_dirty_metadata() with locked buffer as
                  * that function can call sync_dirty_buffer() so for that case
                  * we handle the dirtying after unlocking the buffer.
                  */
                 if (ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 unlock_buffer(bh);
                 if (!ext4_handle_valid(handle))
-                        error = ext4_handle_dirty_xattr_block(handle, inode,
-                                                              bh);
+                        error = ext4_handle_dirty_metadata(handle, inode, bh);
                 if (IS_SYNC(inode))
                         ext4_handle_sync(handle);
                 dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1));
@@ -863,13 +857,14 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
                                 ext4_xattr_cache_insert(ext4_mb_cache,
                                         bs->bh);
                         }
+                        ext4_xattr_block_csum_set(inode, bs->bh);
                         unlock_buffer(bs->bh);
                         if (error == -EFSCORRUPTED)
                                 goto bad_block;
                         if (!error)
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      bs->bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   bs->bh);
                         if (error)
                                 goto cleanup;
                         goto inserted;
@@ -967,10 +962,11 @@ inserted:
                                         ce->e_reusable = 0;
                                 ea_bdebug(new_bh, "reusing; refcount now=%d",
                                           ref);
+                                ext4_xattr_block_csum_set(inode, new_bh);
                                 unlock_buffer(new_bh);
-                                error = ext4_handle_dirty_xattr_block(handle,
-                                                                      inode,
-                                                                      new_bh);
+                                error = ext4_handle_dirty_metadata(handle,
+                                                                   inode,
+                                                                   new_bh);
                                 if (error)
                                         goto cleanup_dquot;
                         }
@@ -1020,11 +1016,12 @@ getblk_failed:
                                 goto getblk_failed;
                         }
                         memcpy(new_bh->b_data, s->base, new_bh->b_size);
+                        ext4_xattr_block_csum_set(inode, new_bh);
                         set_buffer_uptodate(new_bh);
                         unlock_buffer(new_bh);
                         ext4_xattr_cache_insert(ext4_mb_cache, new_bh);
-                        error = ext4_handle_dirty_xattr_block(handle,
-                                                              inode, new_bh);
+                        error = ext4_handle_dirty_metadata(handle, inode,
+                                                           new_bh);
                         if (error)
                                 goto cleanup;
                 }
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index a77df377e2e8..ee2d0a485fc3 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -196,6 +196,7 @@ static void update_mem_info(struct f2fs_sb_info *sbi)
         si->base_mem += (NM_I(sbi)->nat_bits_blocks << F2FS_BLKSIZE_BITS);
         si->base_mem += NM_I(sbi)->nat_blocks * NAT_ENTRY_BITMAP_SIZE;
         si->base_mem += NM_I(sbi)->nat_blocks / 8;
+        si->base_mem += NM_I(sbi)->nat_blocks * sizeof(unsigned short);
 
 get_cache:
         si->cache_mem = 0;
diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 4650c9b85de7..8d5c62b07b28 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -750,7 +750,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
         dentry_blk = page_address(page);
         bit_pos = dentry - dentry_blk->dentry;
         for (i = 0; i < slots; i++)
-                clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
+                __clear_bit_le(bit_pos + i, &dentry_blk->dentry_bitmap);
 
         /* Let's check and deallocate this dentry page */
         bit_pos = find_next_bit_le(&dentry_blk->dentry_bitmap,
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index e849f83d6114..0a6e115562f6 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -561,6 +561,8 @@ struct f2fs_nm_info {
         struct mutex build_lock;        /* lock for build free nids */
         unsigned char (*free_nid_bitmap)[NAT_ENTRY_BITMAP_SIZE];
         unsigned char *nat_block_bitmap;
+        unsigned short *free_nid_count; /* free nid count of NAT block */
+        spinlock_t free_nid_lock;       /* protect updating of nid count */
 
         /* for checkpoint */
         char *nat_bitmap;               /* NAT bitmap pointer */
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index 94967171dee8..481aa8dc79f4 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -338,9 +338,6 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
                 set_nat_flag(e, IS_CHECKPOINTED, false);
         __set_nat_cache_dirty(nm_i, e);
 
-        if (enabled_nat_bits(sbi, NULL) && new_blkaddr == NEW_ADDR)
-                clear_bit_le(NAT_BLOCK_OFFSET(ni->nid), nm_i->empty_nat_bits);
-
         /* update fsync_mark if its inode nat entry is still alive */
         if (ni->nid != ni->ino)
                 e = __lookup_nat_cache(nm_i, ni->ino);
@@ -1823,7 +1820,8 @@ static void remove_free_nid(struct f2fs_sb_info *sbi, nid_t nid)
                 kmem_cache_free(free_nid_slab, i);
 }
 
-void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
+static void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid,
+                        bool set, bool build, bool locked)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(nid);
@@ -1833,9 +1831,18 @@ void update_free_nid_bitmap(struct f2fs_sb_info *sbi, nid_t nid, bool set)
                 return;
 
         if (set)
-                set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __set_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
         else
-                clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+                __clear_bit_le(nid_ofs, nm_i->free_nid_bitmap[nat_ofs]);
+
+        if (!locked)
+                spin_lock(&nm_i->free_nid_lock);
+        if (set)
+                nm_i->free_nid_count[nat_ofs]++;
+        else if (!build)
+                nm_i->free_nid_count[nat_ofs]--;
+        if (!locked)
+                spin_unlock(&nm_i->free_nid_lock);
 }
 
 static void scan_nat_page(struct f2fs_sb_info *sbi,
@@ -1847,7 +1854,10 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
         unsigned int nat_ofs = NAT_BLOCK_OFFSET(start_nid);
         int i;
 
-        set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
+        if (test_bit_le(nat_ofs, nm_i->nat_block_bitmap))
+                return;
+
+        __set_bit_le(nat_ofs, nm_i->nat_block_bitmap);
 
         i = start_nid % NAT_ENTRY_PER_BLOCK;
 
@@ -1861,7 +1871,7 @@ static void scan_nat_page(struct f2fs_sb_info *sbi,
                 f2fs_bug_on(sbi, blk_addr == NEW_ADDR);
                 if (blk_addr == NULL_ADDR)
                         freed = add_free_nid(sbi, start_nid, true);
-                update_free_nid_bitmap(sbi, start_nid, freed);
+                update_free_nid_bitmap(sbi, start_nid, freed, true, false);
         }
 }
 
@@ -1877,6 +1887,8 @@ static void scan_free_nid_bits(struct f2fs_sb_info *sbi)
         for (i = 0; i < nm_i->nat_blocks; i++) {
                 if (!test_bit_le(i, nm_i->nat_block_bitmap))
                         continue;
+                if (!nm_i->free_nid_count[i])
+                        continue;
                 for (idx = 0; idx < NAT_ENTRY_PER_BLOCK; idx++) {
                         nid_t nid;
 
@@ -1907,58 +1919,6 @@ out:
         up_read(&nm_i->nat_tree_lock);
 }
 
-static int scan_nat_bits(struct f2fs_sb_info *sbi)
-{
-        struct f2fs_nm_info *nm_i = NM_I(sbi);
-        struct page *page;
-        unsigned int i = 0;
-        nid_t nid;
-
-        if (!enabled_nat_bits(sbi, NULL))
-                return -EAGAIN;
-
-        down_read(&nm_i->nat_tree_lock);
-check_empty:
-        i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                i = 0;
-                goto check_partial;
-        }
-
-        for (nid = i * NAT_ENTRY_PER_BLOCK; nid < (i + 1) * NAT_ENTRY_PER_BLOCK;
-                                                                        nid++) {
-                if (unlikely(nid >= nm_i->max_nid))
-                        break;
-                add_free_nid(sbi, nid, true);
-        }
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] >= MAX_FREE_NIDS)
-                goto out;
-        i++;
-        goto check_empty;
-
-check_partial:
-        i = find_next_zero_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
-        if (i >= nm_i->nat_blocks) {
-                disable_nat_bits(sbi, true);
-                up_read(&nm_i->nat_tree_lock);
-                return -EINVAL;
-        }
-
-        nid = i * NAT_ENTRY_PER_BLOCK;
-        page = get_current_nat_page(sbi, nid);
-        scan_nat_page(sbi, page, nid);
-        f2fs_put_page(page, 1);
-
-        if (nm_i->nid_cnt[FREE_NID_LIST] < MAX_FREE_NIDS) {
-                i++;
-                goto check_partial;
-        }
-out:
-        up_read(&nm_i->nat_tree_lock);
-        return 0;
-}
-
 static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -1980,21 +1940,6 @@ static void __build_free_nids(struct f2fs_sb_info *sbi, bool sync, bool mount)
 
                 if (nm_i->nid_cnt[FREE_NID_LIST])
                         return;
-
-                /* try to find free nids with nat_bits */
-                if (!scan_nat_bits(sbi) && nm_i->nid_cnt[FREE_NID_LIST])
-                        return;
-        }
-
-        /* find next valid candidate */
-        if (enabled_nat_bits(sbi, NULL)) {
-                int idx = find_next_zero_bit_le(nm_i->full_nat_bits,
-                                        nm_i->nat_blocks, 0);
-
-                if (idx >= nm_i->nat_blocks)
-                        set_sbi_flag(sbi, SBI_NEED_FSCK);
-                else
-                        nid = idx * NAT_ENTRY_PER_BLOCK;
         }
 
         /* readahead nat pages to be scanned */
@@ -2081,7 +2026,7 @@ retry:
                 __insert_nid_to_list(sbi, i, ALLOC_NID_LIST, false);
                 nm_i->available_nids--;
 
-                update_free_nid_bitmap(sbi, *nid, false);
+                update_free_nid_bitmap(sbi, *nid, false, false, false);
 
                 spin_unlock(&nm_i->nid_list_lock);
                 return true;
@@ -2137,7 +2082,7 @@ void alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid)
 
         nm_i->available_nids++;
 
-        update_free_nid_bitmap(sbi, nid, true);
+        update_free_nid_bitmap(sbi, nid, true, false, false);
 
         spin_unlock(&nm_i->nid_list_lock);
 
@@ -2383,7 +2328,7 @@ add_out:
         list_add_tail(&nes->set_list, head);
 }
 
-void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
+static void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                                                 struct page *page)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -2402,16 +2347,16 @@ void __update_nat_bits(struct f2fs_sb_info *sbi, nid_t start_nid,
                         valid++;
         }
         if (valid == 0) {
-                set_bit_le(nat_index, nm_i->empty_nat_bits);
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->empty_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
                 return;
         }
 
-        clear_bit_le(nat_index, nm_i->empty_nat_bits);
+        __clear_bit_le(nat_index, nm_i->empty_nat_bits);
         if (valid == NAT_ENTRY_PER_BLOCK)
-                set_bit_le(nat_index, nm_i->full_nat_bits);
+                __set_bit_le(nat_index, nm_i->full_nat_bits);
         else
-                clear_bit_le(nat_index, nm_i->full_nat_bits);
+                __clear_bit_le(nat_index, nm_i->full_nat_bits);
 }
 
 static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
@@ -2467,11 +2412,11 @@ static void __flush_nat_entry_set(struct f2fs_sb_info *sbi,
                         add_free_nid(sbi, nid, false);
                         spin_lock(&NM_I(sbi)->nid_list_lock);
                         NM_I(sbi)->available_nids++;
-                        update_free_nid_bitmap(sbi, nid, true);
+                        update_free_nid_bitmap(sbi, nid, true, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 } else {
                         spin_lock(&NM_I(sbi)->nid_list_lock);
-                        update_free_nid_bitmap(sbi, nid, false);
+                        update_free_nid_bitmap(sbi, nid, false, false, false);
                         spin_unlock(&NM_I(sbi)->nid_list_lock);
                 }
         }
@@ -2577,6 +2522,40 @@ static int __get_nat_bitmaps(struct f2fs_sb_info *sbi)
         return 0;
 }
 
+inline void load_free_nid_bitmap(struct f2fs_sb_info *sbi)
+{
+        struct f2fs_nm_info *nm_i = NM_I(sbi);
+        unsigned int i = 0;
+        nid_t nid, last_nid;
+
+        if (!enabled_nat_bits(sbi, NULL))
+                return;
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->empty_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+
+                nid = i * NAT_ENTRY_PER_BLOCK;
+                last_nid = (i + 1) * NAT_ENTRY_PER_BLOCK;
+
+                spin_lock(&nm_i->free_nid_lock);
+                for (; nid < last_nid; nid++)
+                        update_free_nid_bitmap(sbi, nid, true, true, true);
+                spin_unlock(&nm_i->free_nid_lock);
+        }
+
+        for (i = 0; i < nm_i->nat_blocks; i++) {
+                i = find_next_bit_le(nm_i->full_nat_bits, nm_i->nat_blocks, i);
+                if (i >= nm_i->nat_blocks)
+                        break;
+
+                __set_bit_le(i, nm_i->nat_block_bitmap);
+        }
+}
+
 static int init_node_manager(struct f2fs_sb_info *sbi)
 {
         struct f2fs_super_block *sb_raw = F2FS_RAW_SUPER(sbi);
@@ -2638,7 +2617,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
         return 0;
 }
 
-int init_free_nid_cache(struct f2fs_sb_info *sbi)
+static int init_free_nid_cache(struct f2fs_sb_info *sbi)
 {
         struct f2fs_nm_info *nm_i = NM_I(sbi);
 
@@ -2651,6 +2630,14 @@ int init_free_nid_cache(struct f2fs_sb_info *sbi)
                                                                 GFP_KERNEL);
         if (!nm_i->nat_block_bitmap)
                 return -ENOMEM;
+
+        nm_i->free_nid_count = f2fs_kvzalloc(nm_i->nat_blocks *
+                                        sizeof(unsigned short), GFP_KERNEL);
+        if (!nm_i->free_nid_count)
+                return -ENOMEM;
+
+        spin_lock_init(&nm_i->free_nid_lock);
+
         return 0;
 }
 
@@ -2670,6 +2657,9 @@ int build_node_manager(struct f2fs_sb_info *sbi)
         if (err)
                 return err;
 
+        /* load free nid status from nat_bits table */
+        load_free_nid_bitmap(sbi);
+
         build_free_nids(sbi, true, true);
         return 0;
 }
@@ -2730,6 +2720,7 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
 
         kvfree(nm_i->nat_block_bitmap);
         kvfree(nm_i->free_nid_bitmap);
+        kvfree(nm_i->free_nid_count);
 
         kfree(nm_i->nat_bitmap);
         kfree(nm_i->nat_bits);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 4bd7a8b19332..29ef7088c558 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1163,6 +1163,12 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
                 if (f2fs_discard_en(sbi) &&
                         !f2fs_test_and_set_bit(offset, se->discard_map))
                         sbi->discard_blks--;
+
+                /* don't overwrite by SSR to keep node chain */
+                if (se->type == CURSEG_WARM_NODE) {
+                        if (!f2fs_test_and_set_bit(offset, se->ckpt_valid_map))
+                                se->ckpt_valid_blocks++;
+                }
         } else {
                 if (!f2fs_test_and_clear_bit(offset, se->cur_valid_map)) {
 #ifdef CONFIG_F2FS_CHECK_FS
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 338d2f73eb29..a2c05f2ada6d 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1359,6 +1359,16 @@ out:
         return 0;
 }
 
+static void fat_dummy_inode_init(struct inode *inode)
+{
+        /* Initialize this dummy inode to work as no-op. */
+        MSDOS_I(inode)->mmu_private = 0;
+        MSDOS_I(inode)->i_start = 0;
+        MSDOS_I(inode)->i_logstart = 0;
+        MSDOS_I(inode)->i_attrs = 0;
+        MSDOS_I(inode)->i_pos = 0;
+}
+
 static int fat_read_root(struct inode *inode)
 {
         struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
@@ -1803,12 +1813,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
         fat_inode = new_inode(sb);
         if (!fat_inode)
                 goto out_fail;
-        MSDOS_I(fat_inode)->i_pos = 0;
+        fat_dummy_inode_init(fat_inode);
         sbi->fat_inode = fat_inode;
 
         fsinfo_inode = new_inode(sb);
         if (!fsinfo_inode)
                 goto out_fail;
+        fat_dummy_inode_init(fsinfo_inode);
         fsinfo_inode->i_ino = MSDOS_FSINFO_INO;
         sbi->fsinfo_inode = fsinfo_inode;
         insert_inode_hash(fsinfo_inode);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index ef600591d96f..63ee2940775c 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -173,19 +173,33 @@ static void wb_wakeup(struct bdi_writeback *wb)
         spin_unlock_bh(&wb->work_lock);
 }
 
+static void finish_writeback_work(struct bdi_writeback *wb,
+                                  struct wb_writeback_work *work)
+{
+        struct wb_completion *done = work->done;
+
+        if (work->auto_free)
+                kfree(work);
+        if (done && atomic_dec_and_test(&done->cnt))
+                wake_up_all(&wb->bdi->wb_waitq);
+}
+
 static void wb_queue_work(struct bdi_writeback *wb,
                           struct wb_writeback_work *work)
 {
         trace_writeback_queue(wb, work);
 
-        spin_lock_bh(&wb->work_lock);
-        if (!test_bit(WB_registered, &wb->state))
-                goto out_unlock;
         if (work->done)
                 atomic_inc(&work->done->cnt);
-        list_add_tail(&work->list, &wb->work_list);
-        mod_delayed_work(bdi_wq, &wb->dwork, 0);
-out_unlock:
+
+        spin_lock_bh(&wb->work_lock);
+
+        if (test_bit(WB_registered, &wb->state)) {
+                list_add_tail(&work->list, &wb->work_list);
+                mod_delayed_work(bdi_wq, &wb->dwork, 0);
+        } else
+                finish_writeback_work(wb, work);
+
         spin_unlock_bh(&wb->work_lock);
 }
 
@@ -1873,16 +1887,9 @@ static long wb_do_writeback(struct bdi_writeback *wb)
 
         set_bit(WB_writeback_running, &wb->state);
         while ((work = get_next_work_item(wb)) != NULL) {
-                struct wb_completion *done = work->done;
-
                 trace_writeback_exec(wb, work);
-
                 wrote += wb_writeback(wb, work);
-
-                if (work->auto_free)
-                        kfree(work);
-                if (done && atomic_dec_and_test(&done->cnt))
-                        wake_up_all(&wb->bdi->wb_waitq);
+                finish_writeback_work(wb, work);
         }
 
         /*
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index c45084ac642d..511e1ed7e2de 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -207,7 +207,7 @@ struct lm_lockname {
         struct gfs2_sbd *ln_sbd;
         u64 ln_number;
         unsigned int ln_type;
-};
+} __packed __aligned(sizeof(int));
 
 #define lm_name_equal(name1, name2) \
         (((name1)->ln_number == (name2)->ln_number) &&  \
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 8f96461236f6..dde861387a40 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -136,17 +136,26 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
         vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
         vma->vm_ops = &hugetlb_vm_ops;
 
+        /*
+         * Offset passed to mmap (before page shift) could have been
+         * negative when represented as a (l)off_t.
+         */
+        if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0)
+                return -EINVAL;
+
         if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
                 return -EINVAL;
 
         vma_len = (loff_t)(vma->vm_end - vma->vm_start);
+        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+        /* check for overflow */
+        if (len < vma_len)
+                return -EINVAL;
 
         inode_lock(inode);
         file_accessed(file);
 
         ret = -ENOMEM;
-        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-
         if (hugetlb_reserve_pages(inode,
                                 vma->vm_pgoff >> huge_page_order(h),
                                 len >> huge_page_shift(h), vma,
@@ -155,7 +164,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 
         ret = 0;
         if (vma->vm_flags & VM_WRITE && inode->i_size < len)
-                inode->i_size = len;
+                i_size_write(inode, len);
 out:
         inode_unlock(inode);
 
@@ -695,14 +704,11 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode->i_mode = S_IFDIR | config->mode;
                 inode->i_uid = config->uid;
                 inode->i_gid = config->gid;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
-                info = HUGETLBFS_I(inode);
-                mpol_shared_policy_init(&info->policy, NULL);
                 inode->i_op = &hugetlbfs_dir_inode_operations;
                 inode->i_fop = &simple_dir_operations;
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
@@ -733,7 +739,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
                 lockdep_set_class(&inode->i_mapping->i_mmap_rwsem,
@@ -741,15 +746,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
                 inode->i_mapping->private_data = resv_map;
-                info = HUGETLBFS_I(inode);
-                /*
-                 * The policy is initialized here even if we are creating a
-                 * private inode because initialization simply creates an
-                 * an empty rb tree and calls rwlock_init(), later when we
-                 * call mpol_free_shared_policy() it will just return because
-                 * the rb tree will still be empty.
-                 */
-                mpol_shared_policy_init(&info->policy, NULL);
                 switch (mode & S_IFMT) {
                 default:
                         init_special_inode(inode, mode, dev);
@@ -937,6 +933,18 @@ static struct inode *hugetlbfs_alloc_inode(struct super_block *sb)
                 hugetlbfs_inc_free_inodes(sbinfo);
                 return NULL;
         }
+
+        /*
+         * Any time after allocation, hugetlbfs_destroy_inode can be called
+         * for the inode.  mpol_free_shared_policy is unconditionally called
+         * as part of hugetlbfs_destroy_inode.  So, initialize policy here
+         * in case of a quick call to destroy.
+         *
+         * Note that the policy is initialized even if we are creating a
+         * private inode.  This simplifies hugetlbfs_destroy_inode.
+         */
+        mpol_shared_policy_init(&p->policy, NULL);
+
         return &p->vfs_inode;
 }
 
diff --git a/fs/iomap.c b/fs/iomap.c
index 3ca1a8e44135..141c3cd55a8b 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -846,7 +846,8 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         struct address_space *mapping = iocb->ki_filp->f_mapping;
         struct inode *inode = file_inode(iocb->ki_filp);
         size_t count = iov_iter_count(iter);
-        loff_t pos = iocb->ki_pos, end = iocb->ki_pos + count - 1, ret = 0;
+        loff_t pos = iocb->ki_pos, start = pos;
+        loff_t end = iocb->ki_pos + count - 1, ret = 0;
         unsigned int flags = IOMAP_DIRECT;
         struct blk_plug plug;
         struct iomap_dio *dio;
@@ -887,12 +888,12 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
         }
 
         if (mapping->nrpages) {
-                ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, end);
+                ret = filemap_write_and_wait_range(mapping, start, end);
                 if (ret)
                         goto out_free_dio;
 
                 ret = invalidate_inode_pages2_range(mapping,
-                                iocb->ki_pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
+                                start >> PAGE_SHIFT, end >> PAGE_SHIFT);
                 WARN_ON_ONCE(ret);
                 ret = 0;
         }
@@ -941,6 +942,8 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                 __set_current_state(TASK_RUNNING);
         }
 
+        ret = iomap_dio_complete(dio);
+
         /*
          * Try again to invalidate clean pages which might have been cached by
          * non-direct readahead, or faulted in by get_user_pages() if the source
@@ -949,12 +952,12 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
          * this invalidation fails, tough, the write still worked...
          */
         if (iov_iter_rw(iter) == WRITE && mapping->nrpages) {
-                ret = invalidate_inode_pages2_range(mapping,
-                                iocb->ki_pos >> PAGE_SHIFT, end >> PAGE_SHIFT);
-                WARN_ON_ONCE(ret);
+                int err = invalidate_inode_pages2_range(mapping,
+                                start >> PAGE_SHIFT, end >> PAGE_SHIFT);
+                WARN_ON_ONCE(err);
         }
 
-        return iomap_dio_complete(dio);
+        return ret;
 
 out_free_dio:
         kfree(dio);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index a1a359bfcc9c..5adc2fb62b0f 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1125,10 +1125,8 @@ static journal_t *journal_init_common(struct block_device *bdev,
 
         /* Set up a default-sized revoke table for the new mount. */
         err = jbd2_journal_init_revoke(journal, JOURNAL_REVOKE_DEFAULT_HASH);
-        if (err) {
-                kfree(journal);
-                return NULL;
-        }
+        if (err)
+                goto err_cleanup;
 
         spin_lock_init(&journal->j_history_lock);
 
@@ -1145,23 +1143,25 @@ static journal_t *journal_init_common(struct block_device *bdev,
         journal->j_wbufsize = n;
         journal->j_wbuf = kmalloc_array(n, sizeof(struct buffer_head *),
                                         GFP_KERNEL);
-        if (!journal->j_wbuf) {
-                kfree(journal);
-                return NULL;
-        }
+        if (!journal->j_wbuf)
+                goto err_cleanup;
 
         bh = getblk_unmovable(journal->j_dev, start, journal->j_blocksize);
         if (!bh) {
                 pr_err("%s: Cannot get buffer for journal superblock\n",
                         __func__);
-                kfree(journal->j_wbuf);
-                kfree(journal);
-                return NULL;
+                goto err_cleanup;
         }
         journal->j_sb_buffer = bh;
         journal->j_superblock = (journal_superblock_t *)bh->b_data;
 
         return journal;
+
+err_cleanup:
+        kfree(journal->j_wbuf);
+        jbd2_journal_destroy_revoke(journal);
+        kfree(journal);
+        return NULL;
 }
 
 /* jbd2_journal_init_dev and jbd2_journal_init_inode:
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
index cfc38b552118..f9aefcda5854 100644
--- a/fs/jbd2/revoke.c
+++ b/fs/jbd2/revoke.c
@@ -280,6 +280,7 @@ int jbd2_journal_init_revoke(journal_t *journal, int hash_size)
 
 fail1:
         jbd2_journal_destroy_revoke_table(journal->j_revoke_table[0]);
+        journal->j_revoke_table[0] = NULL;
 fail0:
         return -ENOMEM;
 }
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 8e4dc7ab584c..ac2dfe0c5a9c 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -809,7 +809,8 @@ void kernfs_drain_open_files(struct kernfs_node *kn)
                 if (kn->flags & KERNFS_HAS_MMAP)
                         unmap_mapping_range(inode->i_mapping, 0, 0, 1);
 
-                kernfs_release_file(kn, of);
+                if (kn->flags & KERNFS_HAS_RELEASE)
+                        kernfs_release_file(kn, of);
         }
 
         mutex_unlock(&kernfs_open_file_mutex);
diff --git a/fs/namei.c b/fs/namei.c
index d41fab78798b..19dcf62133cc 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2145,6 +2145,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
         int retval = 0;
         const char *s = nd->name->name;
 
+        if (!*s)
+                flags &= ~LOOKUP_RCU;
+
         nd->last_type = LAST_ROOT; /* if there are only slashes... */
         nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT;
         nd->depth = 0;
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index bb79972dc638..773774531aff 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -232,12 +232,12 @@ static struct svc_serv_ops nfs41_cb_sv_ops = {
         .svo_module             = THIS_MODULE,
 };
 
-struct svc_serv_ops *nfs4_cb_sv_ops[] = {
+static struct svc_serv_ops *nfs4_cb_sv_ops[] = {
         [0] = &nfs40_cb_sv_ops,
         [1] = &nfs41_cb_sv_ops,
 };
 #else
-struct svc_serv_ops *nfs4_cb_sv_ops[] = {
+static struct svc_serv_ops *nfs4_cb_sv_ops[] = {
         [0] = &nfs40_cb_sv_ops,
         [1] = NULL,
 };
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 91a8d610ba0f..390ada8741bc 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -325,10 +325,33 @@ static struct nfs_client *nfs_match_client(const struct nfs_client_initdata *dat
         return NULL;
 }
 
-static bool nfs_client_init_is_complete(const struct nfs_client *clp)
+/*
+ * Return true if @clp is done initializing, false if still working on it.
+ *
+ * Use nfs_client_init_status to check if it was successful.
+ */
+bool nfs_client_init_is_complete(const struct nfs_client *clp)
 {
         return clp->cl_cons_state <= NFS_CS_READY;
 }
+EXPORT_SYMBOL_GPL(nfs_client_init_is_complete);
+
+/*
+ * Return 0 if @clp was successfully initialized, -errno otherwise.
+ *
+ * This must be called *after* nfs_client_init_is_complete() returns true,
+ * otherwise it will pop WARN_ON_ONCE and return -EINVAL
+ */
+int nfs_client_init_status(const struct nfs_client *clp)
+{
+        /* called without checking nfs_client_init_is_complete */
+        if (clp->cl_cons_state > NFS_CS_READY) {
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
+        return clp->cl_cons_state;
+}
+EXPORT_SYMBOL_GPL(nfs_client_init_status);
 
 int nfs_wait_client_init_complete(const struct nfs_client *clp)
 {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index fb499a3f21b5..f92ba8d6c556 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2055,7 +2055,7 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
         struct inode *old_inode = d_inode(old_dentry);
         struct inode *new_inode = d_inode(new_dentry);
-        struct dentry *dentry = NULL, *rehash = NULL;
+        struct dentry *dentry = NULL;
         struct rpc_task *task;
         int error = -EBUSY;
 
@@ -2078,10 +2078,8 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                  * To prevent any new references to the target during the
                  * rename, we unhash the dentry in advance.
                  */
-                if (!d_unhashed(new_dentry)) {
+                if (!d_unhashed(new_dentry))
                         d_drop(new_dentry);
-                        rehash = new_dentry;
-                }
 
                 if (d_count(new_dentry) > 2) {
                         int err;
@@ -2098,7 +2096,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                                 goto out;
 
                         new_dentry = dentry;
-                        rehash = NULL;
                         new_inode = NULL;
                 }
         }
@@ -2119,8 +2116,6 @@ int nfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 error = task->tk_status;
         rpc_put_task(task);
 out:
-        if (rehash)
-                d_rehash(rehash);
         trace_nfs_rename_exit(old_dir, old_dentry,
                         new_dir, new_dentry, error);
         /* new dentry created? */
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 44347f4bdc15..acd30baca461 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -202,10 +202,10 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                         task->tk_status);
                 nfs4_mark_deviceid_unavailable(devid);
                 pnfs_error_mark_layout_for_return(inode, lseg);
-                pnfs_set_lo_fail(lseg);
                 rpc_wake_up(&tbl->slot_tbl_waitq);
                 /* fall through */
         default:
+                pnfs_set_lo_fail(lseg);
 reset:
                 dprintk("%s Retry through MDS. Error %d\n", __func__,
                         task->tk_status);
@@ -560,6 +560,50 @@ filelayout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
         return PNFS_ATTEMPTED;
 }
 
+static int
+filelayout_check_deviceid(struct pnfs_layout_hdr *lo,
+                          struct nfs4_filelayout_segment *fl,
+                          gfp_t gfp_flags)
+{
+        struct nfs4_deviceid_node *d;
+        struct nfs4_file_layout_dsaddr *dsaddr;
+        int status = -EINVAL;
+
+        /* find and reference the deviceid */
+        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), &fl->deviceid,
+                        lo->plh_lc_cred, gfp_flags);
+        if (d == NULL)
+                goto out;
+
+        dsaddr = container_of(d, struct nfs4_file_layout_dsaddr, id_node);
+        /* Found deviceid is unavailable */
+        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
+                goto out_put;
+
+        fl->dsaddr = dsaddr;
+
+        if (fl->first_stripe_index >= dsaddr->stripe_count) {
+                dprintk("%s Bad first_stripe_index %u\n",
+                                __func__, fl->first_stripe_index);
+                goto out_put;
+        }
+
+        if ((fl->stripe_type == STRIPE_SPARSE &&
+            fl->num_fh > 1 && fl->num_fh != dsaddr->ds_num) ||
+            (fl->stripe_type == STRIPE_DENSE &&
+            fl->num_fh != dsaddr->stripe_count)) {
+                dprintk("%s num_fh %u not valid for given packing\n",
+                        __func__, fl->num_fh);
+                goto out_put;
+        }
+        status = 0;
+out:
+        return status;
+out_put:
+        nfs4_fl_put_deviceid(dsaddr);
+        goto out;
+}
+
 /*
  * filelayout_check_layout()
  *
@@ -572,11 +616,8 @@ static int
 filelayout_check_layout(struct pnfs_layout_hdr *lo,
                         struct nfs4_filelayout_segment *fl,
                         struct nfs4_layoutget_res *lgr,
-                        struct nfs4_deviceid *id,
                         gfp_t gfp_flags)
 {
-        struct nfs4_deviceid_node *d;
-        struct nfs4_file_layout_dsaddr *dsaddr;
         int status = -EINVAL;
 
         dprintk("--> %s\n", __func__);
@@ -601,41 +642,10 @@ filelayout_check_layout(struct pnfs_layout_hdr *lo,
                 goto out;
         }
 
-        /* find and reference the deviceid */
-        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), id,
-                        lo->plh_lc_cred, gfp_flags);
-        if (d == NULL)
-                goto out;
-
-        dsaddr = container_of(d, struct nfs4_file_layout_dsaddr, id_node);
-        /* Found deviceid is unavailable */
-        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
-                goto out_put;
-
-        fl->dsaddr = dsaddr;
-
-        if (fl->first_stripe_index >= dsaddr->stripe_count) {
-                dprintk("%s Bad first_stripe_index %u\n",
-                                __func__, fl->first_stripe_index);
-                goto out_put;
-        }
-
-        if ((fl->stripe_type == STRIPE_SPARSE &&
-            fl->num_fh > 1 && fl->num_fh != dsaddr->ds_num) ||
-            (fl->stripe_type == STRIPE_DENSE &&
-            fl->num_fh != dsaddr->stripe_count)) {
-                dprintk("%s num_fh %u not valid for given packing\n",
-                        __func__, fl->num_fh);
-                goto out_put;
-        }
-
         status = 0;
 out:
         dprintk("--> %s returns %d\n", __func__, status);
         return status;
-out_put:
-        nfs4_fl_put_deviceid(dsaddr);
-        goto out;
 }
 
 static void _filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
@@ -657,7 +667,6 @@ static int
 filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                          struct nfs4_filelayout_segment *fl,
                          struct nfs4_layoutget_res *lgr,
-                         struct nfs4_deviceid *id,
                          gfp_t gfp_flags)
 {
         struct xdr_stream stream;
@@ -682,9 +691,9 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
         if (unlikely(!p))
                 goto out_err;
 
-        memcpy(id, p, sizeof(*id));
+        memcpy(&fl->deviceid, p, sizeof(fl->deviceid));
         p += XDR_QUADLEN(NFS4_DEVICEID4_SIZE);
-        nfs4_print_deviceid(id);
+        nfs4_print_deviceid(&fl->deviceid);
 
         nfl_util = be32_to_cpup(p++);
         if (nfl_util & NFL4_UFLG_COMMIT_THRU_MDS)
@@ -831,15 +840,14 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
 {
         struct nfs4_filelayout_segment *fl;
         int rc;
-        struct nfs4_deviceid id;
 
         dprintk("--> %s\n", __func__);
         fl = kzalloc(sizeof(*fl), gfp_flags);
         if (!fl)
                 return NULL;
 
-        rc = filelayout_decode_layout(layoutid, fl, lgr, &id, gfp_flags);
-        if (rc != 0 || filelayout_check_layout(layoutid, fl, lgr, &id, gfp_flags)) {
+        rc = filelayout_decode_layout(layoutid, fl, lgr, gfp_flags);
+        if (rc != 0 || filelayout_check_layout(layoutid, fl, lgr, gfp_flags)) {
                 _filelayout_free_lseg(fl);
                 return NULL;
         }
@@ -888,18 +896,51 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev,
         return min(stripe_unit - (unsigned int)stripe_offset, size);
 }
 
+static struct pnfs_layout_segment *
+fl_pnfs_update_layout(struct inode *ino,
+                      struct nfs_open_context *ctx,
+                      loff_t pos,
+                      u64 count,
+                      enum pnfs_iomode iomode,
+                      bool strict_iomode,
+                      gfp_t gfp_flags)
+{
+        struct pnfs_layout_segment *lseg = NULL;
+        struct pnfs_layout_hdr *lo;
+        struct nfs4_filelayout_segment *fl;
+        int status;
+
+        lseg = pnfs_update_layout(ino, ctx, pos, count, iomode, strict_iomode,
+                                  gfp_flags);
+        if (!lseg)
+                lseg = ERR_PTR(-ENOMEM);
+        if (IS_ERR(lseg))
+                goto out;
+
+        lo = NFS_I(ino)->layout;
+        fl = FILELAYOUT_LSEG(lseg);
+
+        status = filelayout_check_deviceid(lo, fl, gfp_flags);
+        if (status)
+                lseg = ERR_PTR(status);
+out:
+        if (IS_ERR(lseg))
+                pnfs_put_lseg(lseg);
+        return lseg;
+}
+
 static void
 filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio,
                         struct nfs_page *req)
 {
         if (!pgio->pg_lseg) {
-                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-                                           req->wb_context,
-                                           0,
-                                           NFS4_MAX_UINT64,
-                                           IOMODE_READ,
-                                           false,
-                                           GFP_KERNEL);
+                pgio->pg_lseg = fl_pnfs_update_layout(pgio->pg_inode,
+                                                      req->wb_context,
+                                                      0,
+                                                      NFS4_MAX_UINT64,
+                                                      IOMODE_READ,
+                                                      false,
+                                                      GFP_KERNEL);
                 if (IS_ERR(pgio->pg_lseg)) {
                         pgio->pg_error = PTR_ERR(pgio->pg_lseg);
                         pgio->pg_lseg = NULL;
@@ -919,13 +960,13 @@ filelayout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         int status;
 
         if (!pgio->pg_lseg) {
-                pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
-                                           req->wb_context,
-                                           0,
-                                           NFS4_MAX_UINT64,
-                                           IOMODE_RW,
-                                           false,
-                                           GFP_NOFS);
+                pgio->pg_lseg = fl_pnfs_update_layout(pgio->pg_inode,
+                                                      req->wb_context,
+                                                      0,
+                                                      NFS4_MAX_UINT64,
+                                                      IOMODE_RW,
+                                                      false,
+                                                      GFP_NOFS);
                 if (IS_ERR(pgio->pg_lseg)) {
                         pgio->pg_error = PTR_ERR(pgio->pg_lseg);
                         pgio->pg_lseg = NULL;
diff --git a/fs/nfs/filelayout/filelayout.h b/fs/nfs/filelayout/filelayout.h
index 2896cb833a11..79323b5dab0c 100644
--- a/fs/nfs/filelayout/filelayout.h
+++ b/fs/nfs/filelayout/filelayout.h
@@ -55,15 +55,16 @@ struct nfs4_file_layout_dsaddr {
 };
 
 struct nfs4_filelayout_segment {
-        struct pnfs_layout_segment generic_hdr;
-        u32 stripe_type;
-        u32 commit_through_mds;
-        u32 stripe_unit;
-        u32 first_stripe_index;
-        u64 pattern_offset;
-        struct nfs4_file_layout_dsaddr *dsaddr; /* Point to GETDEVINFO data */
-        unsigned int num_fh;
-        struct nfs_fh **fh_array;
+        struct pnfs_layout_segment      generic_hdr;
+        u32                             stripe_type;
+        u32                             commit_through_mds;
+        u32                             stripe_unit;
+        u32                             first_stripe_index;
+        u64                             pattern_offset;
+        struct nfs4_deviceid            deviceid;
+        struct nfs4_file_layout_dsaddr  *dsaddr; /* Point to GETDEVINFO data */
+        unsigned int                    num_fh;
+        struct nfs_fh                   **fh_array;
 };
 
 struct nfs4_filelayout {
diff --git a/fs/nfs/filelayout/filelayoutdev.c b/fs/nfs/filelayout/filelayoutdev.c
index f956ca20a8a3..d913e818858f 100644
--- a/fs/nfs/filelayout/filelayoutdev.c
+++ b/fs/nfs/filelayout/filelayoutdev.c
@@ -266,6 +266,7 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
         struct nfs4_deviceid_node *devid = FILELAYOUT_DEVID_NODE(lseg);
         struct nfs4_pnfs_ds *ret = ds;
         struct nfs_server *s = NFS_SERVER(lseg->pls_layout->plh_inode);
+        int status;
 
         if (ds == NULL) {
                 printk(KERN_ERR "NFS: %s: No data server for offset index %d\n",
@@ -277,9 +278,14 @@ nfs4_fl_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx)
         if (ds->ds_clp)
                 goto out_test_devid;
 
-        nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
+        status = nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
                              dataserver_retrans, 4,
                              s->nfs_client->cl_minorversion);
+        if (status) {
+                nfs4_mark_deviceid_unavailable(devid);
+                ret = NULL;
+                goto out;
+        }
 
 out_test_devid:
         if (ret->ds_clp == NULL ||
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index f4f39b0ab09b..98b34c9b0564 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -175,7 +175,19 @@ ff_layout_no_read_on_rw(struct pnfs_layout_segment *lseg)
 static inline bool
 ff_layout_test_devid_unavailable(struct nfs4_deviceid_node *node)
 {
-        return nfs4_test_deviceid_unavailable(node);
+        /*
+         * Flexfiles should never mark a DS unavailable, but if it does
+         * print a (ratelimited) warning as this can affect performance.
+         */
+        if (nfs4_test_deviceid_unavailable(node)) {
+                u32 *p = (u32 *)node->deviceid.data;
+
+                pr_warn_ratelimited("NFS: flexfiles layout referencing an "
+                                "unavailable device [%x%x%x%x]\n",
+                                p[0], p[1], p[2], p[3]);
+                return true;
+        }
+        return false;
 }
 
 static inline int
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index e5a6f248697b..457cfeb1d5c1 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -208,6 +208,10 @@ static bool ff_layout_mirror_valid(struct pnfs_layout_segment *lseg,
                 } else
                         goto outerr;
         }
+
+        if (IS_ERR(mirror->mirror_ds))
+                goto outerr;
+
         if (mirror->mirror_ds->ds == NULL) {
                 struct nfs4_deviceid_node *devid;
                 devid = &mirror->mirror_ds->id_node;
@@ -384,6 +388,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
         struct inode *ino = lseg->pls_layout->plh_inode;
         struct nfs_server *s = NFS_SERVER(ino);
         unsigned int max_payload;
+        int status;
 
         if (!ff_layout_mirror_valid(lseg, mirror, true)) {
                 pr_err_ratelimited("NFS: %s: No data server for offset index %d\n",
@@ -404,7 +409,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
         /* FIXME: For now we assume the server sent only one version of NFS
          * to use for the DS.
          */
-        nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
+        status = nfs4_pnfs_ds_connect(s, ds, devid, dataserver_timeo,
                              dataserver_retrans,
                              mirror->mirror_ds->ds_versions[0].version,
                              mirror->mirror_ds->ds_versions[0].minor_version);
@@ -420,11 +425,11 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
                         mirror->mirror_ds->ds_versions[0].wsize = max_payload;
                 goto out;
         }
+out_fail:
         ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
                                  mirror, lseg->pls_range.offset,
                                  lseg->pls_range.length, NFS4ERR_NXIO,
                                  OP_ILLEGAL, GFP_NOIO);
-out_fail:
         if (fail_return || !ff_layout_has_available_ds(lseg))
                 pnfs_error_mark_layout_for_return(ino, lseg);
         ds = NULL;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 09ca5095c04e..7b38fedb7e03 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -186,6 +186,8 @@ extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                            struct nfs_fh *,
                                            struct nfs_fattr *,
                                            rpc_authflavor_t);
+extern bool nfs_client_init_is_complete(const struct nfs_client *clp);
+extern int nfs_client_init_status(const struct nfs_client *clp);
 extern int nfs_wait_client_init_complete(const struct nfs_client *clp);
 extern void nfs_mark_client_ready(struct nfs_client *clp, int state);
 extern struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 5ae9d64ea08b..8346ccbf2d52 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -1023,9 +1023,9 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
         server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
         server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
 
-        if (server->rsize > server_resp_sz)
+        if (!server->rsize || server->rsize > server_resp_sz)
                 server->rsize = server_resp_sz;
-        if (server->wsize > server_rqst_sz)
+        if (!server->wsize || server->wsize > server_rqst_sz)
                 server->wsize = server_rqst_sz;
 #endif /* CONFIG_NFS_V4_1 */
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 1b183686c6d4..201ca3f2c4ba 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2258,8 +2258,6 @@ static int nfs4_opendata_access(struct rpc_cred *cred,
         if ((mask & ~cache.mask & (MAY_READ | MAY_EXEC)) == 0)
                 return 0;
 
-        /* even though OPEN succeeded, access is denied. Close the file */
-        nfs4_close_state(state, fmode);
         return -EACCES;
 }
 
@@ -2444,17 +2442,14 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
         }
 
         nfs4_stateid_copy(&stateid, &delegation->stateid);
-        if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+        if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) ||
+                !test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+                        &delegation->flags)) {
                 rcu_read_unlock();
                 nfs_finish_clear_delegation_stateid(state, &stateid);
                 return;
         }
 
-        if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags)) {
-                rcu_read_unlock();
-                return;
-        }
-
         cred = get_rpccred(delegation->cred);
         rcu_read_unlock();
         status = nfs41_test_and_free_expired_stateid(server, &stateid, cred);
@@ -7427,11 +7422,11 @@ static void nfs4_exchange_id_release(void *data)
         struct nfs41_exchange_id_data *cdata =
                                         (struct nfs41_exchange_id_data *)data;
 
-        nfs_put_client(cdata->args.client);
         if (cdata->xprt) {
                 xprt_put(cdata->xprt);
                 rpc_clnt_xprt_switch_put(cdata->args.client->cl_rpcclient);
         }
+        nfs_put_client(cdata->args.client);
         kfree(cdata->res.impl_id);
         kfree(cdata->res.server_scope);
         kfree(cdata->res.server_owner);
@@ -7538,10 +7533,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
         task_setup_data.callback_data = calldata;
 
         task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task)) {
-        status = PTR_ERR(task);
-                goto out_impl_id;
-        }
+        if (IS_ERR(task))
+                return PTR_ERR(task);
 
         if (!xprt) {
                 status = rpc_wait_for_completion_task(task);
@@ -7569,6 +7562,7 @@ out_server_owner:
         kfree(calldata->res.server_owner);
 out_calldata:
         kfree(calldata);
+        nfs_put_client(clp);
         goto out;
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index f0369e362753..80ce289eea05 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -3942,7 +3942,7 @@ static int decode_attr_group(struct xdr_stream *xdr, uint32_t *bitmap,
                 if (len <= 0)
                         goto out;
                 dprintk("%s: name=%s\n", __func__, group_name->data);
-                return NFS_ATTR_FATTR_OWNER_NAME;
+                return NFS_ATTR_FATTR_GROUP_NAME;
         } else {
                 len = xdr_stream_decode_opaque_inline(xdr, (void **)&p,
                                 XDR_MAX_NETOBJ);
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 63f77b49a586..590e1e35781f 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -367,7 +367,7 @@ void nfs4_pnfs_ds_put(struct nfs4_pnfs_ds *ds);
 struct nfs4_pnfs_ds *nfs4_pnfs_ds_add(struct list_head *dsaddrs,
                                       gfp_t gfp_flags);
 void nfs4_pnfs_v3_ds_connect_unload(void);
-void nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
+int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
                           struct nfs4_deviceid_node *devid, unsigned int timeo,
                           unsigned int retrans, u32 version, u32 minor_version);
 struct nfs4_pnfs_ds_addr *nfs4_decode_mp_ds_addr(struct net *net,
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 9414b492439f..7250b95549ec 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -745,15 +745,17 @@ out:
 /*
  * Create an rpc connection to the nfs4_pnfs_ds data server.
  * Currently only supports IPv4 and IPv6 addresses.
- * If connection fails, make devid unavailable.
+ * If connection fails, make devid unavailable and return a -errno.
  */
-void nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
+int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
                           struct nfs4_deviceid_node *devid, unsigned int timeo,
                           unsigned int retrans, u32 version, u32 minor_version)
 {
-        if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
-                int err = 0;
+        int err;
 
+again:
+        err = 0;
+        if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) {
                 if (version == 3) {
                         err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo,
                                                        retrans);
@@ -766,12 +768,29 @@ void nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds,
                         err = -EPROTONOSUPPORT;
                 }
 
-                if (err)
-                        nfs4_mark_deviceid_unavailable(devid);
                 nfs4_clear_ds_conn_bit(ds);
         } else {
                 nfs4_wait_ds_connect(ds);
+
+                /* what was waited on didn't connect AND didn't mark unavail */
+                if (!ds->ds_clp && !nfs4_test_deviceid_unavailable(devid))
+                        goto again;
         }
+
+        /*
+         * At this point the ds->ds_clp should be ready, but it might have
+         * hit an error.
+         */
+        if (!err) {
+                if (!ds->ds_clp || !nfs_client_init_is_complete(ds->ds_clp)) {
+                        WARN_ON_ONCE(ds->ds_clp ||
+                                !nfs4_test_deviceid_unavailable(devid));
+                        return -EINVAL;
+                }
+                err = nfs_client_init_status(ds->ds_clp);
+        }
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_connect);
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e75b056f46f4..abb2c8a3be42 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1784,7 +1784,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data)
                         (long long)req_offset(req));
                 if (status < 0) {
                         nfs_context_set_write_error(req->wb_context, status);
-                        nfs_inode_remove_request(req);
+                        if (req->wb_page)
+                                nfs_inode_remove_request(req);
                         dprintk_cont(", error = %d\n", status);
                         goto next;
                 }
@@ -1793,7 +1794,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data)
                  * returned by the server against all stored verfs. */
                 if (!nfs_write_verifier_cmp(&req->wb_verf, &data->verf.verifier)) {
                         /* We have a match */
-                        nfs_inode_remove_request(req);
+                        if (req->wb_page)
+                                nfs_inode_remove_request(req);
                         dprintk_cont(" OK\n");
                         goto next;
                 }
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index cbeeda1e94a2..d86031b6ad79 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2489,7 +2489,7 @@ bool nfsd4_spo_must_allow(struct svc_rqst *rqstp)
 
 int nfsd4_max_reply(struct svc_rqst *rqstp, struct nfsd4_op *op)
 {
-        if (op->opnum == OP_ILLEGAL)
+        if (op->opnum == OP_ILLEGAL || op->status == nfserr_notsupp)
                 return op_encode_hdr_size * sizeof(__be32);
 
         BUG_ON(OPDESC(op)->op_rsize_bop == NULL);
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 73e75ac90525..8bf8f667a8cf 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -538,13 +538,21 @@ out_free:
 
 static ssize_t
 nfsd_print_version_support(char *buf, int remaining, const char *sep,
-                unsigned vers, unsigned minor)
+                unsigned vers, int minor)
 {
-        const char *format = (minor == 0) ? "%s%c%u" : "%s%c%u.%u";
+        const char *format = minor < 0 ? "%s%c%u" : "%s%c%u.%u";
         bool supported = !!nfsd_vers(vers, NFSD_TEST);
 
-        if (vers == 4 && !nfsd_minorversion(minor, NFSD_TEST))
+        if (vers == 4 && minor >= 0 &&
+            !nfsd_minorversion(minor, NFSD_TEST))
                 supported = false;
+        if (minor == 0 && supported)
+                /*
+                 * special case for backward compatability.
+                 * +4.0 is never reported, it is implied by
+                 * +4, unless -4.0 is present.
+                 */
+                return 0;
         return snprintf(buf, remaining, format, sep,
                         supported ? '+' : '-', vers, minor);
 }
@@ -554,7 +562,6 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
         char *mesg = buf;
         char *vers, *minorp, sign;
         int len, num, remaining;
-        unsigned minor;
         ssize_t tlen = 0;
         char *sep;
         struct nfsd_net *nn = net_generic(netns(file), nfsd_net_id);
@@ -575,6 +582,7 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                 if (len <= 0) return -EINVAL;
                 do {
                         enum vers_op cmd;
+                        unsigned minor;
                         sign = *vers;
                         if (sign == '+' || sign == '-')
                                 num = simple_strtol((vers+1), &minorp, 0);
@@ -585,8 +593,8 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                                         return -EINVAL;
                                 if (kstrtouint(minorp+1, 0, &minor) < 0)
                                         return -EINVAL;
-                        } else
-                                minor = 0;
+                        }
+
                         cmd = sign == '-' ? NFSD_CLEAR : NFSD_SET;
                         switch(num) {
                         case 2:
@@ -594,8 +602,20 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                                 nfsd_vers(num, cmd);
                                 break;
                         case 4:
-                                if (nfsd_minorversion(minor, cmd) >= 0)
-                                        break;
+                                if (*minorp == '.') {
+                                        if (nfsd_minorversion(minor, cmd) < 0)
+                                                return -EINVAL;
+                                } else if ((cmd == NFSD_SET) != nfsd_vers(num, NFSD_TEST)) {
+                                        /*
+                                         * Either we have +4 and no minors are enabled,
+                                         * or we have -4 and at least one minor is enabled.
+                                         * In either case, propagate 'cmd' to all minors.
+                                         */
+                                        minor = 0;
+                                        while (nfsd_minorversion(minor, cmd) >= 0)
+                                                minor++;
+                                }
+                                break;
                         default:
                                 return -EINVAL;
                         }
@@ -612,9 +632,11 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
         sep = "";
         remaining = SIMPLE_TRANSACTION_LIMIT;
         for (num=2 ; num <= 4 ; num++) {
+                int minor;
                 if (!nfsd_vers(num, NFSD_AVAIL))
                         continue;
-                minor = 0;
+
+                minor = -1;
                 do {
                         len = nfsd_print_version_support(buf, remaining,
                                         sep, num, minor);
@@ -624,7 +646,8 @@ static ssize_t __write_versions(struct file *file, char *buf, size_t size)
                         buf += len;
                         tlen += len;
                         minor++;
-                        sep = " ";
+                        if (len)
+                                sep = " ";
                 } while (num == 4 && minor <= NFSD_SUPPORTED_MINOR_VERSION);
         }
 out:
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index fa82b7707e85..03a7e9da4da0 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -786,6 +786,7 @@ nfserrno (int errno)
                 { nfserr_serverfault, -ESERVERFAULT },
                 { nfserr_serverfault, -ENFILE },
                 { nfserr_io, -EUCLEAN },
+                { nfserr_perm, -ENOKEY },
         };
         int     i;
 
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 786a4a2cb2d7..31e1f9593457 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -167,7 +167,8 @@ nfsd_adjust_nfsd_versions4(void)
 
 int nfsd_minorversion(u32 minorversion, enum vers_op change)
 {
-        if (minorversion > NFSD_SUPPORTED_MINOR_VERSION)
+        if (minorversion > NFSD_SUPPORTED_MINOR_VERSION &&
+            change != NFSD_AVAIL)
                 return -1;
         switch(change) {
         case NFSD_SET:
@@ -415,23 +416,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
 
 void nfsd_reset_versions(void)
 {
-        int found_one = 0;
         int i;
 
-        for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) {
-                if (nfsd_program.pg_vers[i])
-                        found_one = 1;
-        }
+        for (i = 0; i < NFSD_NRVERS; i++)
+                if (nfsd_vers(i, NFSD_TEST))
+                        return;
 
-        if (!found_one) {
-                for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++)
-                        nfsd_program.pg_vers[i] = nfsd_version[i];
-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
-                for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++)
-                        nfsd_acl_program.pg_vers[i] =
-                                nfsd_acl_version[i];
-#endif
-        }
+        for (i = 0; i < NFSD_NRVERS; i++)
+                if (i != 4)
+                        nfsd_vers(i, NFSD_SET);
+                else {
+                        int minor = 0;
+                        while (nfsd_minorversion(minor, NFSD_SET) >= 0)
+                                minor++;
+                }
 }
 
 /*
diff --git a/fs/nsfs.c b/fs/nsfs.c
index 1656843e87d2..323f492e0822 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -91,6 +91,7 @@ slow:
                 return ERR_PTR(-ENOMEM);
         }
         d_instantiate(dentry, inode);
+        dentry->d_flags |= DCACHE_RCUACCESS;
         dentry->d_fsdata = (void *)ns->ops;
         d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
         if (d) {
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 4348027384f5..d0ab7e56d0b4 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1863,7 +1863,7 @@ static int o2net_accept_one(struct socket *sock, int *more)
 
         new_sock->type = sock->type;
         new_sock->ops = sock->ops;
-        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK);
+        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, false);
         if (ret < 0)
                 goto out;
 
diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
index c4ab6fdf17a0..e1534c9bab16 100644
--- a/fs/orangefs/devorangefs-req.c
+++ b/fs/orangefs/devorangefs-req.c
@@ -208,14 +208,19 @@ restart:
                                 continue;
                         /*
                          * Skip ops whose filesystem we don't know about unless
-                         * it is being mounted.
+                         * it is being mounted or unmounted.  It is possible for
+                         * a filesystem we don't know about to be unmounted if
+                         * it fails to mount in the kernel after userspace has
+                         * been sent the mount request.
                          */
                         /* XXX: is there a better way to detect this? */
                         } else if (ret == -1 &&
                                    !(op->upcall.type ==
                                         ORANGEFS_VFS_OP_FS_MOUNT ||
                                      op->upcall.type ==
-                                        ORANGEFS_VFS_OP_GETATTR)) {
+                                        ORANGEFS_VFS_OP_GETATTR ||
+                                     op->upcall.type ==
+                                        ORANGEFS_VFS_OP_FS_UMOUNT)) {
                                 gossip_debug(GOSSIP_DEV_DEBUG,
                                     "orangefs: skipping op tag %llu %s\n",
                                     llu(op->tag), get_opname_string(op));
diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h
index 5e48a0be9761..8afac46fcc87 100644
--- a/fs/orangefs/orangefs-kernel.h
+++ b/fs/orangefs/orangefs-kernel.h
@@ -249,6 +249,7 @@ struct orangefs_sb_info_s {
         char devname[ORANGEFS_MAX_SERVER_ADDR_LEN];
         struct super_block *sb;
         int mount_pending;
+        int no_list;
         struct list_head list;
 };
 
diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
index 67c24351a67f..629d8c917fa6 100644
--- a/fs/orangefs/super.c
+++ b/fs/orangefs/super.c
@@ -263,8 +263,13 @@ int orangefs_remount(struct orangefs_sb_info_s *orangefs_sb)
                 if (!new_op)
                         return -ENOMEM;
                 new_op->upcall.req.features.features = 0;
-                ret = service_operation(new_op, "orangefs_features", 0);
-                orangefs_features = new_op->downcall.resp.features.features;
+                ret = service_operation(new_op, "orangefs_features",
+                    ORANGEFS_OP_PRIORITY | ORANGEFS_OP_NO_MUTEX);
+                if (!ret)
+                        orangefs_features =
+                            new_op->downcall.resp.features.features;
+                else
+                        orangefs_features = 0;
                 op_release(new_op);
         } else {
                 orangefs_features = 0;
@@ -488,7 +493,7 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
 
         if (ret) {
                 d = ERR_PTR(ret);
-                goto free_op;
+                goto free_sb_and_op;
         }
 
         /*
@@ -514,6 +519,9 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
         spin_unlock(&orangefs_superblocks_lock);
         op_release(new_op);
 
+        /* Must be removed from the list now. */
+        ORANGEFS_SB(sb)->no_list = 0;
+
         if (orangefs_userspace_version >= 20906) {
                 new_op = op_alloc(ORANGEFS_VFS_OP_FEATURES);
                 if (!new_op)
@@ -528,6 +536,10 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
 
         return dget(sb->s_root);
 
+free_sb_and_op:
+        /* Will call orangefs_kill_sb with sb not in list. */
+        ORANGEFS_SB(sb)->no_list = 1;
+        deactivate_locked_super(sb);
 free_op:
         gossip_err("orangefs_mount: mount request failed with %d\n", ret);
         if (ret == -EINVAL) {
@@ -553,12 +565,14 @@ void orangefs_kill_sb(struct super_block *sb)
          */
          orangefs_unmount_sb(sb);
 
-        /* remove the sb from our list of orangefs specific sb's */
-
-        spin_lock(&orangefs_superblocks_lock);
-        __list_del_entry(&ORANGEFS_SB(sb)->list);       /* not list_del_init */
-        ORANGEFS_SB(sb)->list.prev = NULL;
-        spin_unlock(&orangefs_superblocks_lock);
+        if (!ORANGEFS_SB(sb)->no_list) {
+                /* remove the sb from our list of orangefs specific sb's */
+                spin_lock(&orangefs_superblocks_lock);
+                /* not list_del_init */
+                __list_del_entry(&ORANGEFS_SB(sb)->list);
+                ORANGEFS_SB(sb)->list.prev = NULL;
+                spin_unlock(&orangefs_superblocks_lock);
+        }
 
         /*
          * make sure that ORANGEFS_DEV_REMOUNT_ALL loop that might've seen us
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 1953986ee6bc..6e610a205e15 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -12,7 +12,6 @@
 #include <linux/slab.h>
 #include <linux/cred.h>
 #include <linux/xattr.h>
-#include <linux/sched/signal.h>
 #include "overlayfs.h"
 #include "ovl_entry.h"
 
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 8f91ec66baa3..d04ea4349909 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -1074,6 +1074,7 @@ static int sysctl_check_table(const char *path, struct ctl_table *table)
 
                 if ((table->proc_handler == proc_dostring) ||
                     (table->proc_handler == proc_dointvec) ||
+                    (table->proc_handler == proc_douintvec) ||
                     (table->proc_handler == proc_dointvec_minmax) ||
                     (table->proc_handler == proc_dointvec_jiffies) ||
                     (table->proc_handler == proc_dointvec_userhz_jiffies) ||
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f08bd31c1081..312578089544 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -900,7 +900,14 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma,
 static inline void clear_soft_dirty_pmd(struct vm_area_struct *vma,
                 unsigned long addr, pmd_t *pmdp)
 {
-        pmd_t pmd = pmdp_huge_get_and_clear(vma->vm_mm, addr, pmdp);
+        pmd_t pmd = *pmdp;
+
+        /* See comment in change_huge_pmd() */
+        pmdp_invalidate(vma, addr, pmdp);
+        if (pmd_dirty(*pmdp))
+                pmd = pmd_mkdirty(pmd);
+        if (pmd_young(*pmdp))
+                pmd = pmd_mkyoung(pmd);
 
         pmd = pmd_wrprotect(pmd);
         pmd = pmd_clear_soft_dirty(pmd);
diff --git a/fs/stat.c b/fs/stat.c
index fa0be59340cc..c6c963b2546b 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -130,9 +130,13 @@ EXPORT_SYMBOL(vfs_getattr);
 int vfs_statx_fd(unsigned int fd, struct kstat *stat,
                  u32 request_mask, unsigned int query_flags)
 {
-        struct fd f = fdget_raw(fd);
+        struct fd f;
         int error = -EBADF;
 
+        if (query_flags & ~KSTAT_QUERY_FLAGS)
+                return -EINVAL;
+
+        f = fdget_raw(fd);
         if (f.file) {
                 error = vfs_getattr(&f.file->f_path, stat,
                                     request_mask, query_flags);
@@ -155,9 +159,6 @@ EXPORT_SYMBOL(vfs_statx_fd);
  * Additionally, the use of AT_SYMLINK_NOFOLLOW in flags will prevent a symlink
  * at the given name from being referenced.
  *
- * The caller must have preset stat->request_mask as for vfs_getattr().  The
- * flags are also used to load up stat->query_flags.
- *
  * 0 will be returned on success, and a -ve error code if unsuccessful.
  */
 int vfs_statx(int dfd, const char __user *filename, int flags,
@@ -509,46 +510,38 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, const char __user *, filename,
 }
 #endif /* __ARCH_WANT_STAT64 || __ARCH_WANT_COMPAT_STAT64 */
 
-static inline int __put_timestamp(struct timespec *kts,
-                                  struct statx_timestamp __user *uts)
-{
-        return (__put_user(kts->tv_sec,         &uts->tv_sec            ) ||
-                __put_user(kts->tv_nsec,        &uts->tv_nsec           ) ||
-                __put_user(0,                   &uts->__reserved        ));
-}
-
-/*
- * Set the statx results.
- */
-static long statx_set_result(struct kstat *stat, struct statx __user *buffer)
+static noinline_for_stack int
+cp_statx(const struct kstat *stat, struct statx __user *buffer)
 {
-        uid_t uid = from_kuid_munged(current_user_ns(), stat->uid);
-        gid_t gid = from_kgid_munged(current_user_ns(), stat->gid);
-
-        if (__put_user(stat->result_mask,       &buffer->stx_mask       ) ||
-            __put_user(stat->mode,              &buffer->stx_mode       ) ||
-            __clear_user(&buffer->__spare0, sizeof(buffer->__spare0))     ||
-            __put_user(stat->nlink,             &buffer->stx_nlink      ) ||
-            __put_user(uid,                     &buffer->stx_uid        ) ||
-            __put_user(gid,                     &buffer->stx_gid        ) ||
-            __put_user(stat->attributes,        &buffer->stx_attributes ) ||
-            __put_user(stat->blksize,           &buffer->stx_blksize    ) ||
-            __put_user(MAJOR(stat->rdev),       &buffer->stx_rdev_major ) ||
-            __put_user(MINOR(stat->rdev),       &buffer->stx_rdev_minor ) ||
-            __put_user(MAJOR(stat->dev),        &buffer->stx_dev_major  ) ||
-            __put_user(MINOR(stat->dev),        &buffer->stx_dev_minor  ) ||
-            __put_timestamp(&stat->atime,       &buffer->stx_atime      ) ||
-            __put_timestamp(&stat->btime,       &buffer->stx_btime      ) ||
-            __put_timestamp(&stat->ctime,       &buffer->stx_ctime      ) ||
-            __put_timestamp(&stat->mtime,       &buffer->stx_mtime      ) ||
-            __put_user(stat->ino,               &buffer->stx_ino        ) ||
-            __put_user(stat->size,              &buffer->stx_size       ) ||
-            __put_user(stat->blocks,            &buffer->stx_blocks     ) ||
-            __clear_user(&buffer->__spare1, sizeof(buffer->__spare1))     ||
-            __clear_user(&buffer->__spare2, sizeof(buffer->__spare2)))
-                return -EFAULT;
-
-        return 0;
+        struct statx tmp;
+
+        memset(&tmp, 0, sizeof(tmp));
+
+        tmp.stx_mask = stat->result_mask;
+        tmp.stx_blksize = stat->blksize;
+        tmp.stx_attributes = stat->attributes;
+        tmp.stx_nlink = stat->nlink;
+        tmp.stx_uid = from_kuid_munged(current_user_ns(), stat->uid);
+        tmp.stx_gid = from_kgid_munged(current_user_ns(), stat->gid);
+        tmp.stx_mode = stat->mode;
+        tmp.stx_ino = stat->ino;
+        tmp.stx_size = stat->size;
+        tmp.stx_blocks = stat->blocks;
+        tmp.stx_attributes_mask = stat->attributes_mask;
+        tmp.stx_atime.tv_sec = stat->atime.tv_sec;
+        tmp.stx_atime.tv_nsec = stat->atime.tv_nsec;
+        tmp.stx_btime.tv_sec = stat->btime.tv_sec;
+        tmp.stx_btime.tv_nsec = stat->btime.tv_nsec;
+        tmp.stx_ctime.tv_sec = stat->ctime.tv_sec;
+        tmp.stx_ctime.tv_nsec = stat->ctime.tv_nsec;
+        tmp.stx_mtime.tv_sec = stat->mtime.tv_sec;
+        tmp.stx_mtime.tv_nsec = stat->mtime.tv_nsec;
+        tmp.stx_rdev_major = MAJOR(stat->rdev);
+        tmp.stx_rdev_minor = MINOR(stat->rdev);
+        tmp.stx_dev_major = MAJOR(stat->dev);
+        tmp.stx_dev_minor = MINOR(stat->dev);
+
+        return copy_to_user(buffer, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
 /**
@@ -570,10 +563,10 @@ SYSCALL_DEFINE5(statx,
         struct kstat stat;
         int error;
 
+        if (mask & STATX__RESERVED)
+                return -EINVAL;
         if ((flags & AT_STATX_SYNC_TYPE) == AT_STATX_SYNC_TYPE)
                 return -EINVAL;
-        if (!access_ok(VERIFY_WRITE, buffer, sizeof(*buffer)))
-                return -EFAULT;
 
         if (filename)
                 error = vfs_statx(dfd, filename, flags, &stat, mask);
@@ -581,7 +574,8 @@ SYSCALL_DEFINE5(statx,
                 error = vfs_statx_fd(dfd, &stat, mask, flags);
         if (error)
                 return error;
-        return statx_set_result(&stat, buffer);
+
+        return cp_statx(&stat, buffer);
 }
 
 /* Caller is here responsible for sufficient locking (ie. inode->i_lock) */
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index b803213d1307..39c75a86c67f 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -108,7 +108,7 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
 {
         const struct sysfs_ops *ops = sysfs_file_ops(of->kn);
         struct kobject *kobj = of->kn->parent->priv;
-        size_t len;
+        ssize_t len;
 
         /*
          * If buf != of->prealloc_buf, we don't know how
@@ -117,13 +117,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
         if (WARN_ON_ONCE(buf != of->prealloc_buf))
                 return 0;
         len = ops->show(kobj, of->kn->priv, buf);
+        if (len < 0)
+                return len;
         if (pos) {
                 if (len <= pos)
                         return 0;
                 len -= pos;
                 memmove(buf, buf + pos, len);
         }
-        return min(count, len);
+        return min_t(ssize_t, count, len);
 }
 
 /* kernfs write callback for regular sysfs files */
diff --git a/fs/timerfd.c b/fs/timerfd.c
index 384fa759a563..c543cdb5f8ed 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -400,9 +400,9 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
              clockid != CLOCK_BOOTTIME_ALARM))
                 return -EINVAL;
 
-        if (!capable(CAP_WAKE_ALARM) &&
-            (clockid == CLOCK_REALTIME_ALARM ||
-             clockid == CLOCK_BOOTTIME_ALARM))
+        if ((clockid == CLOCK_REALTIME_ALARM ||
+             clockid == CLOCK_BOOTTIME_ALARM) &&
+            !capable(CAP_WAKE_ALARM))
                 return -EPERM;
 
         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
@@ -449,7 +449,7 @@ static int do_timerfd_settime(int ufd, int flags,
                 return ret;
         ctx = f.file->private_data;
 
-        if (!capable(CAP_WAKE_ALARM) && isalarm(ctx)) {
+        if (isalarm(ctx) && !capable(CAP_WAKE_ALARM)) {
                 fdput(f);
                 return -EPERM;
         }
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 1e712a364680..718b749fa11a 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -32,6 +32,7 @@
 #include <linux/math64.h>
 #include <linux/uaccess.h>
 #include <linux/random.h>
+#include <linux/ctype.h>
 #include "ubifs.h"
 
 static DEFINE_SPINLOCK(dbg_lock);
@@ -286,8 +287,10 @@ void ubifs_dump_inode(struct ubifs_info *c, const struct inode *inode)
                         break;
                 }
 
-                pr_err("\t%d: %s (%s)\n",
-                       count++, dent->name, get_dent_type(dent->type));
+                pr_err("\t%d: inode %llu, type %s, len %d\n",
+                       count++, (unsigned long long) le64_to_cpu(dent->inum),
+                       get_dent_type(dent->type),
+                       le16_to_cpu(dent->nlen));
 
                 fname_name(&nm) = dent->name;
                 fname_len(&nm) = le16_to_cpu(dent->nlen);
@@ -464,7 +467,8 @@ void ubifs_dump_node(const struct ubifs_info *c, const void *node)
                         pr_err("(bad name length, not printing, bad or corrupted node)");
                 else {
                         for (i = 0; i < nlen && dent->name[i]; i++)
-                                pr_cont("%c", dent->name[i]);
+                                pr_cont("%c", isprint(dent->name[i]) ?
+                                        dent->name[i] : '?');
                 }
                 pr_cont("\n");
 
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index 30825d882aa9..b777bddaa1dd 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -606,8 +606,8 @@ static int ubifs_readdir(struct file *file, struct dir_context *ctx)
         }
 
         while (1) {
-                dbg_gen("feed '%s', ino %llu, new f_pos %#x",
-                        dent->name, (unsigned long long)le64_to_cpu(dent->inum),
+                dbg_gen("ino %llu, new f_pos %#x",
+                        (unsigned long long)le64_to_cpu(dent->inum),
                         key_hash_flash(c, &dent->key));
                 ubifs_assert(le64_to_cpu(dent->ch.sqnum) >
                              ubifs_inode(dir)->creat_sqnum);
@@ -748,6 +748,11 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
                 goto out_fname;
 
         lock_2_inodes(dir, inode);
+
+        /* Handle O_TMPFILE corner case, it is allowed to link a O_TMPFILE. */
+        if (inode->i_nlink == 0)
+                ubifs_delete_orphan(c, inode->i_ino);
+
         inc_nlink(inode);
         ihold(inode);
         inode->i_ctime = ubifs_current_time(inode);
@@ -768,6 +773,8 @@ out_cancel:
         dir->i_size -= sz_change;
         dir_ui->ui_size = dir->i_size;
         drop_nlink(inode);
+        if (inode->i_nlink == 0)
+                ubifs_add_orphan(c, inode->i_ino);
         unlock_2_inodes(dir, inode);
         ubifs_release_budget(c, &req);
         iput(inode);
@@ -1068,8 +1075,10 @@ static int ubifs_mknod(struct inode *dir, struct dentry *dentry,
         }
 
         err = fscrypt_setup_filename(dir, &dentry->d_name, 0, &nm);
-        if (err)
+        if (err) {
+                kfree(dev);
                 goto out_budg;
+        }
 
         sz_change = CALC_DENT_SIZE(fname_len(&nm));
 
@@ -1316,9 +1325,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,
         unsigned int uninitialized_var(saved_nlink);
         struct fscrypt_name old_nm, new_nm;
 
-        if (flags & ~RENAME_NOREPLACE)
-                return -EINVAL;
-
         /*
          * Budget request settings: deletion direntry, new direntry, removing
          * the old inode, and changing old and new parent directory inodes.
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 973607df579d..f7555fc25877 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -138,8 +138,6 @@ out:
  * userfaultfd_ctx_get - Acquires a reference to the internal userfaultfd
  * context.
  * @ctx: [in] Pointer to the userfaultfd context.
- *
- * Returns: In case of success, returns not zero.
  */
 static void userfaultfd_ctx_get(struct userfaultfd_ctx *ctx)
 {
@@ -267,6 +265,7 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
 {
         struct mm_struct *mm = ctx->mm;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd, _pmd;
         pte_t *pte;
@@ -277,7 +276,10 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
                 goto out;
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (!p4d_present(*p4d))
+                goto out;
+        pud = pud_offset(p4d, address);
         if (!pud_present(*pud))
                 goto out;
         pmd = pmd_offset(pud, address);
@@ -490,7 +492,7 @@ int handle_userfault(struct vm_fault *vmf, unsigned long reason)
                          * in such case.
                          */
                         down_read(&mm->mmap_sem);
-                        ret = 0;
+                        ret = VM_FAULT_NOPAGE;
                 }
         }
 
@@ -527,10 +529,11 @@ out:
         return ret;
 }
 
-static int userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
-                                             struct userfaultfd_wait_queue *ewq)
+static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
+                                              struct userfaultfd_wait_queue *ewq)
 {
-        int ret = 0;
+        if (WARN_ON_ONCE(current->flags & PF_EXITING))
+                goto out;
 
         ewq->ctx = ctx;
         init_waitqueue_entry(&ewq->wq, current);
@@ -547,8 +550,16 @@ static int userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                         break;
                 if (ACCESS_ONCE(ctx->released) ||
                     fatal_signal_pending(current)) {
-                        ret = -1;
                         __remove_wait_queue(&ctx->event_wqh, &ewq->wq);
+                        if (ewq->msg.event == UFFD_EVENT_FORK) {
+                                struct userfaultfd_ctx *new;
+
+                                new = (struct userfaultfd_ctx *)
+                                        (unsigned long)
+                                        ewq->msg.arg.reserved.reserved1;
+
+                                userfaultfd_ctx_put(new);
+                        }
                         break;
                 }
 
@@ -566,9 +577,8 @@ static int userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
          * ctx may go away after this if the userfault pseudo fd is
          * already released.
          */
-
+out:
         userfaultfd_ctx_put(ctx);
-        return ret;
 }
 
 static void userfaultfd_event_complete(struct userfaultfd_ctx *ctx,
@@ -626,7 +636,7 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
         return 0;
 }
 
-static int dup_fctx(struct userfaultfd_fork_ctx *fctx)
+static void dup_fctx(struct userfaultfd_fork_ctx *fctx)
 {
         struct userfaultfd_ctx *ctx = fctx->orig;
         struct userfaultfd_wait_queue ewq;
@@ -636,17 +646,15 @@ static int dup_fctx(struct userfaultfd_fork_ctx *fctx)
         ewq.msg.event = UFFD_EVENT_FORK;
         ewq.msg.arg.reserved.reserved1 = (unsigned long)fctx->new;
 
-        return userfaultfd_event_wait_completion(ctx, &ewq);
+        userfaultfd_event_wait_completion(ctx, &ewq);
 }
 
 void dup_userfaultfd_complete(struct list_head *fcs)
 {
-        int ret = 0;
         struct userfaultfd_fork_ctx *fctx, *n;
 
         list_for_each_entry_safe(fctx, n, fcs, list) {
-                if (!ret)
-                        ret = dup_fctx(fctx);
+                dup_fctx(fctx);
                 list_del(&fctx->list);
                 kfree(fctx);
         }
@@ -689,8 +697,7 @@ void mremap_userfaultfd_complete(struct vm_userfaultfd_ctx *vm_ctx,
         userfaultfd_event_wait_completion(ctx, &ewq);
 }
 
-void userfaultfd_remove(struct vm_area_struct *vma,
-                        struct vm_area_struct **prev,
+bool userfaultfd_remove(struct vm_area_struct *vma,
                         unsigned long start, unsigned long end)
 {
         struct mm_struct *mm = vma->vm_mm;
@@ -699,13 +706,11 @@ void userfaultfd_remove(struct vm_area_struct *vma,
 
         ctx = vma->vm_userfaultfd_ctx.ctx;
         if (!ctx || !(ctx->features & UFFD_FEATURE_EVENT_REMOVE))
-                return;
+                return true;
 
         userfaultfd_ctx_get(ctx);
         up_read(&mm->mmap_sem);
 
-        *prev = NULL; /* We wait for ACK w/o the mmap semaphore */
-
         msg_init(&ewq.msg);
 
         ewq.msg.event = UFFD_EVENT_REMOVE;
@@ -714,7 +719,7 @@ void userfaultfd_remove(struct vm_area_struct *vma,
 
         userfaultfd_event_wait_completion(ctx, &ewq);
 
-        down_read(&mm->mmap_sem);
+        return false;
 }
 
 static bool has_unmap_ctx(struct userfaultfd_ctx *ctx, struct list_head *unmaps,
@@ -775,34 +780,6 @@ void userfaultfd_unmap_complete(struct mm_struct *mm, struct list_head *uf)
         }
 }
 
-void userfaultfd_exit(struct mm_struct *mm)
-{
-        struct vm_area_struct *vma = mm->mmap;
-
-        /*
-         * We can do the vma walk without locking because the caller
-         * (exit_mm) knows it now has exclusive access
-         */
-        while (vma) {
-                struct userfaultfd_ctx *ctx = vma->vm_userfaultfd_ctx.ctx;
-
-                if (ctx && (ctx->features & UFFD_FEATURE_EVENT_EXIT)) {
-                        struct userfaultfd_wait_queue ewq;
-
-                        userfaultfd_ctx_get(ctx);
-
-                        msg_init(&ewq.msg);
-                        ewq.msg.event = UFFD_EVENT_EXIT;
-
-                        userfaultfd_event_wait_completion(ctx, &ewq);
-
-                        ctx->features &= ~UFFD_FEATURE_EVENT_EXIT;
-                }
-
-                vma = vma->vm_next;
-        }
-}
-
 static int userfaultfd_release(struct inode *inode, struct file *file)
 {
         struct userfaultfd_ctx *ctx = file->private_data;
@@ -1779,7 +1756,7 @@ static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
          *      protocols: aa:... bb:...
          */
         seq_printf(m, "pending:\t%lu\ntotal:\t%lu\nAPI:\t%Lx:%x:%Lx\n",
-                   pending, total, UFFD_API, UFFD_API_FEATURES,
+                   pending, total, UFFD_API, ctx->features,
                    UFFD_API_IOCTLS|UFFD_API_RANGE_IOCTLS);
 }
 #endif
diff --git a/fs/xfs/kmem.c b/fs/xfs/kmem.c
index 2dfdc62f795e..70a5b55e0870 100644
--- a/fs/xfs/kmem.c
+++ b/fs/xfs/kmem.c
@@ -25,24 +25,6 @@
 #include "kmem.h"
 #include "xfs_message.h"
 
-/*
- * Greedy allocation.  May fail and may return vmalloced memory.
- */
-void *
-kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize)
-{
-        void            *ptr;
-        size_t          kmsize = maxsize;
-
-        while (!(ptr = vzalloc(kmsize))) {
-                if ((kmsize >>= 1) <= minsize)
-                        kmsize = minsize;
-        }
-        if (ptr)
-                *size = kmsize;
-        return ptr;
-}
-
 void *
 kmem_alloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
index 689f746224e7..f0fc84fcaac2 100644
--- a/fs/xfs/kmem.h
+++ b/fs/xfs/kmem.h
@@ -69,8 +69,6 @@ static inline void  kmem_free(const void *ptr)
 }
 
 
-extern void *kmem_zalloc_greedy(size_t *, size_t, size_t);
-
 static inline void *
 kmem_zalloc(size_t size, xfs_km_flags_t flags)
 {
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index a9c66d47757a..9bd104f32908 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -763,8 +763,8 @@ xfs_bmap_extents_to_btree(
                 args.type = XFS_ALLOCTYPE_START_BNO;
                 args.fsbno = XFS_INO_TO_FSB(mp, ip->i_ino);
         } else if (dfops->dop_low) {
-try_another_ag:
                 args.type = XFS_ALLOCTYPE_START_BNO;
+try_another_ag:
                 args.fsbno = *firstblock;
         } else {
                 args.type = XFS_ALLOCTYPE_NEAR_BNO;
@@ -790,13 +790,17 @@ try_another_ag:
         if (xfs_sb_version_hasreflink(&cur->bc_mp->m_sb) &&
             args.fsbno == NULLFSBLOCK &&
             args.type == XFS_ALLOCTYPE_NEAR_BNO) {
-                dfops->dop_low = true;
+                args.type = XFS_ALLOCTYPE_FIRST_AG;
                 goto try_another_ag;
         }
+        if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
+                xfs_iroot_realloc(ip, -1, whichfork);
+                xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
+                return -ENOSPC;
+        }
         /*
          * Allocation can't fail, the space was reserved.
          */
-        ASSERT(args.fsbno != NULLFSBLOCK);
         ASSERT(*firstblock == NULLFSBLOCK ||
                args.agno >= XFS_FSB_TO_AGNO(mp, *firstblock));
         *firstblock = cur->bc_private.b.firstblock = args.fsbno;
@@ -4150,6 +4154,19 @@ xfs_bmapi_read(
         return 0;
 }
 
+/*
+ * Add a delayed allocation extent to an inode. Blocks are reserved from the
+ * global pool and the extent inserted into the inode in-core extent tree.
+ *
+ * On entry, got refers to the first extent beyond the offset of the extent to
+ * allocate or eof is specified if no such extent exists. On return, got refers
+ * to the extent record that was inserted to the inode fork.
+ *
+ * Note that the allocated extent may have been merged with contiguous extents
+ * during insertion into the inode fork. Thus, got does not reflect the current
+ * state of the inode fork on return. If necessary, the caller can use lastx to
+ * look up the updated record in the inode fork.
+ */
 int
 xfs_bmapi_reserve_delalloc(
         struct xfs_inode        *ip,
@@ -4236,13 +4253,8 @@ xfs_bmapi_reserve_delalloc(
         got->br_startblock = nullstartblock(indlen);
         got->br_blockcount = alen;
         got->br_state = XFS_EXT_NORM;
-        xfs_bmap_add_extent_hole_delay(ip, whichfork, lastx, got);
 
-        /*
-         * Update our extent pointer, given that xfs_bmap_add_extent_hole_delay
-         * might have merged it into one of the neighbouring ones.
-         */
-        xfs_bmbt_get_all(xfs_iext_get_ext(ifp, *lastx), got);
+        xfs_bmap_add_extent_hole_delay(ip, whichfork, lastx, got);
 
         /*
          * Tag the inode if blocks were preallocated. Note that COW fork
@@ -4254,10 +4266,6 @@ xfs_bmapi_reserve_delalloc(
         if (whichfork == XFS_COW_FORK && (prealloc || aoff < off || alen > len))
                 xfs_inode_set_cowblocks_tag(ip);
 
-        ASSERT(got->br_startoff <= aoff);
-        ASSERT(got->br_startoff + got->br_blockcount >= aoff + alen);
-        ASSERT(isnullstartblock(got->br_startblock));
-        ASSERT(got->br_state == XFS_EXT_NORM);
         return 0;
 
 out_unreserve_blocks:
diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
index f93072b58a58..fd55db479385 100644
--- a/fs/xfs/libxfs/xfs_bmap_btree.c
+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
@@ -447,8 +447,8 @@ xfs_bmbt_alloc_block(
 
         if (args.fsbno == NULLFSBLOCK) {
                 args.fsbno = be64_to_cpu(start->l);
-try_another_ag:
                 args.type = XFS_ALLOCTYPE_START_BNO;
+try_another_ag:
                 /*
                  * Make sure there is sufficient room left in the AG to
                  * complete a full tree split for an extent insert.  If
@@ -488,8 +488,8 @@ try_another_ag:
         if (xfs_sb_version_hasreflink(&cur->bc_mp->m_sb) &&
             args.fsbno == NULLFSBLOCK &&
             args.type == XFS_ALLOCTYPE_NEAR_BNO) {
-                cur->bc_private.b.dfops->dop_low = true;
                 args.fsbno = cur->bc_private.b.firstblock;
+                args.type = XFS_ALLOCTYPE_FIRST_AG;
                 goto try_another_ag;
         }
 
@@ -506,7 +506,7 @@ try_another_ag:
                         goto error0;
                 cur->bc_private.b.dfops->dop_low = true;
         }
-        if (args.fsbno == NULLFSBLOCK) {
+        if (WARN_ON_ONCE(args.fsbno == NULLFSBLOCK)) {
                 XFS_BTREE_TRACE_CURSOR(cur, XBT_EXIT);
                 *stat = 0;
                 return 0;
diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h
index d04547fcf274..39f8604f764e 100644
--- a/fs/xfs/libxfs/xfs_dir2_priv.h
+++ b/fs/xfs/libxfs/xfs_dir2_priv.h
@@ -125,6 +125,7 @@ extern int xfs_dir2_sf_create(struct xfs_da_args *args, xfs_ino_t pino);
 extern int xfs_dir2_sf_lookup(struct xfs_da_args *args);
 extern int xfs_dir2_sf_removename(struct xfs_da_args *args);
 extern int xfs_dir2_sf_replace(struct xfs_da_args *args);
+extern int xfs_dir2_sf_verify(struct xfs_inode *ip);
 
 /* xfs_dir2_readdir.c */
 extern int xfs_readdir(struct xfs_inode *dp, struct dir_context *ctx,
diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
index c6809ff41197..e84af093b2ab 100644
--- a/fs/xfs/libxfs/xfs_dir2_sf.c
+++ b/fs/xfs/libxfs/xfs_dir2_sf.c
@@ -629,6 +629,112 @@ xfs_dir2_sf_check(
 }
 #endif  /* DEBUG */
 
+/* Verify the consistency of an inline directory. */
+int
+xfs_dir2_sf_verify(
+        struct xfs_inode                *ip)
+{
+        struct xfs_mount                *mp = ip->i_mount;
+        struct xfs_dir2_sf_hdr          *sfp;
+        struct xfs_dir2_sf_entry        *sfep;
+        struct xfs_dir2_sf_entry        *next_sfep;
+        char                            *endp;
+        const struct xfs_dir_ops        *dops;
+        struct xfs_ifork                *ifp;
+        xfs_ino_t                       ino;
+        int                             i;
+        int                             i8count;
+        int                             offset;
+        int                             size;
+        int                             error;
+        __uint8_t                       filetype;
+
+        ASSERT(ip->i_d.di_format == XFS_DINODE_FMT_LOCAL);
+        /*
+         * xfs_iread calls us before xfs_setup_inode sets up ip->d_ops,
+         * so we can only trust the mountpoint to have the right pointer.
+         */
+        dops = xfs_dir_get_ops(mp, NULL);
+
+        ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+        sfp = (struct xfs_dir2_sf_hdr *)ifp->if_u1.if_data;
+        size = ifp->if_bytes;
+
+        /*
+         * Give up if the directory is way too short.
+         */
+        if (size <= offsetof(struct xfs_dir2_sf_hdr, parent) ||
+            size < xfs_dir2_sf_hdr_size(sfp->i8count))
+                return -EFSCORRUPTED;
+
+        endp = (char *)sfp + size;
+
+        /* Check .. entry */
+        ino = dops->sf_get_parent_ino(sfp);
+        i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
+        error = xfs_dir_ino_validate(mp, ino);
+        if (error)
+                return error;
+        offset = dops->data_first_offset;
+
+        /* Check all reported entries */
+        sfep = xfs_dir2_sf_firstentry(sfp);
+        for (i = 0; i < sfp->count; i++) {
+                /*
+                 * struct xfs_dir2_sf_entry has a variable length.
+                 * Check the fixed-offset parts of the structure are
+                 * within the data buffer.
+                 */
+                if (((char *)sfep + sizeof(*sfep)) >= endp)
+                        return -EFSCORRUPTED;
+
+                /* Don't allow names with known bad length. */
+                if (sfep->namelen == 0)
+                        return -EFSCORRUPTED;
+
+                /*
+                 * Check that the variable-length part of the structure is
+                 * within the data buffer.  The next entry starts after the
+                 * name component, so nextentry is an acceptable test.
+                 */
+                next_sfep = dops->sf_nextentry(sfp, sfep);
+                if (endp < (char *)next_sfep)
+                        return -EFSCORRUPTED;
+
+                /* Check that the offsets always increase. */
+                if (xfs_dir2_sf_get_offset(sfep) < offset)
+                        return -EFSCORRUPTED;
+
+                /* Check the inode number. */
+                ino = dops->sf_get_ino(sfp, sfep);
+                i8count += ino > XFS_DIR2_MAX_SHORT_INUM;
+                error = xfs_dir_ino_validate(mp, ino);
+                if (error)
+                        return error;
+
+                /* Check the file type. */
+                filetype = dops->sf_get_ftype(sfep);
+                if (filetype >= XFS_DIR3_FT_MAX)
+                        return -EFSCORRUPTED;
+
+                offset = xfs_dir2_sf_get_offset(sfep) +
+                                dops->data_entsize(sfep->namelen);
+
+                sfep = next_sfep;
+        }
+        if (i8count != sfp->i8count)
+                return -EFSCORRUPTED;
+        if ((void *)sfep != (void *)endp)
+                return -EFSCORRUPTED;
+
+        /* Make sure this whole thing ought to be in local format. */
+        if (offset + (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
+            (uint)sizeof(xfs_dir2_block_tail_t) > mp->m_dir_geo->blksize)
+                return -EFSCORRUPTED;
+
+        return 0;
+}
+
 /*
  * Create a new (shortform) directory.
  */
diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
index 25c1e078aef6..8a37efe04de3 100644
--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -33,6 +33,8 @@
 #include "xfs_trace.h"
 #include "xfs_attr_sf.h"
 #include "xfs_da_format.h"
+#include "xfs_da_btree.h"
+#include "xfs_dir2_priv.h"
 
 kmem_zone_t *xfs_ifork_zone;
 
@@ -210,6 +212,16 @@ xfs_iformat_fork(
         if (error)
                 return error;
 
+        /* Check inline dir contents. */
+        if (S_ISDIR(VFS_I(ip)->i_mode) &&
+            dip->di_format == XFS_DINODE_FMT_LOCAL) {
+                error = xfs_dir2_sf_verify(ip);
+                if (error) {
+                        xfs_idestroy_fork(ip, XFS_DATA_FORK);
+                        return error;
+                }
+        }
+
         if (xfs_is_reflink_inode(ip)) {
                 ASSERT(ip->i_cowfp == NULL);
                 xfs_ifork_init_cow(ip);
@@ -320,7 +332,6 @@ xfs_iformat_local(
         int             whichfork,
         int             size)
 {
-
         /*
          * If the size is unreasonable, then something
          * is wrong and we just bail out rather than crash in
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index bf65a9ea8642..61494295d92f 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -274,54 +274,49 @@ xfs_end_io(
         struct xfs_ioend        *ioend =
                 container_of(work, struct xfs_ioend, io_work);
         struct xfs_inode        *ip = XFS_I(ioend->io_inode);
+        xfs_off_t               offset = ioend->io_offset;
+        size_t                  size = ioend->io_size;
         int                     error = ioend->io_bio->bi_error;
 
         /*
-         * Set an error if the mount has shut down and proceed with end I/O
-         * processing so it can perform whatever cleanups are necessary.
+         * Just clean up the in-memory strutures if the fs has been shut down.
          */
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
                 error = -EIO;
+                goto done;
+        }
 
         /*
-         * For a CoW extent, we need to move the mapping from the CoW fork
-         * to the data fork.  If instead an error happened, just dump the
-         * new blocks.
+         * Clean up any COW blocks on an I/O error.
          */
-        if (ioend->io_type == XFS_IO_COW) {
-                if (error)
-                        goto done;
-                if (ioend->io_bio->bi_error) {
-                        error = xfs_reflink_cancel_cow_range(ip,
-                                        ioend->io_offset, ioend->io_size);
-                        goto done;
+        if (unlikely(error)) {
+                switch (ioend->io_type) {
+                case XFS_IO_COW:
+                        xfs_reflink_cancel_cow_range(ip, offset, size, true);
+                        break;
                 }
-                error = xfs_reflink_end_cow(ip, ioend->io_offset,
-                                ioend->io_size);
-                if (error)
-                        goto done;
+
+                goto done;
         }
 
         /*
-         * For unwritten extents we need to issue transactions to convert a
-         * range to normal written extens after the data I/O has finished.
-         * Detecting and handling completion IO errors is done individually
-         * for each case as different cleanup operations need to be performed
-         * on error.
+         * Success:  commit the COW or unwritten blocks if needed.
          */
-        if (ioend->io_type == XFS_IO_UNWRITTEN) {
-                if (error)
-                        goto done;
-                error = xfs_iomap_write_unwritten(ip, ioend->io_offset,
-                                                  ioend->io_size);
-        } else if (ioend->io_append_trans) {
-                error = xfs_setfilesize_ioend(ioend, error);
-        } else {
-                ASSERT(!xfs_ioend_is_append(ioend) ||
-                       ioend->io_type == XFS_IO_COW);
+        switch (ioend->io_type) {
+        case XFS_IO_COW:
+                error = xfs_reflink_end_cow(ip, offset, size);
+                break;
+        case XFS_IO_UNWRITTEN:
+                error = xfs_iomap_write_unwritten(ip, offset, size);
+                break;
+        default:
+                ASSERT(!xfs_ioend_is_append(ioend) || ioend->io_append_trans);
+                break;
         }
 
 done:
+        if (ioend->io_append_trans)
+                error = xfs_setfilesize_ioend(ioend, error);
         xfs_destroy_ioend(ioend, error);
 }
 
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 8b75dcea5966..828532ce0adc 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1311,8 +1311,16 @@ xfs_free_file_space(
         /*
          * Now that we've unmap all full blocks we'll have to zero out any
          * partial block at the beginning and/or end.  xfs_zero_range is
-         * smart enough to skip any holes, including those we just created.
+         * smart enough to skip any holes, including those we just created,
+         * but we must take care not to zero beyond EOF and enlarge i_size.
          */
+
+        if (offset >= XFS_ISIZE(ip))
+                return 0;
+
+        if (offset + len > XFS_ISIZE(ip))
+                len = XFS_ISIZE(ip) - offset;
+
         return xfs_zero_range(ip, offset, len, NULL);
 }
 
diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 003a99b83bd8..ad9396e516f6 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -71,22 +71,11 @@ xfs_dir2_sf_getdents(
         struct xfs_da_geometry  *geo = args->geo;
 
         ASSERT(dp->i_df.if_flags & XFS_IFINLINE);
-        /*
-         * Give up if the directory is way too short.
-         */
-        if (dp->i_d.di_size < offsetof(xfs_dir2_sf_hdr_t, parent)) {
-                ASSERT(XFS_FORCED_SHUTDOWN(dp->i_mount));
-                return -EIO;
-        }
-
         ASSERT(dp->i_df.if_bytes == dp->i_d.di_size);
         ASSERT(dp->i_df.if_u1.if_data != NULL);
 
         sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
 
-        if (dp->i_d.di_size < xfs_dir2_sf_hdr_size(sfp->i8count))
-                return -EFSCORRUPTED;
-
         /*
          * If the block number in the offset is out of range, we're done.
          */
diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
index 7234b9748c36..3531f8f72fa5 100644
--- a/fs/xfs/xfs_icache.c
+++ b/fs/xfs/xfs_icache.c
@@ -1608,7 +1608,7 @@ xfs_inode_free_cowblocks(
         xfs_ilock(ip, XFS_IOLOCK_EXCL);
         xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
 
-        ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF);
+        ret = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, false);
 
         xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
         xfs_iunlock(ip, XFS_IOLOCK_EXCL);
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index edfa6a55b064..7605d8396596 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -50,6 +50,7 @@
 #include "xfs_log.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_reflink.h"
+#include "xfs_dir2_priv.h"
 
 kmem_zone_t *xfs_inode_zone;
 
@@ -1615,7 +1616,7 @@ xfs_itruncate_extents(
 
         /* Remove all pending CoW reservations. */
         error = xfs_reflink_cancel_cow_blocks(ip, &tp, first_unmap_block,
-                        last_block);
+                        last_block, true);
         if (error)
                 goto out;
 
@@ -3546,6 +3547,12 @@ xfs_iflush_int(
         if (ip->i_d.di_version < 3)
                 ip->i_d.di_flushiter++;
 
+        /* Check the inline directory data. */
+        if (S_ISDIR(VFS_I(ip)->i_mode) &&
+            ip->i_d.di_format == XFS_DINODE_FMT_LOCAL &&
+            xfs_dir2_sf_verify(ip))
+                goto corrupt_out;
+
         /*
          * Copy the dirty parts of the inode into the on-disk inode.  We always
          * copy out the core of the inode, because if the inode is dirty at all
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 41662fb14e87..288ee5b840d7 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -630,6 +630,11 @@ retry:
                 goto out_unlock;
         }
 
+        /*
+         * Flag newly allocated delalloc blocks with IOMAP_F_NEW so we punch
+         * them out if the write happens to fail.
+         */
+        iomap->flags = IOMAP_F_NEW;
         trace_xfs_iomap_alloc(ip, offset, count, 0, &got);
 done:
         if (isnullstartblock(got.br_startblock))
@@ -1071,16 +1076,22 @@ xfs_file_iomap_end_delalloc(
         struct xfs_inode        *ip,
         loff_t                  offset,
         loff_t                  length,
-        ssize_t                 written)
+        ssize_t                 written,
+        struct iomap            *iomap)
 {
         struct xfs_mount        *mp = ip->i_mount;
         xfs_fileoff_t           start_fsb;
         xfs_fileoff_t           end_fsb;
         int                     error = 0;
 
-        /* behave as if the write failed if drop writes is enabled */
-        if (xfs_mp_drop_writes(mp))
+        /*
+         * Behave as if the write failed if drop writes is enabled. Set the NEW
+         * flag to force delalloc cleanup.
+         */
+        if (xfs_mp_drop_writes(mp)) {
+                iomap->flags |= IOMAP_F_NEW;
                 written = 0;
+        }
 
         /*
          * start_fsb refers to the first unused block after a short write. If
@@ -1094,14 +1105,14 @@ xfs_file_iomap_end_delalloc(
         end_fsb = XFS_B_TO_FSB(mp, offset + length);
 
         /*
-         * Trim back delalloc blocks if we didn't manage to write the whole
-         * range reserved.
+         * Trim delalloc blocks if they were allocated by this write and we
+         * didn't manage to write the whole range.
          *
          * We don't need to care about racing delalloc as we hold i_mutex
          * across the reserve/allocate/unreserve calls. If there are delalloc
          * blocks in the range, they are ours.
          */
-        if (start_fsb < end_fsb) {
+        if ((iomap->flags & IOMAP_F_NEW) && start_fsb < end_fsb) {
                 truncate_pagecache_range(VFS_I(ip), XFS_FSB_TO_B(mp, start_fsb),
                                          XFS_FSB_TO_B(mp, end_fsb) - 1);
 
@@ -1131,7 +1142,7 @@ xfs_file_iomap_end(
 {
         if ((flags & IOMAP_WRITE) && iomap->type == IOMAP_DELALLOC)
                 return xfs_file_iomap_end_delalloc(XFS_I(inode), offset,
-                                length, written);
+                                length, written, iomap);
         return 0;
 }
 
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 229cc6a6d8ef..ebfc13350f9a 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -516,6 +516,20 @@ xfs_vn_getattr(
         stat->blocks =
                 XFS_FSB_TO_BB(mp, ip->i_d.di_nblocks + ip->i_delayed_blks);
 
+        if (ip->i_d.di_version == 3) {
+                if (request_mask & STATX_BTIME) {
+                        stat->result_mask |= STATX_BTIME;
+                        stat->btime.tv_sec = ip->i_d.di_crtime.t_sec;
+                        stat->btime.tv_nsec = ip->i_d.di_crtime.t_nsec;
+                }
+        }
+
+        if (ip->i_d.di_flags & XFS_DIFLAG_IMMUTABLE)
+                stat->attributes |= STATX_ATTR_IMMUTABLE;
+        if (ip->i_d.di_flags & XFS_DIFLAG_APPEND)
+                stat->attributes |= STATX_ATTR_APPEND;
+        if (ip->i_d.di_flags & XFS_DIFLAG_NODUMP)
+                stat->attributes |= STATX_ATTR_NODUMP;
 
         switch (inode->i_mode & S_IFMT) {
         case S_IFBLK:
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 66e881790c17..26d67ce3c18d 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -361,7 +361,6 @@ xfs_bulkstat(
         xfs_agino_t             agino;  /* inode # in allocation group */
         xfs_agnumber_t          agno;   /* allocation group number */
         xfs_btree_cur_t         *cur;   /* btree cursor for ialloc btree */
-        size_t                  irbsize; /* size of irec buffer in bytes */
         xfs_inobt_rec_incore_t  *irbuf; /* start of irec buffer */
         int                     nirbuf; /* size of irbuf */
         int                     ubcount; /* size of user's buffer */
@@ -388,11 +387,10 @@ xfs_bulkstat(
         *ubcountp = 0;
         *done = 0;
 
-        irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4);
+        irbuf = kmem_zalloc_large(PAGE_SIZE * 4, KM_SLEEP);
         if (!irbuf)
                 return -ENOMEM;
-
-        nirbuf = irbsize / sizeof(*irbuf);
+        nirbuf = (PAGE_SIZE * 4) / sizeof(*irbuf);
 
         /*
          * Loop over the allocation groups, starting from the last
@@ -585,7 +583,7 @@ xfs_inumbers(
                 return error;
 
         bcount = MIN(left, (int)(PAGE_SIZE / sizeof(*buffer)));
-        buffer = kmem_alloc(bcount * sizeof(*buffer), KM_SLEEP);
+        buffer = kmem_zalloc(bcount * sizeof(*buffer), KM_SLEEP);
         do {
                 struct xfs_inobt_rec_incore     r;
                 int                             stat;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 450bde68bb75..688ebff1f663 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -513,8 +513,7 @@ STATIC void
 xfs_set_inoalignment(xfs_mount_t *mp)
 {
         if (xfs_sb_version_hasalign(&mp->m_sb) &&
-            mp->m_sb.sb_inoalignmt >=
-            XFS_B_TO_FSBT(mp, mp->m_inode_cluster_size))
+                mp->m_sb.sb_inoalignmt >= xfs_icluster_size_fsb(mp))
                 mp->m_inoalign_mask = mp->m_sb.sb_inoalignmt - 1;
         else
                 mp->m_inoalign_mask = 0;
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index da6d08fb359c..4a84c5ea266d 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -548,14 +548,18 @@ xfs_reflink_trim_irec_to_next_cow(
 }
 
 /*
- * Cancel all pending CoW reservations for some block range of an inode.
+ * Cancel CoW reservations for some block range of an inode.
+ *
+ * If cancel_real is true this function cancels all COW fork extents for the
+ * inode; if cancel_real is false, real extents are not cleared.
  */
 int
 xfs_reflink_cancel_cow_blocks(
         struct xfs_inode                *ip,
         struct xfs_trans                **tpp,
         xfs_fileoff_t                   offset_fsb,
-        xfs_fileoff_t                   end_fsb)
+        xfs_fileoff_t                   end_fsb,
+        bool                            cancel_real)
 {
         struct xfs_ifork                *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
         struct xfs_bmbt_irec            got, del;
@@ -579,7 +583,7 @@ xfs_reflink_cancel_cow_blocks(
                                         &idx, &got, &del);
                         if (error)
                                 break;
-                } else {
+                } else if (del.br_state == XFS_EXT_UNWRITTEN || cancel_real) {
                         xfs_trans_ijoin(*tpp, ip, 0);
                         xfs_defer_init(&dfops, &firstfsb);
 
@@ -621,13 +625,17 @@ xfs_reflink_cancel_cow_blocks(
 }
 
 /*
- * Cancel all pending CoW reservations for some byte range of an inode.
+ * Cancel CoW reservations for some byte range of an inode.
+ *
+ * If cancel_real is true this function cancels all COW fork extents for the
+ * inode; if cancel_real is false, real extents are not cleared.
  */
 int
 xfs_reflink_cancel_cow_range(
         struct xfs_inode        *ip,
         xfs_off_t               offset,
-        xfs_off_t               count)
+        xfs_off_t               count,
+        bool                    cancel_real)
 {
         struct xfs_trans        *tp;
         xfs_fileoff_t           offset_fsb;
@@ -653,7 +661,8 @@ xfs_reflink_cancel_cow_range(
         xfs_trans_ijoin(tp, ip, 0);
 
         /* Scrape out the old CoW reservations */
-        error = xfs_reflink_cancel_cow_blocks(ip, &tp, offset_fsb, end_fsb);
+        error = xfs_reflink_cancel_cow_blocks(ip, &tp, offset_fsb, end_fsb,
+                        cancel_real);
         if (error)
                 goto out_cancel;
 
@@ -1450,7 +1459,7 @@ next:
          * We didn't find any shared blocks so turn off the reflink flag.
          * First, get rid of any leftover CoW mappings.
          */
-        error = xfs_reflink_cancel_cow_blocks(ip, tpp, 0, NULLFILEOFF);
+        error = xfs_reflink_cancel_cow_blocks(ip, tpp, 0, NULLFILEOFF, true);
         if (error)
                 return error;
 
diff --git a/fs/xfs/xfs_reflink.h b/fs/xfs/xfs_reflink.h
index 33ac9b8db683..d29a7967f029 100644
--- a/fs/xfs/xfs_reflink.h
+++ b/fs/xfs/xfs_reflink.h
@@ -39,9 +39,9 @@ extern void xfs_reflink_trim_irec_to_next_cow(struct xfs_inode *ip,
 
 extern int xfs_reflink_cancel_cow_blocks(struct xfs_inode *ip,
                 struct xfs_trans **tpp, xfs_fileoff_t offset_fsb,
-                xfs_fileoff_t end_fsb);
+                xfs_fileoff_t end_fsb, bool cancel_real);
 extern int xfs_reflink_cancel_cow_range(struct xfs_inode *ip, xfs_off_t offset,
-                xfs_off_t count);
+                xfs_off_t count, bool cancel_real);
 extern int xfs_reflink_end_cow(struct xfs_inode *ip, xfs_off_t offset,
                 xfs_off_t count);
 extern int xfs_reflink_recover_cow(struct xfs_mount *mp);
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 890862f2447c..685c042a120f 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -953,7 +953,7 @@ xfs_fs_destroy_inode(
         XFS_STATS_INC(ip->i_mount, vn_remove);
 
         if (xfs_is_reflink_inode(ip)) {
-                error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF);
+                error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true);
                 if (error && !XFS_FORCED_SHUTDOWN(ip->i_mount))
                         xfs_warn(ip->i_mount,
 "Error %d while evicting CoW blocks for inode %llu.",
diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
index 5bdab6bffd23..928fd66b1271 100644
--- a/include/asm-generic/4level-fixup.h
+++ b/include/asm-generic/4level-fixup.h
@@ -15,7 +15,6 @@
         ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
                 NULL: pmd_offset(pud, address))
 
-#define pud_alloc(mm, pgd, address)     (pgd)
 #define pud_offset(pgd, start)          (pgd)
 #define pud_none(pud)                   0
 #define pud_bad(pud)                    0
@@ -35,4 +34,6 @@
 #undef  pud_addr_end
 #define pud_addr_end(addr, end)         (end)
 
+#include <asm-generic/5level-fixup.h>
+
 #endif
diff --git a/include/asm-generic/5level-fixup.h b/include/asm-generic/5level-fixup.h
new file mode 100644
index 000000000000..b5ca82dc4175
--- /dev/null
+++ b/include/asm-generic/5level-fixup.h
@@ -0,0 +1,41 @@
+#ifndef _5LEVEL_FIXUP_H
+#define _5LEVEL_FIXUP_H
+
+#define __ARCH_HAS_5LEVEL_HACK
+#define __PAGETABLE_P4D_FOLDED
+
+#define P4D_SHIFT                       PGDIR_SHIFT
+#define P4D_SIZE                        PGDIR_SIZE
+#define P4D_MASK                        PGDIR_MASK
+#define PTRS_PER_P4D                    1
+
+#define p4d_t                           pgd_t
+
+#define pud_alloc(mm, p4d, address) \
+        ((unlikely(pgd_none(*(p4d))) && __pud_alloc(mm, p4d, address)) ? \
+                NULL : pud_offset(p4d, address))
+
+#define p4d_alloc(mm, pgd, address)     (pgd)
+#define p4d_offset(pgd, start)          (pgd)
+#define p4d_none(p4d)                   0
+#define p4d_bad(p4d)                    0
+#define p4d_present(p4d)                1
+#define p4d_ERROR(p4d)                  do { } while (0)
+#define p4d_clear(p4d)                  pgd_clear(p4d)
+#define p4d_val(p4d)                    pgd_val(p4d)
+#define p4d_populate(mm, p4d, pud)      pgd_populate(mm, p4d, pud)
+#define p4d_page(p4d)                   pgd_page(p4d)
+#define p4d_page_vaddr(p4d)             pgd_page_vaddr(p4d)
+
+#define __p4d(x)                        __pgd(x)
+#define set_p4d(p4dp, p4d)              set_pgd(p4dp, p4d)
+
+#undef p4d_free_tlb
+#define p4d_free_tlb(tlb, x, addr)      do { } while (0)
+#define p4d_free(mm, x)                 do { } while (0)
+#define __p4d_free_tlb(tlb, x, addr)    do { } while (0)
+
+#undef  p4d_addr_end
+#define p4d_addr_end(addr, end)         (end)
+
+#endif
diff --git a/include/asm-generic/pgtable-nop4d-hack.h b/include/asm-generic/pgtable-nop4d-hack.h
new file mode 100644
index 000000000000..752fb7511750
--- /dev/null
+++ b/include/asm-generic/pgtable-nop4d-hack.h
@@ -0,0 +1,62 @@
+#ifndef _PGTABLE_NOP4D_HACK_H
+#define _PGTABLE_NOP4D_HACK_H
+
+#ifndef __ASSEMBLY__
+#include <asm-generic/5level-fixup.h>
+
+#define __PAGETABLE_PUD_FOLDED
+
+/*
+ * Having the pud type consist of a pgd gets the size right, and allows
+ * us to conceptually access the pgd entry that this pud is folded into
+ * without casting.
+ */
+typedef struct { pgd_t pgd; } pud_t;
+
+#define PUD_SHIFT       PGDIR_SHIFT
+#define PTRS_PER_PUD    1
+#define PUD_SIZE        (1UL << PUD_SHIFT)
+#define PUD_MASK        (~(PUD_SIZE-1))
+
+/*
+ * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * setup: the pud is never bad, and a pud always exists (as it's folded
+ * into the pgd entry)
+ */
+static inline int pgd_none(pgd_t pgd)           { return 0; }
+static inline int pgd_bad(pgd_t pgd)            { return 0; }
+static inline int pgd_present(pgd_t pgd)        { return 1; }
+static inline void pgd_clear(pgd_t *pgd)        { }
+#define pud_ERROR(pud)                          (pgd_ERROR((pud).pgd))
+
+#define pgd_populate(mm, pgd, pud)              do { } while (0)
+/*
+ * (puds are folded into pgds so this doesn't get actually called,
+ * but the define is needed for a generic inline function.)
+ */
+#define set_pgd(pgdptr, pgdval) set_pud((pud_t *)(pgdptr), (pud_t) { pgdval })
+
+static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+{
+        return (pud_t *)pgd;
+}
+
+#define pud_val(x)                              (pgd_val((x).pgd))
+#define __pud(x)                                ((pud_t) { __pgd(x) })
+
+#define pgd_page(pgd)                           (pud_page((pud_t){ pgd }))
+#define pgd_page_vaddr(pgd)                     (pud_page_vaddr((pud_t){ pgd }))
+
+/*
+ * allocating and freeing a pud is trivial: the 1-entry pud is
+ * inside the pgd, so has no extra memory associated with it.
+ */
+#define pud_alloc_one(mm, address)              NULL
+#define pud_free(mm, x)                         do { } while (0)
+#define __pud_free_tlb(tlb, x, a)               do { } while (0)
+
+#undef  pud_addr_end
+#define pud_addr_end(addr, end)                 (end)
+
+#endif /* __ASSEMBLY__ */
+#endif /* _PGTABLE_NOP4D_HACK_H */
diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h
new file mode 100644
index 000000000000..de364ecb8df6
--- /dev/null
+++ b/include/asm-generic/pgtable-nop4d.h
@@ -0,0 +1,56 @@
+#ifndef _PGTABLE_NOP4D_H
+#define _PGTABLE_NOP4D_H
+
+#ifndef __ASSEMBLY__
+
+#define __PAGETABLE_P4D_FOLDED
+
+typedef struct { pgd_t pgd; } p4d_t;
+
+#define P4D_SHIFT       PGDIR_SHIFT
+#define PTRS_PER_P4D    1
+#define P4D_SIZE        (1UL << P4D_SHIFT)
+#define P4D_MASK        (~(P4D_SIZE-1))
+
+/*
+ * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * setup: the p4d is never bad, and a p4d always exists (as it's folded
+ * into the pgd entry)
+ */
+static inline int pgd_none(pgd_t pgd)           { return 0; }
+static inline int pgd_bad(pgd_t pgd)            { return 0; }
+static inline int pgd_present(pgd_t pgd)        { return 1; }
+static inline void pgd_clear(pgd_t *pgd)        { }
+#define p4d_ERROR(p4d)                          (pgd_ERROR((p4d).pgd))
+
+#define pgd_populate(mm, pgd, p4d)              do { } while (0)
+/*
+ * (p4ds are folded into pgds so this doesn't get actually called,
+ * but the define is needed for a generic inline function.)
+ */
+#define set_pgd(pgdptr, pgdval) set_p4d((p4d_t *)(pgdptr), (p4d_t) { pgdval })
+
+static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
+{
+        return (p4d_t *)pgd;
+}
+
+#define p4d_val(x)                              (pgd_val((x).pgd))
+#define __p4d(x)                                ((p4d_t) { __pgd(x) })
+
+#define pgd_page(pgd)                           (p4d_page((p4d_t){ pgd }))
+#define pgd_page_vaddr(pgd)                     (p4d_page_vaddr((p4d_t){ pgd }))
+
+/*
+ * allocating and freeing a p4d is trivial: the 1-entry p4d is
+ * inside the pgd, so has no extra memory associated with it.
+ */
+#define p4d_alloc_one(mm, address)              NULL
+#define p4d_free(mm, x)                         do { } while (0)
+#define __p4d_free_tlb(tlb, x, a)               do { } while (0)
+
+#undef  p4d_addr_end
+#define p4d_addr_end(addr, end)                 (end)
+
+#endif /* __ASSEMBLY__ */
+#endif /* _PGTABLE_NOP4D_H */
diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
index 810431d8351b..c2b9b96d6268 100644
--- a/include/asm-generic/pgtable-nopud.h
+++ b/include/asm-generic/pgtable-nopud.h
@@ -3,52 +3,57 @@
 
 #ifndef __ASSEMBLY__
 
+#ifdef __ARCH_USE_5LEVEL_HACK
+#include <asm-generic/pgtable-nop4d-hack.h>
+#else
+#include <asm-generic/pgtable-nop4d.h>
+
 #define __PAGETABLE_PUD_FOLDED
 
 /*
- * Having the pud type consist of a pgd gets the size right, and allows
- * us to conceptually access the pgd entry that this pud is folded into
+ * Having the pud type consist of a p4d gets the size right, and allows
+ * us to conceptually access the p4d entry that this pud is folded into
  * without casting.
  */
-typedef struct { pgd_t pgd; } pud_t;
+typedef struct { p4d_t p4d; } pud_t;
 
-#define PUD_SHIFT       PGDIR_SHIFT
+#define PUD_SHIFT       P4D_SHIFT
 #define PTRS_PER_PUD    1
 #define PUD_SIZE        (1UL << PUD_SHIFT)
 #define PUD_MASK        (~(PUD_SIZE-1))
 
 /*
- * The "pgd_xxx()" functions here are trivial for a folded two-level
+ * The "p4d_xxx()" functions here are trivial for a folded two-level
  * setup: the pud is never bad, and a pud always exists (as it's folded
- * into the pgd entry)
+ * into the p4d entry)
  */
-static inline int pgd_none(pgd_t pgd)           { return 0; }
-static inline int pgd_bad(pgd_t pgd)            { return 0; }
-static inline int pgd_present(pgd_t pgd)        { return 1; }
-static inline void pgd_clear(pgd_t *pgd)        { }
-#define pud_ERROR(pud)                          (pgd_ERROR((pud).pgd))
+static inline int p4d_none(p4d_t p4d)           { return 0; }
+static inline int p4d_bad(p4d_t p4d)            { return 0; }
+static inline int p4d_present(p4d_t p4d)        { return 1; }
+static inline void p4d_clear(p4d_t *p4d)        { }
+#define pud_ERROR(pud)                          (p4d_ERROR((pud).p4d))
 
-#define pgd_populate(mm, pgd, pud)              do { } while (0)
+#define p4d_populate(mm, p4d, pud)              do { } while (0)
 /*
- * (puds are folded into pgds so this doesn't get actually called,
+ * (puds are folded into p4ds so this doesn't get actually called,
  * but the define is needed for a generic inline function.)
  */
-#define set_pgd(pgdptr, pgdval)                 set_pud((pud_t *)(pgdptr), (pud_t) { pgdval })
+#define set_p4d(p4dptr, p4dval) set_pud((pud_t *)(p4dptr), (pud_t) { p4dval })
 
-static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
+static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
 {
-        return (pud_t *)pgd;
+        return (pud_t *)p4d;
 }
 
-#define pud_val(x)                              (pgd_val((x).pgd))
-#define __pud(x)                                ((pud_t) { __pgd(x) } )
+#define pud_val(x)                              (p4d_val((x).p4d))
+#define __pud(x)                                ((pud_t) { __p4d(x) })
 
-#define pgd_page(pgd)                           (pud_page((pud_t){ pgd }))
-#define pgd_page_vaddr(pgd)                     (pud_page_vaddr((pud_t){ pgd }))
+#define p4d_page(p4d)                           (pud_page((pud_t){ p4d }))
+#define p4d_page_vaddr(p4d)                     (pud_page_vaddr((pud_t){ p4d }))
 
 /*
  * allocating and freeing a pud is trivial: the 1-entry pud is
- * inside the pgd, so has no extra memory associated with it.
+ * inside the p4d, so has no extra memory associated with it.
  */
 #define pud_alloc_one(mm, address)              NULL
 #define pud_free(mm, x)                         do { } while (0)
@@ -58,4 +63,5 @@ static inline pud_t * pud_offset(pgd_t * pgd, unsigned long address)
 #define pud_addr_end(addr, end)                 (end)
 
 #endif /* __ASSEMBLY__ */
+#endif /* !__ARCH_USE_5LEVEL_HACK */
 #endif /* _PGTABLE_NOPUD_H */
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f4ca23b158b3..1fad160f35de 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -10,9 +10,9 @@
 #include <linux/bug.h>
 #include <linux/errno.h>
 
-#if 4 - defined(__PAGETABLE_PUD_FOLDED) - defined(__PAGETABLE_PMD_FOLDED) != \
-        CONFIG_PGTABLE_LEVELS
-#error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{PUD,PMD}_FOLDED
+#if 5 - defined(__PAGETABLE_P4D_FOLDED) - defined(__PAGETABLE_PUD_FOLDED) - \
+        defined(__PAGETABLE_PMD_FOLDED) != CONFIG_PGTABLE_LEVELS
+#error CONFIG_PGTABLE_LEVELS is not consistent with __PAGETABLE_{P4D,PUD,PMD}_FOLDED
 #endif
 
 /*
@@ -424,6 +424,13 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
         (__boundary - 1 < (end) - 1)? __boundary: (end);                \
 })
 
+#ifndef p4d_addr_end
+#define p4d_addr_end(addr, end)                                         \
+({      unsigned long __boundary = ((addr) + P4D_SIZE) & P4D_MASK;      \
+        (__boundary - 1 < (end) - 1)? __boundary: (end);                \
+})
+#endif
+
 #ifndef pud_addr_end
 #define pud_addr_end(addr, end)                                         \
 ({      unsigned long __boundary = ((addr) + PUD_SIZE) & PUD_MASK;      \
@@ -444,6 +451,7 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
  * Do the tests inline, but report and clear the bad entry in mm/memory.c.
  */
 void pgd_clear_bad(pgd_t *);
+void p4d_clear_bad(p4d_t *);
 void pud_clear_bad(pud_t *);
 void pmd_clear_bad(pmd_t *);
 
@@ -458,6 +466,17 @@ static inline int pgd_none_or_clear_bad(pgd_t *pgd)
         return 0;
 }
 
+static inline int p4d_none_or_clear_bad(p4d_t *p4d)
+{
+        if (p4d_none(*p4d))
+                return 1;
+        if (unlikely(p4d_bad(*p4d))) {
+                p4d_clear_bad(p4d);
+                return 1;
+        }
+        return 0;
+}
+
 static inline int pud_none_or_clear_bad(pud_t *pud)
 {
         if (pud_none(*pud))
@@ -844,11 +863,30 @@ static inline int pmd_protnone(pmd_t pmd)
 #endif /* CONFIG_MMU */
 
 #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
+
+#ifndef __PAGETABLE_P4D_FOLDED
+int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot);
+int p4d_clear_huge(p4d_t *p4d);
+#else
+static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
+{
+        return 0;
+}
+static inline int p4d_clear_huge(p4d_t *p4d)
+{
+        return 0;
+}
+#endif /* !__PAGETABLE_P4D_FOLDED */
+
 int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot);
 int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot);
 int pud_clear_huge(pud_t *pud);
 int pmd_clear_huge(pmd_t *pmd);
 #else   /* !CONFIG_HAVE_ARCH_HUGE_VMAP */
+static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot)
+{
+        return 0;
+}
 static inline int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot)
 {
         return 0;
@@ -857,6 +895,10 @@ static inline int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
 {
         return 0;
 }
+static inline int p4d_clear_huge(p4d_t *p4d)
+{
+        return 0;
+}
 static inline int pud_clear_huge(pud_t *pud)
 {
         return 0;
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 4df64a1fc09e..532372c6cf15 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -14,8 +14,8 @@
  * [_sdata, _edata]: contains .data.* sections, may also contain .rodata.*
  *                   and/or .init.* sections.
  * [__start_rodata, __end_rodata]: contains .rodata.* sections
- * [__start_data_ro_after_init, __end_data_ro_after_init]:
- *                   contains data.ro_after_init section
+ * [__start_ro_after_init, __end_ro_after_init]:
+ *                   contains .data..ro_after_init section
  * [__init_begin, __init_end]: contains .init.* sections, but .init.text.*
  *                   may be out of this range on some architectures.
  * [_sinittext, _einittext]: contains .init.text.* sections
@@ -33,7 +33,7 @@ extern char _data[], _sdata[], _edata[];
 extern char __bss_start[], __bss_stop[];
 extern char __init_begin[], __init_end[];
 extern char _sinittext[], _einittext[];
-extern char __start_data_ro_after_init[], __end_data_ro_after_init[];
+extern char __start_ro_after_init[], __end_ro_after_init[];
 extern char _end[];
 extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
 extern char __kprobes_text_start[], __kprobes_text_end[];
diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
index 4329bc6ef04b..8afa4335e5b2 100644
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -270,6 +270,12 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
                 __pte_free_tlb(tlb, ptep, address);             \
         } while (0)
 
+#define pmd_free_tlb(tlb, pmdp, address)                        \
+        do {                                                    \
+                __tlb_adjust_range(tlb, address, PAGE_SIZE);            \
+                __pmd_free_tlb(tlb, pmdp, address);             \
+        } while (0)
+
 #ifndef __ARCH_HAS_4LEVEL_HACK
 #define pud_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
@@ -278,11 +284,13 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
         } while (0)
 #endif
 
-#define pmd_free_tlb(tlb, pmdp, address)                        \
+#ifndef __ARCH_HAS_5LEVEL_HACK
+#define p4d_free_tlb(tlb, pudp, address)                        \
         do {                                                    \
-                __tlb_adjust_range(tlb, address, PAGE_SIZE);    \
-                __pmd_free_tlb(tlb, pmdp, address);             \
+                __tlb_adjust_range(tlb, address, PAGE_SIZE);            \
+                __p4d_free_tlb(tlb, pudp, address);             \
         } while (0)
+#endif
 
 #define tlb_migrate_finish(mm) do {} while (0)
 
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 0968d13b3885..143db9c523e2 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -173,6 +173,7 @@
         KEEP(*(__##name##_of_table_end))
 
 #define CLKSRC_OF_TABLES()      OF_TABLE(CONFIG_CLKSRC_OF, clksrc)
+#define CLKEVT_OF_TABLES()      OF_TABLE(CONFIG_CLKEVT_OF, clkevt)
 #define IRQCHIP_OF_MATCH_TABLE() OF_TABLE(CONFIG_IRQCHIP, irqchip)
 #define CLK_OF_TABLES()         OF_TABLE(CONFIG_COMMON_CLK, clk)
 #define IOMMU_OF_TABLES()       OF_TABLE(CONFIG_OF_IOMMU, iommu)
@@ -260,9 +261,9 @@
  */
 #ifndef RO_AFTER_INIT_DATA
 #define RO_AFTER_INIT_DATA                                              \
-        __start_data_ro_after_init = .;                                 \
+        VMLINUX_SYMBOL(__start_ro_after_init) = .;                      \
         *(.data..ro_after_init)                                         \
-        __end_data_ro_after_init = .;
+        VMLINUX_SYMBOL(__end_ro_after_init) = .;
 #endif
 
 /*
@@ -559,6 +560,7 @@
         CLK_OF_TABLES()                                                 \
         RESERVEDMEM_OF_TABLES()                                         \
         CLKSRC_OF_TABLES()                                              \
+        CLKEVT_OF_TABLES()                                              \
         IOMMU_OF_TABLES()                                               \
         CPU_METHOD_OF_TABLES()                                          \
         CPUIDLE_METHOD_OF_TABLES()                                      \
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index a2bfd7843f18..e2b9c6fe2714 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -73,7 +73,7 @@ int af_alg_unregister_type(const struct af_alg_type *type);
 
 int af_alg_release(struct socket *sock);
 void af_alg_release_parent(struct sock *sk);
-int af_alg_accept(struct sock *sk, struct socket *newsock);
+int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern);
 
 int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len);
 void af_alg_free_sg(struct af_alg_sgl *sgl);
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index 1d4f365d8f03..f6d9af3efa45 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -166,6 +166,16 @@ static inline struct ahash_instance *ahash_alloc_instance(
         return crypto_alloc_instance2(name, alg, ahash_instance_headroom());
 }
 
+static inline void ahash_request_complete(struct ahash_request *req, int err)
+{
+        req->base.complete(&req->base, err);
+}
+
+static inline u32 ahash_request_flags(struct ahash_request *req)
+{
+        return req->base.flags;
+}
+
 static inline struct crypto_ahash *crypto_spawn_ahash(
         struct crypto_ahash_spawn *spawn)
 {
diff --git a/include/drm/ttm/ttm_object.h b/include/drm/ttm/ttm_object.h
index ed953f98f0e1..1487011fe057 100644
--- a/include/drm/ttm/ttm_object.h
+++ b/include/drm/ttm/ttm_object.h
@@ -229,6 +229,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base);
  * @ref_type: The type of reference.
  * @existed: Upon completion, indicates that an identical reference object
  * already existed, and the refcount was upped on that object instead.
+ * @require_existed: Fail with -EPERM if an identical ref object didn't
+ * already exist.
  *
  * Checks that the base object is shareable and adds a ref object to it.
  *
@@ -243,7 +245,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base);
  */
 extern int ttm_ref_object_add(struct ttm_object_file *tfile,
                               struct ttm_base_object *base,
-                              enum ttm_ref_type ref_type, bool *existed);
+                              enum ttm_ref_type ref_type, bool *existed,
+                              bool require_existed);
 
 extern bool ttm_ref_object_exists(struct ttm_object_file *tfile,
                                   struct ttm_base_object *base);
diff --git a/include/dt-bindings/sound/cs42l42.h b/include/dt-bindings/sound/cs42l42.h
index 399a123aed58..db69d84ed7d1 100644
--- a/include/dt-bindings/sound/cs42l42.h
+++ b/include/dt-bindings/sound/cs42l42.h
@@ -20,7 +20,7 @@
 #define CS42L42_HPOUT_LOAD_1NF          0
 #define CS42L42_HPOUT_LOAD_10NF         1
 
-/* HPOUT Clamp to GND Overide */
+/* HPOUT Clamp to GND Override */
 #define CS42L42_HPOUT_CLAMP_EN          0
 #define CS42L42_HPOUT_CLAMP_DIS         1
 
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index b72dd2ad5f44..c0b3d999c266 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -295,6 +295,7 @@ void kvm_vgic_vcpu_early_init(struct kvm_vcpu *vcpu);
 void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu);
 int kvm_vgic_map_resources(struct kvm *kvm);
 int kvm_vgic_hyp_init(void);
+void kvm_vgic_init_cpu_hardware(void);
 
 int kvm_vgic_inject_irq(struct kvm *kvm, int cpuid, unsigned int intid,
                         bool level);
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 673acda012af..9b05886f9773 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -287,18 +287,15 @@ static inline bool invalid_phys_cpuid(phys_cpuid_t phys_id)
 }
 
 /* Validate the processor object's proc_id */
-bool acpi_processor_validate_proc_id(int proc_id);
+bool acpi_duplicate_processor_id(int proc_id);
 
 #ifdef CONFIG_ACPI_HOTPLUG_CPU
 /* Arch dependent functions for cpu hotplug support */
 int acpi_map_cpu(acpi_handle handle, phys_cpuid_t physid, u32 acpi_id,
                  int *pcpu);
 int acpi_unmap_cpu(int cpu);
-int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid);
 #endif /* CONFIG_ACPI_HOTPLUG_CPU */
 
-void acpi_set_processor_mapping(void);
-
 #ifdef CONFIG_ACPI_HOTPLUG_IOAPIC
 int acpi_get_ioapic_id(acpi_handle handle, u32 gsi_base, u64 *phys_addr);
 #endif
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index b296a9006117..9382c5da7a2e 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -51,6 +51,7 @@ struct blk_mq_hw_ctx {
 
         atomic_t                nr_active;
 
+        struct delayed_work     delayed_run_work;
         struct delayed_work     delay_work;
 
         struct hlist_node       cpuhp_dead;
@@ -238,6 +239,7 @@ void blk_mq_stop_hw_queues(struct request_queue *q);
 void blk_mq_start_hw_queues(struct request_queue *q);
 void blk_mq_start_stopped_hw_queue(struct blk_mq_hw_ctx *hctx, bool async);
 void blk_mq_start_stopped_hw_queues(struct request_queue *q, bool async);
+void blk_mq_delay_run_hw_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs);
 void blk_mq_run_hw_queues(struct request_queue *q, bool async);
 void blk_mq_delay_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs);
 void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset,
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 796016e63c1d..01a696b0a4d3 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -435,7 +435,6 @@ struct request_queue {
         struct delayed_work     delay_work;
 
         struct backing_dev_info *backing_dev_info;
-        struct disk_devt        *disk_devt;
 
         /*
          * The queue owner gets to use this for whatever they like.
@@ -611,7 +610,6 @@ struct request_queue {
 #define QUEUE_FLAG_FLUSH_NQ    25       /* flush not queueuable */
 #define QUEUE_FLAG_DAX         26       /* device supports DAX */
 #define QUEUE_FLAG_STATS       27       /* track rq completion times */
-#define QUEUE_FLAG_RESTART     28       /* queue needs restart at completion */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
                                  (1 << QUEUE_FLAG_STACKABLE)    |       \
@@ -1674,12 +1672,36 @@ static inline bool bios_segs_mergeable(struct request_queue *q,
         return true;
 }
 
-static inline bool bio_will_gap(struct request_queue *q, struct bio *prev,
-                         struct bio *next)
+static inline bool bio_will_gap(struct request_queue *q,
+                                struct request *prev_rq,
+                                struct bio *prev,
+                                struct bio *next)
 {
         if (bio_has_data(prev) && queue_virt_boundary(q)) {
                 struct bio_vec pb, nb;
 
+                /*
+                 * don't merge if the 1st bio starts with non-zero
+                 * offset, otherwise it is quite difficult to respect
+                 * sg gap limit. We work hard to merge a huge number of small
+                 * single bios in case of mkfs.
+                 */
+                if (prev_rq)
+                        bio_get_first_bvec(prev_rq->bio, &pb);
+                else
+                        bio_get_first_bvec(prev, &pb);
+                if (pb.bv_offset)
+                        return true;
+
+                /*
+                 * We don't need to worry about the situation that the
+                 * merged segment ends in unaligned virt boundary:
+                 *
+                 * - if 'pb' ends aligned, the merged segment ends aligned
+                 * - if 'pb' ends unaligned, the next bio must include
+                 *   one single bvec of 'nb', otherwise the 'nb' can't
+                 *   merge with 'pb'
+                 */
                 bio_get_last_bvec(prev, &pb);
                 bio_get_first_bvec(next, &nb);
 
@@ -1692,12 +1714,12 @@ static inline bool bio_will_gap(struct request_queue *q, struct bio *prev,
 
 static inline bool req_gap_back_merge(struct request *req, struct bio *bio)
 {
-        return bio_will_gap(req->q, req->biotail, bio);
+        return bio_will_gap(req->q, req, req->biotail, bio);
 }
 
 static inline bool req_gap_front_merge(struct request *req, struct bio *bio)
 {
-        return bio_will_gap(req->q, bio, req->bio);
+        return bio_will_gap(req->q, NULL, bio, req->bio);
 }
 
 int kblockd_schedule_work(struct work_struct *work);
diff --git a/include/linux/ccp.h b/include/linux/ccp.h
index c71dd8fa5764..c41b8d99dd0e 100644
--- a/include/linux/ccp.h
+++ b/include/linux/ccp.h
@@ -556,7 +556,7 @@ enum ccp_engine {
  * struct ccp_cmd - CCP operation request
  * @entry: list element (ccp driver use only)
  * @work: work element used for callbacks (ccp driver use only)
- * @ccp: CCP device to be run on (ccp driver use only)
+ * @ccp: CCP device to be run on
  * @ret: operation return code (ccp driver use only)
  * @flags: cmd processing flags
  * @engine: CCP operation to perform
diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
index 1816c5e26581..88cd5dc8e238 100644
--- a/include/linux/ceph/libceph.h
+++ b/include/linux/ceph/libceph.h
@@ -48,6 +48,7 @@ struct ceph_options {
         unsigned long mount_timeout;            /* jiffies */
         unsigned long osd_idle_ttl;             /* jiffies */
         unsigned long osd_keepalive_timeout;    /* jiffies */
+        unsigned long osd_request_timeout;      /* jiffies */
 
         /*
          * any type that can't be simply compared or doesn't need need
@@ -68,6 +69,7 @@ struct ceph_options {
 #define CEPH_MOUNT_TIMEOUT_DEFAULT      msecs_to_jiffies(60 * 1000)
 #define CEPH_OSD_KEEPALIVE_DEFAULT      msecs_to_jiffies(5 * 1000)
 #define CEPH_OSD_IDLE_TTL_DEFAULT       msecs_to_jiffies(60 * 1000)
+#define CEPH_OSD_REQUEST_TIMEOUT_DEFAULT 0  /* no timeout */
 
 #define CEPH_MONC_HUNT_INTERVAL         msecs_to_jiffies(3 * 1000)
 #define CEPH_MONC_PING_INTERVAL         msecs_to_jiffies(10 * 1000)
diff --git a/include/linux/ceph/osd_client.h b/include/linux/ceph/osd_client.h
index 2ea0c282f3dc..c125b5d9e13c 100644
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -189,6 +189,7 @@ struct ceph_osd_request {
 
         /* internal */
         unsigned long r_stamp;                /* jiffies, send or check time */
+        unsigned long r_start_stamp;          /* jiffies */
         int r_attempts;
         struct ceph_eversion r_replay_version; /* aka reassert_version */
         u32 r_last_force_resend;
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index f6b43fbb141c..af9c86e958bd 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -570,6 +570,25 @@ static inline void pr_cont_cgroup_path(struct cgroup *cgrp)
         pr_cont_kernfs_path(cgrp->kn);
 }
 
+static inline void cgroup_init_kthreadd(void)
+{
+        /*
+         * kthreadd is inherited by all kthreads, keep it in the root so
+         * that the new kthreads are guaranteed to stay in the root until
+         * initialization is finished.
+         */
+        current->no_cgroup_migration = 1;
+}
+
+static inline void cgroup_kthread_ready(void)
+{
+        /*
+         * This kthread finished initialization.  The creator should have
+         * set PF_NO_SETAFFINITY if this kthread should stay in the root.
+         */
+        current->no_cgroup_migration = 0;
+}
+
 #else /* !CONFIG_CGROUPS */
 
 struct cgroup_subsys_state;
@@ -590,6 +609,8 @@ static inline void cgroup_free(struct task_struct *p) {}
 
 static inline int cgroup_init_early(void) { return 0; }
 static inline int cgroup_init(void) { return 0; }
+static inline void cgroup_init_kthreadd(void) {}
+static inline void cgroup_kthread_ready(void) {}
 
 static inline bool task_under_cgroup_hierarchy(struct task_struct *task,
                                                struct cgroup *ancestor)
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 5d3053c34fb3..6d7edc3082f9 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -229,7 +229,7 @@ static inline void tick_setup_hrtimer_broadcast(void) { }
 
 #ifdef CONFIG_CLKEVT_PROBE
 extern int clockevent_probe(void);
-#els
+#else
 static inline int clockevent_probe(void) { return 0; }
 #endif
 
diff --git a/include/linux/dccp.h b/include/linux/dccp.h
index 61d042bbbf60..68449293c4b6 100644
--- a/include/linux/dccp.h
+++ b/include/linux/dccp.h
@@ -163,6 +163,7 @@ struct dccp_request_sock {
         __u64                    dreq_isr;
         __u64                    dreq_gsr;
         __be32                   dreq_service;
+        spinlock_t               dreq_lock;
         struct list_head         dreq_featneg;
         __u32                    dreq_timestamp_echo;
         __u32                    dreq_timestamp_time;
diff --git a/include/linux/device.h b/include/linux/device.h
index 30c4570e928d..9ef518af5515 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1140,7 +1140,6 @@ static inline bool device_supports_offline(struct device *dev)
 extern void lock_device_hotplug(void);
 extern void unlock_device_hotplug(void);
 extern int lock_device_hotplug_sysfs(void);
-void assert_held_device_hotplug(void);
 extern int device_offline(struct device *dev);
 extern int device_online(struct device *dev);
 extern void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode);
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index aebecc4ed088..22d39e8d4de1 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -211,7 +211,7 @@ extern ssize_t elv_iosched_show(struct request_queue *, char *);
 extern ssize_t elv_iosched_store(struct request_queue *, const char *, size_t);
 
 extern int elevator_init(struct request_queue *, char *);
-extern void elevator_exit(struct elevator_queue *);
+extern void elevator_exit(struct request_queue *, struct elevator_queue *);
 extern int elevator_change(struct request_queue *, const char *);
 extern bool elv_bio_merge_ok(struct request *, struct bio *);
 extern struct elevator_queue *elevator_alloc(struct request_queue *,
diff --git a/include/linux/errqueue.h b/include/linux/errqueue.h
index 9ca23fcfb5d7..6fdfc884fdeb 100644
--- a/include/linux/errqueue.h
+++ b/include/linux/errqueue.h
@@ -20,6 +20,8 @@ struct sock_exterr_skb {
         struct sock_extended_err        ee;
         u16                             addr_offset;
         __be16                          port;
+        u8                              opt_stats:1,
+                                        unused:7;
 };
 
 #endif
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 0c167fdee5f7..fbf7b39e8103 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -409,6 +409,7 @@ struct bpf_prog {
         u16                     pages;          /* Number of allocated pages */
         kmemcheck_bitfield_begin(meta);
         u16                     jited:1,        /* Is our filter JIT'ed? */
+                                locked:1,       /* Program image locked? */
                                 gpl_compatible:1, /* Is filter GPL compatible? */
                                 cb_access:1,    /* Is control block accessed? */
                                 dst_needed:1,   /* Do we need dst entry? */
@@ -554,22 +555,29 @@ static inline bool bpf_prog_was_classic(const struct bpf_prog *prog)
 #ifdef CONFIG_ARCH_HAS_SET_MEMORY
 static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
 {
-        set_memory_ro((unsigned long)fp, fp->pages);
+        fp->locked = 1;
+        WARN_ON_ONCE(set_memory_ro((unsigned long)fp, fp->pages));
 }
 
 static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
 {
-        set_memory_rw((unsigned long)fp, fp->pages);
+        if (fp->locked) {
+                WARN_ON_ONCE(set_memory_rw((unsigned long)fp, fp->pages));
+                /* In case set_memory_rw() fails, we want to be the first
+                 * to crash here instead of some random place later on.
+                 */
+                fp->locked = 0;
+        }
 }
 
 static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
 {
-        set_memory_ro((unsigned long)hdr, hdr->pages);
+        WARN_ON_ONCE(set_memory_ro((unsigned long)hdr, hdr->pages));
 }
 
 static inline void bpf_jit_binary_unlock_ro(struct bpf_binary_header *hdr)
 {
-        set_memory_rw((unsigned long)hdr, hdr->pages);
+        WARN_ON_ONCE(set_memory_rw((unsigned long)hdr, hdr->pages));
 }
 #else
 static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index aad3fd0ff5f8..7251f7bb45e8 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2678,7 +2678,7 @@ static const char * const kernel_read_file_str[] = {
 
 static inline const char *kernel_read_file_id_str(enum kernel_read_file_id id)
 {
-        if (id < 0 || id >= READING_MAX_ID)
+        if ((unsigned)id >= READING_MAX_ID)
                 return kernel_read_file_str[READING_UNKNOWN];
 
         return kernel_read_file_str[id];
diff --git a/include/linux/fscrypt_common.h b/include/linux/fscrypt_common.h
index 547f81592ba1..10c1abfbac6c 100644
--- a/include/linux/fscrypt_common.h
+++ b/include/linux/fscrypt_common.h
@@ -87,7 +87,6 @@ struct fscrypt_operations {
         unsigned int flags;
         const char *key_prefix;
         int (*get_context)(struct inode *, void *, size_t);
-        int (*prepare_context)(struct inode *);
         int (*set_context)(struct inode *, const void *, size_t, void *);
         int (*dummy_context)(struct inode *);
         bool (*is_encrypted)(struct inode *);
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index a999d281a2f1..76f39754e7b0 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -167,13 +167,6 @@ struct blk_integrity {
 };
 
 #endif  /* CONFIG_BLK_DEV_INTEGRITY */
-struct disk_devt {
-        atomic_t count;
-        void (*release)(struct disk_devt *disk_devt);
-};
-
-void put_disk_devt(struct disk_devt *disk_devt);
-void get_disk_devt(struct disk_devt *disk_devt);
 
 struct gendisk {
         /* major, first_minor and minors are input parameters only,
@@ -183,7 +176,6 @@ struct gendisk {
         int first_minor;
         int minors;                     /* maximum number of minors, =1 for
                                          * disks that can't be partitioned. */
-        struct disk_devt *disk_devt;
 
         char disk_name[DISK_NAME_LEN];  /* name of major driver */
         char *(*devnode)(struct gendisk *gd, umode_t *mode);
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index 2484b2fcc6eb..933d93656605 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -143,15 +143,6 @@ struct gpio_desc *devm_fwnode_get_index_gpiod_from_child(struct device *dev,
                                                 struct fwnode_handle *child,
                                                 enum gpiod_flags flags,
                                                 const char *label);
-/* FIXME: delete this helper when users are switched over */
-static inline struct gpio_desc *devm_get_gpiod_from_child(struct device *dev,
-                          const char *con_id, struct fwnode_handle *child)
-{
-        return devm_fwnode_get_index_gpiod_from_child(dev, con_id,
-                                                      0, child,
-                                                      GPIOD_ASIS,
-                                                      "?");
-}
 
 #else /* CONFIG_GPIOLIB */
 
@@ -444,13 +435,6 @@ struct gpio_desc *devm_fwnode_get_index_gpiod_from_child(struct device *dev,
         return ERR_PTR(-ENOSYS);
 }
 
-/* FIXME: delete this when all users are switched over */
-static inline struct gpio_desc *devm_get_gpiod_from_child(struct device *dev,
-                          const char *con_id, struct fwnode_handle *child)
-{
-        return ERR_PTR(-ENOSYS);
-}
-
 #endif /* CONFIG_GPIOLIB */
 
 static inline
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 503099d8aada..b857fc8cc2ec 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -122,7 +122,7 @@ struct page *follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 struct page *follow_huge_pud(struct mm_struct *mm, unsigned long address,
                                 pud_t *pud, int flags);
 int pmd_huge(pmd_t pmd);
-int pud_huge(pud_t pmd);
+int pud_huge(pud_t pud);
 unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
                 unsigned long address, unsigned long end, pgprot_t newprot);
 
@@ -197,6 +197,9 @@ static inline void __unmap_hugepage_range(struct mmu_gather *tlb,
 #ifndef pgd_huge
 #define pgd_huge(x)     0
 #endif
+#ifndef p4d_huge
+#define p4d_huge(x)     0
+#endif
 
 #ifndef pgd_write
 static inline int pgd_write(pgd_t pgd)
diff --git a/include/linux/hwmon.h b/include/linux/hwmon.h
index 78d59dba563e..88b673749121 100644
--- a/include/linux/hwmon.h
+++ b/include/linux/hwmon.h
@@ -88,6 +88,7 @@ enum hwmon_temp_attributes {
 #define HWMON_T_CRIT_HYST       BIT(hwmon_temp_crit_hyst)
 #define HWMON_T_EMERGENCY       BIT(hwmon_temp_emergency)
 #define HWMON_T_EMERGENCY_HYST  BIT(hwmon_temp_emergency_hyst)
+#define HWMON_T_ALARM           BIT(hwmon_temp_alarm)
 #define HWMON_T_MIN_ALARM       BIT(hwmon_temp_min_alarm)
 #define HWMON_T_MAX_ALARM       BIT(hwmon_temp_max_alarm)
 #define HWMON_T_CRIT_ALARM      BIT(hwmon_temp_crit_alarm)
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 62bbf3c1aa4a..970771a5f739 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -845,6 +845,13 @@ struct vmbus_channel {
          * link up channels based on their CPU affinity.
          */
         struct list_head percpu_list;
+
+        /*
+         * Defer freeing channel until after all cpu's have
+         * gone through grace period.
+         */
+        struct rcu_head rcu;
+
         /*
          * For performance critical channels (storage, networking
          * etc,), Hyper-V has a mechanism to enhance the throughput
@@ -1430,9 +1437,6 @@ extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp, u8 *buf,
                                 const int *srv_version, int srv_vercnt,
                                 int *nego_fw_version, int *nego_srv_version);
 
-void hv_event_tasklet_disable(struct vmbus_channel *channel);
-void hv_event_tasklet_enable(struct vmbus_channel *channel);
-
 void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
 
 void vmbus_setevent(struct vmbus_channel *channel);
diff --git a/include/linux/iio/sw_device.h b/include/linux/iio/sw_device.h
index 23ca41515527..fa7931933067 100644
--- a/include/linux/iio/sw_device.h
+++ b/include/linux/iio/sw_device.h
@@ -62,7 +62,7 @@ void iio_swd_group_init_type_name(struct iio_sw_device *d,
                                   const char *name,
                                   struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
         config_group_init_type_name(&d->group, name, type);
 #endif
 }
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 6a6de187ddc0..2e4de0deee53 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -125,9 +125,16 @@ enum iommu_attr {
 };
 
 /* These are the possible reserved region types */
-#define IOMMU_RESV_DIRECT       (1 << 0)
-#define IOMMU_RESV_RESERVED     (1 << 1)
-#define IOMMU_RESV_MSI          (1 << 2)
+enum iommu_resv_type {
+        /* Memory regions which must be mapped 1:1 at all times */
+        IOMMU_RESV_DIRECT,
+        /* Arbitrary "never map this or give it to a device" address ranges */
+        IOMMU_RESV_RESERVED,
+        /* Hardware MSI region (untranslated) */
+        IOMMU_RESV_MSI,
+        /* Software-managed MSI translation window */
+        IOMMU_RESV_SW_MSI,
+};
 
 /**
  * struct iommu_resv_region - descriptor for a reserved memory region
@@ -142,7 +149,7 @@ struct iommu_resv_region {
         phys_addr_t             start;
         size_t                  length;
         int                     prot;
-        int                     type;
+        enum iommu_resv_type    type;
 };
 
 #ifdef CONFIG_IOMMU_API
@@ -288,7 +295,8 @@ extern void iommu_get_resv_regions(struct device *dev, struct list_head *list);
 extern void iommu_put_resv_regions(struct device *dev, struct list_head *list);
 extern int iommu_request_dm_for_dev(struct device *dev);
 extern struct iommu_resv_region *
-iommu_alloc_resv_region(phys_addr_t start, size_t length, int prot, int type);
+iommu_alloc_resv_region(phys_addr_t start, size_t length, int prot,
+                        enum iommu_resv_type type);
 extern int iommu_get_group_resv_regions(struct iommu_group *group,
                                         struct list_head *head);
 
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 672cfef72fc8..97cbca19430d 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -373,6 +373,8 @@
 #define ICC_IGRPEN0_EL1_MASK            (1 << ICC_IGRPEN0_EL1_SHIFT)
 #define ICC_IGRPEN1_EL1_SHIFT           0
 #define ICC_IGRPEN1_EL1_MASK            (1 << ICC_IGRPEN1_EL1_SHIFT)
+#define ICC_SRE_EL1_DIB                 (1U << 2)
+#define ICC_SRE_EL1_DFB                 (1U << 1)
 #define ICC_SRE_EL1_SRE                 (1U << 0)
 
 /*
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index eafc965b3eb8..dc30f3d057eb 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -96,6 +96,9 @@
 #define GICH_MISR_EOI                   (1 << 0)
 #define GICH_MISR_U                     (1 << 1)
 
+#define GICV_PMR_PRIORITY_SHIFT         3
+#define GICV_PMR_PRIORITY_MASK          (0x1f << GICV_PMR_PRIORITY_SHIFT)
+
 #ifndef __ASSEMBLY__
 
 #include <linux/irqdomain.h>
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index 188eced6813e..9f3616085423 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -524,6 +524,10 @@ static inline struct irq_domain *irq_find_matching_fwnode(
 {
         return NULL;
 }
+static inline bool irq_domain_check_msi_remap(void)
+{
+        return false;
+}
 #endif /* !CONFIG_IRQ_DOMAIN */
 
 #endif /* _LINUX_IRQDOMAIN_H */
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 8e06d758ee48..2afd74b9d844 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -90,6 +90,13 @@ extern bool static_key_initialized;
 struct static_key {
         atomic_t enabled;
 /*
+ * Note:
+ *   To make anonymous unions work with old compilers, the static
+ *   initialization of them requires brackets. This creates a dependency
+ *   on the order of the struct with the initializers. If any fields
+ *   are added, STATIC_KEY_INIT_TRUE and STATIC_KEY_INIT_FALSE may need
+ *   to be modified.
+ *
  * bit 0 => 1 if key is initially true
  *          0 if initially false
  * bit 1 => 1 if points to struct static_key_mod
@@ -166,10 +173,10 @@ extern void static_key_disable(struct static_key *key);
  */
 #define STATIC_KEY_INIT_TRUE                                    \
         { .enabled = { 1 },                                     \
-          .entries = (void *)JUMP_TYPE_TRUE }
+          { .entries = (void *)JUMP_TYPE_TRUE } }
 #define STATIC_KEY_INIT_FALSE                                   \
         { .enabled = { 0 },                                     \
-          .entries = (void *)JUMP_TYPE_FALSE }
+          { .entries = (void *)JUMP_TYPE_FALSE } }
 
 #else  /* !HAVE_JUMP_LABEL */
 
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index ceb3fe78a0d3..a5c7046f26b4 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -6,6 +6,7 @@
 struct kmem_cache;
 struct page;
 struct vm_struct;
+struct task_struct;
 
 #ifdef CONFIG_KASAN
 
@@ -18,6 +19,7 @@ extern unsigned char kasan_zero_page[PAGE_SIZE];
 extern pte_t kasan_zero_pte[PTRS_PER_PTE];
 extern pmd_t kasan_zero_pmd[PTRS_PER_PMD];
 extern pud_t kasan_zero_pud[PTRS_PER_PUD];
+extern p4d_t kasan_zero_p4d[PTRS_PER_P4D];
 
 void kasan_populate_zero_shadow(const void *shadow_start,
                                 const void *shadow_end);
@@ -74,6 +76,9 @@ size_t ksize(const void *);
 static inline void kasan_unpoison_slab(const void *ptr) { ksize(ptr); }
 size_t kasan_metadata_size(struct kmem_cache *cache);
 
+bool kasan_save_enable_multi_shot(void);
+void kasan_restore_multi_shot(bool enabled);
+
 #else /* CONFIG_KASAN */
 
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 2c14ad9809da..d0250744507a 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -162,8 +162,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
                     int len, void *val);
 int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
                             int len, struct kvm_io_device *dev);
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-                              struct kvm_io_device *dev);
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+                               struct kvm_io_device *dev);
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
                                          gpa_t addr);
 
diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
index b01fe1009084..87ff4f58a2f0 100644
--- a/include/linux/list_nulls.h
+++ b/include/linux/list_nulls.h
@@ -29,6 +29,11 @@ struct hlist_nulls_node {
         ((ptr)->first = (struct hlist_nulls_node *) NULLS_MARKER(nulls))
 
 #define hlist_nulls_entry(ptr, type, member) container_of(ptr,type,member)
+
+#define hlist_nulls_entry_safe(ptr, type, member) \
+        ({ typeof(ptr) ____ptr = (ptr); \
+           !is_a_nulls(____ptr) ? hlist_nulls_entry(____ptr, type, member) : NULL; \
+        })
 /**
  * ptr_is_a_nulls - Test if a ptr is a nulls
  * @ptr: ptr to be tested
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 5af377303880..bb7250c45cb8 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -740,6 +740,12 @@ static inline bool mem_cgroup_oom_synchronize(bool wait)
         return false;
 }
 
+static inline void mem_cgroup_update_page_stat(struct page *page,
+                                               enum mem_cgroup_stat_index idx,
+                                               int nr)
+{
+}
+
 static inline void mem_cgroup_inc_page_stat(struct page *page,
                                             enum mem_cgroup_stat_index idx)
 {
diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index 7a01c94496f1..3eef9fb9968a 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -35,10 +35,11 @@
  * Max bus-specific overhead incurred by request/responses.
  * I2C requires 1 additional byte for requests.
  * I2C requires 2 additional bytes for responses.
+ * SPI requires up to 32 additional bytes for responses.
  * */
 #define EC_PROTO_VERSION_UNKNOWN        0
 #define EC_MAX_REQUEST_OVERHEAD         1
-#define EC_MAX_RESPONSE_OVERHEAD        2
+#define EC_MAX_RESPONSE_OVERHEAD        32
 
 /*
  * Command interface between EC and AP, for LPC, I2C and SPI interfaces.
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 7e66e4f62858..1beb1ec2fbdf 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -476,6 +476,7 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+        MLX4_INTERFACE_STATE_NOWAIT     = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 0d65dd72c0f4..00a8fa7e366a 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -32,6 +32,8 @@ struct user_struct;
 struct writeback_control;
 struct bdi_writeback;
 
+void init_mm_internals(void);
+
 #ifndef CONFIG_NEED_MULTIPLE_NODES      /* Don't use mapnrs, do it properly */
 extern unsigned long max_mapnr;
 
@@ -1560,14 +1562,24 @@ static inline pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr,
         return ptep;
 }
 
+#ifdef __PAGETABLE_P4D_FOLDED
+static inline int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd,
+                                                unsigned long address)
+{
+        return 0;
+}
+#else
+int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
+#endif
+
 #ifdef __PAGETABLE_PUD_FOLDED
-static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
+static inline int __pud_alloc(struct mm_struct *mm, p4d_t *p4d,
                                                 unsigned long address)
 {
         return 0;
 }
 #else
-int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
+int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address);
 #endif
 
 #if defined(__PAGETABLE_PMD_FOLDED) || !defined(CONFIG_MMU)
@@ -1619,11 +1631,22 @@ int __pte_alloc_kernel(pmd_t *pmd, unsigned long address);
  * Remove it when 4level-fixup.h has been removed.
  */
 #if defined(CONFIG_MMU) && !defined(__ARCH_HAS_4LEVEL_HACK)
-static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+
+#ifndef __ARCH_HAS_5LEVEL_HACK
+static inline p4d_t *p4d_alloc(struct mm_struct *mm, pgd_t *pgd,
+                unsigned long address)
+{
+        return (unlikely(pgd_none(*pgd)) && __p4d_alloc(mm, pgd, address)) ?
+                NULL : p4d_offset(pgd, address);
+}
+
+static inline pud_t *pud_alloc(struct mm_struct *mm, p4d_t *p4d,
+                unsigned long address)
 {
-        return (unlikely(pgd_none(*pgd)) && __pud_alloc(mm, pgd, address))?
-                NULL: pud_offset(pgd, address);
+        return (unlikely(p4d_none(*p4d)) && __pud_alloc(mm, p4d, address)) ?
+                NULL : pud_offset(p4d, address);
 }
+#endif /* !__ARCH_HAS_5LEVEL_HACK */
 
 static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
 {
@@ -2385,7 +2408,8 @@ void sparse_mem_maps_populate_node(struct page **map_map,
 
 struct page *sparse_mem_map_populate(unsigned long pnum, int nid);
 pgd_t *vmemmap_pgd_populate(unsigned long addr, int node);
-pud_t *vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node);
+p4d_t *vmemmap_p4d_populate(pgd_t *pgd, unsigned long addr, int node);
+pud_t *vmemmap_pud_populate(p4d_t *p4d, unsigned long addr, int node);
 pmd_t *vmemmap_pmd_populate(pud_t *pud, unsigned long addr, int node);
 pte_t *vmemmap_pte_populate(pmd_t *pmd, unsigned long addr, int node);
 void *vmemmap_alloc_block(unsigned long size, int node);
diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
index aab032a6ae61..97ca105347a6 100644
--- a/include/linux/mmc/sdio_func.h
+++ b/include/linux/mmc/sdio_func.h
@@ -53,7 +53,7 @@ struct sdio_func {
         unsigned int            state;          /* function state */
 #define SDIO_STATE_PRESENT      (1<<0)          /* present in sysfs */
 
-        u8                      tmpbuf[4];      /* DMA:able scratch buffer */
+        u8                      *tmpbuf;        /* DMA:able scratch buffer */
 
         unsigned                num_info;       /* number of info strings */
         const char              **info;         /* info strings */
diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
index 51891fb0d3ce..c91b3bcd158f 100644
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -394,18 +394,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
         ___pud;                                                         \
 })
 
-#define pmdp_huge_get_and_clear_notify(__mm, __haddr, __pmd)            \
-({                                                                      \
-        unsigned long ___haddr = __haddr & HPAGE_PMD_MASK;              \
-        pmd_t ___pmd;                                                   \
-                                                                        \
-        ___pmd = pmdp_huge_get_and_clear(__mm, __haddr, __pmd);         \
-        mmu_notifier_invalidate_range(__mm, ___haddr,                   \
-                                      ___haddr + HPAGE_PMD_SIZE);       \
-                                                                        \
-        ___pmd;                                                         \
-})
-
 /*
  * set_pte_at_notify() sets the pte _after_ running the notifier.
  * This is safe to start by updating the secondary MMUs, because the primary MMU
@@ -489,7 +477,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
 #define ptep_clear_flush_notify ptep_clear_flush
 #define pmdp_huge_clear_flush_notify pmdp_huge_clear_flush
 #define pudp_huge_clear_flush_notify pudp_huge_clear_flush
-#define pmdp_huge_get_and_clear_notify pmdp_huge_get_and_clear
 #define set_pte_at_notify set_pte_at
 
 #endif /* CONFIG_MMU_NOTIFIER */
diff --git a/include/linux/net.h b/include/linux/net.h
index cd0c8bd0a1de..0620f5e18c96 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -146,7 +146,7 @@ struct proto_ops {
         int             (*socketpair)(struct socket *sock1,
                                       struct socket *sock2);
         int             (*accept)    (struct socket *sock,
-                                      struct socket *newsock, int flags);
+                                      struct socket *newsock, int flags, bool kern);
         int             (*getname)   (struct socket *sock,
                                       struct sockaddr *addr,
                                       int *sockaddr_len, int peer);
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index c43d435d4225..9061780b141f 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -64,26 +64,26 @@ enum {
  * RDMA_QPTYPE field
  */
 enum {
-        NVMF_RDMA_QPTYPE_CONNECTED      = 0, /* Reliable Connected */
-        NVMF_RDMA_QPTYPE_DATAGRAM       = 1, /* Reliable Datagram */
+        NVMF_RDMA_QPTYPE_CONNECTED      = 1, /* Reliable Connected */
+        NVMF_RDMA_QPTYPE_DATAGRAM       = 2, /* Reliable Datagram */
 };
 
 /* RDMA QP Service Type codes for Discovery Log Page entry TSAS
  * RDMA_QPTYPE field
  */
 enum {
-        NVMF_RDMA_PRTYPE_NOT_SPECIFIED  = 0, /* No Provider Specified */
-        NVMF_RDMA_PRTYPE_IB             = 1, /* InfiniBand */
-        NVMF_RDMA_PRTYPE_ROCE           = 2, /* InfiniBand RoCE */
-        NVMF_RDMA_PRTYPE_ROCEV2         = 3, /* InfiniBand RoCEV2 */
-        NVMF_RDMA_PRTYPE_IWARP          = 4, /* IWARP */
+        NVMF_RDMA_PRTYPE_NOT_SPECIFIED  = 1, /* No Provider Specified */
+        NVMF_RDMA_PRTYPE_IB             = 2, /* InfiniBand */
+        NVMF_RDMA_PRTYPE_ROCE           = 3, /* InfiniBand RoCE */
+        NVMF_RDMA_PRTYPE_ROCEV2         = 4, /* InfiniBand RoCEV2 */
+        NVMF_RDMA_PRTYPE_IWARP          = 5, /* IWARP */
 };
 
 /* RDMA Connection Management Service Type codes for Discovery Log Page
  * entry TSAS RDMA_CMS field
  */
 enum {
-        NVMF_RDMA_CMS_RDMA_CM   = 0, /* Sockets based enpoint addressing */
+        NVMF_RDMA_CMS_RDMA_CM   = 1, /* Sockets based endpoint addressing */
 };
 
 #define NVMF_AQ_DEPTH           32
diff --git a/include/linux/omap-gpmc.h b/include/linux/omap-gpmc.h
index 35d0fd7a4948..fd0de00c0d77 100644
--- a/include/linux/omap-gpmc.h
+++ b/include/linux/omap-gpmc.h
@@ -76,22 +76,12 @@ struct gpmc_timings;
 struct omap_nand_platform_data;
 struct omap_onenand_platform_data;
 
-#if IS_ENABLED(CONFIG_MTD_NAND_OMAP2)
-extern int gpmc_nand_init(struct omap_nand_platform_data *d,
-                          struct gpmc_timings *gpmc_t);
-#else
-static inline int gpmc_nand_init(struct omap_nand_platform_data *d,
-                                 struct gpmc_timings *gpmc_t)
-{
-        return 0;
-}
-#endif
-
 #if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2)
-extern void gpmc_onenand_init(struct omap_onenand_platform_data *d);
+extern int gpmc_onenand_init(struct omap_onenand_platform_data *d);
 #else
 #define board_onenand_data      NULL
-static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d)
+static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d)
 {
+        return 0;
 }
 #endif
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 772476028a65..43a774873aa9 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -837,6 +837,10 @@ int genphy_read_status(struct phy_device *phydev);
 int genphy_suspend(struct phy_device *phydev);
 int genphy_resume(struct phy_device *phydev);
 int genphy_soft_reset(struct phy_device *phydev);
+static inline int genphy_no_soft_reset(struct phy_device *phydev)
+{
+        return 0;
+}
 void phy_driver_unregister(struct phy_driver *drv);
 void phy_drivers_unregister(struct phy_driver *drv, int n);
 int phy_driver_register(struct phy_driver *new_driver, struct module *owner);
diff --git a/include/linux/pinctrl/pinctrl.h b/include/linux/pinctrl/pinctrl.h
index 8ce2d87a238b..5e45385c5bdc 100644
--- a/include/linux/pinctrl/pinctrl.h
+++ b/include/linux/pinctrl/pinctrl.h
@@ -145,8 +145,9 @@ struct pinctrl_desc {
 extern int pinctrl_register_and_init(struct pinctrl_desc *pctldesc,
                                      struct device *dev, void *driver_data,
                                      struct pinctrl_dev **pctldev);
+extern int pinctrl_enable(struct pinctrl_dev *pctldev);
 
-/* Please use pinctrl_register_and_init() instead */
+/* Please use pinctrl_register_and_init() and pinctrl_enable() instead */
 extern struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
                                 struct device *dev, void *driver_data);
 
diff --git a/include/linux/purgatory.h b/include/linux/purgatory.h
new file mode 100644
index 000000000000..d60d4e278609
--- /dev/null
+++ b/include/linux/purgatory.h
@@ -0,0 +1,23 @@
+#ifndef _LINUX_PURGATORY_H
+#define _LINUX_PURGATORY_H
+
+#include <linux/types.h>
+#include <crypto/sha.h>
+#include <uapi/linux/kexec.h>
+
+struct kexec_sha_region {
+        unsigned long start;
+        unsigned long len;
+};
+
+/*
+ * These forward declarations serve two purposes:
+ *
+ * 1) Make sparse happy when checking arch/purgatory
+ * 2) Document that these are required to be global so the symbol
+ *    lookup in kexec works
+ */
+extern struct kexec_sha_region purgatory_sha_regions[KEXEC_SEGMENT_MAX];
+extern u8 purgatory_sha256_digest[SHA256_DIGEST_SIZE];
+
+#endif
diff --git a/include/linux/random.h b/include/linux/random.h
index 7bd2403e4fef..ed5c3838780d 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -37,14 +37,26 @@ extern void get_random_bytes(void *buf, int nbytes);
 extern int add_random_ready_callback(struct random_ready_callback *rdy);
 extern void del_random_ready_callback(struct random_ready_callback *rdy);
 extern void get_random_bytes_arch(void *buf, int nbytes);
-extern int random_int_secret_init(void);
 
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;
 #endif
 
-unsigned int get_random_int(void);
-unsigned long get_random_long(void);
+u32 get_random_u32(void);
+u64 get_random_u64(void);
+static inline unsigned int get_random_int(void)
+{
+        return get_random_u32();
+}
+static inline unsigned long get_random_long(void)
+{
+#if BITS_PER_LONG == 64
+        return get_random_u64();
+#else
+        return get_random_u32();
+#endif
+}
+
 unsigned long randomize_page(unsigned long start, unsigned long range);
 
 u32 prandom_u32(void);
diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
index 4ae95f7e8597..a23a33153180 100644
--- a/include/linux/rculist_nulls.h
+++ b/include/linux/rculist_nulls.h
@@ -156,5 +156,19 @@ static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
                 ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); 1; }); \
                 pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)))
 
+/**
+ * hlist_nulls_for_each_entry_safe -
+ *   iterate over list of given type safe against removal of list entry
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct hlist_nulls_node to use as a loop cursor.
+ * @head:       the head for your list.
+ * @member:     the name of the hlist_nulls_node within the struct.
+ */
+#define hlist_nulls_for_each_entry_safe(tpos, pos, head, member)                \
+        for (({barrier();}),                                                    \
+             pos = rcu_dereference_raw(hlist_nulls_first_rcu(head));            \
+                (!is_a_nulls(pos)) &&                                           \
+                ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member);        \
+                   pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)); 1; });)
 #endif
 #endif
diff --git a/include/linux/regulator/machine.h b/include/linux/regulator/machine.h
index ad3e5158e586..c9f795e9a2ee 100644
--- a/include/linux/regulator/machine.h
+++ b/include/linux/regulator/machine.h
@@ -65,7 +65,7 @@ struct regulator_state {
         int uV; /* suspend voltage */
         unsigned int mode; /* suspend regulator operating mode */
         int enabled; /* is regulator enabled in this suspend state */
-        int disabled; /* is the regulator disbled in this suspend state */
+        int disabled; /* is the regulator disabled in this suspend state */
 };
 
 /**
diff --git a/include/linux/reset.h b/include/linux/reset.h
index 86b4ed75359e..13d8681210d5 100644
--- a/include/linux/reset.h
+++ b/include/linux/reset.h
@@ -15,6 +15,9 @@ int reset_control_status(struct reset_control *rstc);
 struct reset_control *__of_reset_control_get(struct device_node *node,
                                      const char *id, int index, bool shared,
                                      bool optional);
+struct reset_control *__reset_control_get(struct device *dev, const char *id,
+                                          int index, bool shared,
+                                          bool optional);
 void reset_control_put(struct reset_control *rstc);
 struct reset_control *__devm_reset_control_get(struct device *dev,
                                      const char *id, int index, bool shared,
@@ -31,31 +34,26 @@ static inline int device_reset_optional(struct device *dev)
 
 static inline int reset_control_reset(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_assert(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_deassert(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline int reset_control_status(struct reset_control *rstc)
 {
-        WARN_ON(1);
         return 0;
 }
 
 static inline void reset_control_put(struct reset_control *rstc)
 {
-        WARN_ON(1);
 }
 
 static inline int __must_check device_reset(struct device *dev)
@@ -74,14 +72,21 @@ static inline struct reset_control *__of_reset_control_get(
                                         const char *id, int index, bool shared,
                                         bool optional)
 {
-        return ERR_PTR(-ENOTSUPP);
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
+}
+
+static inline struct reset_control *__reset_control_get(
+                                        struct device *dev, const char *id,
+                                        int index, bool shared, bool optional)
+{
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
 }
 
 static inline struct reset_control *__devm_reset_control_get(
                                         struct device *dev, const char *id,
                                         int index, bool shared, bool optional)
 {
-        return ERR_PTR(-ENOTSUPP);
+        return optional ? NULL : ERR_PTR(-ENOTSUPP);
 }
 
 #endif /* CONFIG_RESET_CONTROLLER */
@@ -107,8 +112,7 @@ __must_check reset_control_get_exclusive(struct device *dev, const char *id)
 #ifndef CONFIG_RESET_CONTROLLER
         WARN_ON(1);
 #endif
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, false,
-                                                                        false);
+        return __reset_control_get(dev, id, 0, false, false);
 }
 
 /**
@@ -136,22 +140,19 @@ __must_check reset_control_get_exclusive(struct device *dev, const char *id)
 static inline struct reset_control *reset_control_get_shared(
                                         struct device *dev, const char *id)
 {
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, true,
-                                                                        false);
+        return __reset_control_get(dev, id, 0, true, false);
 }
 
 static inline struct reset_control *reset_control_get_optional_exclusive(
                                         struct device *dev, const char *id)
 {
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, false,
-                                                                        true);
+        return __reset_control_get(dev, id, 0, false, true);
 }
 
 static inline struct reset_control *reset_control_get_optional_shared(
                                         struct device *dev, const char *id)
 {
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, true,
-                                                                        true);
+        return __reset_control_get(dev, id, 0, true, true);
 }
 
 /**
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d67eee84fd43..4cf9a59a4d08 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -604,6 +604,10 @@ struct task_struct {
 #ifdef CONFIG_COMPAT_BRK
         unsigned                        brk_randomized:1;
 #endif
+#ifdef CONFIG_CGROUPS
+        /* disallow userland-initiated cgroup migration */
+        unsigned                        no_cgroup_migration:1;
+#endif
 
         unsigned long                   atomic_flags; /* Flags requiring atomic access. */
 
diff --git a/include/linux/sched/clock.h b/include/linux/sched/clock.h
index 4a68c6791207..34fe92ce1ebd 100644
--- a/include/linux/sched/clock.h
+++ b/include/linux/sched/clock.h
@@ -54,15 +54,16 @@ static inline u64 local_clock(void)
 }
 #else
 extern void sched_clock_init_late(void);
-/*
- * Architectures can set this to 1 if they have specified
- * CONFIG_HAVE_UNSTABLE_SCHED_CLOCK in their arch Kconfig,
- * but then during bootup it turns out that sched_clock()
- * is reliable after all:
- */
 extern int sched_clock_stable(void);
 extern void clear_sched_clock_stable(void);
 
+/*
+ * When sched_clock_stable(), __sched_clock_offset provides the offset
+ * between local_clock() and sched_clock().
+ */
+extern u64 __sched_clock_offset;
+
+
 extern void sched_clock_tick(void);
 extern void sched_clock_idle_sleep_event(void);
 extern void sched_clock_idle_wakeup_event(u64 delta_ns);
diff --git a/include/linux/stat.h b/include/linux/stat.h
index c76e524fb34b..64b6b3aece21 100644
--- a/include/linux/stat.h
+++ b/include/linux/stat.h
@@ -26,6 +26,7 @@ struct kstat {
         unsigned int    nlink;
         uint32_t        blksize;        /* Preferred I/O size */
         u64             attributes;
+        u64             attributes_mask;
 #define KSTAT_ATTR_FS_IOC_FLAGS                         \
         (STATX_ATTR_COMPRESSED |                        \
          STATX_ATTR_IMMUTABLE |                         \
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 804e34c6f981..f2d36a3d3005 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -39,7 +39,10 @@ struct iov_iter {
         };
         union {
                 unsigned long nr_segs;
-                int idx;
+                struct {
+                        int idx;
+                        int start_idx;
+                };
         };
 };
 
@@ -81,6 +84,7 @@ unsigned long iov_shorten(struct iovec *iov, unsigned long nr_segs, size_t to);
 size_t iov_iter_copy_from_user_atomic(struct page *page,
                 struct iov_iter *i, unsigned long offset, size_t bytes);
 void iov_iter_advance(struct iov_iter *i, size_t bytes);
+void iov_iter_revert(struct iov_iter *i, size_t bytes);
 int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
 size_t iov_iter_single_seg_count(const struct iov_iter *i);
 size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
index 1d0043dc34e4..de2a722fe3cf 100644
--- a/include/linux/usb/quirks.h
+++ b/include/linux/usb/quirks.h
@@ -50,4 +50,10 @@
 /* device can't handle Link Power Management */
 #define USB_QUIRK_NO_LPM                        BIT(10)
 
+/*
+ * Device reports its bInterval as linear frames instead of the
+ * USB 2.0 calculation.
+ */
+#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL   BIT(11)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index be765234c0a2..32354b4b4b2b 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -72,7 +72,7 @@ struct ucounts {
         struct hlist_node node;
         struct user_namespace *ns;
         kuid_t uid;
-        atomic_t count;
+        int count;
         atomic_t ucount[UCOUNT_COUNTS];
 };
 
diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
index 0468548acebf..48a3483dccb1 100644
--- a/include/linux/userfaultfd_k.h
+++ b/include/linux/userfaultfd_k.h
@@ -61,8 +61,7 @@ extern void mremap_userfaultfd_complete(struct vm_userfaultfd_ctx *,
                                         unsigned long from, unsigned long to,
                                         unsigned long len);
 
-extern void userfaultfd_remove(struct vm_area_struct *vma,
-                               struct vm_area_struct **prev,
+extern bool userfaultfd_remove(struct vm_area_struct *vma,
                                unsigned long start,
                                unsigned long end);
 
@@ -72,8 +71,6 @@ extern int userfaultfd_unmap_prep(struct vm_area_struct *vma,
 extern void userfaultfd_unmap_complete(struct mm_struct *mm,
                                        struct list_head *uf);
 
-extern void userfaultfd_exit(struct mm_struct *mm);
-
 #else /* CONFIG_USERFAULTFD */
 
 /* mm helpers */
@@ -120,11 +117,11 @@ static inline void mremap_userfaultfd_complete(struct vm_userfaultfd_ctx *ctx,
 {
 }
 
-static inline void userfaultfd_remove(struct vm_area_struct *vma,
-                                      struct vm_area_struct **prev,
+static inline bool userfaultfd_remove(struct vm_area_struct *vma,
                                       unsigned long start,
                                       unsigned long end)
 {
+        return true;
 }
 
 static inline int userfaultfd_unmap_prep(struct vm_area_struct *vma,
@@ -139,10 +136,6 @@ static inline void userfaultfd_unmap_complete(struct mm_struct *mm,
 {
 }
 
-static inline void userfaultfd_exit(struct mm_struct *mm)
-{
-}
-
 #endif /* CONFIG_USERFAULTFD */
 
 #endif /* _LINUX_USERFAULTFD_K_H */
diff --git a/include/linux/virtio.h b/include/linux/virtio.h
index 04b0d3f95043..7edfbdb55a99 100644
--- a/include/linux/virtio.h
+++ b/include/linux/virtio.h
@@ -167,6 +167,7 @@ struct virtio_driver {
         unsigned int feature_table_size;
         const unsigned int *feature_table_legacy;
         unsigned int feature_table_size_legacy;
+        int (*validate)(struct virtio_device *dev);
         int (*probe)(struct virtio_device *dev);
         void (*scan)(struct virtio_device *dev);
         void (*remove)(struct virtio_device *dev);
diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
index 9638bfeb0d1f..584f9a647ad4 100644
--- a/include/linux/virtio_vsock.h
+++ b/include/linux/virtio_vsock.h
@@ -48,6 +48,8 @@ struct virtio_vsock_pkt {
         struct virtio_vsock_hdr hdr;
         struct work_struct work;
         struct list_head list;
+        /* socket refcnt not held, only use for cancellation */
+        struct vsock_sock *vsk;
         void *buf;
         u32 len;
         u32 off;
@@ -56,6 +58,7 @@ struct virtio_vsock_pkt {
 
 struct virtio_vsock_pkt_info {
         u32 remote_cid, remote_port;
+        struct vsock_sock *vsk;
         struct msghdr *msg;
         u32 pkt_len;
         u16 type;
diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
index 6aa1b6cb5828..a80b7b59cf33 100644
--- a/include/linux/vm_event_item.h
+++ b/include/linux/vm_event_item.h
@@ -79,6 +79,9 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
                 THP_SPLIT_PAGE_FAILED,
                 THP_DEFERRED_SPLIT_PAGE,
                 THP_SPLIT_PMD,
+#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+                THP_SPLIT_PUD,
+#endif
                 THP_ZERO_PAGE_ALLOC,
                 THP_ZERO_PAGE_ALLOC_FAILED,
 #endif
diff --git a/include/linux/wait.h b/include/linux/wait.h
index aacb1282d19a..db076ca7f11d 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -620,30 +620,19 @@ do {									\
         __ret;                                                          \
 })
 
+extern int do_wait_intr(wait_queue_head_t *, wait_queue_t *);
+extern int do_wait_intr_irq(wait_queue_head_t *, wait_queue_t *);
 
-#define __wait_event_interruptible_locked(wq, condition, exclusive, irq) \
+#define __wait_event_interruptible_locked(wq, condition, exclusive, fn) \
 ({                                                                      \
-        int __ret = 0;                                                  \
+        int __ret;                                                      \
         DEFINE_WAIT(__wait);                                            \
         if (exclusive)                                                  \
                 __wait.flags |= WQ_FLAG_EXCLUSIVE;                      \
         do {                                                            \
-                if (likely(list_empty(&__wait.task_list)))              \
-                        __add_wait_queue_tail(&(wq), &__wait);          \
-                set_current_state(TASK_INTERRUPTIBLE);                  \
-                if (signal_pending(current)) {                          \
-                        __ret = -ERESTARTSYS;                           \
+                __ret = fn(&(wq), &__wait);                             \
+                if (__ret)                                              \
                         break;                                          \
-                }                                                       \
-                if (irq)                                                \
-                        spin_unlock_irq(&(wq).lock);                    \
-                else                                                    \
-                        spin_unlock(&(wq).lock);                        \
-                schedule();                                             \
-                if (irq)                                                \
-                        spin_lock_irq(&(wq).lock);                      \
-                else                                                    \
-                        spin_lock(&(wq).lock);                          \
         } while (!(condition));                                         \
         __remove_wait_queue(&(wq), &__wait);                            \
         __set_current_state(TASK_RUNNING);                              \
@@ -676,7 +665,7 @@ do {									\
  */
 #define wait_event_interruptible_locked(wq, condition)                  \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, 0))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, do_wait_intr))
 
 /**
  * wait_event_interruptible_locked_irq - sleep until a condition gets true
@@ -703,7 +692,7 @@ do {									\
  */
 #define wait_event_interruptible_locked_irq(wq, condition)              \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, 1))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 0, do_wait_intr_irq))
 
 /**
  * wait_event_interruptible_exclusive_locked - sleep exclusively until a condition gets true
@@ -734,7 +723,7 @@ do {									\
  */
 #define wait_event_interruptible_exclusive_locked(wq, condition)        \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, 0))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, do_wait_intr))
 
 /**
  * wait_event_interruptible_exclusive_locked_irq - sleep until a condition gets true
@@ -765,7 +754,7 @@ do {									\
  */
 #define wait_event_interruptible_exclusive_locked_irq(wq, condition)    \
         ((condition)                                                    \
-         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, 1))
+         ? 0 : __wait_event_interruptible_locked(wq, condition, 1, do_wait_intr_irq))
 
 
 #define __wait_event_killable(wq, condition)                            \
diff --git a/include/media/vsp1.h b/include/media/vsp1.h
index 458b400373d4..38aac554dbba 100644
--- a/include/media/vsp1.h
+++ b/include/media/vsp1.h
@@ -20,8 +20,17 @@ struct device;
 
 int vsp1_du_init(struct device *dev);
 
-int vsp1_du_setup_lif(struct device *dev, unsigned int width,
-                      unsigned int height);
+/**
+ * struct vsp1_du_lif_config - VSP LIF configuration
+ * @width: output frame width
+ * @height: output frame height
+ */
+struct vsp1_du_lif_config {
+        unsigned int width;
+        unsigned int height;
+};
+
+int vsp1_du_setup_lif(struct device *dev, const struct vsp1_du_lif_config *cfg);
 
 struct vsp1_du_atomic_config {
         u32 pixelformat;
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index f2758964ce6f..f32ed9ac181a 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -100,6 +100,9 @@ struct vsock_transport {
         void (*destruct)(struct vsock_sock *);
         void (*release)(struct vsock_sock *);
 
+        /* Cancel all pending packets sent on vsock. */
+        int (*cancel_pkt)(struct vsock_sock *vsk);
+
         /* Connections. */
         int (*connect)(struct vsock_sock *);
 
diff --git a/include/net/inet_common.h b/include/net/inet_common.h
index b7952d55b9c0..f39ae697347f 100644
--- a/include/net/inet_common.h
+++ b/include/net/inet_common.h
@@ -20,7 +20,8 @@ int __inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
                           int addr_len, int flags, int is_sendmsg);
 int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr,
                        int addr_len, int flags);
-int inet_accept(struct socket *sock, struct socket *newsock, int flags);
+int inet_accept(struct socket *sock, struct socket *newsock, int flags,
+                bool kern);
 int inet_sendmsg(struct socket *sock, struct msghdr *msg, size_t size);
 ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
                       size_t size, int flags);
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 826f198374f8..c7a577976bec 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -258,7 +258,7 @@ inet_csk_rto_backoff(const struct inet_connection_sock *icsk,
         return (unsigned long)min_t(u64, when, max_when);
 }
 
-struct sock *inet_csk_accept(struct sock *sk, int flags, int *err);
+struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern);
 
 int inet_csk_get_port(struct sock *sk, unsigned short snum);
 
diff --git a/include/net/irda/timer.h b/include/net/irda/timer.h
index cb2615ccf761..d784f242cf7b 100644
--- a/include/net/irda/timer.h
+++ b/include/net/irda/timer.h
@@ -59,7 +59,7 @@ struct lap_cb;
  *  Slot timer must never exceed 85 ms, and must always be at least 25 ms, 
  *  suggested to  75-85 msec by IrDA lite. This doesn't work with a lot of
  *  devices, and other stackes uses a lot more, so it's best we do it as well
- *  (Note : this is the default value and sysctl overides it - Jean II)
+ *  (Note : this is the default value and sysctl overrides it - Jean II)
  */
 #define SLOT_TIMEOUT            (90*HZ/1000)
 
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index f540f9ad2af4..19605878da47 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -244,7 +244,7 @@ extern s32 (*nf_ct_nat_offset)(const struct nf_conn *ct,
                                u32 seq);
 
 /* Fake conntrack entry for untracked connections */
-DECLARE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+DECLARE_PER_CPU_ALIGNED(struct nf_conn, nf_conntrack_untracked);
 static inline struct nf_conn *nf_ct_untracked_get(void)
 {
         return raw_cpu_ptr(&nf_conntrack_untracked);
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 2aa8a9d80fbe..0136028652bd 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -103,6 +103,35 @@ struct nft_regs {
         };
 };
 
+/* Store/load an u16 or u8 integer to/from the u32 data register.
+ *
+ * Note, when using concatenations, register allocation happens at 32-bit
+ * level. So for store instruction, pad the rest part with zero to avoid
+ * garbage values.
+ */
+
+static inline void nft_reg_store16(u32 *dreg, u16 val)
+{
+        *dreg = 0;
+        *(u16 *)dreg = val;
+}
+
+static inline void nft_reg_store8(u32 *dreg, u8 val)
+{
+        *dreg = 0;
+        *(u8 *)dreg = val;
+}
+
+static inline u16 nft_reg_load16(u32 *sreg)
+{
+        return *(u16 *)sreg;
+}
+
+static inline u8 nft_reg_load8(u32 *sreg)
+{
+        return *(u8 *)sreg;
+}
+
 static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
                                  unsigned int len)
 {
@@ -203,7 +232,6 @@ struct nft_set_elem {
 struct nft_set;
 struct nft_set_iter {
         u8              genmask;
-        bool            flush;
         unsigned int    count;
         unsigned int    skip;
         int             err;
diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
index d150b5066201..97983d1c05e4 100644
--- a/include/net/netfilter/nf_tables_ipv6.h
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -9,12 +9,13 @@ nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
                      struct sk_buff *skb,
                      const struct nf_hook_state *state)
 {
+        unsigned int flags = IP6_FH_F_AUTH;
         int protohdr, thoff = 0;
         unsigned short frag_off;
 
         nft_set_pktinfo(pkt, skb, state);
 
-        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
         if (protohdr < 0) {
                 nft_set_pktinfo_proto_unspec(pkt, skb);
                 return;
@@ -32,6 +33,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
                                 const struct nf_hook_state *state)
 {
 #if IS_ENABLED(CONFIG_IPV6)
+        unsigned int flags = IP6_FH_F_AUTH;
         struct ipv6hdr *ip6h, _ip6h;
         unsigned int thoff = 0;
         unsigned short frag_off;
@@ -50,7 +52,7 @@ __nft_set_pktinfo_ipv6_validate(struct nft_pktinfo *pkt,
         if (pkt_len + sizeof(*ip6h) > skb->len)
                 return -1;
 
-        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, &flags);
         if (protohdr < 0)
                 return -1;
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 1f71ee5ab518..069582ee5d7f 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -448,10 +448,9 @@ static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
         return frag;
 }
 
-static inline void sctp_assoc_pending_pmtu(struct sock *sk, struct sctp_association *asoc)
+static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
 {
-
-        sctp_assoc_sync_pmtu(sk, asoc);
+        sctp_assoc_sync_pmtu(asoc);
         asoc->pmtu_pending = 0;
 }
 
@@ -596,12 +595,23 @@ static inline void sctp_v4_map_v6(union sctp_addr *addr)
  */
 static inline struct dst_entry *sctp_transport_dst_check(struct sctp_transport *t)
 {
-        if (t->dst && (!dst_check(t->dst, t->dst_cookie) ||
-                       t->pathmtu != max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
-                                           SCTP_DEFAULT_MINSEGMENT)))
+        if (t->dst && !dst_check(t->dst, t->dst_cookie))
                 sctp_transport_dst_release(t);
 
         return t->dst;
 }
 
+static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+{
+        __u32 pmtu = max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
+                           SCTP_DEFAULT_MINSEGMENT);
+
+        if (t->pathmtu == pmtu)
+                return true;
+
+        t->pathmtu = pmtu;
+
+        return false;
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index a244db5e5ff7..138f8615acf0 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -83,6 +83,7 @@ struct sctp_bind_addr;
 struct sctp_ulpq;
 struct sctp_ep_common;
 struct crypto_shash;
+struct sctp_stream;
 
 
 #include <net/sctp/tsnmap.h>
@@ -376,7 +377,8 @@ typedef struct sctp_sender_hb_info {
         __u64 hb_nonce;
 } sctp_sender_hb_info_t;
 
-struct sctp_stream *sctp_stream_new(__u16 incnt, __u16 outcnt, gfp_t gfp);
+int sctp_stream_new(struct sctp_association *asoc, gfp_t gfp);
+int sctp_stream_init(struct sctp_association *asoc, gfp_t gfp);
 void sctp_stream_free(struct sctp_stream *stream);
 void sctp_stream_clear(struct sctp_stream *stream);
 
@@ -476,7 +478,8 @@ struct sctp_pf {
         int  (*send_verify) (struct sctp_sock *, union sctp_addr *);
         int  (*supported_addrs)(const struct sctp_sock *, __be16 *);
         struct sock *(*create_accept_sk) (struct sock *sk,
-                                          struct sctp_association *asoc);
+                                          struct sctp_association *asoc,
+                                          bool kern);
         int (*addr_to_user)(struct sctp_sock *sk, union sctp_addr *addr);
         void (*to_sk_saddr)(union sctp_addr *, struct sock *sk);
         void (*to_sk_daddr)(union sctp_addr *, struct sock *sk);
@@ -497,7 +500,6 @@ struct sctp_datamsg {
         /* Did the messenge fail to send? */
         int send_error;
         u8 send_failed:1,
-           force_delay:1,
            can_delay;       /* should this message be Nagle delayed */
 };
 
@@ -752,6 +754,8 @@ struct sctp_transport {
                 /* Is the Path MTU update pending on this tranport */
                 pmtu_pending:1,
 
+                dst_pending_confirm:1,  /* need to confirm neighbour */
+
                 /* Has this transport moved the ctsn since we last sacked */
                 sack_generation:1;
         u32 dst_cookie;
@@ -805,8 +809,6 @@ struct sctp_transport {
 
         __u32 burst_limited;    /* Holds old cwnd when max.burst is applied */
 
-        __u32 dst_pending_confirm;      /* need to confirm neighbour */
-
         /* Destination */
         struct dst_entry *dst;
         /* Source address. */
@@ -950,8 +952,8 @@ void sctp_transport_lower_cwnd(struct sctp_transport *, sctp_lower_cwnd_t);
 void sctp_transport_burst_limited(struct sctp_transport *);
 void sctp_transport_burst_reset(struct sctp_transport *);
 unsigned long sctp_transport_timeout(struct sctp_transport *);
-void sctp_transport_reset(struct sctp_transport *);
-void sctp_transport_update_pmtu(struct sock *, struct sctp_transport *, u32);
+void sctp_transport_reset(struct sctp_transport *t);
+void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu);
 void sctp_transport_immediate_rtx(struct sctp_transport *);
 void sctp_transport_dst_release(struct sctp_transport *t);
 void sctp_transport_dst_confirm(struct sctp_transport *t);
@@ -1876,6 +1878,7 @@ struct sctp_association {
 
         __u8 need_ecne:1,       /* Need to send an ECNE Chunk? */
              temp:1,            /* Is it a temporary association? */
+             force_delay:1,
              prsctp_enable:1,
              reconf_enable:1;
 
@@ -1951,7 +1954,7 @@ void sctp_assoc_update(struct sctp_association *old,
 
 __u32 sctp_association_get_next_tsn(struct sctp_association *);
 
-void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
+void sctp_assoc_sync_pmtu(struct sctp_association *asoc);
 void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
 void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
 void sctp_assoc_set_primary(struct sctp_association *,
diff --git a/include/net/sock.h b/include/net/sock.h
index 5e5997654db6..03252d53975d 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -236,6 +236,7 @@ struct sock_common {
   *     @sk_shutdown: mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
   *     @sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
   *     @sk_lock:       synchronizer
+  *     @sk_kern_sock: True if sock is using kernel lock classes
   *     @sk_rcvbuf: size of receive buffer in bytes
   *     @sk_wq: sock wait queue and async head
   *     @sk_rx_dst: receive input route used by early demux
@@ -430,7 +431,8 @@ struct sock {
 #endif
 
         kmemcheck_bitfield_begin(flags);
-        unsigned int            sk_padding : 2,
+        unsigned int            sk_padding : 1,
+                                sk_kern_sock : 1,
                                 sk_no_check_tx : 1,
                                 sk_no_check_rx : 1,
                                 sk_userlocks : 4,
@@ -1015,7 +1017,8 @@ struct proto {
                                         int addr_len);
         int                     (*disconnect)(struct sock *sk, int flags);
 
-        struct sock *           (*accept)(struct sock *sk, int flags, int *err);
+        struct sock *           (*accept)(struct sock *sk, int flags, int *err,
+                                          bool kern);
 
         int                     (*ioctl)(struct sock *sk, int cmd,
                                          unsigned long arg);
@@ -1573,7 +1576,7 @@ int sock_cmsg_send(struct sock *sk, struct msghdr *msg,
 int sock_no_bind(struct socket *, struct sockaddr *, int);
 int sock_no_connect(struct socket *, struct sockaddr *, int, int);
 int sock_no_socketpair(struct socket *, struct socket *);
-int sock_no_accept(struct socket *, struct socket *, int);
+int sock_no_accept(struct socket *, struct socket *, int, bool);
 int sock_no_getname(struct socket *, struct sockaddr *, int *, int);
 unsigned int sock_no_poll(struct file *, struct socket *,
                           struct poll_table_struct *);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 0f1813c13687..99e4423eb2b8 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1863,6 +1863,9 @@ struct ib_port_immutable {
 };
 
 struct ib_device {
+        /* Do not access @dma_device directly from ULP nor from HW drivers. */
+        struct device                *dma_device;
+
         char                          name[IB_DEVICE_NAME_MAX];
 
         struct list_head              event_handler_list;
@@ -3007,7 +3010,7 @@ static inline int ib_req_ncomp_notif(struct ib_cq *cq, int wc_cnt)
  */
 static inline int ib_dma_mapping_error(struct ib_device *dev, u64 dma_addr)
 {
-        return dma_mapping_error(&dev->dev, dma_addr);
+        return dma_mapping_error(dev->dma_device, dma_addr);
 }
 
 /**
@@ -3021,7 +3024,7 @@ static inline u64 ib_dma_map_single(struct ib_device *dev,
                                     void *cpu_addr, size_t size,
                                     enum dma_data_direction direction)
 {
-        return dma_map_single(&dev->dev, cpu_addr, size, direction);
+        return dma_map_single(dev->dma_device, cpu_addr, size, direction);
 }
 
 /**
@@ -3035,7 +3038,7 @@ static inline void ib_dma_unmap_single(struct ib_device *dev,
                                        u64 addr, size_t size,
                                        enum dma_data_direction direction)
 {
-        dma_unmap_single(&dev->dev, addr, size, direction);
+        dma_unmap_single(dev->dma_device, addr, size, direction);
 }
 
 /**
@@ -3052,7 +3055,7 @@ static inline u64 ib_dma_map_page(struct ib_device *dev,
                                   size_t size,
                                          enum dma_data_direction direction)
 {
-        return dma_map_page(&dev->dev, page, offset, size, direction);
+        return dma_map_page(dev->dma_device, page, offset, size, direction);
 }
 
 /**
@@ -3066,7 +3069,7 @@ static inline void ib_dma_unmap_page(struct ib_device *dev,
                                      u64 addr, size_t size,
                                      enum dma_data_direction direction)
 {
-        dma_unmap_page(&dev->dev, addr, size, direction);
+        dma_unmap_page(dev->dma_device, addr, size, direction);
 }
 
 /**
@@ -3080,7 +3083,7 @@ static inline int ib_dma_map_sg(struct ib_device *dev,
                                 struct scatterlist *sg, int nents,
                                 enum dma_data_direction direction)
 {
-        return dma_map_sg(&dev->dev, sg, nents, direction);
+        return dma_map_sg(dev->dma_device, sg, nents, direction);
 }
 
 /**
@@ -3094,7 +3097,7 @@ static inline void ib_dma_unmap_sg(struct ib_device *dev,
                                    struct scatterlist *sg, int nents,
                                    enum dma_data_direction direction)
 {
-        dma_unmap_sg(&dev->dev, sg, nents, direction);
+        dma_unmap_sg(dev->dma_device, sg, nents, direction);
 }
 
 static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
@@ -3102,7 +3105,8 @@ static inline int ib_dma_map_sg_attrs(struct ib_device *dev,
                                       enum dma_data_direction direction,
                                       unsigned long dma_attrs)
 {
-        return dma_map_sg_attrs(&dev->dev, sg, nents, direction, dma_attrs);
+        return dma_map_sg_attrs(dev->dma_device, sg, nents, direction,
+                                dma_attrs);
 }
 
 static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
@@ -3110,7 +3114,7 @@ static inline void ib_dma_unmap_sg_attrs(struct ib_device *dev,
                                          enum dma_data_direction direction,
                                          unsigned long dma_attrs)
 {
-        dma_unmap_sg_attrs(&dev->dev, sg, nents, direction, dma_attrs);
+        dma_unmap_sg_attrs(dev->dma_device, sg, nents, direction, dma_attrs);
 }
 /**
  * ib_sg_dma_address - Return the DMA address from a scatter/gather entry
@@ -3152,7 +3156,7 @@ static inline void ib_dma_sync_single_for_cpu(struct ib_device *dev,
                                               size_t size,
                                               enum dma_data_direction dir)
 {
-        dma_sync_single_for_cpu(&dev->dev, addr, size, dir);
+        dma_sync_single_for_cpu(dev->dma_device, addr, size, dir);
 }
 
 /**
@@ -3167,7 +3171,7 @@ static inline void ib_dma_sync_single_for_device(struct ib_device *dev,
                                                  size_t size,
                                                  enum dma_data_direction dir)
 {
-        dma_sync_single_for_device(&dev->dev, addr, size, dir);
+        dma_sync_single_for_device(dev->dma_device, addr, size, dir);
 }
 
 /**
@@ -3182,7 +3186,7 @@ static inline void *ib_dma_alloc_coherent(struct ib_device *dev,
                                            dma_addr_t *dma_handle,
                                            gfp_t flag)
 {
-        return dma_alloc_coherent(&dev->dev, size, dma_handle, flag);
+        return dma_alloc_coherent(dev->dma_device, size, dma_handle, flag);
 }
 
 /**
@@ -3196,7 +3200,7 @@ static inline void ib_dma_free_coherent(struct ib_device *dev,
                                         size_t size, void *cpu_addr,
                                         dma_addr_t dma_handle)
 {
-        dma_free_coherent(&dev->dev, size, cpu_addr, dma_handle);
+        dma_free_coherent(dev->dma_device, size, cpu_addr, dma_handle);
 }
 
 /**
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index b0e275de6dec..583875ea136a 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -196,6 +196,7 @@ struct iscsi_conn {
         struct iscsi_task       *task;          /* xmit task in progress */
 
         /* xmit */
+        spinlock_t              taskqueuelock;  /* protects the next three lists */
         struct list_head        mgmtqueue;      /* mgmt (control) xmit queue */
         struct list_head        cmdqueue;       /* data-path cmd queue */
         struct list_head        requeue;        /* tasks needing another run */
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 6f22b39f1b0c..080c7ce9bae8 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -472,6 +472,10 @@ static inline int scsi_device_created(struct scsi_device *sdev)
                 sdev->sdev_state == SDEV_CREATED_BLOCK;
 }
 
+int scsi_internal_device_block(struct scsi_device *sdev, bool wait);
+int scsi_internal_device_unblock(struct scsi_device *sdev,
+                                 enum scsi_device_state new_state);
+
 /* accessor functions for the SCSI parameters */
 static inline int scsi_device_sync(struct scsi_device *sdev)
 {
diff --git a/include/sound/cs35l35.h b/include/sound/cs35l35.h
new file mode 100644
index 000000000000..29da899e17e4
--- /dev/null
+++ b/include/sound/cs35l35.h
@@ -0,0 +1,108 @@
+/*
+ * linux/sound/cs35l35.h -- Platform data for CS35l35
+ *
+ * Copyright (c) 2016 Cirrus Logic Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __CS35L35_H
+#define __CS35L35_H
+
+struct classh_cfg {
+        /*
+         * Class H Algorithm Control Variables
+         * You can either have it done
+         * automatically or you can adjust
+         * these variables for tuning
+         *
+         * if you do not enable the internal algorithm
+         * you will get a set of mixer controls for
+         * Class H tuning
+         *
+         * Section 4.3 of the datasheet
+         */
+        bool classh_bst_override;
+        bool classh_algo_enable;
+        int classh_bst_max_limit;
+        int classh_mem_depth;
+        int classh_release_rate;
+        int classh_headroom;
+        int classh_wk_fet_disable;
+        int classh_wk_fet_delay;
+        int classh_wk_fet_thld;
+        int classh_vpch_auto;
+        int classh_vpch_rate;
+        int classh_vpch_man;
+};
+
+struct monitor_cfg {
+        /*
+         * Signal Monitor Data
+         * highly configurable signal monitoring
+         * data positioning and different types of
+         * monitoring data.
+         *
+         * Section 4.8.2 - 4.8.4 of the datasheet
+         */
+        bool is_present;
+        bool imon_specs;
+        bool vmon_specs;
+        bool vpmon_specs;
+        bool vbstmon_specs;
+        bool vpbrstat_specs;
+        bool zerofill_specs;
+        u8 imon_dpth;
+        u8 imon_loc;
+        u8 imon_frm;
+        u8 imon_scale;
+        u8 vmon_dpth;
+        u8 vmon_loc;
+        u8 vmon_frm;
+        u8 vpmon_dpth;
+        u8 vpmon_loc;
+        u8 vpmon_frm;
+        u8 vbstmon_dpth;
+        u8 vbstmon_loc;
+        u8 vbstmon_frm;
+        u8 vpbrstat_dpth;
+        u8 vpbrstat_loc;
+        u8 vpbrstat_frm;
+        u8 zerofill_dpth;
+        u8 zerofill_loc;
+        u8 zerofill_frm;
+};
+
+struct cs35l35_platform_data {
+
+        /* Stereo (2 Device) */
+        bool stereo;
+        /* serial port drive strength */
+        int sp_drv_str;
+        /* serial port drive in unused slots */
+        int sp_drv_unused;
+        /* Boost Power Down with FET */
+        bool bst_pdn_fet_on;
+        /* Boost Voltage : used if ClassH Algo Enabled */
+        int bst_vctl;
+        /* Boost Converter Peak Current CTRL */
+        int bst_ipk;
+        /* Amp Gain Zero Cross */
+        bool gain_zc;
+        /* Audio Input Location */
+        int aud_channel;
+        /* Advisory Input Location */
+        int adv_channel;
+        /* Shared Boost for stereo */
+        bool shared_bst;
+        /* Specifies this amp is using an external boost supply */
+        bool ext_bst;
+        /* ClassH Algorithm */
+        struct classh_cfg classh_algo;
+        /* Monitor Config */
+        struct monitor_cfg mon_cfg;
+};
+
+#endif /* __CS35L35_H */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index cdfb55f7aede..5170fd81e1fd 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -434,6 +434,8 @@ int snd_soc_codec_set_sysclk(struct snd_soc_codec *codec, int clk_id,
                              int source, unsigned int freq, int dir);
 int snd_soc_codec_set_pll(struct snd_soc_codec *codec, int pll_id, int source,
                           unsigned int freq_in, unsigned int freq_out);
+int snd_soc_codec_set_jack(struct snd_soc_codec *codec,
+                           struct snd_soc_jack *jack, void *data);
 
 int snd_soc_register_card(struct snd_soc_card *card);
 int snd_soc_unregister_card(struct snd_soc_card *card);
@@ -497,7 +499,15 @@ void snd_soc_runtime_deactivate(struct snd_soc_pcm_runtime *rtd, int stream);
 int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
         unsigned int dai_fmt);
 
+#ifdef CONFIG_DMI
 int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour);
+#else
+static inline int snd_soc_set_dmi_name(struct snd_soc_card *card,
+                                       const char *flavour)
+{
+        return 0;
+}
+#endif
 
 /* Utility functions to get clock rates from various things */
 int snd_soc_calc_frame_size(int sample_size, int channels, int tdm_slots);
@@ -721,6 +731,7 @@ struct snd_soc_jack_gpio {
         /* private: */
         struct snd_soc_jack *jack;
         struct delayed_work work;
+        struct notifier_block pm_notifier;
         struct gpio_desc *desc;
 
         void *data;
@@ -812,7 +823,6 @@ struct snd_soc_component {
 
         unsigned int ignore_pmdown_time:1; /* pmdown_time is ignored at stop */
         unsigned int registered_as_component:1;
-        unsigned int auxiliary:1; /* for auxiliary component of the card */
         unsigned int suspended:1; /* is in suspend PM state */
 
         struct list_head list;
@@ -913,6 +923,8 @@ struct snd_soc_codec_driver {
                           int clk_id, int source, unsigned int freq, int dir);
         int (*set_pll)(struct snd_soc_codec *codec, int pll_id, int source,
                 unsigned int freq_in, unsigned int freq_out);
+        int (*set_jack)(struct snd_soc_codec *codec,
+                        struct snd_soc_jack *jack,  void *data);
 
         /* codec IO */
         struct regmap *(*get_regmap)(struct device *);
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index b54b98dc2d4a..1b0f447ce850 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -4,7 +4,12 @@
 #include <linux/types.h>
 #include <target/target_core_base.h>
 
-#define TRANSPORT_FLAG_PASSTHROUGH              1
+#define TRANSPORT_FLAG_PASSTHROUGH              0x1
+/*
+ * ALUA commands, state checks and setup operations are handled by the
+ * backend module.
+ */
+#define TRANSPORT_FLAG_PASSTHROUGH_ALUA         0x2
 
 struct request_queue;
 struct scatterlist;
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 37c274e61acc..ccfad0e9c2cd 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -117,6 +117,7 @@ enum transport_state_table {
         TRANSPORT_ISTATE_PROCESSING = 11,
         TRANSPORT_COMPLETE_QF_WP = 18,
         TRANSPORT_COMPLETE_QF_OK = 19,
+        TRANSPORT_COMPLETE_QF_ERR = 20,
 };
 
 /* Used for struct se_cmd->se_cmd_flags */
@@ -279,8 +280,6 @@ struct t10_alua_tg_pt_gp {
         u16     tg_pt_gp_id;
         int     tg_pt_gp_valid_id;
         int     tg_pt_gp_alua_supported_states;
-        int     tg_pt_gp_alua_pending_state;
-        int     tg_pt_gp_alua_previous_state;
         int     tg_pt_gp_alua_access_status;
         int     tg_pt_gp_alua_access_type;
         int     tg_pt_gp_nonop_delay_msecs;
@@ -289,18 +288,16 @@ struct t10_alua_tg_pt_gp {
         int     tg_pt_gp_pref;
         int     tg_pt_gp_write_metadata;
         u32     tg_pt_gp_members;
-        atomic_t tg_pt_gp_alua_access_state;
+        int     tg_pt_gp_alua_access_state;
         atomic_t tg_pt_gp_ref_cnt;
         spinlock_t tg_pt_gp_lock;
-        struct mutex tg_pt_gp_md_mutex;
+        struct mutex tg_pt_gp_transition_mutex;
         struct se_device *tg_pt_gp_dev;
         struct config_group tg_pt_gp_group;
         struct list_head tg_pt_gp_list;
         struct list_head tg_pt_gp_lun_list;
         struct se_lun *tg_pt_gp_alua_lun;
         struct se_node_acl *tg_pt_gp_alua_nacl;
-        struct delayed_work tg_pt_gp_transition_work;
-        struct completion *tg_pt_gp_transition_complete;
 };
 
 struct t10_vpd {
@@ -705,6 +702,7 @@ struct se_lun {
         u64                     unpacked_lun;
 #define SE_LUN_LINK_MAGIC                       0xffff7771
         u32                     lun_link_magic;
+        bool                    lun_shutdown;
         bool                    lun_access_ro;
         u32                     lun_index;
 
diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h
index 14e49c798135..b35533b94277 100644
--- a/include/trace/events/syscalls.h
+++ b/include/trace/events/syscalls.h
@@ -1,5 +1,6 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM raw_syscalls
+#undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE syscalls
 
 #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index 9b1462e38b82..a076cf1a3a23 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -730,9 +730,11 @@ __SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
 __SYSCALL(__NR_pkey_alloc,    sys_pkey_alloc)
 #define __NR_pkey_free 290
 __SYSCALL(__NR_pkey_free,     sys_pkey_free)
+#define __NR_statx 291
+__SYSCALL(__NR_statx,     sys_statx)
 
 #undef __NR_syscalls
-#define __NR_syscalls 291
+#define __NR_syscalls 292
 
 /*
  * All syscalls below here should go away really,
diff --git a/include/uapi/drm/omap_drm.h b/include/uapi/drm/omap_drm.h
index 407cb55df6ac..7fb97863c945 100644
--- a/include/uapi/drm/omap_drm.h
+++ b/include/uapi/drm/omap_drm.h
@@ -33,8 +33,8 @@ extern "C" {
 #define OMAP_PARAM_CHIPSET_ID   1       /* ie. 0x3430, 0x4430, etc */
 
 struct drm_omap_param {
-        uint64_t param;                 /* in */
-        uint64_t value;                 /* in (set_param), out (get_param) */
+        __u64 param;                    /* in */
+        __u64 value;                    /* in (set_param), out (get_param) */
 };
 
 #define OMAP_BO_SCANOUT         0x00000001      /* scanout capable (phys contiguous) */
@@ -53,18 +53,18 @@ struct drm_omap_param {
 #define OMAP_BO_TILED           (OMAP_BO_TILED_8 | OMAP_BO_TILED_16 | OMAP_BO_TILED_32)
 
 union omap_gem_size {
-        uint32_t bytes;         /* (for non-tiled formats) */
+        __u32 bytes;            /* (for non-tiled formats) */
         struct {
-                uint16_t width;
-                uint16_t height;
+                __u16 width;
+                __u16 height;
         } tiled;                /* (for tiled formats) */
 };
 
 struct drm_omap_gem_new {
         union omap_gem_size size;       /* in */
-        uint32_t flags;                 /* in */
-        uint32_t handle;                /* out */
-        uint32_t __pad;
+        __u32 flags;                    /* in */
+        __u32 handle;                   /* out */
+        __u32 __pad;
 };
 
 /* mask of operations: */
@@ -74,33 +74,33 @@ enum omap_gem_op {
 };
 
 struct drm_omap_gem_cpu_prep {
-        uint32_t handle;                /* buffer handle (in) */
-        uint32_t op;                    /* mask of omap_gem_op (in) */
+        __u32 handle;                   /* buffer handle (in) */
+        __u32 op;                       /* mask of omap_gem_op (in) */
 };
 
 struct drm_omap_gem_cpu_fini {
-        uint32_t handle;                /* buffer handle (in) */
-        uint32_t op;                    /* mask of omap_gem_op (in) */
+        __u32 handle;                   /* buffer handle (in) */
+        __u32 op;                       /* mask of omap_gem_op (in) */
         /* TODO maybe here we pass down info about what regions are touched
          * by sw so we can be clever about cache ops?  For now a placeholder,
          * set to zero and we just do full buffer flush..
          */
-        uint32_t nregions;
-        uint32_t __pad;
+        __u32 nregions;
+        __u32 __pad;
 };
 
 struct drm_omap_gem_info {
-        uint32_t handle;                /* buffer handle (in) */
-        uint32_t pad;
-        uint64_t offset;                /* mmap offset (out) */
+        __u32 handle;                   /* buffer handle (in) */
+        __u32 pad;
+        __u64 offset;                   /* mmap offset (out) */
         /* note: in case of tiled buffers, the user virtual size can be
          * different from the physical size (ie. how many pages are needed
          * to back the object) which is returned in DRM_IOCTL_GEM_OPEN..
          * This size here is the one that should be used if you want to
          * mmap() the buffer:
          */
-        uint32_t size;                  /* virtual size for mmap'ing (out) */
-        uint32_t __pad;
+        __u32 size;                     /* virtual size for mmap'ing (out) */
+        __u32 __pad;
 };
 
 #define DRM_OMAP_GET_PARAM              0x00
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index dd9820b1c779..f8d9fed17ba9 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -445,6 +445,7 @@ header-y += unistd.h
 header-y += unix_diag.h
 header-y += usbdevice_fs.h
 header-y += usbip.h
+header-y += userio.h
 header-y += utime.h
 header-y += utsname.h
 header-y += uuid.h
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index db4c253f8011..dcfc3a5a9cb1 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -713,33 +713,6 @@ enum btrfs_err_code {
         BTRFS_ERROR_DEV_ONLY_WRITABLE,
         BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS
 };
-/* An error code to error string mapping for the kernel
-*  error codes
-*/
-static inline char *btrfs_err_str(enum btrfs_err_code err_code)
-{
-        switch (err_code) {
-                case BTRFS_ERROR_DEV_RAID1_MIN_NOT_MET:
-                        return "unable to go below two devices on raid1";
-                case BTRFS_ERROR_DEV_RAID10_MIN_NOT_MET:
-                        return "unable to go below four devices on raid10";
-                case BTRFS_ERROR_DEV_RAID5_MIN_NOT_MET:
-                        return "unable to go below two devices on raid5";
-                case BTRFS_ERROR_DEV_RAID6_MIN_NOT_MET:
-                        return "unable to go below three devices on raid6";
-                case BTRFS_ERROR_DEV_TGT_REPLACE:
-                        return "unable to remove the dev_replace target dev";
-                case BTRFS_ERROR_DEV_MISSING_NOT_FOUND:
-                        return "no missing devices found to remove";
-                case BTRFS_ERROR_DEV_ONLY_WRITABLE:
-                        return "unable to remove the only writeable device";
-                case BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS:
-                        return "add/delete/balance/replace/resize operation "\
-                                "in progress";
-                default:
-                        return NULL;
-        }
-}
 
 #define BTRFS_IOC_SNAP_CREATE _IOW(BTRFS_IOCTL_MAGIC, 1, \
                                    struct btrfs_ioctl_vol_args)
diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h
index 85bbb1799df3..d496c02e14bc 100644
--- a/include/uapi/linux/ipv6_route.h
+++ b/include/uapi/linux/ipv6_route.h
@@ -35,7 +35,7 @@
 #define RTF_PREF(pref)  ((pref) << 27)
 #define RTF_PREF_MASK   0x18000000
 
-#define RTF_PCPU        0x40000000
+#define RTF_PCPU        0x40000000      /* read-only: can not be set by user */
 #define RTF_LOCAL       0x80000000
 
 
diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
index d08c63f3dd6f..0c5d5dd61b6a 100644
--- a/include/uapi/linux/packet_diag.h
+++ b/include/uapi/linux/packet_diag.h
@@ -64,7 +64,7 @@ struct packet_diag_mclist {
         __u32   pdmc_count;
         __u16   pdmc_type;
         __u16   pdmc_alen;
-        __u8    pdmc_addr[MAX_ADDR_LEN];
+        __u8    pdmc_addr[32]; /* MAX_ADDR_LEN */
 };
 
 struct packet_diag_ring {
diff --git a/include/uapi/linux/stat.h b/include/uapi/linux/stat.h
index 51a6b86e3700..d538897b8e08 100644
--- a/include/uapi/linux/stat.h
+++ b/include/uapi/linux/stat.h
@@ -114,7 +114,7 @@ struct statx {
         __u64   stx_ino;        /* Inode number */
         __u64   stx_size;       /* File size */
         __u64   stx_blocks;     /* Number of 512-byte blocks allocated */
-        __u64   __spare1[1];
+        __u64   stx_attributes_mask; /* Mask to show what's supported in stx_attributes */
         /* 0x40 */
         struct statx_timestamp  stx_atime;      /* Last access time */
         struct statx_timestamp  stx_btime;      /* File creation time */
@@ -152,9 +152,10 @@ struct statx {
 #define STATX_BASIC_STATS       0x000007ffU     /* The stuff in the normal stat struct */
 #define STATX_BTIME             0x00000800U     /* Want/got stx_btime */
 #define STATX_ALL               0x00000fffU     /* All currently supported flags */
+#define STATX__RESERVED         0x80000000U     /* Reserved for future struct statx expansion */
 
 /*
- * Attributes to be found in stx_attributes
+ * Attributes to be found in stx_attributes and masked in stx_attributes_mask.
  *
  * These give information about the features or the state of a file that might
  * be of use to ordinary userspace programs such as GUIs or ls rather than
diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
index c055947c5c98..3b059530dac9 100644
--- a/include/uapi/linux/userfaultfd.h
+++ b/include/uapi/linux/userfaultfd.h
@@ -18,8 +18,7 @@
  * means the userland is reading).
  */
 #define UFFD_API ((__u64)0xAA)
-#define UFFD_API_FEATURES (UFFD_FEATURE_EVENT_EXIT |            \
-                           UFFD_FEATURE_EVENT_FORK |            \
+#define UFFD_API_FEATURES (UFFD_FEATURE_EVENT_FORK |            \
                            UFFD_FEATURE_EVENT_REMAP |           \
                            UFFD_FEATURE_EVENT_REMOVE |  \
                            UFFD_FEATURE_EVENT_UNMAP |           \
@@ -113,7 +112,6 @@ struct uffd_msg {
 #define UFFD_EVENT_REMAP        0x14
 #define UFFD_EVENT_REMOVE       0x15
 #define UFFD_EVENT_UNMAP        0x16
-#define UFFD_EVENT_EXIT         0x17
 
 /* flags for UFFD_EVENT_PAGEFAULT */
 #define UFFD_PAGEFAULT_FLAG_WRITE       (1<<0)  /* If this was a write fault */
@@ -163,7 +161,6 @@ struct uffdio_api {
 #define UFFD_FEATURE_MISSING_HUGETLBFS          (1<<4)
 #define UFFD_FEATURE_MISSING_SHMEM              (1<<5)
 #define UFFD_FEATURE_EVENT_UNMAP                (1<<6)
-#define UFFD_FEATURE_EVENT_EXIT                 (1<<7)
         __u64 features;
 
         __u64 ioctls;
diff --git a/include/uapi/linux/virtio_pci.h b/include/uapi/linux/virtio_pci.h
index 15b4385a2be1..90007a1abcab 100644
--- a/include/uapi/linux/virtio_pci.h
+++ b/include/uapi/linux/virtio_pci.h
@@ -79,7 +79,7 @@
  * configuration space */
 #define VIRTIO_PCI_CONFIG_OFF(msix_enabled)     ((msix_enabled) ? 24 : 20)
 /* Deprecated: please use VIRTIO_PCI_CONFIG_OFF instead */
-#define VIRTIO_PCI_CONFIG(dev)  VIRTIO_PCI_CONFIG_OFF((dev)->pci_dev->msix_enabled)
+#define VIRTIO_PCI_CONFIG(dev)  VIRTIO_PCI_CONFIG_OFF((dev)->msix_enabled)
 
 /* Virtio ABI version, this must match exactly */
 #define VIRTIO_PCI_ABI_VERSION          0
diff --git a/include/uapi/rdma/mlx5-abi.h b/include/uapi/rdma/mlx5-abi.h
index da7cd62bace7..0b3d30837a9f 100644
--- a/include/uapi/rdma/mlx5-abi.h
+++ b/include/uapi/rdma/mlx5-abi.h
@@ -34,6 +34,7 @@
 #define MLX5_ABI_USER_H
 
 #include <linux/types.h>
+#include <linux/if_ether.h>     /* For ETH_ALEN. */
 
 enum {
         MLX5_QP_FLAG_SIGNATURE          = 1 << 0,
@@ -66,7 +67,7 @@ struct mlx5_ib_alloc_ucontext_req {
 };
 
 enum mlx5_lib_caps {
-        MLX5_LIB_CAP_4K_UAR     = (u64)1 << 0,
+        MLX5_LIB_CAP_4K_UAR     = (__u64)1 << 0,
 };
 
 struct mlx5_ib_alloc_ucontext_req_v2 {
diff --git a/include/video/exynos5433_decon.h b/include/video/exynos5433_decon.h
index ef8e2a8ad0af..6b083d327e98 100644
--- a/include/video/exynos5433_decon.h
+++ b/include/video/exynos5433_decon.h
@@ -46,6 +46,7 @@
 #define DECON_FRAMEFIFO_STATUS          0x0524
 #define DECON_CMU                       0x1404
 #define DECON_UPDATE                    0x1410
+#define DECON_CRFMID                    0x1414
 #define DECON_UPDATE_SCHEME             0x1438
 #define DECON_VIDCON1                   0x2000
 #define DECON_VIDCON2                   0x2004
@@ -126,6 +127,10 @@
 
 /* VIDINTCON0 */
 #define VIDINTCON0_FRAMEDONE            (1 << 17)
+#define VIDINTCON0_FRAMESEL_BP          (0 << 15)
+#define VIDINTCON0_FRAMESEL_VS          (1 << 15)
+#define VIDINTCON0_FRAMESEL_AC          (2 << 15)
+#define VIDINTCON0_FRAMESEL_FP          (3 << 15)
 #define VIDINTCON0_INTFRMEN             (1 << 12)
 #define VIDINTCON0_INTEN                (1 << 0)
 
@@ -142,6 +147,13 @@
 #define STANDALONE_UPDATE_F             (1 << 0)
 
 /* DECON_VIDCON1 */
+#define VIDCON1_LINECNT_MASK            (0x0fff << 16)
+#define VIDCON1_I80_ACTIVE              (1 << 15)
+#define VIDCON1_VSTATUS_MASK            (0x3 << 13)
+#define VIDCON1_VSTATUS_VS              (0 << 13)
+#define VIDCON1_VSTATUS_BP              (1 << 13)
+#define VIDCON1_VSTATUS_AC              (2 << 13)
+#define VIDCON1_VSTATUS_FP              (3 << 13)
 #define VIDCON1_VCLK_MASK               (0x3 << 9)
 #define VIDCON1_VCLK_RUN_VDEN_DISABLE   (0x3 << 9)
 #define VIDCON1_VCLK_HOLD               (0x0 << 9)
diff --git a/include/xen/swiotlb-xen.h b/include/xen/swiotlb-xen.h
index a0083be5d529..1f6d78f044b6 100644
--- a/include/xen/swiotlb-xen.h
+++ b/include/xen/swiotlb-xen.h
@@ -2,6 +2,7 @@
 #define __LINUX_SWIOTLB_XEN_H
 
 #include <linux/dma-direction.h>
+#include <linux/scatterlist.h>
 #include <linux/swiotlb.h>
 
 extern int xen_swiotlb_init(int verbose, bool early);
@@ -55,4 +56,14 @@ xen_swiotlb_dma_supported(struct device *hwdev, u64 mask);
 
 extern int
 xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask);
+
+extern int
+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma,
+                     void *cpu_addr, dma_addr_t dma_addr, size_t size,
+                     unsigned long attrs);
+
+extern int
+xen_swiotlb_get_sgtable(struct device *dev, struct sg_table *sgt,
+                        void *cpu_addr, dma_addr_t handle, size_t size,
+                        unsigned long attrs);
 #endif /* __LINUX_SWIOTLB_XEN_H */
diff --git a/init/main.c b/init/main.c
index eae2f15657c6..b0c11cbf5ddf 100644
--- a/init/main.c
+++ b/init/main.c
@@ -882,7 +882,6 @@ static void __init do_basic_setup(void)
         do_ctors();
         usermodehelper_enable();
         do_initcalls();
-        random_int_secret_init();
 }
 
 static void __init do_pre_smp_initcalls(void)
@@ -1023,6 +1022,8 @@ static noinline void __init kernel_init_freeable(void)
 
         workqueue_init();
 
+        init_mm_internals();
+
         do_pre_smp_initcalls();
         lockup_detector_init();
 
diff --git a/kernel/audit.c b/kernel/audit.c
index e794544f5e63..a871bf80fde1 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -54,6 +54,10 @@
 #include <linux/kthread.h>
 #include <linux/kernel.h>
 #include <linux/syscalls.h>
+#include <linux/spinlock.h>
+#include <linux/rcupdate.h>
+#include <linux/mutex.h>
+#include <linux/gfp.h>
 
 #include <linux/audit.h>
 
@@ -90,13 +94,34 @@ static u32	audit_default;
 /* If auditing cannot proceed, audit_failure selects what happens. */
 static u32      audit_failure = AUDIT_FAIL_PRINTK;
 
-/*
- * If audit records are to be written to the netlink socket, audit_pid
- * contains the pid of the auditd process and audit_nlk_portid contains
- * the portid to use to send netlink messages to that process.
+/* private audit network namespace index */
+static unsigned int audit_net_id;
+
+/**
+ * struct audit_net - audit private network namespace data
+ * @sk: communication socket
  */
-int             audit_pid;
-static __u32    audit_nlk_portid;
+struct audit_net {
+        struct sock *sk;
+};
+
+/**
+ * struct auditd_connection - kernel/auditd connection state
+ * @pid: auditd PID
+ * @portid: netlink portid
+ * @net: the associated network namespace
+ * @lock: spinlock to protect write access
+ *
+ * Description:
+ * This struct is RCU protected; you must either hold the RCU lock for reading
+ * or the included spinlock for writing.
+ */
+static struct auditd_connection {
+        int pid;
+        u32 portid;
+        struct net *net;
+        spinlock_t lock;
+} auditd_conn;
 
 /* If audit_rate_limit is non-zero, limit the rate of sending audit records
  * to that number per second.  This prevents DoS attacks, but results in
@@ -123,10 +148,6 @@ u32		audit_sig_sid = 0;
 */
 static atomic_t audit_lost = ATOMIC_INIT(0);
 
-/* The netlink socket. */
-static struct sock *audit_sock;
-static unsigned int audit_net_id;
-
 /* Hash for inode-based rules */
 struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
 
@@ -192,6 +213,43 @@ struct audit_reply {
         struct sk_buff *skb;
 };
 
+/**
+ * auditd_test_task - Check to see if a given task is an audit daemon
+ * @task: the task to check
+ *
+ * Description:
+ * Return 1 if the task is a registered audit daemon, 0 otherwise.
+ */
+int auditd_test_task(const struct task_struct *task)
+{
+        int rc;
+
+        rcu_read_lock();
+        rc = (auditd_conn.pid && task->tgid == auditd_conn.pid ? 1 : 0);
+        rcu_read_unlock();
+
+        return rc;
+}
+
+/**
+ * audit_get_sk - Return the audit socket for the given network namespace
+ * @net: the destination network namespace
+ *
+ * Description:
+ * Returns the sock pointer if valid, NULL otherwise.  The caller must ensure
+ * that a reference is held for the network namespace while the sock is in use.
+ */
+static struct sock *audit_get_sk(const struct net *net)
+{
+        struct audit_net *aunet;
+
+        if (!net)
+                return NULL;
+
+        aunet = net_generic(net, audit_net_id);
+        return aunet->sk;
+}
+
 static void audit_set_portid(struct audit_buffer *ab, __u32 portid)
 {
         if (ab) {
@@ -210,9 +268,7 @@ void audit_panic(const char *message)
                         pr_err("%s\n", message);
                 break;
         case AUDIT_FAIL_PANIC:
-                /* test audit_pid since printk is always losey, why bother? */
-                if (audit_pid)
-                        panic("audit: %s\n", message);
+                panic("audit: %s\n", message);
                 break;
         }
 }
@@ -370,21 +426,60 @@ static int audit_set_failure(u32 state)
         return audit_do_config_change("audit_failure", &audit_failure, state);
 }
 
-/*
- * For one reason or another this nlh isn't getting delivered to the userspace
- * audit daemon, just send it to printk.
+/**
+ * auditd_set - Set/Reset the auditd connection state
+ * @pid: auditd PID
+ * @portid: auditd netlink portid
+ * @net: auditd network namespace pointer
+ *
+ * Description:
+ * This function will obtain and drop network namespace references as
+ * necessary.
+ */
+static void auditd_set(int pid, u32 portid, struct net *net)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&auditd_conn.lock, flags);
+        auditd_conn.pid = pid;
+        auditd_conn.portid = portid;
+        if (auditd_conn.net)
+                put_net(auditd_conn.net);
+        if (net)
+                auditd_conn.net = get_net(net);
+        else
+                auditd_conn.net = NULL;
+        spin_unlock_irqrestore(&auditd_conn.lock, flags);
+}
+
+/**
+ * kauditd_print_skb - Print the audit record to the ring buffer
+ * @skb: audit record
+ *
+ * Whatever the reason, this packet may not make it to the auditd connection
+ * so write it via printk so the information isn't completely lost.
  */
 static void kauditd_printk_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
         char *data = nlmsg_data(nlh);
 
-        if (nlh->nlmsg_type != AUDIT_EOE) {
-                if (printk_ratelimit())
-                        pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
-                else
-                        audit_log_lost("printk limit exceeded");
-        }
+        if (nlh->nlmsg_type != AUDIT_EOE && printk_ratelimit())
+                pr_notice("type=%d %s\n", nlh->nlmsg_type, data);
+}
+
+/**
+ * kauditd_rehold_skb - Handle a audit record send failure in the hold queue
+ * @skb: audit record
+ *
+ * Description:
+ * This should only be used by the kauditd_thread when it fails to flush the
+ * hold queue.
+ */
+static void kauditd_rehold_skb(struct sk_buff *skb)
+{
+        /* put the record back in the queue at the same place */
+        skb_queue_head(&audit_hold_queue, skb);
 }
 
 /**
@@ -444,65 +539,163 @@ static void kauditd_retry_skb(struct sk_buff *skb)
  * auditd_reset - Disconnect the auditd connection
  *
  * Description:
- * Break the auditd/kauditd connection and move all the records in the retry
- * queue into the hold queue in case auditd reconnects.  The audit_cmd_mutex
- * must be held when calling this function.
+ * Break the auditd/kauditd connection and move all the queued records into the
+ * hold queue in case auditd reconnects.
  */
 static void auditd_reset(void)
 {
         struct sk_buff *skb;
 
-        /* break the connection */
-        if (audit_sock) {
-                sock_put(audit_sock);
-                audit_sock = NULL;
-        }
-        audit_pid = 0;
-        audit_nlk_portid = 0;
+        /* if it isn't already broken, break the connection */
+        rcu_read_lock();
+        if (auditd_conn.pid)
+                auditd_set(0, 0, NULL);
+        rcu_read_unlock();
 
-        /* flush all of the retry queue to the hold queue */
+        /* flush all of the main and retry queues to the hold queue */
         while ((skb = skb_dequeue(&audit_retry_queue)))
                 kauditd_hold_skb(skb);
+        while ((skb = skb_dequeue(&audit_queue)))
+                kauditd_hold_skb(skb);
 }
 
 /**
- * kauditd_send_unicast_skb - Send a record via unicast to auditd
+ * auditd_send_unicast_skb - Send a record via unicast to auditd
  * @skb: audit record
+ *
+ * Description:
+ * Send a skb to the audit daemon, returns positive/zero values on success and
+ * negative values on failure; in all cases the skb will be consumed by this
+ * function.  If the send results in -ECONNREFUSED the connection with auditd
+ * will be reset.  This function may sleep so callers should not hold any locks
+ * where this would cause a problem.
  */
-static int kauditd_send_unicast_skb(struct sk_buff *skb)
+static int auditd_send_unicast_skb(struct sk_buff *skb)
 {
         int rc;
+        u32 portid;
+        struct net *net;
+        struct sock *sk;
+
+        /* NOTE: we can't call netlink_unicast while in the RCU section so
+         *       take a reference to the network namespace and grab local
+         *       copies of the namespace, the sock, and the portid; the
+         *       namespace and sock aren't going to go away while we hold a
+         *       reference and if the portid does become invalid after the RCU
+         *       section netlink_unicast() should safely return an error */
+
+        rcu_read_lock();
+        if (!auditd_conn.pid) {
+                rcu_read_unlock();
+                rc = -ECONNREFUSED;
+                goto err;
+        }
+        net = auditd_conn.net;
+        get_net(net);
+        sk = audit_get_sk(net);
+        portid = auditd_conn.portid;
+        rcu_read_unlock();
 
-        /* if we know nothing is connected, don't even try the netlink call */
-        if (!audit_pid)
-                return -ECONNREFUSED;
+        rc = netlink_unicast(sk, skb, portid, 0);
+        put_net(net);
+        if (rc < 0)
+                goto err;
 
-        /* get an extra skb reference in case we fail to send */
-        skb_get(skb);
-        rc = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
-        if (rc >= 0) {
-                consume_skb(skb);
-                rc = 0;
-        }
+        return rc;
 
+err:
+        if (rc == -ECONNREFUSED)
+                auditd_reset();
         return rc;
 }
 
+/**
+ * kauditd_send_queue - Helper for kauditd_thread to flush skb queues
+ * @sk: the sending sock
+ * @portid: the netlink destination
+ * @queue: the skb queue to process
+ * @retry_limit: limit on number of netlink unicast failures
+ * @skb_hook: per-skb hook for additional processing
+ * @err_hook: hook called if the skb fails the netlink unicast send
+ *
+ * Description:
+ * Run through the given queue and attempt to send the audit records to auditd,
+ * returns zero on success, negative values on failure.  It is up to the caller
+ * to ensure that the @sk is valid for the duration of this function.
+ *
+ */
+static int kauditd_send_queue(struct sock *sk, u32 portid,
+                              struct sk_buff_head *queue,
+                              unsigned int retry_limit,
+                              void (*skb_hook)(struct sk_buff *skb),
+                              void (*err_hook)(struct sk_buff *skb))
+{
+        int rc = 0;
+        struct sk_buff *skb;
+        static unsigned int failed = 0;
+
+        /* NOTE: kauditd_thread takes care of all our locking, we just use
+         *       the netlink info passed to us (e.g. sk and portid) */
+
+        while ((skb = skb_dequeue(queue))) {
+                /* call the skb_hook for each skb we touch */
+                if (skb_hook)
+                        (*skb_hook)(skb);
+
+                /* can we send to anyone via unicast? */
+                if (!sk) {
+                        if (err_hook)
+                                (*err_hook)(skb);
+                        continue;
+                }
+
+                /* grab an extra skb reference in case of error */
+                skb_get(skb);
+                rc = netlink_unicast(sk, skb, portid, 0);
+                if (rc < 0) {
+                        /* fatal failure for our queue flush attempt? */
+                        if (++failed >= retry_limit ||
+                            rc == -ECONNREFUSED || rc == -EPERM) {
+                                /* yes - error processing for the queue */
+                                sk = NULL;
+                                if (err_hook)
+                                        (*err_hook)(skb);
+                                if (!skb_hook)
+                                        goto out;
+                                /* keep processing with the skb_hook */
+                                continue;
+                        } else
+                                /* no - requeue to preserve ordering */
+                                skb_queue_head(queue, skb);
+                } else {
+                        /* it worked - drop the extra reference and continue */
+                        consume_skb(skb);
+                        failed = 0;
+                }
+        }
+
+out:
+        return (rc >= 0 ? 0 : rc);
+}
+
 /*
  * kauditd_send_multicast_skb - Send a record to any multicast listeners
  * @skb: audit record
  *
  * Description:
- * This function doesn't consume an skb as might be expected since it has to
- * copy it anyways.
+ * Write a multicast message to anyone listening in the initial network
+ * namespace.  This function doesn't consume an skb as might be expected since
+ * it has to copy it anyways.
  */
 static void kauditd_send_multicast_skb(struct sk_buff *skb)
 {
         struct sk_buff *copy;
-        struct audit_net *aunet = net_generic(&init_net, audit_net_id);
-        struct sock *sock = aunet->nlsk;
+        struct sock *sock = audit_get_sk(&init_net);
         struct nlmsghdr *nlh;
 
+        /* NOTE: we are not taking an additional reference for init_net since
+         *       we don't have to worry about it going away */
+
         if (!netlink_has_listeners(sock, AUDIT_NLGRP_READLOG))
                 return;
 
@@ -526,149 +719,79 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
 }
 
 /**
- * kauditd_wake_condition - Return true when it is time to wake kauditd_thread
- *
- * Description:
- * This function is for use by the wait_event_freezable() call in
- * kauditd_thread().
+ * kauditd_thread - Worker thread to send audit records to userspace
+ * @dummy: unused
  */
-static int kauditd_wake_condition(void)
-{
-        static int pid_last = 0;
-        int rc;
-        int pid = audit_pid;
-
-        /* wake on new messages or a change in the connected auditd */
-        rc = skb_queue_len(&audit_queue) || (pid && pid != pid_last);
-        if (rc)
-                pid_last = pid;
-
-        return rc;
-}
-
 static int kauditd_thread(void *dummy)
 {
         int rc;
-        int auditd = 0;
-        int reschedule = 0;
-        struct sk_buff *skb;
-        struct nlmsghdr *nlh;
+        u32 portid = 0;
+        struct net *net = NULL;
+        struct sock *sk = NULL;
 
 #define UNICAST_RETRIES 5
-#define AUDITD_BAD(x,y) \
-        ((x) == -ECONNREFUSED || (x) == -EPERM || ++(y) >= UNICAST_RETRIES)
-
-        /* NOTE: we do invalidate the auditd connection flag on any sending
-         * errors, but we only "restore" the connection flag at specific places
-         * in the loop in order to help ensure proper ordering of audit
-         * records */
 
         set_freezable();
         while (!kthread_should_stop()) {
-                /* NOTE: possible area for future improvement is to look at
-                 *       the hold and retry queues, since only this thread
-                 *       has access to these queues we might be able to do
-                 *       our own queuing and skip some/all of the locking */
-
-                /* NOTE: it might be a fun experiment to split the hold and
-                 *       retry queue handling to another thread, but the
-                 *       synchronization issues and other overhead might kill
-                 *       any performance gains */
+                /* NOTE: see the lock comments in auditd_send_unicast_skb() */
+                rcu_read_lock();
+                if (!auditd_conn.pid) {
+                        rcu_read_unlock();
+                        goto main_queue;
+                }
+                net = auditd_conn.net;
+                get_net(net);
+                sk = audit_get_sk(net);
+                portid = auditd_conn.portid;
+                rcu_read_unlock();
 
                 /* attempt to flush the hold queue */
-                while (auditd && (skb = skb_dequeue(&audit_hold_queue))) {
-                        rc = kauditd_send_unicast_skb(skb);
-                        if (rc) {
-                                /* requeue to the same spot */
-                                skb_queue_head(&audit_hold_queue, skb);
-
-                                auditd = 0;
-                                if (AUDITD_BAD(rc, reschedule)) {
-                                        mutex_lock(&audit_cmd_mutex);
-                                        auditd_reset();
-                                        mutex_unlock(&audit_cmd_mutex);
-                                        reschedule = 0;
-                                }
-                        } else
-                                /* we were able to send successfully */
-                                reschedule = 0;
+                rc = kauditd_send_queue(sk, portid,
+                                        &audit_hold_queue, UNICAST_RETRIES,
+                                        NULL, kauditd_rehold_skb);
+                if (rc < 0) {
+                        sk = NULL;
+                        auditd_reset();
+                        goto main_queue;
                 }
 
                 /* attempt to flush the retry queue */
-                while (auditd && (skb = skb_dequeue(&audit_retry_queue))) {
-                        rc = kauditd_send_unicast_skb(skb);
-                        if (rc) {
-                                auditd = 0;
-                                if (AUDITD_BAD(rc, reschedule)) {
-                                        kauditd_hold_skb(skb);
-                                        mutex_lock(&audit_cmd_mutex);
-                                        auditd_reset();
-                                        mutex_unlock(&audit_cmd_mutex);
-                                        reschedule = 0;
-                                } else
-                                        /* temporary problem (we hope), queue
-                                         * to the same spot and retry */
-                                        skb_queue_head(&audit_retry_queue, skb);
-                        } else
-                                /* we were able to send successfully */
-                                reschedule = 0;
+                rc = kauditd_send_queue(sk, portid,
+                                        &audit_retry_queue, UNICAST_RETRIES,
+                                        NULL, kauditd_hold_skb);
+                if (rc < 0) {
+                        sk = NULL;
+                        auditd_reset();
+                        goto main_queue;
                 }
 
-                /* standard queue processing, try to be as quick as possible */
-quick_loop:
-                skb = skb_dequeue(&audit_queue);
-                if (skb) {
-                        /* setup the netlink header, see the comments in
-                         * kauditd_send_multicast_skb() for length quirks */
-                        nlh = nlmsg_hdr(skb);
-                        nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
-
-                        /* attempt to send to any multicast listeners */
-                        kauditd_send_multicast_skb(skb);
-
-                        /* attempt to send to auditd, queue on failure */
-                        if (auditd) {
-                                rc = kauditd_send_unicast_skb(skb);
-                                if (rc) {
-                                        auditd = 0;
-                                        if (AUDITD_BAD(rc, reschedule)) {
-                                                mutex_lock(&audit_cmd_mutex);
-                                                auditd_reset();
-                                                mutex_unlock(&audit_cmd_mutex);
-                                                reschedule = 0;
-                                        }
-
-                                        /* move to the retry queue */
-                                        kauditd_retry_skb(skb);
-                                } else
-                                        /* everything is working so go fast! */
-                                        goto quick_loop;
-                        } else if (reschedule)
-                                /* we are currently having problems, move to
-                                 * the retry queue */
-                                kauditd_retry_skb(skb);
-                        else
-                                /* dump the message via printk and hold it */
-                                kauditd_hold_skb(skb);
-                } else {
-                        /* we have flushed the backlog so wake everyone */
-                        wake_up(&audit_backlog_wait);
-
-                        /* if everything is okay with auditd (if present), go
-                         * to sleep until there is something new in the queue
-                         * or we have a change in the connected auditd;
-                         * otherwise simply reschedule to give things a chance
-                         * to recover */
-                        if (reschedule) {
-                                set_current_state(TASK_INTERRUPTIBLE);
-                                schedule();
-                        } else
-                                wait_event_freezable(kauditd_wait,
-                                                     kauditd_wake_condition());
-
-                        /* update the auditd connection status */
-                        auditd = (audit_pid ? 1 : 0);
+main_queue:
+                /* process the main queue - do the multicast send and attempt
+                 * unicast, dump failed record sends to the retry queue; if
+                 * sk == NULL due to previous failures we will just do the
+                 * multicast send and move the record to the retry queue */
+                rc = kauditd_send_queue(sk, portid, &audit_queue, 1,
+                                        kauditd_send_multicast_skb,
+                                        kauditd_retry_skb);
+                if (sk == NULL || rc < 0)
+                        auditd_reset();
+                sk = NULL;
+
+                /* drop our netns reference, no auditd sends past this line */
+                if (net) {
+                        put_net(net);
+                        net = NULL;
                 }
+
+                /* we have processed all the queues so wake everyone */
+                wake_up(&audit_backlog_wait);
+
+                /* NOTE: we want to wake up if there is anything on the queue,
+                 *       regardless of if an auditd is connected, as we need to
+                 *       do the multicast send and rotate records from the
+                 *       main queue to the retry/hold queues */
+                wait_event_freezable(kauditd_wait,
+                                     (skb_queue_len(&audit_queue) ? 1 : 0));
         }
 
         return 0;
@@ -678,17 +801,16 @@ int audit_send_list(void *_dest)
 {
         struct audit_netlink_list *dest = _dest;
         struct sk_buff *skb;
-        struct net *net = dest->net;
-        struct audit_net *aunet = net_generic(net, audit_net_id);
+        struct sock *sk = audit_get_sk(dest->net);
 
         /* wait for parent to finish and send an ACK */
         mutex_lock(&audit_cmd_mutex);
         mutex_unlock(&audit_cmd_mutex);
 
         while ((skb = __skb_dequeue(&dest->q)) != NULL)
-                netlink_unicast(aunet->nlsk, skb, dest->portid, 0);
+                netlink_unicast(sk, skb, dest->portid, 0);
 
-        put_net(net);
+        put_net(dest->net);
         kfree(dest);
 
         return 0;
@@ -722,16 +844,15 @@ out_kfree_skb:
 static int audit_send_reply_thread(void *arg)
 {
         struct audit_reply *reply = (struct audit_reply *)arg;
-        struct net *net = reply->net;
-        struct audit_net *aunet = net_generic(net, audit_net_id);
+        struct sock *sk = audit_get_sk(reply->net);
 
         mutex_lock(&audit_cmd_mutex);
         mutex_unlock(&audit_cmd_mutex);
 
         /* Ignore failure. It'll only happen if the sender goes away,
            because our timeout is set to infinite. */
-        netlink_unicast(aunet->nlsk , reply->skb, reply->portid, 0);
-        put_net(net);
+        netlink_unicast(sk, reply->skb, reply->portid, 0);
+        put_net(reply->net);
         kfree(reply);
         return 0;
 }
@@ -949,12 +1070,12 @@ static int audit_set_feature(struct sk_buff *skb)
 
 static int audit_replace(pid_t pid)
 {
-        struct sk_buff *skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0,
-                                               &pid, sizeof(pid));
+        struct sk_buff *skb;
 
+        skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0, &pid, sizeof(pid));
         if (!skb)
                 return -ENOMEM;
-        return netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
+        return auditd_send_unicast_skb(skb);
 }
 
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
@@ -981,7 +1102,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 memset(&s, 0, sizeof(s));
                 s.enabled               = audit_enabled;
                 s.failure               = audit_failure;
-                s.pid                   = audit_pid;
+                rcu_read_lock();
+                s.pid                   = auditd_conn.pid;
+                rcu_read_unlock();
                 s.rate_limit            = audit_rate_limit;
                 s.backlog_limit         = audit_backlog_limit;
                 s.lost                  = atomic_read(&audit_lost);
@@ -1014,30 +1137,44 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                          *       from the initial pid namespace, but something
                          *       to keep in mind if this changes */
                         int new_pid = s.pid;
+                        pid_t auditd_pid;
                         pid_t requesting_pid = task_tgid_vnr(current);
 
-                        if ((!new_pid) && (requesting_pid != audit_pid)) {
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 0);
+                        /* test the auditd connection */
+                        audit_replace(requesting_pid);
+
+                        rcu_read_lock();
+                        auditd_pid = auditd_conn.pid;
+                        /* only the current auditd can unregister itself */
+                        if ((!new_pid) && (requesting_pid != auditd_pid)) {
+                                rcu_read_unlock();
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 0);
                                 return -EACCES;
                         }
-                        if (audit_pid && new_pid &&
-                            audit_replace(requesting_pid) != -ECONNREFUSED) {
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 0);
+                        /* replacing a healthy auditd is not allowed */
+                        if (auditd_pid && new_pid) {
+                                rcu_read_unlock();
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 0);
                                 return -EEXIST;
                         }
+                        rcu_read_unlock();
+
                         if (audit_enabled != AUDIT_OFF)
-                                audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
+                                audit_log_config_change("audit_pid", new_pid,
+                                                        auditd_pid, 1);
+
                         if (new_pid) {
-                                if (audit_sock)
-                                        sock_put(audit_sock);
-                                audit_pid = new_pid;
-                                audit_nlk_portid = NETLINK_CB(skb).portid;
-                                sock_hold(skb->sk);
-                                audit_sock = skb->sk;
-                        } else {
+                                /* register a new auditd connection */
+                                auditd_set(new_pid,
+                                           NETLINK_CB(skb).portid,
+                                           sock_net(NETLINK_CB(skb).sk));
+                                /* try to process any backlog */
+                                wake_up_interruptible(&kauditd_wait);
+                        } else
+                                /* unregister the auditd connection */
                                 auditd_reset();
-                        }
-                        wake_up_interruptible(&kauditd_wait);
                 }
                 if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
                         err = audit_set_rate_limit(s.rate_limit);
@@ -1090,7 +1227,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                                 if (err)
                                         break;
                         }
-                        mutex_unlock(&audit_cmd_mutex);
                         audit_log_common_recv_msg(&ab, msg_type);
                         if (msg_type != AUDIT_USER_TTY)
                                 audit_log_format(ab, " msg='%.*s'",
@@ -1108,7 +1244,6 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         }
                         audit_set_portid(ab, NETLINK_CB(skb).portid);
                         audit_log_end(ab);
-                        mutex_lock(&audit_cmd_mutex);
                 }
                 break;
         case AUDIT_ADD_RULE:
@@ -1298,26 +1433,26 @@ static int __net_init audit_net_init(struct net *net)
 
         struct audit_net *aunet = net_generic(net, audit_net_id);
 
-        aunet->nlsk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
-        if (aunet->nlsk == NULL) {
+        aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg);
+        if (aunet->sk == NULL) {
                 audit_panic("cannot initialize netlink socket in namespace");
                 return -ENOMEM;
         }
-        aunet->nlsk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+        aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
+
         return 0;
 }
 
 static void __net_exit audit_net_exit(struct net *net)
 {
         struct audit_net *aunet = net_generic(net, audit_net_id);
-        struct sock *sock = aunet->nlsk;
-        mutex_lock(&audit_cmd_mutex);
-        if (sock == audit_sock)
+
+        rcu_read_lock();
+        if (net == auditd_conn.net)
                 auditd_reset();
-        mutex_unlock(&audit_cmd_mutex);
+        rcu_read_unlock();
 
-        netlink_kernel_release(sock);
-        aunet->nlsk = NULL;
+        netlink_kernel_release(aunet->sk);
 }
 
 static struct pernet_operations audit_net_ops __net_initdata = {
@@ -1335,20 +1470,24 @@ static int __init audit_init(void)
         if (audit_initialized == AUDIT_DISABLED)
                 return 0;
 
-        pr_info("initializing netlink subsys (%s)\n",
-                audit_default ? "enabled" : "disabled");
-        register_pernet_subsys(&audit_net_ops);
+        memset(&auditd_conn, 0, sizeof(auditd_conn));
+        spin_lock_init(&auditd_conn.lock);
 
         skb_queue_head_init(&audit_queue);
         skb_queue_head_init(&audit_retry_queue);
         skb_queue_head_init(&audit_hold_queue);
-        audit_initialized = AUDIT_INITIALIZED;
-        audit_enabled = audit_default;
-        audit_ever_enabled |= !!audit_default;
 
         for (i = 0; i < AUDIT_INODE_BUCKETS; i++)
                 INIT_LIST_HEAD(&audit_inode_hash[i]);
 
+        pr_info("initializing netlink subsys (%s)\n",
+                audit_default ? "enabled" : "disabled");
+        register_pernet_subsys(&audit_net_ops);
+
+        audit_initialized = AUDIT_INITIALIZED;
+        audit_enabled = audit_default;
+        audit_ever_enabled |= !!audit_default;
+
         kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
         if (IS_ERR(kauditd_task)) {
                 int err = PTR_ERR(kauditd_task);
@@ -1519,20 +1658,16 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
         if (unlikely(!audit_filter(type, AUDIT_FILTER_TYPE)))
                 return NULL;
 
-        /* don't ever fail/sleep on these two conditions:
+        /* NOTE: don't ever fail/sleep on these two conditions:
          * 1. auditd generated record - since we need auditd to drain the
          *    queue; also, when we are checking for auditd, compare PIDs using
          *    task_tgid_vnr() since auditd_pid is set in audit_receive_msg()
          *    using a PID anchored in the caller's namespace
-         * 2. audit command message - record types 1000 through 1099 inclusive
-         *    are command messages/records used to manage the kernel subsystem
-         *    and the audit userspace, blocking on these messages could cause
-         *    problems under load so don't do it (note: not all of these
-         *    command types are valid as record types, but it is quicker to
-         *    just check two ints than a series of ints in a if/switch stmt) */
-        if (!((audit_pid && audit_pid == task_tgid_vnr(current)) ||
-              (type >= 1000 && type <= 1099))) {
-                long sleep_time = audit_backlog_wait_time;
+         * 2. generator holding the audit_cmd_mutex - we don't want to block
+         *    while holding the mutex */
+        if (!(auditd_test_task(current) ||
+              (current == __mutex_owner(&audit_cmd_mutex)))) {
+                long stime = audit_backlog_wait_time;
 
                 while (audit_backlog_limit &&
                        (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
@@ -1541,14 +1676,13 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 
                         /* sleep if we are allowed and we haven't exhausted our
                          * backlog wait limit */
-                        if ((gfp_mask & __GFP_DIRECT_RECLAIM) &&
-                            (sleep_time > 0)) {
+                        if (gfpflags_allow_blocking(gfp_mask) && (stime > 0)) {
                                 DECLARE_WAITQUEUE(wait, current);
 
                                 add_wait_queue_exclusive(&audit_backlog_wait,
                                                          &wait);
                                 set_current_state(TASK_UNINTERRUPTIBLE);
-                                sleep_time = schedule_timeout(sleep_time);
+                                stime = schedule_timeout(stime);
                                 remove_wait_queue(&audit_backlog_wait, &wait);
                         } else {
                                 if (audit_rate_check() && printk_ratelimit())
@@ -2127,15 +2261,27 @@ out:
  */
 void audit_log_end(struct audit_buffer *ab)
 {
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+
         if (!ab)
                 return;
-        if (!audit_rate_check()) {
-                audit_log_lost("rate limit exceeded");
-        } else {
-                skb_queue_tail(&audit_queue, ab->skb);
-                wake_up_interruptible(&kauditd_wait);
+
+        if (audit_rate_check()) {
+                skb = ab->skb;
                 ab->skb = NULL;
-        }
+
+                /* setup the netlink header, see the comments in
+                 * kauditd_send_multicast_skb() for length quirks */
+                nlh = nlmsg_hdr(skb);
+                nlh->nlmsg_len = skb->len - NLMSG_HDRLEN;
+
+                /* queue the netlink packet and poke the kauditd thread */
+                skb_queue_tail(&audit_queue, skb);
+                wake_up_interruptible(&kauditd_wait);
+        } else
+                audit_log_lost("rate limit exceeded");
+
         audit_buffer_free(ab);
 }
 
diff --git a/kernel/audit.h b/kernel/audit.h
index ca579880303a..0d87f8ab8778 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -218,7 +218,7 @@ extern void audit_log_name(struct audit_context *context,
                            struct audit_names *n, const struct path *path,
                            int record_num, int *call_panic);
 
-extern int audit_pid;
+extern int auditd_test_task(const struct task_struct *task);
 
 #define AUDIT_INODE_BUCKETS     32
 extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
@@ -250,10 +250,6 @@ struct audit_netlink_list {
 
 int audit_send_list(void *);
 
-struct audit_net {
-        struct sock *nlsk;
-};
-
 extern int selinux_audit_rule_update(void);
 
 extern struct mutex audit_filter_mutex;
@@ -337,14 +333,7 @@ extern u32 audit_sig_sid;
 extern int audit_filter(int msgtype, unsigned int listtype);
 
 #ifdef CONFIG_AUDITSYSCALL
-extern int __audit_signal_info(int sig, struct task_struct *t);
-static inline int audit_signal_info(int sig, struct task_struct *t)
-{
-        if (unlikely((audit_pid && t->tgid == audit_pid) ||
-                     (audit_signals && !audit_dummy_context())))
-                return __audit_signal_info(sig, t);
-        return 0;
-}
+extern int audit_signal_info(int sig, struct task_struct *t);
 extern void audit_filter_inodes(struct task_struct *, struct audit_context *);
 extern struct list_head *audit_killed_trees(void);
 #else
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index d6a8de5f8fa3..1c2333155893 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -762,7 +762,7 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
         struct audit_entry *e;
         enum audit_state state;
 
-        if (audit_pid && tsk->tgid == audit_pid)
+        if (auditd_test_task(tsk))
                 return AUDIT_DISABLED;
 
         rcu_read_lock();
@@ -816,7 +816,7 @@ void audit_filter_inodes(struct task_struct *tsk, struct audit_context *ctx)
 {
         struct audit_names *n;
 
-        if (audit_pid && tsk->tgid == audit_pid)
+        if (auditd_test_task(tsk))
                 return;
 
         rcu_read_lock();
@@ -2249,26 +2249,27 @@ void __audit_ptrace(struct task_struct *t)
  * If the audit subsystem is being terminated, record the task (pid)
  * and uid that is doing that.
  */
-int __audit_signal_info(int sig, struct task_struct *t)
+int audit_signal_info(int sig, struct task_struct *t)
 {
         struct audit_aux_data_pids *axp;
         struct task_struct *tsk = current;
         struct audit_context *ctx = tsk->audit_context;
         kuid_t uid = current_uid(), t_uid = task_uid(t);
 
-        if (audit_pid && t->tgid == audit_pid) {
-                if (sig == SIGTERM || sig == SIGHUP || sig == SIGUSR1 || sig == SIGUSR2) {
-                        audit_sig_pid = task_tgid_nr(tsk);
-                        if (uid_valid(tsk->loginuid))
-                                audit_sig_uid = tsk->loginuid;
-                        else
-                                audit_sig_uid = uid;
-                        security_task_getsecid(tsk, &audit_sig_sid);
-                }
-                if (!audit_signals || audit_dummy_context())
-                        return 0;
+        if (auditd_test_task(t) &&
+            (sig == SIGTERM || sig == SIGHUP ||
+             sig == SIGUSR1 || sig == SIGUSR2)) {
+                audit_sig_pid = task_tgid_nr(tsk);
+                if (uid_valid(tsk->loginuid))
+                        audit_sig_uid = tsk->loginuid;
+                else
+                        audit_sig_uid = uid;
+                security_task_getsecid(tsk, &audit_sig_sid);
         }
 
+        if (!audit_signals || audit_dummy_context())
+                return 0;
+
         /* optimize the common case by putting first signal recipient directly
          * in audit_context */
         if (!ctx->target_pid) {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index f45827e205d3..b4f1cb0c5ac7 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1162,12 +1162,12 @@ out:
         LD_ABS_W: /* BPF_R0 = ntohl(*(u32 *) (skb->data + imm32)) */
                 off = IMM;
 load_word:
-                /* BPF_LD + BPD_ABS and BPF_LD + BPF_IND insns are
-                 * only appearing in the programs where ctx ==
-                 * skb. All programs keep 'ctx' in regs[BPF_REG_CTX]
-                 * == BPF_R6, bpf_convert_filter() saves it in BPF_R6,
-                 * internal BPF verifier will check that BPF_R6 ==
-                 * ctx.
+                /* BPF_LD + BPD_ABS and BPF_LD + BPF_IND insns are only
+                 * appearing in the programs where ctx == skb
+                 * (see may_access_skb() in the verifier). All programs
+                 * keep 'ctx' in regs[BPF_REG_CTX] == BPF_R6,
+                 * bpf_convert_filter() saves it in BPF_R6, internal BPF
+                 * verifier will check that BPF_R6 == ctx.
                  *
                  * BPF_ABS and BPF_IND are wrappers of function calls,
                  * so they scratch BPF_R1-BPF_R5 registers, preserve
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 3ea87fb19a94..361a69dfe543 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -13,11 +13,12 @@
 #include <linux/bpf.h>
 #include <linux/jhash.h>
 #include <linux/filter.h>
+#include <linux/rculist_nulls.h>
 #include "percpu_freelist.h"
 #include "bpf_lru_list.h"
 
 struct bucket {
-        struct hlist_head head;
+        struct hlist_nulls_head head;
         raw_spinlock_t lock;
 };
 
@@ -29,28 +30,26 @@ struct bpf_htab {
                 struct pcpu_freelist freelist;
                 struct bpf_lru lru;
         };
-        void __percpu *extra_elems;
+        struct htab_elem *__percpu *extra_elems;
         atomic_t count; /* number of elements in this hashtable */
         u32 n_buckets;  /* number of hash buckets */
         u32 elem_size;  /* size of each element in bytes */
 };
 
-enum extra_elem_state {
-        HTAB_NOT_AN_EXTRA_ELEM = 0,
-        HTAB_EXTRA_ELEM_FREE,
-        HTAB_EXTRA_ELEM_USED
-};
-
 /* each htab element is struct htab_elem + key + value */
 struct htab_elem {
         union {
-                struct hlist_node hash_node;
-                struct bpf_htab *htab;
-                struct pcpu_freelist_node fnode;
+                struct hlist_nulls_node hash_node;
+                struct {
+                        void *padding;
+                        union {
+                                struct bpf_htab *htab;
+                                struct pcpu_freelist_node fnode;
+                        };
+                };
         };
         union {
                 struct rcu_head rcu;
-                enum extra_elem_state state;
                 struct bpf_lru_node lru_node;
         };
         u32 hash;
@@ -71,6 +70,11 @@ static bool htab_is_percpu(const struct bpf_htab *htab)
                 htab->map.map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH;
 }
 
+static bool htab_is_prealloc(const struct bpf_htab *htab)
+{
+        return !(htab->map.map_flags & BPF_F_NO_PREALLOC);
+}
+
 static inline void htab_elem_set_ptr(struct htab_elem *l, u32 key_size,
                                      void __percpu *pptr)
 {
@@ -122,17 +126,20 @@ static struct htab_elem *prealloc_lru_pop(struct bpf_htab *htab, void *key,
 
 static int prealloc_init(struct bpf_htab *htab)
 {
+        u32 num_entries = htab->map.max_entries;
         int err = -ENOMEM, i;
 
-        htab->elems = bpf_map_area_alloc(htab->elem_size *
-                                         htab->map.max_entries);
+        if (!htab_is_percpu(htab) && !htab_is_lru(htab))
+                num_entries += num_possible_cpus();
+
+        htab->elems = bpf_map_area_alloc(htab->elem_size * num_entries);
         if (!htab->elems)
                 return -ENOMEM;
 
         if (!htab_is_percpu(htab))
                 goto skip_percpu_elems;
 
-        for (i = 0; i < htab->map.max_entries; i++) {
+        for (i = 0; i < num_entries; i++) {
                 u32 size = round_up(htab->map.value_size, 8);
                 void __percpu *pptr;
 
@@ -160,10 +167,11 @@ skip_percpu_elems:
         if (htab_is_lru(htab))
                 bpf_lru_populate(&htab->lru, htab->elems,
                                  offsetof(struct htab_elem, lru_node),
-                                 htab->elem_size, htab->map.max_entries);
+                                 htab->elem_size, num_entries);
         else
-                pcpu_freelist_populate(&htab->freelist, htab->elems,
-                                       htab->elem_size, htab->map.max_entries);
+                pcpu_freelist_populate(&htab->freelist,
+                                       htab->elems + offsetof(struct htab_elem, fnode),
+                                       htab->elem_size, num_entries);
 
         return 0;
 
@@ -184,16 +192,22 @@ static void prealloc_destroy(struct bpf_htab *htab)
 
 static int alloc_extra_elems(struct bpf_htab *htab)
 {
-        void __percpu *pptr;
+        struct htab_elem *__percpu *pptr, *l_new;
+        struct pcpu_freelist_node *l;
         int cpu;
 
-        pptr = __alloc_percpu_gfp(htab->elem_size, 8, GFP_USER | __GFP_NOWARN);
+        pptr = __alloc_percpu_gfp(sizeof(struct htab_elem *), 8,
+                                  GFP_USER | __GFP_NOWARN);
         if (!pptr)
                 return -ENOMEM;
 
         for_each_possible_cpu(cpu) {
-                ((struct htab_elem *)per_cpu_ptr(pptr, cpu))->state =
-                        HTAB_EXTRA_ELEM_FREE;
+                l = pcpu_freelist_pop(&htab->freelist);
+                /* pop will succeed, since prealloc_init()
+                 * preallocated extra num_possible_cpus elements
+                 */
+                l_new = container_of(l, struct htab_elem, fnode);
+                *per_cpu_ptr(pptr, cpu) = l_new;
         }
         htab->extra_elems = pptr;
         return 0;
@@ -217,6 +231,11 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
         int err, i;
         u64 cost;
 
+        BUILD_BUG_ON(offsetof(struct htab_elem, htab) !=
+                     offsetof(struct htab_elem, hash_node.pprev));
+        BUILD_BUG_ON(offsetof(struct htab_elem, fnode.next) !=
+                     offsetof(struct htab_elem, hash_node.pprev));
+
         if (lru && !capable(CAP_SYS_ADMIN))
                 /* LRU implementation is much complicated than other
                  * maps.  Hence, limit to CAP_SYS_ADMIN for now.
@@ -326,29 +345,29 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                 goto free_htab;
 
         for (i = 0; i < htab->n_buckets; i++) {
-                INIT_HLIST_HEAD(&htab->buckets[i].head);
+                INIT_HLIST_NULLS_HEAD(&htab->buckets[i].head, i);
                 raw_spin_lock_init(&htab->buckets[i].lock);
         }
 
-        if (!percpu && !lru) {
-                /* lru itself can remove the least used element, so
-                 * there is no need for an extra elem during map_update.
-                 */
-                err = alloc_extra_elems(htab);
-                if (err)
-                        goto free_buckets;
-        }
-
         if (prealloc) {
                 err = prealloc_init(htab);
                 if (err)
-                        goto free_extra_elems;
+                        goto free_buckets;
+
+                if (!percpu && !lru) {
+                        /* lru itself can remove the least used element, so
+                         * there is no need for an extra elem during map_update.
+                         */
+                        err = alloc_extra_elems(htab);
+                        if (err)
+                                goto free_prealloc;
+                }
         }
 
         return &htab->map;
 
-free_extra_elems:
-        free_percpu(htab->extra_elems);
+free_prealloc:
+        prealloc_destroy(htab);
 free_buckets:
         bpf_map_area_free(htab->buckets);
 free_htab:
@@ -366,20 +385,44 @@ static inline struct bucket *__select_bucket(struct bpf_htab *htab, u32 hash)
         return &htab->buckets[hash & (htab->n_buckets - 1)];
 }
 
-static inline struct hlist_head *select_bucket(struct bpf_htab *htab, u32 hash)
+static inline struct hlist_nulls_head *select_bucket(struct bpf_htab *htab, u32 hash)
 {
         return &__select_bucket(htab, hash)->head;
 }
 
-static struct htab_elem *lookup_elem_raw(struct hlist_head *head, u32 hash,
+/* this lookup function can only be called with bucket lock taken */
+static struct htab_elem *lookup_elem_raw(struct hlist_nulls_head *head, u32 hash,
                                          void *key, u32 key_size)
 {
+        struct hlist_nulls_node *n;
+        struct htab_elem *l;
+
+        hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
+                if (l->hash == hash && !memcmp(&l->key, key, key_size))
+                        return l;
+
+        return NULL;
+}
+
+/* can be called without bucket lock. it will repeat the loop in
+ * the unlikely event when elements moved from one bucket into another
+ * while link list is being walked
+ */
+static struct htab_elem *lookup_nulls_elem_raw(struct hlist_nulls_head *head,
+                                               u32 hash, void *key,
+                                               u32 key_size, u32 n_buckets)
+{
+        struct hlist_nulls_node *n;
         struct htab_elem *l;
 
-        hlist_for_each_entry_rcu(l, head, hash_node)
+again:
+        hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
                 if (l->hash == hash && !memcmp(&l->key, key, key_size))
                         return l;
 
+        if (unlikely(get_nulls_value(n) != (hash & (n_buckets - 1))))
+                goto again;
+
         return NULL;
 }
 
@@ -387,7 +430,7 @@ static struct htab_elem *lookup_elem_raw(struct hlist_head *head, u32 hash,
 static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct htab_elem *l;
         u32 hash, key_size;
 
@@ -400,7 +443,7 @@ static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
 
         head = select_bucket(htab, hash);
 
-        l = lookup_elem_raw(head, hash, key, key_size);
+        l = lookup_nulls_elem_raw(head, hash, key, key_size, htab->n_buckets);
 
         return l;
 }
@@ -433,8 +476,9 @@ static void *htab_lru_map_lookup_elem(struct bpf_map *map, void *key)
 static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
 {
         struct bpf_htab *htab = (struct bpf_htab *)arg;
-        struct htab_elem *l, *tgt_l;
-        struct hlist_head *head;
+        struct htab_elem *l = NULL, *tgt_l;
+        struct hlist_nulls_head *head;
+        struct hlist_nulls_node *n;
         unsigned long flags;
         struct bucket *b;
 
@@ -444,9 +488,9 @@ static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
 
         raw_spin_lock_irqsave(&b->lock, flags);
 
-        hlist_for_each_entry_rcu(l, head, hash_node)
+        hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
                 if (l == tgt_l) {
-                        hlist_del_rcu(&l->hash_node);
+                        hlist_nulls_del_rcu(&l->hash_node);
                         break;
                 }
 
@@ -459,7 +503,7 @@ static bool htab_lru_map_delete_node(void *arg, struct bpf_lru_node *node)
 static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct htab_elem *l, *next_l;
         u32 hash, key_size;
         int i;
@@ -473,7 +517,7 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
         head = select_bucket(htab, hash);
 
         /* lookup the key */
-        l = lookup_elem_raw(head, hash, key, key_size);
+        l = lookup_nulls_elem_raw(head, hash, key, key_size, htab->n_buckets);
 
         if (!l) {
                 i = 0;
@@ -481,7 +525,7 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
         }
 
         /* key was found, get next key in the same bucket */
-        next_l = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(&l->hash_node)),
+        next_l = hlist_nulls_entry_safe(rcu_dereference_raw(hlist_nulls_next_rcu(&l->hash_node)),
                                   struct htab_elem, hash_node);
 
         if (next_l) {
@@ -500,7 +544,7 @@ find_first_elem:
                 head = select_bucket(htab, i);
 
                 /* pick first element in the bucket */
-                next_l = hlist_entry_safe(rcu_dereference_raw(hlist_first_rcu(head)),
+                next_l = hlist_nulls_entry_safe(rcu_dereference_raw(hlist_nulls_first_rcu(head)),
                                           struct htab_elem, hash_node);
                 if (next_l) {
                         /* if it's not empty, just return it */
@@ -538,12 +582,7 @@ static void htab_elem_free_rcu(struct rcu_head *head)
 
 static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 {
-        if (l->state == HTAB_EXTRA_ELEM_USED) {
-                l->state = HTAB_EXTRA_ELEM_FREE;
-                return;
-        }
-
-        if (!(htab->map.map_flags & BPF_F_NO_PREALLOC)) {
+        if (htab_is_prealloc(htab)) {
                 pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
                 atomic_dec(&htab->count);
@@ -573,43 +612,43 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr,
 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                          void *value, u32 key_size, u32 hash,
                                          bool percpu, bool onallcpus,
-                                         bool old_elem_exists)
+                                         struct htab_elem *old_elem)
 {
         u32 size = htab->map.value_size;
-        bool prealloc = !(htab->map.map_flags & BPF_F_NO_PREALLOC);
-        struct htab_elem *l_new;
+        bool prealloc = htab_is_prealloc(htab);
+        struct htab_elem *l_new, **pl_new;
         void __percpu *pptr;
-        int err = 0;
 
         if (prealloc) {
-                l_new = (struct htab_elem *)pcpu_freelist_pop(&htab->freelist);
-                if (!l_new)
-                        err = -E2BIG;
-        } else {
-                if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
-                        atomic_dec(&htab->count);
-                        err = -E2BIG;
+                if (old_elem) {
+                        /* if we're updating the existing element,
+                         * use per-cpu extra elems to avoid freelist_pop/push
+                         */
+                        pl_new = this_cpu_ptr(htab->extra_elems);
+                        l_new = *pl_new;
+                        *pl_new = old_elem;
                 } else {
-                        l_new = kmalloc(htab->elem_size,
-                                        GFP_ATOMIC | __GFP_NOWARN);
-                        if (!l_new)
-                                return ERR_PTR(-ENOMEM);
-                }
-        }
+                        struct pcpu_freelist_node *l;
 
-        if (err) {
-                if (!old_elem_exists)
-                        return ERR_PTR(err);
-
-                /* if we're updating the existing element and the hash table
-                 * is full, use per-cpu extra elems
-                 */
-                l_new = this_cpu_ptr(htab->extra_elems);
-                if (l_new->state != HTAB_EXTRA_ELEM_FREE)
-                        return ERR_PTR(-E2BIG);
-                l_new->state = HTAB_EXTRA_ELEM_USED;
+                        l = pcpu_freelist_pop(&htab->freelist);
+                        if (!l)
+                                return ERR_PTR(-E2BIG);
+                        l_new = container_of(l, struct htab_elem, fnode);
+                }
         } else {
-                l_new->state = HTAB_NOT_AN_EXTRA_ELEM;
+                if (atomic_inc_return(&htab->count) > htab->map.max_entries)
+                        if (!old_elem) {
+                                /* when map is full and update() is replacing
+                                 * old element, it's ok to allocate, since
+                                 * old element will be freed immediately.
+                                 * Otherwise return an error
+                                 */
+                                atomic_dec(&htab->count);
+                                return ERR_PTR(-E2BIG);
+                        }
+                l_new = kmalloc(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN);
+                if (!l_new)
+                        return ERR_PTR(-ENOMEM);
         }
 
         memcpy(l_new->key, key, key_size);
@@ -661,7 +700,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new = NULL, *l_old;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -690,7 +729,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
                 goto err;
 
         l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false,
-                                !!l_old);
+                                l_old);
         if (IS_ERR(l_new)) {
                 /* all pre-allocated elements are in use or memory exhausted */
                 ret = PTR_ERR(l_new);
@@ -700,10 +739,11 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
         /* add new element to the head of the list, so that
          * concurrent search will find it before old elem
          */
-        hlist_add_head_rcu(&l_new->hash_node, head);
+        hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         if (l_old) {
-                hlist_del_rcu(&l_old->hash_node);
-                free_htab_elem(htab, l_old);
+                hlist_nulls_del_rcu(&l_old->hash_node);
+                if (!htab_is_prealloc(htab))
+                        free_htab_elem(htab, l_old);
         }
         ret = 0;
 err:
@@ -716,7 +756,7 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new, *l_old = NULL;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -757,10 +797,10 @@ static int htab_lru_map_update_elem(struct bpf_map *map, void *key, void *value,
         /* add new element to the head of the list, so that
          * concurrent search will find it before old elem
          */
-        hlist_add_head_rcu(&l_new->hash_node, head);
+        hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         if (l_old) {
                 bpf_lru_node_set_ref(&l_new->lru_node);
-                hlist_del_rcu(&l_old->hash_node);
+                hlist_nulls_del_rcu(&l_old->hash_node);
         }
         ret = 0;
 
@@ -781,7 +821,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new = NULL, *l_old;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -815,12 +855,12 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
                                 value, onallcpus);
         } else {
                 l_new = alloc_htab_elem(htab, key, value, key_size,
-                                        hash, true, onallcpus, false);
+                                        hash, true, onallcpus, NULL);
                 if (IS_ERR(l_new)) {
                         ret = PTR_ERR(l_new);
                         goto err;
                 }
-                hlist_add_head_rcu(&l_new->hash_node, head);
+                hlist_nulls_add_head_rcu(&l_new->hash_node, head);
         }
         ret = 0;
 err:
@@ -834,7 +874,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
         struct htab_elem *l_new = NULL, *l_old;
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         unsigned long flags;
         struct bucket *b;
         u32 key_size, hash;
@@ -882,7 +922,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
         } else {
                 pcpu_copy_value(htab, htab_elem_get_ptr(l_new, key_size),
                                 value, onallcpus);
-                hlist_add_head_rcu(&l_new->hash_node, head);
+                hlist_nulls_add_head_rcu(&l_new->hash_node, head);
                 l_new = NULL;
         }
         ret = 0;
@@ -910,7 +950,7 @@ static int htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key,
 static int htab_map_delete_elem(struct bpf_map *map, void *key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct bucket *b;
         struct htab_elem *l;
         unsigned long flags;
@@ -930,7 +970,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
         l = lookup_elem_raw(head, hash, key, key_size);
 
         if (l) {
-                hlist_del_rcu(&l->hash_node);
+                hlist_nulls_del_rcu(&l->hash_node);
                 free_htab_elem(htab, l);
                 ret = 0;
         }
@@ -942,7 +982,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
 static int htab_lru_map_delete_elem(struct bpf_map *map, void *key)
 {
         struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
-        struct hlist_head *head;
+        struct hlist_nulls_head *head;
         struct bucket *b;
         struct htab_elem *l;
         unsigned long flags;
@@ -962,7 +1002,7 @@ static int htab_lru_map_delete_elem(struct bpf_map *map, void *key)
         l = lookup_elem_raw(head, hash, key, key_size);
 
         if (l) {
-                hlist_del_rcu(&l->hash_node);
+                hlist_nulls_del_rcu(&l->hash_node);
                 ret = 0;
         }
 
@@ -977,14 +1017,13 @@ static void delete_all_elements(struct bpf_htab *htab)
         int i;
 
         for (i = 0; i < htab->n_buckets; i++) {
-                struct hlist_head *head = select_bucket(htab, i);
-                struct hlist_node *n;
+                struct hlist_nulls_head *head = select_bucket(htab, i);
+                struct hlist_nulls_node *n;
                 struct htab_elem *l;
 
-                hlist_for_each_entry_safe(l, n, head, hash_node) {
-                        hlist_del_rcu(&l->hash_node);
-                        if (l->state != HTAB_EXTRA_ELEM_USED)
-                                htab_elem_free(htab, l);
+                hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
+                        hlist_nulls_del_rcu(&l->hash_node);
+                        htab_elem_free(htab, l);
                 }
         }
 }
@@ -1004,7 +1043,7 @@ static void htab_map_free(struct bpf_map *map)
          * not have executed. Wait for them.
          */
         rcu_barrier();
-        if (htab->map.map_flags & BPF_F_NO_PREALLOC)
+        if (!htab_is_prealloc(htab))
                 delete_all_elements(htab);
         else
                 prealloc_destroy(htab);
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 8bfe0afaee10..b37bd9ab7f57 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -500,9 +500,15 @@ unlock:
         raw_spin_unlock(&trie->lock);
 }
 
+static int trie_get_next_key(struct bpf_map *map, void *key, void *next_key)
+{
+        return -ENOTSUPP;
+}
+
 static const struct bpf_map_ops trie_ops = {
         .map_alloc = trie_alloc,
         .map_free = trie_free,
+        .map_get_next_key = trie_get_next_key,
         .map_lookup_elem = trie_lookup_elem,
         .map_update_elem = trie_update_elem,
         .map_delete_elem = trie_delete_elem,
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 7af0dcc5d755..821f9e807de5 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -617,6 +617,14 @@ static void fixup_bpf_calls(struct bpf_prog *prog)
                         if (insn->imm == BPF_FUNC_xdp_adjust_head)
                                 prog->xdp_adjust_head = 1;
                         if (insn->imm == BPF_FUNC_tail_call) {
+                                /* If we tail call into other programs, we
+                                 * cannot make any assumptions since they
+                                 * can be replaced dynamically during runtime
+                                 * in the program array.
+                                 */
+                                prog->cb_access = 1;
+                                prog->xdp_adjust_head = 1;
+
                                 /* mark bpf_tail_call as different opcode
                                  * to avoid conditional branch in
                                  * interpeter for every normal call
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 796b68d00119..a834068a400e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -765,38 +765,56 @@ static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
         }
 }
 
-static int check_ptr_alignment(struct bpf_verifier_env *env,
-                               struct bpf_reg_state *reg, int off, int size)
+static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
+                                   int off, int size)
 {
-        if (reg->type != PTR_TO_PACKET && reg->type != PTR_TO_MAP_VALUE_ADJ) {
-                if (off % size != 0) {
-                        verbose("misaligned access off %d size %d\n",
-                                off, size);
-                        return -EACCES;
-                } else {
-                        return 0;
-                }
-        }
-
-        if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
-                /* misaligned access to packet is ok on x86,arm,arm64 */
-                return 0;
-
         if (reg->id && size != 1) {
-                verbose("Unknown packet alignment. Only byte-sized access allowed\n");
+                verbose("Unknown alignment. Only byte-sized access allowed in packet access.\n");
                 return -EACCES;
         }
 
         /* skb->data is NET_IP_ALIGN-ed */
-        if (reg->type == PTR_TO_PACKET &&
-            (NET_IP_ALIGN + reg->off + off) % size != 0) {
+        if ((NET_IP_ALIGN + reg->off + off) % size != 0) {
                 verbose("misaligned packet access off %d+%d+%d size %d\n",
                         NET_IP_ALIGN, reg->off, off, size);
                 return -EACCES;
         }
+
         return 0;
 }
 
+static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
+                                   int size)
+{
+        if (size != 1) {
+                verbose("Unknown alignment. Only byte-sized access allowed in value access.\n");
+                return -EACCES;
+        }
+
+        return 0;
+}
+
+static int check_ptr_alignment(const struct bpf_reg_state *reg,
+                               int off, int size)
+{
+        switch (reg->type) {
+        case PTR_TO_PACKET:
+                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
+                       check_pkt_ptr_alignment(reg, off, size);
+        case PTR_TO_MAP_VALUE_ADJ:
+                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
+                       check_val_ptr_alignment(reg, size);
+        default:
+                if (off % size != 0) {
+                        verbose("misaligned access off %d size %d\n",
+                                off, size);
+                        return -EACCES;
+                }
+
+                return 0;
+        }
+}
+
 /* check whether memory at (regno + off) is accessible for t = (read | write)
  * if t==write, value_regno is a register which value is stored into memory
  * if t==read, value_regno is a register which will receive the value from memory
@@ -818,7 +836,7 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
         if (size < 0)
                 return size;
 
-        err = check_ptr_alignment(env, reg, off, size);
+        err = check_ptr_alignment(reg, off, size);
         if (err)
                 return err;
 
@@ -1925,6 +1943,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                  * register as unknown.
                  */
                 if (env->allow_ptr_leaks &&
+                    BPF_CLASS(insn->code) == BPF_ALU64 && opcode == BPF_ADD &&
                     (dst_reg->type == PTR_TO_MAP_VALUE ||
                      dst_reg->type == PTR_TO_MAP_VALUE_ADJ))
                         dst_reg->type = PTR_TO_MAP_VALUE_ADJ;
@@ -1973,14 +1992,15 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state,
 
         for (i = 0; i < MAX_BPF_REG; i++)
                 if (regs[i].type == PTR_TO_PACKET && regs[i].id == dst_reg->id)
-                        regs[i].range = dst_reg->off;
+                        /* keep the maximum range already checked */
+                        regs[i].range = max(regs[i].range, dst_reg->off);
 
         for (i = 0; i < MAX_BPF_STACK; i += BPF_REG_SIZE) {
                 if (state->stack_slot_type[i] != STACK_SPILL)
                         continue;
                 reg = &state->spilled_regs[i / BPF_REG_SIZE];
                 if (reg->type == PTR_TO_PACKET && reg->id == dst_reg->id)
-                        reg->range = dst_reg->off;
+                        reg->range = max(reg->range, dst_reg->off);
         }
 }
 
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index 56eba9caa632..1dc22f6b49f5 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -1329,7 +1329,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
                 struct task_struct *task;
                 int count = 0;
 
-                seq_printf(seq, "css_set %p\n", cset);
+                seq_printf(seq, "css_set %pK\n", cset);
 
                 list_for_each_entry(task, &cset->tasks, cg_list) {
                         if (count++ > MAX_TASKS_SHOWN_PER_CSS)
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 0125589c7428..687f5e0194ef 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2425,11 +2425,12 @@ ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf,
                 tsk = tsk->group_leader;
 
         /*
-         * Workqueue threads may acquire PF_NO_SETAFFINITY and become
-         * trapped in a cpuset, or RT worker may be born in a cgroup
-         * with no rt_runtime allocated.  Just say no.
+         * kthreads may acquire PF_NO_SETAFFINITY during initialization.
+         * If userland migrates such a kthread to a non-root cgroup, it can
+         * become trapped in a cpuset, or RT kthread may be born in a
+         * cgroup with no rt_runtime allocated.  Just say no.
          */
-        if (tsk == kthreadd_task || (tsk->flags & PF_NO_SETAFFINITY)) {
+        if (tsk->no_cgroup_migration || (tsk->flags & PF_NO_SETAFFINITY)) {
                 ret = -EINVAL;
                 goto out_unlock_rcu;
         }
@@ -2669,7 +2670,7 @@ static bool css_visible(struct cgroup_subsys_state *css)
  *
  * Returns 0 on success, -errno on failure.  On failure, csses which have
  * been processed already aren't cleaned up.  The caller is responsible for
- * cleaning up with cgroup_apply_control_disble().
+ * cleaning up with cgroup_apply_control_disable().
  */
 static int cgroup_apply_control_enable(struct cgroup *cgrp)
 {
diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c
index e756dae49300..2237201d66d5 100644
--- a/kernel/cgroup/pids.c
+++ b/kernel/cgroup/pids.c
@@ -229,7 +229,7 @@ static int pids_can_fork(struct task_struct *task)
                 /* Only log the first time events_limit is incremented. */
                 if (atomic64_inc_return(&pids->events_limit) == 1) {
                         pr_info("cgroup: fork rejected by pids controller in ");
-                        pr_cont_cgroup_path(task_cgroup(current, pids_cgrp_id));
+                        pr_cont_cgroup_path(css->cgroup);
                         pr_cont("\n");
                 }
                 cgroup_file_notify(&pids->events_file);
diff --git a/kernel/cpu.c b/kernel/cpu.c
index f7c063239fa5..37b223e4fc05 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1335,26 +1335,21 @@ static int cpuhp_store_callbacks(enum cpuhp_state state, const char *name,
         struct cpuhp_step *sp;
         int ret = 0;
 
-        mutex_lock(&cpuhp_state_mutex);
-
         if (state == CPUHP_AP_ONLINE_DYN || state == CPUHP_BP_PREPARE_DYN) {
                 ret = cpuhp_reserve_state(state);
                 if (ret < 0)
-                        goto out;
+                        return ret;
                 state = ret;
         }
         sp = cpuhp_get_step(state);
-        if (name && sp->name) {
-                ret = -EBUSY;
-                goto out;
-        }
+        if (name && sp->name)
+                return -EBUSY;
+
         sp->startup.single = startup;
         sp->teardown.single = teardown;
         sp->name = name;
         sp->multi_instance = multi_instance;
         INIT_HLIST_HEAD(&sp->list);
-out:
-        mutex_unlock(&cpuhp_state_mutex);
         return ret;
 }
 
@@ -1428,6 +1423,7 @@ int __cpuhp_state_add_instance(enum cpuhp_state state, struct hlist_node *node,
                 return -EINVAL;
 
         get_online_cpus();
+        mutex_lock(&cpuhp_state_mutex);
 
         if (!invoke || !sp->startup.multi)
                 goto add_node;
@@ -1447,16 +1443,14 @@ int __cpuhp_state_add_instance(enum cpuhp_state state, struct hlist_node *node,
                 if (ret) {
                         if (sp->teardown.multi)
                                 cpuhp_rollback_install(cpu, state, node);
-                        goto err;
+                        goto unlock;
                 }
         }
 add_node:
         ret = 0;
-        mutex_lock(&cpuhp_state_mutex);
         hlist_add_head(node, &sp->list);
+unlock:
         mutex_unlock(&cpuhp_state_mutex);
-
-err:
         put_online_cpus();
         return ret;
 }
@@ -1491,6 +1485,7 @@ int __cpuhp_setup_state(enum cpuhp_state state,
                 return -EINVAL;
 
         get_online_cpus();
+        mutex_lock(&cpuhp_state_mutex);
 
         ret = cpuhp_store_callbacks(state, name, startup, teardown,
                                     multi_instance);
@@ -1524,6 +1519,7 @@ int __cpuhp_setup_state(enum cpuhp_state state,
                 }
         }
 out:
+        mutex_unlock(&cpuhp_state_mutex);
         put_online_cpus();
         /*
          * If the requested state is CPUHP_AP_ONLINE_DYN, return the
@@ -1547,6 +1543,8 @@ int __cpuhp_state_remove_instance(enum cpuhp_state state,
                 return -EINVAL;
 
         get_online_cpus();
+        mutex_lock(&cpuhp_state_mutex);
+
         if (!invoke || !cpuhp_get_teardown_cb(state))
                 goto remove;
         /*
@@ -1563,7 +1561,6 @@ int __cpuhp_state_remove_instance(enum cpuhp_state state,
         }
 
 remove:
-        mutex_lock(&cpuhp_state_mutex);
         hlist_del(node);
         mutex_unlock(&cpuhp_state_mutex);
         put_online_cpus();
@@ -1571,6 +1568,7 @@ remove:
         return 0;
 }
 EXPORT_SYMBOL_GPL(__cpuhp_state_remove_instance);
+
 /**
  * __cpuhp_remove_state - Remove the callbacks for an hotplug machine state
  * @state:      The state to remove
@@ -1589,6 +1587,7 @@ void __cpuhp_remove_state(enum cpuhp_state state, bool invoke)
 
         get_online_cpus();
 
+        mutex_lock(&cpuhp_state_mutex);
         if (sp->multi_instance) {
                 WARN(!hlist_empty(&sp->list),
                      "Error: Removing state %d which has instances left.\n",
@@ -1613,6 +1612,7 @@ void __cpuhp_remove_state(enum cpuhp_state state, bool invoke)
         }
 remove:
         cpuhp_store_callbacks(state, NULL, NULL, NULL, false);
+        mutex_unlock(&cpuhp_state_mutex);
         put_online_cpus();
 }
 EXPORT_SYMBOL(__cpuhp_remove_state);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6f41548f2e32..ff01cba86f43 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -998,7 +998,7 @@ list_update_cgroup_event(struct perf_event *event,
  */
 #define PERF_CPU_HRTIMER (1000 / HZ)
 /*
- * function must be called with interrupts disbled
+ * function must be called with interrupts disabled
  */
 static enum hrtimer_restart perf_mux_hrtimer_handler(struct hrtimer *hr)
 {
@@ -4256,7 +4256,7 @@ int perf_event_release_kernel(struct perf_event *event)
 
         raw_spin_lock_irq(&ctx->lock);
         /*
-         * Mark this even as STATE_DEAD, there is no external reference to it
+         * Mark this event as STATE_DEAD, there is no external reference to it
          * anymore.
          *
          * Anybody acquiring event->child_mutex after the below loop _must_
@@ -10417,21 +10417,22 @@ void perf_event_free_task(struct task_struct *task)
                         continue;
 
                 mutex_lock(&ctx->mutex);
-again:
-                list_for_each_entry_safe(event, tmp, &ctx->pinned_groups,
-                                group_entry)
-                        perf_free_event(event, ctx);
+                raw_spin_lock_irq(&ctx->lock);
+                /*
+                 * Destroy the task <-> ctx relation and mark the context dead.
+                 *
+                 * This is important because even though the task hasn't been
+                 * exposed yet the context has been (through child_list).
+                 */
+                RCU_INIT_POINTER(task->perf_event_ctxp[ctxn], NULL);
+                WRITE_ONCE(ctx->task, TASK_TOMBSTONE);
+                put_task_struct(task); /* cannot be last */
+                raw_spin_unlock_irq(&ctx->lock);
 
-                list_for_each_entry_safe(event, tmp, &ctx->flexible_groups,
-                                group_entry)
+                list_for_each_entry_safe(event, tmp, &ctx->event_list, event_entry)
                         perf_free_event(event, ctx);
 
-                if (!list_empty(&ctx->pinned_groups) ||
-                                !list_empty(&ctx->flexible_groups))
-                        goto again;
-
                 mutex_unlock(&ctx->mutex);
-
                 put_ctx(ctx);
         }
 }
@@ -10469,7 +10470,12 @@ const struct perf_event_attr *perf_event_attrs(struct perf_event *event)
 }
 
 /*
- * inherit a event from parent task to child task:
+ * Inherit a event from parent task to child task.
+ *
+ * Returns:
+ *  - valid pointer on success
+ *  - NULL for orphaned events
+ *  - IS_ERR() on error
  */
 static struct perf_event *
 inherit_event(struct perf_event *parent_event,
@@ -10563,6 +10569,16 @@ inherit_event(struct perf_event *parent_event,
         return child_event;
 }
 
+/*
+ * Inherits an event group.
+ *
+ * This will quietly suppress orphaned events; !inherit_event() is not an error.
+ * This matches with perf_event_release_kernel() removing all child events.
+ *
+ * Returns:
+ *  - 0 on success
+ *  - <0 on error
+ */
 static int inherit_group(struct perf_event *parent_event,
               struct task_struct *parent,
               struct perf_event_context *parent_ctx,
@@ -10577,6 +10593,11 @@ static int inherit_group(struct perf_event *parent_event,
                                  child, NULL, child_ctx);
         if (IS_ERR(leader))
                 return PTR_ERR(leader);
+        /*
+         * @leader can be NULL here because of is_orphaned_event(). In this
+         * case inherit_event() will create individual events, similar to what
+         * perf_group_detach() would do anyway.
+         */
         list_for_each_entry(sub, &parent_event->sibling_list, group_entry) {
                 child_ctr = inherit_event(sub, parent, parent_ctx,
                                             child, leader, child_ctx);
@@ -10586,6 +10607,17 @@ static int inherit_group(struct perf_event *parent_event,
         return 0;
 }
 
+/*
+ * Creates the child task context and tries to inherit the event-group.
+ *
+ * Clears @inherited_all on !attr.inherited or error. Note that we'll leave
+ * inherited_all set when we 'fail' to inherit an orphaned event; this is
+ * consistent with perf_event_release_kernel() removing all child events.
+ *
+ * Returns:
+ *  - 0 on success
+ *  - <0 on error
+ */
 static int
 inherit_task_group(struct perf_event *event, struct task_struct *parent,
                    struct perf_event_context *parent_ctx,
@@ -10608,7 +10640,6 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
                  * First allocate and initialize a context for the
                  * child.
                  */
-
                 child_ctx = alloc_perf_context(parent_ctx->pmu, child);
                 if (!child_ctx)
                         return -ENOMEM;
@@ -10670,7 +10701,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn)
                 ret = inherit_task_group(event, parent, parent_ctx,
                                          child, ctxn, &inherited_all);
                 if (ret)
-                        break;
+                        goto out_unlock;
         }
 
         /*
@@ -10686,7 +10717,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn)
                 ret = inherit_task_group(event, parent, parent_ctx,
                                          child, ctxn, &inherited_all);
                 if (ret)
-                        break;
+                        goto out_unlock;
         }
 
         raw_spin_lock_irqsave(&parent_ctx->lock, flags);
@@ -10714,6 +10745,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn)
         }
 
         raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+out_unlock:
         mutex_unlock(&parent_ctx->mutex);
 
         perf_unpin_context(parent_ctx);
diff --git a/kernel/exit.c b/kernel/exit.c
index e126ebf2400c..516acdb0e0ec 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -554,7 +554,6 @@ static void exit_mm(void)
         enter_lazy_tlb(mm, current);
         task_unlock(current);
         mm_update_next_owner(mm);
-        userfaultfd_exit(mm);
         mmput(mm);
         if (test_thread_flag(TIF_MEMDIE))
                 exit_oom_victim();
diff --git a/kernel/futex.c b/kernel/futex.c
index 229a744b1781..45858ec73941 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2815,7 +2815,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 {
         struct hrtimer_sleeper timeout, *to = NULL;
         struct rt_mutex_waiter rt_waiter;
-        struct rt_mutex *pi_mutex = NULL;
         struct futex_hash_bucket *hb;
         union futex_key key2 = FUTEX_KEY_INIT;
         struct futex_q q = futex_q_init;
@@ -2899,6 +2898,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                 if (q.pi_state && (q.pi_state->owner != current)) {
                         spin_lock(q.lock_ptr);
                         ret = fixup_pi_state_owner(uaddr2, &q, current);
+                        if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current)
+                                rt_mutex_unlock(&q.pi_state->pi_mutex);
                         /*
                          * Drop the reference to the pi state which
                          * the requeue_pi() code acquired for us.
@@ -2907,6 +2908,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                         spin_unlock(q.lock_ptr);
                 }
         } else {
+                struct rt_mutex *pi_mutex;
+
                 /*
                  * We have been woken up by futex_unlock_pi(), a timeout, or a
                  * signal.  futex_unlock_pi() will not destroy the lock_ptr nor
@@ -2930,18 +2933,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                 if (res)
                         ret = (res < 0) ? res : 0;
 
+                /*
+                 * If fixup_pi_state_owner() faulted and was unable to handle
+                 * the fault, unlock the rt_mutex and return the fault to
+                 * userspace.
+                 */
+                if (ret && rt_mutex_owner(pi_mutex) == current)
+                        rt_mutex_unlock(pi_mutex);
+
                 /* Unqueue and drop the lock. */
                 unqueue_me_pi(&q);
         }
 
-        /*
-         * If fixup_pi_state_owner() faulted and was unable to handle the
-         * fault, unlock the rt_mutex and return the fault to userspace.
-         */
-        if (ret == -EFAULT) {
-                if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
-                        rt_mutex_unlock(pi_mutex);
-        } else if (ret == -EINTR) {
+        if (ret == -EINTR) {
                 /*
                  * We've already been requeued, but cannot restart by calling
                  * futex_lock_pi() directly. We could restart this syscall, but
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index 4544b115f5eb..e2d356dd7581 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -59,7 +59,7 @@ static int get_nodes_in_cpumask(const struct cpumask *mask, nodemask_t *nodemsk)
 struct cpumask *
 irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
 {
-        int n, nodes, vecs_per_node, cpus_per_vec, extra_vecs, curvec;
+        int n, nodes, cpus_per_vec, extra_vecs, curvec;
         int affv = nvecs - affd->pre_vectors - affd->post_vectors;
         int last_affv = affv + affd->pre_vectors;
         nodemask_t nodemsk = NODE_MASK_NONE;
@@ -94,19 +94,21 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
                 goto done;
         }
 
-        /* Spread the vectors per node */
-        vecs_per_node = affv / nodes;
-        /* Account for rounding errors */
-        extra_vecs = affv - (nodes * vecs_per_node);
-
         for_each_node_mask(n, nodemsk) {
-                int ncpus, v, vecs_to_assign = vecs_per_node;
+                int ncpus, v, vecs_to_assign, vecs_per_node;
+
+                /* Spread the vectors per node */
+                vecs_per_node = (affv - (curvec - affd->pre_vectors)) / nodes;
 
                 /* Get the cpus on this node which are in the mask */
                 cpumask_and(nmsk, cpu_online_mask, cpumask_of_node(n));
 
                 /* Calculate the number of cpus per vector */
                 ncpus = cpumask_weight(nmsk);
+                vecs_to_assign = min(vecs_per_node, ncpus);
+
+                /* Account for rounding errors */
+                extra_vecs = ncpus - vecs_to_assign * (ncpus / vecs_to_assign);
 
                 for (v = 0; curvec < last_affv && v < vecs_to_assign;
                      curvec++, v++) {
@@ -115,14 +117,14 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd)
                         /* Account for extra vectors to compensate rounding errors */
                         if (extra_vecs) {
                                 cpus_per_vec++;
-                                if (!--extra_vecs)
-                                        vecs_per_node++;
+                                --extra_vecs;
                         }
                         irq_spread_init_one(masks + curvec, nmsk, cpus_per_vec);
                 }
 
                 if (curvec >= last_affv)
                         break;
+                --nodes;
         }
 
 done:
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index b56a558e406d..b118735fea9d 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -614,13 +614,13 @@ static int kexec_calculate_store_digests(struct kimage *image)
                 ret = crypto_shash_final(desc, digest);
                 if (ret)
                         goto out_free_digest;
-                ret = kexec_purgatory_get_set_symbol(image, "sha_regions",
-                                                sha_regions, sha_region_sz, 0);
+                ret = kexec_purgatory_get_set_symbol(image, "purgatory_sha_regions",
+                                                     sha_regions, sha_region_sz, 0);
                 if (ret)
                         goto out_free_digest;
 
-                ret = kexec_purgatory_get_set_symbol(image, "sha256_digest",
-                                                digest, SHA256_DIGEST_SIZE, 0);
+                ret = kexec_purgatory_get_set_symbol(image, "purgatory_sha256_digest",
+                                                     digest, SHA256_DIGEST_SIZE, 0);
                 if (ret)
                         goto out_free_digest;
         }
diff --git a/kernel/kexec_internal.h b/kernel/kexec_internal.h
index 4cef7e4706b0..799a8a452187 100644
--- a/kernel/kexec_internal.h
+++ b/kernel/kexec_internal.h
@@ -15,11 +15,7 @@ int kimage_is_destination_range(struct kimage *image,
 extern struct mutex kexec_mutex;
 
 #ifdef CONFIG_KEXEC_FILE
-struct kexec_sha_region {
-        unsigned long start;
-        unsigned long len;
-};
-
+#include <linux/purgatory.h>
 void kimage_file_post_load_cleanup(struct kimage *image);
 #else /* CONFIG_KEXEC_FILE */
 static inline void kimage_file_post_load_cleanup(struct kimage *image) { }
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 2f26adea0f84..26db528c1d88 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -20,6 +20,7 @@
 #include <linux/freezer.h>
 #include <linux/ptrace.h>
 #include <linux/uaccess.h>
+#include <linux/cgroup.h>
 #include <trace/events/sched.h>
 
 static DEFINE_SPINLOCK(kthread_create_lock);
@@ -225,6 +226,7 @@ static int kthread(void *_create)
 
         ret = -EINTR;
         if (!test_bit(KTHREAD_SHOULD_STOP, &self->flags)) {
+                cgroup_kthread_ready();
                 __kthread_parkme(self);
                 ret = threadfn(data);
         }
@@ -538,6 +540,7 @@ int kthreadd(void *unused)
         set_mems_allowed(node_states[N_MEMORY]);
 
         current->flags |= PF_NOFREEZE;
+        cgroup_init_kthreadd();
 
         for (;;) {
                 set_current_state(TASK_INTERRUPTIBLE);
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 12e38c213b70..a95e5d1f4a9c 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -3262,10 +3262,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         if (depth) {
                 hlock = curr->held_locks + depth - 1;
                 if (hlock->class_idx == class_idx && nest_lock) {
-                        if (hlock->references)
+                        if (hlock->references) {
+                                /*
+                                 * Check: unsigned int references:12, overflow.
+                                 */
+                                if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
+                                        return 0;
+
                                 hlock->references++;
-                        else
+                        } else {
                                 hlock->references = 2;
+                        }
 
                         return 1;
                 }
diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h
index c2b88490d857..c08fbd2f5ba9 100644
--- a/kernel/locking/lockdep_internals.h
+++ b/kernel/locking/lockdep_internals.h
@@ -46,13 +46,13 @@ enum {
                 (LOCKF_USED_IN_HARDIRQ_READ | LOCKF_USED_IN_SOFTIRQ_READ)
 
 /*
- * CONFIG_PROVE_LOCKING_SMALL is defined for sparc. Sparc requires .text,
+ * CONFIG_LOCKDEP_SMALL is defined for sparc. Sparc requires .text,
  * .data and .bss to fit in required 32MB limit for the kernel. With
- * PROVE_LOCKING we could go over this limit and cause system boot-up problems.
+ * CONFIG_LOCKDEP we could go over this limit and cause system boot-up problems.
  * So, reduce the static allocations for lockdeps related structures so that
  * everything fits in current required size limit.
  */
-#ifdef CONFIG_PROVE_LOCKING_SMALL
+#ifdef CONFIG_LOCKDEP_SMALL
 /*
  * MAX_LOCKDEP_ENTRIES is the maximum number of lock dependencies
  * we track.
diff --git a/kernel/locking/rwsem-spinlock.c b/kernel/locking/rwsem-spinlock.c
index 7bc24d477805..c65f7989f850 100644
--- a/kernel/locking/rwsem-spinlock.c
+++ b/kernel/locking/rwsem-spinlock.c
@@ -213,10 +213,9 @@ int __sched __down_write_common(struct rw_semaphore *sem, int state)
                  */
                 if (sem->count == 0)
                         break;
-                if (signal_pending_state(state, current)) {
-                        ret = -EINTR;
-                        goto out;
-                }
+                if (signal_pending_state(state, current))
+                        goto out_nolock;
+
                 set_current_state(state);
                 raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
                 schedule();
@@ -224,12 +223,19 @@ int __sched __down_write_common(struct rw_semaphore *sem, int state)
         }
         /* got the lock */
         sem->count = -1;
-out:
         list_del(&waiter.list);
 
         raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
 
         return ret;
+
+out_nolock:
+        list_del(&waiter.list);
+        if (!list_empty(&sem->wait_list))
+                __rwsem_do_wake(sem, 1);
+        raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
+
+        return -EINTR;
 }
 
 void __sched __down_write(struct rw_semaphore *sem)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index da6c9a34f62f..6b7abb334ca6 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -50,7 +50,7 @@ static void test_mutex_work(struct work_struct *work)
 
         if (mtx->flags & TEST_MTX_TRY) {
                 while (!ww_mutex_trylock(&mtx->mutex))
-                        cpu_relax();
+                        cond_resched();
         } else {
                 ww_mutex_lock(&mtx->mutex, NULL);
         }
@@ -88,7 +88,7 @@ static int __test_mutex(unsigned int flags)
                                 ret = -EINVAL;
                                 break;
                         }
-                        cpu_relax();
+                        cond_resched();
                 } while (time_before(jiffies, timeout));
         } else {
                 ret = wait_for_completion_timeout(&mtx.done, TIMEOUT);
@@ -627,7 +627,7 @@ static int __init test_ww_mutex_init(void)
         if (ret)
                 return ret;
 
-        ret = stress(4096, hweight32(STRESS_ALL)*ncpus, 1<<12, STRESS_ALL);
+        ret = stress(4095, hweight32(STRESS_ALL)*ncpus, 1<<12, STRESS_ALL);
         if (ret)
                 return ret;
 
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 06123234f118..07e85e5229da 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -247,11 +247,9 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(resource_size(res), SECTION_SIZE);
 
-        lock_device_hotplug();
         mem_hotplug_begin();
         arch_remove_memory(align_start, align_size);
         mem_hotplug_done();
-        unlock_device_hotplug();
 
         untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
         pgmap_radix_release(res);
@@ -364,11 +362,9 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         if (error)
                 goto err_pfn_remap;
 
-        lock_device_hotplug();
         mem_hotplug_begin();
         error = arch_add_memory(nid, align_start, align_size, true);
         mem_hotplug_done();
-        unlock_device_hotplug();
         if (error)
                 goto err_add_memory;
 
diff --git a/kernel/padata.c b/kernel/padata.c
index 05316c9f32da..3202aa17492c 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -186,19 +186,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd)
 
         reorder = &next_queue->reorder;
 
+        spin_lock(&reorder->lock);
         if (!list_empty(&reorder->list)) {
                 padata = list_entry(reorder->list.next,
                                     struct padata_priv, list);
 
-                spin_lock(&reorder->lock);
                 list_del_init(&padata->list);
                 atomic_dec(&pd->reorder_objects);
-                spin_unlock(&reorder->lock);
 
                 pd->processed++;
 
+                spin_unlock(&reorder->lock);
                 goto out;
         }
+        spin_unlock(&reorder->lock);
 
         if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) {
                 padata = ERR_PTR(-ENODATA);
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 0af928712174..266ddcc1d8bb 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -184,11 +184,17 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
 
         WARN_ON(!task->ptrace || task->parent != current);
 
+        /*
+         * PTRACE_LISTEN can allow ptrace_trap_notify to wake us up remotely.
+         * Recheck state under the lock to close this race.
+         */
         spin_lock_irq(&task->sighand->siglock);
-        if (__fatal_signal_pending(task))
-                wake_up_state(task, __TASK_TRACED);
-        else
-                task->state = TASK_TRACED;
+        if (task->state == __TASK_TRACED) {
+                if (__fatal_signal_pending(task))
+                        wake_up_state(task, __TASK_TRACED);
+                else
+                        task->state = TASK_TRACED;
+        }
         spin_unlock_irq(&task->sighand->siglock);
 }
 
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index a08795e21628..00a45c45beca 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -96,10 +96,10 @@ static DEFINE_STATIC_KEY_FALSE(__sched_clock_stable);
 static int __sched_clock_stable_early = 1;
 
 /*
- * We want: ktime_get_ns() + gtod_offset == sched_clock() + raw_offset
+ * We want: ktime_get_ns() + __gtod_offset == sched_clock() + __sched_clock_offset
  */
-static __read_mostly u64 raw_offset;
-static __read_mostly u64 gtod_offset;
+__read_mostly u64 __sched_clock_offset;
+static __read_mostly u64 __gtod_offset;
 
 struct sched_clock_data {
         u64                     tick_raw;
@@ -131,17 +131,24 @@ static void __set_sched_clock_stable(void)
         /*
          * Attempt to make the (initial) unstable->stable transition continuous.
          */
-        raw_offset = (scd->tick_gtod + gtod_offset) - (scd->tick_raw);
+        __sched_clock_offset = (scd->tick_gtod + __gtod_offset) - (scd->tick_raw);
 
         printk(KERN_INFO "sched_clock: Marking stable (%lld, %lld)->(%lld, %lld)\n",
-                        scd->tick_gtod, gtod_offset,
-                        scd->tick_raw,  raw_offset);
+                        scd->tick_gtod, __gtod_offset,
+                        scd->tick_raw,  __sched_clock_offset);
 
         static_branch_enable(&__sched_clock_stable);
         tick_dep_clear(TICK_DEP_BIT_CLOCK_UNSTABLE);
 }
 
-static void __clear_sched_clock_stable(struct work_struct *work)
+static void __sched_clock_work(struct work_struct *work)
+{
+        static_branch_disable(&__sched_clock_stable);
+}
+
+static DECLARE_WORK(sched_clock_work, __sched_clock_work);
+
+static void __clear_sched_clock_stable(void)
 {
         struct sched_clock_data *scd = this_scd();
 
@@ -154,17 +161,17 @@ static void __clear_sched_clock_stable(struct work_struct *work)
          *
          * Still do what we can.
          */
-        gtod_offset = (scd->tick_raw + raw_offset) - (scd->tick_gtod);
+        __gtod_offset = (scd->tick_raw + __sched_clock_offset) - (scd->tick_gtod);
 
         printk(KERN_INFO "sched_clock: Marking unstable (%lld, %lld)<-(%lld, %lld)\n",
-                        scd->tick_gtod, gtod_offset,
-                        scd->tick_raw,  raw_offset);
+                        scd->tick_gtod, __gtod_offset,
+                        scd->tick_raw,  __sched_clock_offset);
 
-        static_branch_disable(&__sched_clock_stable);
         tick_dep_set(TICK_DEP_BIT_CLOCK_UNSTABLE);
-}
 
-static DECLARE_WORK(sched_clock_work, __clear_sched_clock_stable);
+        if (sched_clock_stable())
+                schedule_work(&sched_clock_work);
+}
 
 void clear_sched_clock_stable(void)
 {
@@ -173,7 +180,7 @@ void clear_sched_clock_stable(void)
         smp_mb(); /* matches sched_clock_init_late() */
 
         if (sched_clock_running == 2)
-                schedule_work(&sched_clock_work);
+                __clear_sched_clock_stable();
 }
 
 void sched_clock_init_late(void)
@@ -214,7 +221,7 @@ static inline u64 wrap_max(u64 x, u64 y)
  */
 static u64 sched_clock_local(struct sched_clock_data *scd)
 {
-        u64 now, clock, old_clock, min_clock, max_clock;
+        u64 now, clock, old_clock, min_clock, max_clock, gtod;
         s64 delta;
 
 again:
@@ -231,9 +238,10 @@ again:
          *                    scd->tick_gtod + TICK_NSEC);
          */
 
-        clock = scd->tick_gtod + gtod_offset + delta;
-        min_clock = wrap_max(scd->tick_gtod, old_clock);
-        max_clock = wrap_max(old_clock, scd->tick_gtod + TICK_NSEC);
+        gtod = scd->tick_gtod + __gtod_offset;
+        clock = gtod + delta;
+        min_clock = wrap_max(gtod, old_clock);
+        max_clock = wrap_max(old_clock, gtod + TICK_NSEC);
 
         clock = wrap_max(clock, min_clock);
         clock = wrap_min(clock, max_clock);
@@ -317,7 +325,7 @@ u64 sched_clock_cpu(int cpu)
         u64 clock;
 
         if (sched_clock_stable())
-                return sched_clock() + raw_offset;
+                return sched_clock() + __sched_clock_offset;
 
         if (unlikely(!sched_clock_running))
                 return 0ull;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 956383844116..3b31fc05a0f1 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3287,10 +3287,15 @@ pick_next_task(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
         struct task_struct *p;
 
         /*
-         * Optimization: we know that if all tasks are in
-         * the fair class we can call that function directly:
+         * Optimization: we know that if all tasks are in the fair class we can
+         * call that function directly, but only if the @prev task wasn't of a
+         * higher scheduling class, because otherwise those loose the
+         * opportunity to pull in more work from other CPUs.
          */
-        if (likely(rq->nr_running == rq->cfs.h_nr_running)) {
+        if (likely((prev->sched_class == &idle_sched_class ||
+                    prev->sched_class == &fair_sched_class) &&
+                   rq->nr_running == rq->cfs.h_nr_running)) {
+
                 p = fair_sched_class.pick_next_task(rq, prev, rf);
                 if (unlikely(p == RETRY_TASK))
                         goto again;
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 8f8de3d4d6b7..54c577578da6 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -36,6 +36,7 @@ struct sugov_policy {
         u64 last_freq_update_time;
         s64 freq_update_delay_ns;
         unsigned int next_freq;
+        unsigned int cached_raw_freq;
 
         /* The next fields are only needed if fast switch cannot be used. */
         struct irq_work irq_work;
@@ -52,7 +53,6 @@ struct sugov_cpu {
         struct update_util_data update_util;
         struct sugov_policy *sg_policy;
 
-        unsigned int cached_raw_freq;
         unsigned long iowait_boost;
         unsigned long iowait_boost_max;
         u64 last_update;
@@ -116,7 +116,7 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
 
 /**
  * get_next_freq - Compute a new frequency for a given cpufreq policy.
- * @sg_cpu: schedutil cpu object to compute the new frequency for.
+ * @sg_policy: schedutil policy object to compute the new frequency for.
  * @util: Current CPU utilization.
  * @max: CPU capacity.
  *
@@ -136,19 +136,18 @@ static void sugov_update_commit(struct sugov_policy *sg_policy, u64 time,
  * next_freq (as calculated above) is returned, subject to policy min/max and
  * cpufreq driver limitations.
  */
-static unsigned int get_next_freq(struct sugov_cpu *sg_cpu, unsigned long util,
-                                  unsigned long max)
+static unsigned int get_next_freq(struct sugov_policy *sg_policy,
+                                  unsigned long util, unsigned long max)
 {
-        struct sugov_policy *sg_policy = sg_cpu->sg_policy;
         struct cpufreq_policy *policy = sg_policy->policy;
         unsigned int freq = arch_scale_freq_invariant() ?
                                 policy->cpuinfo.max_freq : policy->cur;
 
         freq = (freq + (freq >> 2)) * util / max;
 
-        if (freq == sg_cpu->cached_raw_freq && sg_policy->next_freq != UINT_MAX)
+        if (freq == sg_policy->cached_raw_freq && sg_policy->next_freq != UINT_MAX)
                 return sg_policy->next_freq;
-        sg_cpu->cached_raw_freq = freq;
+        sg_policy->cached_raw_freq = freq;
         return cpufreq_driver_resolve_freq(policy, freq);
 }
 
@@ -213,7 +212,7 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         } else {
                 sugov_get_util(&util, &max);
                 sugov_iowait_boost(sg_cpu, &util, &max);
-                next_f = get_next_freq(sg_cpu, util, max);
+                next_f = get_next_freq(sg_policy, util, max);
         }
         sugov_update_commit(sg_policy, time, next_f);
 }
@@ -267,7 +266,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu,
                 sugov_iowait_boost(j_sg_cpu, &util, &max);
         }
 
-        return get_next_freq(sg_cpu, util, max);
+        return get_next_freq(sg_policy, util, max);
 }
 
 static void sugov_update_shared(struct update_util_data *hook, u64 time,
@@ -580,25 +579,19 @@ static int sugov_start(struct cpufreq_policy *policy)
         sg_policy->next_freq = UINT_MAX;
         sg_policy->work_in_progress = false;
         sg_policy->need_freq_update = false;
+        sg_policy->cached_raw_freq = 0;
 
         for_each_cpu(cpu, policy->cpus) {
                 struct sugov_cpu *sg_cpu = &per_cpu(sugov_cpu, cpu);
 
+                memset(sg_cpu, 0, sizeof(*sg_cpu));
                 sg_cpu->sg_policy = sg_policy;
-                if (policy_is_shared(policy)) {
-                        sg_cpu->util = 0;
-                        sg_cpu->max = 0;
-                        sg_cpu->flags = SCHED_CPUFREQ_RT;
-                        sg_cpu->last_update = 0;
-                        sg_cpu->cached_raw_freq = 0;
-                        sg_cpu->iowait_boost = 0;
-                        sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
-                        cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
-                                                     sugov_update_shared);
-                } else {
-                        cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
-                                                     sugov_update_single);
-                }
+                sg_cpu->flags = SCHED_CPUFREQ_RT;
+                sg_cpu->iowait_boost_max = policy->cpuinfo.max_freq;
+                cpufreq_add_update_util_hook(cpu, &sg_cpu->update_util,
+                                             policy_is_shared(policy) ?
+                                                        sugov_update_shared :
+                                                        sugov_update_single);
         }
         return 0;
 }
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 99b2c33a9fbc..a2ce59015642 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -445,13 +445,13 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se,
  *
  * This function returns true if:
  *
- *   runtime / (deadline - t) > dl_runtime / dl_period ,
+ *   runtime / (deadline - t) > dl_runtime / dl_deadline ,
  *
  * IOW we can't recycle current parameters.
  *
- * Notice that the bandwidth check is done against the period. For
+ * Notice that the bandwidth check is done against the deadline. For
  * task with deadline equal to period this is the same of using
- * dl_deadline instead of dl_period in the equation above.
+ * dl_period instead of dl_deadline in the equation above.
  */
 static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
                                struct sched_dl_entity *pi_se, u64 t)
@@ -476,7 +476,7 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
          * of anything below microseconds resolution is actually fiction
          * (but still we want to give the user that illusion >;).
          */
-        left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
+        left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
         right = ((dl_se->deadline - t) >> DL_SCALE) *
                 (pi_se->dl_runtime >> DL_SCALE);
 
@@ -505,10 +505,15 @@ static void update_dl_entity(struct sched_dl_entity *dl_se,
         }
 }
 
+static inline u64 dl_next_period(struct sched_dl_entity *dl_se)
+{
+        return dl_se->deadline - dl_se->dl_deadline + dl_se->dl_period;
+}
+
 /*
  * If the entity depleted all its runtime, and if we want it to sleep
  * while waiting for some new execution time to become available, we
- * set the bandwidth enforcement timer to the replenishment instant
+ * set the bandwidth replenishment timer to the replenishment instant
  * and try to activate it.
  *
  * Notice that it is important for the caller to know if the timer
@@ -530,7 +535,7 @@ static int start_dl_timer(struct task_struct *p)
          * that it is actually coming from rq->clock and not from
          * hrtimer's time base reading.
          */
-        act = ns_to_ktime(dl_se->deadline);
+        act = ns_to_ktime(dl_next_period(dl_se));
         now = hrtimer_cb_get_time(timer);
         delta = ktime_to_ns(now) - rq_clock(rq);
         act = ktime_add_ns(act, delta);
@@ -638,6 +643,7 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
                 lockdep_unpin_lock(&rq->lock, rf.cookie);
                 rq = dl_task_offline_migration(rq, p);
                 rf.cookie = lockdep_pin_lock(&rq->lock);
+                update_rq_clock(rq);
 
                 /*
                  * Now that the task has been migrated to the new RQ and we
@@ -689,6 +695,37 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se)
         timer->function = dl_task_timer;
 }
 
+/*
+ * During the activation, CBS checks if it can reuse the current task's
+ * runtime and period. If the deadline of the task is in the past, CBS
+ * cannot use the runtime, and so it replenishes the task. This rule
+ * works fine for implicit deadline tasks (deadline == period), and the
+ * CBS was designed for implicit deadline tasks. However, a task with
+ * constrained deadline (deadine < period) might be awakened after the
+ * deadline, but before the next period. In this case, replenishing the
+ * task would allow it to run for runtime / deadline. As in this case
+ * deadline < period, CBS enables a task to run for more than the
+ * runtime / period. In a very loaded system, this can cause a domino
+ * effect, making other tasks miss their deadlines.
+ *
+ * To avoid this problem, in the activation of a constrained deadline
+ * task after the deadline but before the next period, throttle the
+ * task and set the replenishing timer to the begin of the next period,
+ * unless it is boosted.
+ */
+static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se)
+{
+        struct task_struct *p = dl_task_of(dl_se);
+        struct rq *rq = rq_of_dl_rq(dl_rq_of_se(dl_se));
+
+        if (dl_time_before(dl_se->deadline, rq_clock(rq)) &&
+            dl_time_before(rq_clock(rq), dl_next_period(dl_se))) {
+                if (unlikely(dl_se->dl_boosted || !start_dl_timer(p)))
+                        return;
+                dl_se->dl_throttled = 1;
+        }
+}
+
 static
 int dl_runtime_exceeded(struct sched_dl_entity *dl_se)
 {
@@ -922,6 +959,11 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se)
         __dequeue_dl_entity(dl_se);
 }
 
+static inline bool dl_is_constrained(struct sched_dl_entity *dl_se)
+{
+        return dl_se->dl_deadline < dl_se->dl_period;
+}
+
 static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
 {
         struct task_struct *pi_task = rt_mutex_get_top_task(p);
@@ -948,6 +990,15 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
         }
 
         /*
+         * Check if a constrained deadline task was activated
+         * after the deadline but before the next period.
+         * If that is the case, the task will be throttled and
+         * the replenishment timer will be set to the next period.
+         */
+        if (!p->dl.dl_throttled && dl_is_constrained(&p->dl))
+                dl_check_constrained_dl(&p->dl);
+
+        /*
          * If p is throttled, we do nothing. In fact, if it exhausted
          * its budget it needs a replenishment and, since it now is on
          * its rq, the bandwidth timer callback (which clearly has not
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 3e88b35ac157..dea138964b91 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5799,7 +5799,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t
          * Due to large variance we need a large fuzz factor; hackbench in
          * particularly is sensitive here.
          */
-        if ((avg_idle / 512) < avg_cost)
+        if (sched_feat(SIS_AVG_CPU) && (avg_idle / 512) < avg_cost)
                 return -1;
 
         time = local_clock();
diff --git a/kernel/sched/features.h b/kernel/sched/features.h
index 69631fa46c2f..1b3c8189b286 100644
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -51,6 +51,11 @@ SCHED_FEAT(NONTASK_CAPACITY, true)
  */
 SCHED_FEAT(TTWU_QUEUE, true)
 
+/*
+ * When doing wakeups, attempt to limit superfluous scans of the LLC domain.
+ */
+SCHED_FEAT(SIS_AVG_CPU, false)
+
 #ifdef HAVE_RT_PUSH_IPI
 /*
  * In order to avoid a thundering herd attack of CPUs that are
diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c
index 7296b7308eca..f15fb2bdbc0d 100644
--- a/kernel/sched/loadavg.c
+++ b/kernel/sched/loadavg.c
@@ -169,7 +169,7 @@ static inline int calc_load_write_idx(void)
          * If the folding window started, make sure we start writing in the
          * next idle-delta.
          */
-        if (!time_before(jiffies, calc_load_update))
+        if (!time_before(jiffies, READ_ONCE(calc_load_update)))
                 idx++;
 
         return idx & 1;
@@ -202,8 +202,9 @@ void calc_load_exit_idle(void)
         struct rq *this_rq = this_rq();
 
         /*
-         * If we're still before the sample window, we're done.
+         * If we're still before the pending sample window, we're done.
          */
+        this_rq->calc_load_update = READ_ONCE(calc_load_update);
         if (time_before(jiffies, this_rq->calc_load_update))
                 return;
 
@@ -212,7 +213,6 @@ void calc_load_exit_idle(void)
          * accounted through the nohz accounting, so skip the entire deal and
          * sync up for the next window.
          */
-        this_rq->calc_load_update = calc_load_update;
         if (time_before(jiffies, this_rq->calc_load_update + 10))
                 this_rq->calc_load_update += LOAD_FREQ;
 }
@@ -308,13 +308,15 @@ calc_load_n(unsigned long load, unsigned long exp,
  */
 static void calc_global_nohz(void)
 {
+        unsigned long sample_window;
         long delta, active, n;
 
-        if (!time_before(jiffies, calc_load_update + 10)) {
+        sample_window = READ_ONCE(calc_load_update);
+        if (!time_before(jiffies, sample_window + 10)) {
                 /*
                  * Catch-up, fold however many we are behind still
                  */
-                delta = jiffies - calc_load_update - 10;
+                delta = jiffies - sample_window - 10;
                 n = 1 + (delta / LOAD_FREQ);
 
                 active = atomic_long_read(&calc_load_tasks);
@@ -324,7 +326,7 @@ static void calc_global_nohz(void)
                 avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
                 avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
 
-                calc_load_update += n * LOAD_FREQ;
+                WRITE_ONCE(calc_load_update, sample_window + n * LOAD_FREQ);
         }
 
         /*
@@ -352,9 +354,11 @@ static inline void calc_global_nohz(void) { }
  */
 void calc_global_load(unsigned long ticks)
 {
+        unsigned long sample_window;
         long active, delta;
 
-        if (time_before(jiffies, calc_load_update + 10))
+        sample_window = READ_ONCE(calc_load_update);
+        if (time_before(jiffies, sample_window + 10))
                 return;
 
         /*
@@ -371,7 +375,7 @@ void calc_global_load(unsigned long ticks)
         avenrun[1] = calc_load(avenrun[1], EXP_5, active);
         avenrun[2] = calc_load(avenrun[2], EXP_15, active);
 
-        calc_load_update += LOAD_FREQ;
+        WRITE_ONCE(calc_load_update, sample_window + LOAD_FREQ);
 
         /*
          * In case we idled for multiple LOAD_FREQ intervals, catch up in bulk.
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 4d2ea6f25568..b8c84c6dee64 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -242,6 +242,45 @@ long prepare_to_wait_event(wait_queue_head_t *q, wait_queue_t *wait, int state)
 }
 EXPORT_SYMBOL(prepare_to_wait_event);
 
+/*
+ * Note! These two wait functions are entered with the
+ * wait-queue lock held (and interrupts off in the _irq
+ * case), so there is no race with testing the wakeup
+ * condition in the caller before they add the wait
+ * entry to the wake queue.
+ */
+int do_wait_intr(wait_queue_head_t *wq, wait_queue_t *wait)
+{
+        if (likely(list_empty(&wait->task_list)))
+                __add_wait_queue_tail(wq, wait);
+
+        set_current_state(TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+
+        spin_unlock(&wq->lock);
+        schedule();
+        spin_lock(&wq->lock);
+        return 0;
+}
+EXPORT_SYMBOL(do_wait_intr);
+
+int do_wait_intr_irq(wait_queue_head_t *wq, wait_queue_t *wait)
+{
+        if (likely(list_empty(&wait->task_list)))
+                __add_wait_queue_tail(wq, wait);
+
+        set_current_state(TASK_INTERRUPTIBLE);
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+
+        spin_unlock_irq(&wq->lock);
+        schedule();
+        spin_lock_irq(&wq->lock);
+        return 0;
+}
+EXPORT_SYMBOL(do_wait_intr_irq);
+
 /**
  * finish_wait - clean up after waiting in a queue
  * @q: waitqueue waited on
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index acf0a5a06da7..8c8714fcb53c 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2133,9 +2133,12 @@ static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
         if (write) {
                 if (*negp)
                         return -EINVAL;
+                if (*lvalp > UINT_MAX)
+                        return -EINVAL;
                 *valp = *lvalp;
         } else {
                 unsigned int val = *valp;
+                *negp = false;
                 *lvalp = (unsigned long)val;
         }
         return 0;
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 7906b3f0c41a..497719127bf9 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -125,7 +125,7 @@ int register_refined_jiffies(long cycles_per_second)
         shift_hz += cycles_per_tick/2;
         do_div(shift_hz, cycles_per_tick);
         /* Calculate nsec_per_tick using shift_hz */
-        nsec_per_tick = (u64)TICK_NSEC << 8;
+        nsec_per_tick = (u64)NSEC_PER_SEC << 8;
         nsec_per_tick += (u32)shift_hz/2;
         do_div(nsec_per_tick, (u32)shift_hz);
 
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index d5038005eb5d..d4a06e714645 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -429,7 +429,7 @@ config BLK_DEV_IO_TRACE
 
           If unsure, say N.
 
-config KPROBE_EVENT
+config KPROBE_EVENTS
         depends on KPROBES
         depends on HAVE_REGS_AND_STACK_ACCESS_API
         bool "Enable kprobes-based dynamic events"
@@ -447,7 +447,7 @@ config KPROBE_EVENT
           This option is also required by perf-probe subcommand of perf tools.
           If you want to use perf tools, this option is strongly recommended.
 
-config UPROBE_EVENT
+config UPROBE_EVENTS
         bool "Enable uprobes-based dynamic events"
         depends on ARCH_SUPPORTS_UPROBES
         depends on MMU
@@ -466,7 +466,7 @@ config UPROBE_EVENT
 
 config BPF_EVENTS
         depends on BPF_SYSCALL
-        depends on (KPROBE_EVENT || UPROBE_EVENT) && PERF_EVENTS
+        depends on (KPROBE_EVENTS || UPROBE_EVENTS) && PERF_EVENTS
         bool
         default y
         help
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index e57980845549..90f2701d92a7 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -57,7 +57,7 @@ obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
 obj-$(CONFIG_EVENT_TRACING) += trace_events_trigger.o
 obj-$(CONFIG_HIST_TRIGGERS) += trace_events_hist.o
 obj-$(CONFIG_BPF_EVENTS) += bpf_trace.o
-obj-$(CONFIG_KPROBE_EVENT) += trace_kprobe.o
+obj-$(CONFIG_KPROBE_EVENTS) += trace_kprobe.o
 obj-$(CONFIG_TRACEPOINTS) += power-traces.o
 ifeq ($(CONFIG_PM),y)
 obj-$(CONFIG_TRACEPOINTS) += rpm-traces.o
@@ -66,7 +66,7 @@ ifeq ($(CONFIG_TRACING),y)
 obj-$(CONFIG_KGDB_KDB) += trace_kdb.o
 endif
 obj-$(CONFIG_PROBE_EVENTS) += trace_probe.o
-obj-$(CONFIG_UPROBE_EVENT) += trace_uprobe.o
+obj-$(CONFIG_UPROBE_EVENTS) += trace_uprobe.o
 
 obj-$(CONFIG_TRACEPOINT_BENCHMARK) += trace_benchmark.o
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 0d1597c9ee30..dd3e91d68dc7 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -3755,23 +3755,24 @@ static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
         ftrace_probe_registered = 1;
 }
 
-static void __disable_ftrace_function_probe(void)
+static bool __disable_ftrace_function_probe(void)
 {
         int i;
 
         if (!ftrace_probe_registered)
-                return;
+                return false;
 
         for (i = 0; i < FTRACE_FUNC_HASHSIZE; i++) {
                 struct hlist_head *hhd = &ftrace_func_hash[i];
                 if (hhd->first)
-                        return;
+                        return false;
         }
 
         /* no more funcs left */
         ftrace_shutdown(&trace_probe_ops, 0);
 
         ftrace_probe_registered = 0;
+        return true;
 }
 
 
@@ -3901,6 +3902,7 @@ static void
 __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                                   void *data, int flags)
 {
+        struct ftrace_ops_hash old_hash_ops;
         struct ftrace_func_entry *rec_entry;
         struct ftrace_func_probe *entry;
         struct ftrace_func_probe *p;
@@ -3912,6 +3914,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
         struct hlist_node *tmp;
         char str[KSYM_SYMBOL_LEN];
         int i, ret;
+        bool disabled;
 
         if (glob && (strcmp(glob, "*") == 0 || !strlen(glob)))
                 func_g.search = NULL;
@@ -3930,6 +3933,10 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
 
         mutex_lock(&trace_probe_ops.func_hash->regex_lock);
 
+        old_hash_ops.filter_hash = old_hash;
+        /* Probes only have filters */
+        old_hash_ops.notrace_hash = NULL;
+
         hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
         if (!hash)
                 /* Hmm, should report this somehow */
@@ -3967,12 +3974,17 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
                 }
         }
         mutex_lock(&ftrace_lock);
-        __disable_ftrace_function_probe();
+        disabled = __disable_ftrace_function_probe();
         /*
          * Remove after the disable is called. Otherwise, if the last
          * probe is removed, a null hash means *all enabled*.
          */
         ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
+
+        /* still need to update the function call sites */
+        if (ftrace_enabled && !disabled)
+                ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS,
+                                       &old_hash_ops);
         synchronize_sched();
         if (!ret)
                 free_ftrace_hash_rcu(old_hash);
@@ -4416,16 +4428,24 @@ static int __init set_graph_notrace_function(char *str)
 }
 __setup("ftrace_graph_notrace=", set_graph_notrace_function);
 
+static int __init set_graph_max_depth_function(char *str)
+{
+        if (!str)
+                return 0;
+        fgraph_max_depth = simple_strtoul(str, NULL, 0);
+        return 1;
+}
+__setup("ftrace_graph_max_depth=", set_graph_max_depth_function);
+
 static void __init set_ftrace_early_graph(char *buf, int enable)
 {
         int ret;
         char *func;
         struct ftrace_hash *hash;
 
-        if (enable)
-                hash = ftrace_graph_hash;
-        else
-                hash = ftrace_graph_notrace_hash;
+        hash = alloc_ftrace_hash(FTRACE_HASH_DEFAULT_BITS);
+        if (WARN_ON(!hash))
+                return;
 
         while (buf) {
                 func = strsep(&buf, ",");
@@ -4435,6 +4455,11 @@ static void __init set_ftrace_early_graph(char *buf, int enable)
                         printk(KERN_DEBUG "ftrace: function %s not "
                                           "traceable\n", func);
         }
+
+        if (enable)
+                ftrace_graph_hash = hash;
+        else
+                ftrace_graph_notrace_hash = hash;
 }
 #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
 
@@ -5488,7 +5513,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
  * Normally the mcount trampoline will call the ops->func, but there
  * are times that it should not. For example, if the ops does not
  * have its own recursion protection, then it should call the
- * ftrace_ops_recurs_func() instead.
+ * ftrace_ops_assist_func() instead.
  *
  * Returns the function that the trampoline should call for @ops.
  */
@@ -5541,6 +5566,15 @@ static void clear_ftrace_pids(struct trace_array *tr)
         trace_free_pid_list(pid_list);
 }
 
+void ftrace_clear_pids(struct trace_array *tr)
+{
+        mutex_lock(&ftrace_lock);
+
+        clear_ftrace_pids(tr);
+
+        mutex_unlock(&ftrace_lock);
+}
+
 static void ftrace_pid_reset(struct trace_array *tr)
 {
         mutex_lock(&ftrace_lock);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 96fc3c043ad6..ca47a4fa2986 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3405,11 +3405,23 @@ EXPORT_SYMBOL_GPL(ring_buffer_iter_reset);
 int ring_buffer_iter_empty(struct ring_buffer_iter *iter)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
+        struct buffer_page *reader;
+        struct buffer_page *head_page;
+        struct buffer_page *commit_page;
+        unsigned commit;
 
         cpu_buffer = iter->cpu_buffer;
 
-        return iter->head_page == cpu_buffer->commit_page &&
-                iter->head == rb_commit_index(cpu_buffer);
+        /* Remember, trace recording is off when iterator is in use */
+        reader = cpu_buffer->reader_page;
+        head_page = cpu_buffer->head_page;
+        commit_page = cpu_buffer->commit_page;
+        commit = rb_page_commit(commit_page);
+
+        return ((iter->head_page == commit_page && iter->head == commit) ||
+                (iter->head_page == reader && commit_page == head_page &&
+                 head_page->read == commit &&
+                 iter->head == rb_page_commit(cpu_buffer->reader_page)));
 }
 EXPORT_SYMBOL_GPL(ring_buffer_iter_empty);
 
@@ -4826,9 +4838,9 @@ static __init int test_ringbuffer(void)
                 rb_data[cpu].cnt = cpu;
                 rb_threads[cpu] = kthread_create(rb_test, &rb_data[cpu],
                                                  "rbtester/%d", cpu);
-                if (WARN_ON(!rb_threads[cpu])) {
+                if (WARN_ON(IS_ERR(rb_threads[cpu]))) {
                         pr_cont("FAILED\n");
-                        ret = -1;
+                        ret = PTR_ERR(rb_threads[cpu]);
                         goto out_free;
                 }
 
@@ -4838,9 +4850,9 @@ static __init int test_ringbuffer(void)
 
         /* Now create the rb hammer! */
         rb_hammer = kthread_run(rb_hammer_test, NULL, "rbhammer");
-        if (WARN_ON(!rb_hammer)) {
+        if (WARN_ON(IS_ERR(rb_hammer))) {
                 pr_cont("FAILED\n");
-                ret = -1;
+                ret = PTR_ERR(rb_hammer);
                 goto out_free;
         }
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 707445ceb7ef..0ad75e9698f6 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4341,22 +4341,22 @@ static const char readme_msg[] =
         "\t\t\t  traces\n"
 #endif
 #endif /* CONFIG_STACK_TRACER */
-#ifdef CONFIG_KPROBE_EVENT
+#ifdef CONFIG_KPROBE_EVENTS
         "  kprobe_events\t\t- Add/remove/show the kernel dynamic events\n"
         "\t\t\t  Write into this file to define/undefine new trace events.\n"
 #endif
-#ifdef CONFIG_UPROBE_EVENT
+#ifdef CONFIG_UPROBE_EVENTS
         "  uprobe_events\t\t- Add/remove/show the userspace dynamic events\n"
         "\t\t\t  Write into this file to define/undefine new trace events.\n"
 #endif
-#if defined(CONFIG_KPROBE_EVENT) || defined(CONFIG_UPROBE_EVENT)
+#if defined(CONFIG_KPROBE_EVENTS) || defined(CONFIG_UPROBE_EVENTS)
         "\t  accepts: event-definitions (one definition per line)\n"
         "\t   Format: p|r[:[<group>/]<event>] <place> [<args>]\n"
         "\t           -:[<group>/]<event>\n"
-#ifdef CONFIG_KPROBE_EVENT
+#ifdef CONFIG_KPROBE_EVENTS
         "\t    place: [<module>:]<symbol>[+<offset>]|<memaddr>\n"
 #endif
-#ifdef CONFIG_UPROBE_EVENT
+#ifdef CONFIG_UPROBE_EVENTS
         "\t    place: <path>:<offset>\n"
 #endif
         "\t     args: <name>=fetcharg[:type]\n"
@@ -6733,11 +6733,13 @@ ftrace_trace_snapshot_callback(struct ftrace_hash *hash,
                 return ret;
 
  out_reg:
-        ret = register_ftrace_function_probe(glob, ops, count);
+        ret = alloc_snapshot(&global_trace);
+        if (ret < 0)
+                goto out;
 
-        if (ret >= 0)
-                alloc_snapshot(&global_trace);
+        ret = register_ftrace_function_probe(glob, ops, count);
 
+ out:
         return ret < 0 ? ret : 0;
 }
 
@@ -7402,6 +7404,7 @@ static int instance_rmdir(const char *name)
 
         tracing_set_nop(tr);
         event_trace_del_tracer(tr);
+        ftrace_clear_pids(tr);
         ftrace_destroy_function_files(tr);
         tracefs_remove_recursive(tr->dir);
         free_trace_buffers(tr);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index ae1cce91fead..d19d52d600d6 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -896,6 +896,7 @@ int using_ftrace_ops_list_func(void);
 void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d_tracer);
 void ftrace_init_tracefs_toplevel(struct trace_array *tr,
                                   struct dentry *d_tracer);
+void ftrace_clear_pids(struct trace_array *tr);
 #else
 static inline int ftrace_trace_task(struct trace_array *tr)
 {
@@ -914,6 +915,7 @@ ftrace_init_global_array_ops(struct trace_array *tr) { }
 static inline void ftrace_reset_array_ops(struct trace_array *tr) { }
 static inline void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d) { }
 static inline void ftrace_init_tracefs_toplevel(struct trace_array *tr, struct dentry *d) { }
+static inline void ftrace_clear_pids(struct trace_array *tr) { }
 /* ftace_func_t type is not defined, use macro instead of static inline */
 #define ftrace_init_array_ops(tr, func) do { } while (0)
 #endif /* CONFIG_FUNCTION_TRACER */
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 0c0ae54d44c6..903273c93e61 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -248,7 +248,7 @@ ASSIGN_FETCH_FUNC(file_offset, ftype),			\
 #define FETCH_TYPE_STRING       0
 #define FETCH_TYPE_STRSIZE      1
 
-#ifdef CONFIG_KPROBE_EVENT
+#ifdef CONFIG_KPROBE_EVENTS
 struct symbol_cache;
 unsigned long update_symbol_cache(struct symbol_cache *sc);
 void free_symbol_cache(struct symbol_cache *sc);
@@ -278,7 +278,7 @@ alloc_symbol_cache(const char *sym, long offset)
 {
         return NULL;
 }
-#endif /* CONFIG_KPROBE_EVENT */
+#endif /* CONFIG_KPROBE_EVENTS */
 
 struct probe_arg {
         struct fetch_param      fetch;
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 1d68b5b7ad41..5fb1f2c87e6b 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -65,7 +65,7 @@ void stack_trace_print(void)
 }
 
 /*
- * When arch-specific code overides this function, the following
+ * When arch-specific code overrides this function, the following
  * data should be filled up, assuming stack_trace_max_lock is held to
  * prevent concurrent updates.
  *     stack_trace_index[]
diff --git a/kernel/ucount.c b/kernel/ucount.c
index 62630a40ab3a..b4eeee03934f 100644
--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -144,7 +144,7 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
 
                 new->ns = ns;
                 new->uid = uid;
-                atomic_set(&new->count, 0);
+                new->count = 0;
 
                 spin_lock_irq(&ucounts_lock);
                 ucounts = find_ucounts(ns, uid, hashent);
@@ -155,8 +155,10 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid)
                         ucounts = new;
                 }
         }
-        if (!atomic_add_unless(&ucounts->count, 1, INT_MAX))
+        if (ucounts->count == INT_MAX)
                 ucounts = NULL;
+        else
+                ucounts->count += 1;
         spin_unlock_irq(&ucounts_lock);
         return ucounts;
 }
@@ -165,13 +167,15 @@ static void put_ucounts(struct ucounts *ucounts)
 {
         unsigned long flags;
 
-        if (atomic_dec_and_test(&ucounts->count)) {
-                spin_lock_irqsave(&ucounts_lock, flags);
+        spin_lock_irqsave(&ucounts_lock, flags);
+        ucounts->count -= 1;
+        if (!ucounts->count)
                 hlist_del_init(&ucounts->node);
-                spin_unlock_irqrestore(&ucounts_lock, flags);
+        else
+                ucounts = NULL;
+        spin_unlock_irqrestore(&ucounts_lock, flags);
 
-                kfree(ucounts);
-        }
+        kfree(ucounts);
 }
 
 static inline bool atomic_inc_below(atomic_t *v, int u)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 072cbc9b175d..c0168b7da1ea 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1507,6 +1507,7 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
         struct timer_list *timer = &dwork->timer;
         struct work_struct *work = &dwork->work;
 
+        WARN_ON_ONCE(!wq);
         WARN_ON_ONCE(timer->function != delayed_work_timer_fn ||
                      timer->data != (unsigned long)dwork);
         WARN_ON_ONCE(timer_pending(timer));
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 97d62c2da6c2..fa16c0f82d6e 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1103,9 +1103,6 @@ config PROVE_LOCKING
 
          For more details, see Documentation/locking/lockdep-design.txt.
 
-config PROVE_LOCKING_SMALL
-        bool
-
 config LOCKDEP
         bool
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
@@ -1114,6 +1111,9 @@ config LOCKDEP
         select KALLSYMS
         select KALLSYMS_ALL
 
+config LOCKDEP_SMALL
+        bool
+
 config LOCK_STAT
         bool "Lock usage statistics"
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
diff --git a/lib/ioremap.c b/lib/ioremap.c
index a3e14ce92a56..4bb30206b942 100644
--- a/lib/ioremap.c
+++ b/lib/ioremap.c
@@ -14,6 +14,7 @@
 #include <asm/pgtable.h>
 
 #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
+static int __read_mostly ioremap_p4d_capable;
 static int __read_mostly ioremap_pud_capable;
 static int __read_mostly ioremap_pmd_capable;
 static int __read_mostly ioremap_huge_disabled;
@@ -35,6 +36,11 @@ void __init ioremap_huge_init(void)
         }
 }
 
+static inline int ioremap_p4d_enabled(void)
+{
+        return ioremap_p4d_capable;
+}
+
 static inline int ioremap_pud_enabled(void)
 {
         return ioremap_pud_capable;
@@ -46,6 +52,7 @@ static inline int ioremap_pmd_enabled(void)
 }
 
 #else   /* !CONFIG_HAVE_ARCH_HUGE_VMAP */
+static inline int ioremap_p4d_enabled(void) { return 0; }
 static inline int ioremap_pud_enabled(void) { return 0; }
 static inline int ioremap_pmd_enabled(void) { return 0; }
 #endif  /* CONFIG_HAVE_ARCH_HUGE_VMAP */
@@ -94,14 +101,14 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
         return 0;
 }
 
-static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
+static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
                 unsigned long end, phys_addr_t phys_addr, pgprot_t prot)
 {
         pud_t *pud;
         unsigned long next;
 
         phys_addr -= addr;
-        pud = pud_alloc(&init_mm, pgd, addr);
+        pud = pud_alloc(&init_mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -120,6 +127,32 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
         return 0;
 }
 
+static inline int ioremap_p4d_range(pgd_t *pgd, unsigned long addr,
+                unsigned long end, phys_addr_t phys_addr, pgprot_t prot)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        phys_addr -= addr;
+        p4d = p4d_alloc(&init_mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+
+                if (ioremap_p4d_enabled() &&
+                    ((next - addr) == P4D_SIZE) &&
+                    IS_ALIGNED(phys_addr + addr, P4D_SIZE)) {
+                        if (p4d_set_huge(p4d, phys_addr + addr, prot))
+                                continue;
+                }
+
+                if (ioremap_pud_range(p4d, addr, next, phys_addr + addr, prot))
+                        return -ENOMEM;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 int ioremap_page_range(unsigned long addr,
                        unsigned long end, phys_addr_t phys_addr, pgprot_t prot)
 {
@@ -135,7 +168,7 @@ int ioremap_page_range(unsigned long addr,
         pgd = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                err = ioremap_pud_range(pgd, addr, next, phys_addr+addr, prot);
+                err = ioremap_p4d_range(pgd, addr, next, phys_addr+addr, prot);
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index e68604ae3ced..60abc44385b7 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -786,6 +786,68 @@ void iov_iter_advance(struct iov_iter *i, size_t size)
 }
 EXPORT_SYMBOL(iov_iter_advance);
 
+void iov_iter_revert(struct iov_iter *i, size_t unroll)
+{
+        if (!unroll)
+                return;
+        i->count += unroll;
+        if (unlikely(i->type & ITER_PIPE)) {
+                struct pipe_inode_info *pipe = i->pipe;
+                int idx = i->idx;
+                size_t off = i->iov_offset;
+                while (1) {
+                        size_t n = off - pipe->bufs[idx].offset;
+                        if (unroll < n) {
+                                off -= (n - unroll);
+                                break;
+                        }
+                        unroll -= n;
+                        if (!unroll && idx == i->start_idx) {
+                                off = 0;
+                                break;
+                        }
+                        if (!idx--)
+                                idx = pipe->buffers - 1;
+                        off = pipe->bufs[idx].offset + pipe->bufs[idx].len;
+                }
+                i->iov_offset = off;
+                i->idx = idx;
+                pipe_truncate(i);
+                return;
+        }
+        if (unroll <= i->iov_offset) {
+                i->iov_offset -= unroll;
+                return;
+        }
+        unroll -= i->iov_offset;
+        if (i->type & ITER_BVEC) {
+                const struct bio_vec *bvec = i->bvec;
+                while (1) {
+                        size_t n = (--bvec)->bv_len;
+                        i->nr_segs++;
+                        if (unroll <= n) {
+                                i->bvec = bvec;
+                                i->iov_offset = n - unroll;
+                                return;
+                        }
+                        unroll -= n;
+                }
+        } else { /* same logics for iovec and kvec */
+                const struct iovec *iov = i->iov;
+                while (1) {
+                        size_t n = (--iov)->iov_len;
+                        i->nr_segs++;
+                        if (unroll <= n) {
+                                i->iov = iov;
+                                i->iov_offset = n - unroll;
+                                return;
+                        }
+                        unroll -= n;
+                }
+        }
+}
+EXPORT_SYMBOL(iov_iter_revert);
+
 /*
  * Return the count of just the current iov_iter segment.
  */
@@ -839,6 +901,7 @@ void iov_iter_pipe(struct iov_iter *i, int direction,
         i->idx = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
         i->iov_offset = 0;
         i->count = count;
+        i->start_idx = i->idx;
 }
 EXPORT_SYMBOL(iov_iter_pipe);
 
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 5ed506d648c4..691a9ad48497 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -2129,8 +2129,8 @@ int ida_pre_get(struct ida *ida, gfp_t gfp)
                 struct ida_bitmap *bitmap = kmalloc(sizeof(*bitmap), gfp);
                 if (!bitmap)
                         return 0;
-                bitmap = this_cpu_cmpxchg(ida_bitmap, NULL, bitmap);
-                kfree(bitmap);
+                if (this_cpu_cmpxchg(ida_bitmap, NULL, bitmap))
+                        kfree(bitmap);
         }
 
         return 1;
diff --git a/lib/refcount.c b/lib/refcount.c
index 1d33366189d1..aa09ad3c30b0 100644
--- a/lib/refcount.c
+++ b/lib/refcount.c
@@ -58,7 +58,7 @@ bool refcount_add_not_zero(unsigned int i, refcount_t *r)
                 val = old;
         }
 
-        WARN(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
+        WARN_ONCE(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
 
         return true;
 }
@@ -66,7 +66,7 @@ EXPORT_SYMBOL_GPL(refcount_add_not_zero);
 
 void refcount_add(unsigned int i, refcount_t *r)
 {
-        WARN(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
+        WARN_ONCE(!refcount_add_not_zero(i, r), "refcount_t: addition on 0; use-after-free.\n");
 }
 EXPORT_SYMBOL_GPL(refcount_add);
 
@@ -97,7 +97,7 @@ bool refcount_inc_not_zero(refcount_t *r)
                 val = old;
         }
 
-        WARN(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
+        WARN_ONCE(new == UINT_MAX, "refcount_t: saturated; leaking memory.\n");
 
         return true;
 }
@@ -111,7 +111,7 @@ EXPORT_SYMBOL_GPL(refcount_inc_not_zero);
  */
 void refcount_inc(refcount_t *r)
 {
-        WARN(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
+        WARN_ONCE(!refcount_inc_not_zero(r), "refcount_t: increment on 0; use-after-free.\n");
 }
 EXPORT_SYMBOL_GPL(refcount_inc);
 
@@ -125,7 +125,7 @@ bool refcount_sub_and_test(unsigned int i, refcount_t *r)
 
                 new = val - i;
                 if (new > val) {
-                        WARN(new > val, "refcount_t: underflow; use-after-free.\n");
+                        WARN_ONCE(new > val, "refcount_t: underflow; use-after-free.\n");
                         return false;
                 }
 
@@ -164,7 +164,7 @@ EXPORT_SYMBOL_GPL(refcount_dec_and_test);
 
 void refcount_dec(refcount_t *r)
 {
-        WARN(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
+        WARN_ONCE(refcount_dec_and_test(r), "refcount_t: decrement hit 0; leaking memory.\n");
 }
 EXPORT_SYMBOL_GPL(refcount_dec);
 
@@ -204,7 +204,7 @@ bool refcount_dec_not_one(refcount_t *r)
 
                 new = val - 1;
                 if (new > val) {
-                        WARN(new > val, "refcount_t: underflow; use-after-free.\n");
+                        WARN_ONCE(new > val, "refcount_t: underflow; use-after-free.\n");
                         return true;
                 }
 
diff --git a/lib/syscall.c b/lib/syscall.c
index 17d5ff5fa6a3..2c6cd1b5c3ea 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -12,6 +12,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
 
         if (!try_get_task_stack(target)) {
                 /* Task has no stack, so the task isn't in a syscall. */
+                *sp = *pc = 0;
                 *callno = -1;
                 return 0;
         }
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 0b1d3140fbb8..a25c9763fce1 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -20,6 +20,7 @@
 #include <linux/string.h>
 #include <linux/uaccess.h>
 #include <linux/module.h>
+#include <linux/kasan.h>
 
 /*
  * Note: test functions are marked noinline so that their names appear in
@@ -474,6 +475,12 @@ static noinline void __init use_after_scope_test(void)
 
 static int __init kmalloc_tests_init(void)
 {
+        /*
+         * Temporarily enable multi-shot mode. Otherwise, we'd only get a
+         * report for the first case.
+         */
+        bool multishot = kasan_save_enable_multi_shot();
+
         kmalloc_oob_right();
         kmalloc_oob_left();
         kmalloc_node_oob_right();
@@ -499,6 +506,9 @@ static int __init kmalloc_tests_init(void)
         ksize_unpoisons_memory();
         copy_user_test();
         use_after_scope_test();
+
+        kasan_restore_multi_shot(multishot);
+
         return -EAGAIN;
 }
 
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 6d861d090e9f..c6f2a37028c2 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -683,33 +683,26 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
 static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
 {
         struct radix_tree_iter iter;
-        struct rb_node *rbn;
         void **slot;
 
         WARN_ON(test_bit(WB_registered, &bdi->wb.state));
 
         spin_lock_irq(&cgwb_lock);
-
         radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0)
                 cgwb_kill(*slot);
-
-        while ((rbn = rb_first(&bdi->cgwb_congested_tree))) {
-                struct bdi_writeback_congested *congested =
-                        rb_entry(rbn, struct bdi_writeback_congested, rb_node);
-
-                rb_erase(rbn, &bdi->cgwb_congested_tree);
-                congested->bdi = NULL;  /* mark @congested unlinked */
-        }
-
         spin_unlock_irq(&cgwb_lock);
 
         /*
-         * All cgwb's and their congested states must be shutdown and
-         * released before returning.  Drain the usage counter to wait for
-         * all cgwb's and cgwb_congested's ever created on @bdi.
+         * All cgwb's must be shutdown and released before returning.  Drain
+         * the usage counter to wait for all cgwb's ever created on @bdi.
          */
         atomic_dec(&bdi->usage_cnt);
         wait_event(cgwb_release_wait, !atomic_read(&bdi->usage_cnt));
+        /*
+         * Grab back our reference so that we hold it when @bdi gets
+         * re-registered.
+         */
+        atomic_inc(&bdi->usage_cnt);
 }
 
 /**
@@ -749,6 +742,21 @@ void wb_blkcg_offline(struct blkcg *blkcg)
         spin_unlock_irq(&cgwb_lock);
 }
 
+static void cgwb_bdi_exit(struct backing_dev_info *bdi)
+{
+        struct rb_node *rbn;
+
+        spin_lock_irq(&cgwb_lock);
+        while ((rbn = rb_first(&bdi->cgwb_congested_tree))) {
+                struct bdi_writeback_congested *congested =
+                        rb_entry(rbn, struct bdi_writeback_congested, rb_node);
+
+                rb_erase(rbn, &bdi->cgwb_congested_tree);
+                congested->bdi = NULL;  /* mark @congested unlinked */
+        }
+        spin_unlock_irq(&cgwb_lock);
+}
+
 #else   /* CONFIG_CGROUP_WRITEBACK */
 
 static int cgwb_bdi_init(struct backing_dev_info *bdi)
@@ -769,7 +777,9 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
         return 0;
 }
 
-static void cgwb_bdi_destroy(struct backing_dev_info *bdi)
+static void cgwb_bdi_destroy(struct backing_dev_info *bdi) { }
+
+static void cgwb_bdi_exit(struct backing_dev_info *bdi)
 {
         wb_congested_put(bdi->wb_congested);
 }
@@ -857,6 +867,8 @@ int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
                         MINOR(owner->devt));
         if (rc)
                 return rc;
+        /* Leaking owner reference... */
+        WARN_ON(bdi->owner);
         bdi->owner = owner;
         get_device(owner);
         return 0;
@@ -898,6 +910,7 @@ static void bdi_exit(struct backing_dev_info *bdi)
 {
         WARN_ON_ONCE(bdi->dev);
         wb_exit(&bdi->wb);
+        cgwb_bdi_exit(bdi);
 }
 
 static void release_bdi(struct kref *ref)
diff --git a/mm/gup.c b/mm/gup.c
index 9c047e951aa3..04aa405350dc 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -226,6 +226,7 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
                               unsigned int *page_mask)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         spinlock_t *ptl;
@@ -243,8 +244,13 @@ struct page *follow_page_mask(struct vm_area_struct *vma,
         pgd = pgd_offset(mm, address);
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
                 return no_page_table(vma, flags);
-
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (p4d_none(*p4d))
+                return no_page_table(vma, flags);
+        BUILD_BUG_ON(p4d_huge(*p4d));
+        if (unlikely(p4d_bad(*p4d)))
+                return no_page_table(vma, flags);
+        pud = pud_offset(p4d, address);
         if (pud_none(*pud))
                 return no_page_table(vma, flags);
         if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) {
@@ -325,6 +331,7 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
                 struct page **page)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
@@ -338,7 +345,9 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
         else
                 pgd = pgd_offset_gate(mm, address);
         BUG_ON(pgd_none(*pgd));
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        BUG_ON(p4d_none(*p4d));
+        pud = pud_offset(p4d, address);
         BUG_ON(pud_none(*pud));
         pmd = pmd_offset(pud, address);
         if (pmd_none(*pmd))
@@ -1400,13 +1409,13 @@ static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
         return 1;
 }
 
-static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
+static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end,
                          int write, struct page **pages, int *nr)
 {
         unsigned long next;
         pud_t *pudp;
 
-        pudp = pud_offset(&pgd, addr);
+        pudp = pud_offset(&p4d, addr);
         do {
                 pud_t pud = READ_ONCE(*pudp);
 
@@ -1428,6 +1437,31 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
         return 1;
 }
 
+static int gup_p4d_range(pgd_t pgd, unsigned long addr, unsigned long end,
+                         int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        p4d_t *p4dp;
+
+        p4dp = p4d_offset(&pgd, addr);
+        do {
+                p4d_t p4d = READ_ONCE(*p4dp);
+
+                next = p4d_addr_end(addr, end);
+                if (p4d_none(p4d))
+                        return 0;
+                BUILD_BUG_ON(p4d_huge(p4d));
+                if (unlikely(is_hugepd(__hugepd(p4d_val(p4d))))) {
+                        if (!gup_huge_pd(__hugepd(p4d_val(p4d)), addr,
+                                         P4D_SHIFT, next, write, pages, nr))
+                                return 0;
+                } else if (!gup_pud_range(p4d, addr, next, write, pages, nr))
+                        return 0;
+        } while (p4dp++, addr = next, addr != end);
+
+        return 1;
+}
+
 /*
  * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to
  * the regular GUP. It will only return non-negative values.
@@ -1478,7 +1512,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
                         if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr,
                                          PGDIR_SHIFT, next, write, pages, &nr))
                                 break;
-                } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
+                } else if (!gup_p4d_range(pgd, addr, next, write, pages, &nr))
                         break;
         } while (pgdp++, addr = next, addr != end);
         local_irq_restore(flags);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index d36b2af4d1bf..f3c4f9d22821 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -240,18 +240,18 @@ static ssize_t defrag_store(struct kobject *kobj,
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
                 set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
-        } else if (!memcmp("defer", buf,
-                    min(sizeof("defer")-1, count))) {
-                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
-                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
-                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
-                set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
         } else if (!memcmp("defer+madvise", buf,
                     min(sizeof("defer+madvise")-1, count))) {
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
                 set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+        } else if (!memcmp("defer", buf,
+                    min(sizeof("defer")-1, count))) {
+                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
+                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
+                clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
+                set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
         } else if (!memcmp("madvise", buf,
                            min(sizeof("madvise")-1, count))) {
                 clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
@@ -1568,8 +1568,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                 deactivate_page(page);
 
         if (pmd_young(orig_pmd) || pmd_dirty(orig_pmd)) {
-                orig_pmd = pmdp_huge_get_and_clear_full(tlb->mm, addr, pmd,
-                        tlb->fullmm);
+                pmdp_invalidate(vma, addr, pmd);
                 orig_pmd = pmd_mkold(orig_pmd);
                 orig_pmd = pmd_mkclean(orig_pmd);
 
@@ -1724,37 +1723,69 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 {
         struct mm_struct *mm = vma->vm_mm;
         spinlock_t *ptl;
-        int ret = 0;
+        pmd_t entry;
+        bool preserve_write;
+        int ret;
 
         ptl = __pmd_trans_huge_lock(pmd, vma);
-        if (ptl) {
-                pmd_t entry;
-                bool preserve_write = prot_numa && pmd_write(*pmd);
-                ret = 1;
+        if (!ptl)
+                return 0;
 
-                /*
-                 * Avoid trapping faults against the zero page. The read-only
-                 * data is likely to be read-cached on the local CPU and
-                 * local/remote hits to the zero page are not interesting.
-                 */
-                if (prot_numa && is_huge_zero_pmd(*pmd)) {
-                        spin_unlock(ptl);
-                        return ret;
-                }
+        preserve_write = prot_numa && pmd_write(*pmd);
+        ret = 1;
 
-                if (!prot_numa || !pmd_protnone(*pmd)) {
-                        entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd);
-                        entry = pmd_modify(entry, newprot);
-                        if (preserve_write)
-                                entry = pmd_mk_savedwrite(entry);
-                        ret = HPAGE_PMD_NR;
-                        set_pmd_at(mm, addr, pmd, entry);
-                        BUG_ON(vma_is_anonymous(vma) && !preserve_write &&
-                                        pmd_write(entry));
-                }
-                spin_unlock(ptl);
-        }
+        /*
+         * Avoid trapping faults against the zero page. The read-only
+         * data is likely to be read-cached on the local CPU and
+         * local/remote hits to the zero page are not interesting.
+         */
+        if (prot_numa && is_huge_zero_pmd(*pmd))
+                goto unlock;
+
+        if (prot_numa && pmd_protnone(*pmd))
+                goto unlock;
+
+        /*
+         * In case prot_numa, we are under down_read(mmap_sem). It's critical
+         * to not clear pmd intermittently to avoid race with MADV_DONTNEED
+         * which is also under down_read(mmap_sem):
+         *
+         *      CPU0:                           CPU1:
+         *                              change_huge_pmd(prot_numa=1)
+         *                               pmdp_huge_get_and_clear_notify()
+         * madvise_dontneed()
+         *  zap_pmd_range()
+         *   pmd_trans_huge(*pmd) == 0 (without ptl)
+         *   // skip the pmd
+         *                               set_pmd_at();
+         *                               // pmd is re-established
+         *
+         * The race makes MADV_DONTNEED miss the huge pmd and don't clear it
+         * which may break userspace.
+         *
+         * pmdp_invalidate() is required to make sure we don't miss
+         * dirty/young flags set by hardware.
+         */
+        entry = *pmd;
+        pmdp_invalidate(vma, addr, pmd);
+
+        /*
+         * Recover dirty/young flags.  It relies on pmdp_invalidate to not
+         * corrupt them.
+         */
+        if (pmd_dirty(*pmd))
+                entry = pmd_mkdirty(entry);
+        if (pmd_young(*pmd))
+                entry = pmd_mkyoung(entry);
 
+        entry = pmd_modify(entry, newprot);
+        if (preserve_write)
+                entry = pmd_mk_savedwrite(entry);
+        ret = HPAGE_PMD_NR;
+        set_pmd_at(mm, addr, pmd, entry);
+        BUG_ON(vma_is_anonymous(vma) && !preserve_write && pmd_write(entry));
+unlock:
+        spin_unlock(ptl);
         return ret;
 }
 
@@ -1828,7 +1859,7 @@ static void __split_huge_pud_locked(struct vm_area_struct *vma, pud_t *pud,
         VM_BUG_ON_VMA(vma->vm_end < haddr + HPAGE_PUD_SIZE, vma);
         VM_BUG_ON(!pud_trans_huge(*pud) && !pud_devmap(*pud));
 
-        count_vm_event(THP_SPLIT_PMD);
+        count_vm_event(THP_SPLIT_PUD);
 
         pudp_huge_clear_flush_notify(vma, haddr, pud);
 }
@@ -2048,6 +2079,7 @@ void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address,
                 bool freeze, struct page *page)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
 
@@ -2055,7 +2087,11 @@ void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address,
         if (!pgd_present(*pgd))
                 return;
 
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (!p4d_present(*p4d))
+                return;
+
+        pud = pud_offset(p4d, address);
         if (!pud_present(*pud))
                 return;
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index a7aa811b7d14..e5828875f7bb 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4403,7 +4403,9 @@ int hugetlb_reserve_pages(struct inode *inode,
         return 0;
 out_err:
         if (!vma || vma->vm_flags & VM_MAYSHARE)
-                region_abort(resv_map, from, to);
+                /* Don't call region_abort if region_chg failed */
+                if (chg >= 0)
+                        region_abort(resv_map, from, to);
         if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
                 kref_put(&resv_map->refs, resv_map_release);
         return ret;
@@ -4555,7 +4557,8 @@ out:
 int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
 {
         pgd_t *pgd = pgd_offset(mm, *addr);
-        pud_t *pud = pud_offset(pgd, *addr);
+        p4d_t *p4d = p4d_offset(pgd, *addr);
+        pud_t *pud = pud_offset(p4d, *addr);
 
         BUG_ON(page_count(virt_to_page(ptep)) == 0);
         if (page_count(virt_to_page(ptep)) == 1)
@@ -4586,11 +4589,13 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                         unsigned long addr, unsigned long sz)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pte_t *pte = NULL;
 
         pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
+        p4d = p4d_offset(pgd, addr);
+        pud = pud_alloc(mm, p4d, addr);
         if (pud) {
                 if (sz == PUD_SIZE) {
                         pte = (pte_t *)pud;
@@ -4610,18 +4615,22 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
-        pmd_t *pmd = NULL;
+        pmd_t *pmd;
 
         pgd = pgd_offset(mm, addr);
-        if (pgd_present(*pgd)) {
-                pud = pud_offset(pgd, addr);
-                if (pud_present(*pud)) {
-                        if (pud_huge(*pud))
-                                return (pte_t *)pud;
-                        pmd = pmd_offset(pud, addr);
-                }
-        }
+        if (!pgd_present(*pgd))
+                return NULL;
+        p4d = p4d_offset(pgd, addr);
+        if (!p4d_present(*p4d))
+                return NULL;
+        pud = pud_offset(p4d, addr);
+        if (!pud_present(*pud))
+                return NULL;
+        if (pud_huge(*pud))
+                return (pte_t *)pud;
+        pmd = pmd_offset(pud, addr);
         return (pte_t *) pmd;
 }
 
@@ -4644,6 +4653,7 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address,
 {
         struct page *page = NULL;
         spinlock_t *ptl;
+        pte_t pte;
 retry:
         ptl = pmd_lockptr(mm, pmd);
         spin_lock(ptl);
@@ -4653,12 +4663,13 @@ retry:
          */
         if (!pmd_huge(*pmd))
                 goto out;
-        if (pmd_present(*pmd)) {
+        pte = huge_ptep_get((pte_t *)pmd);
+        if (pte_present(pte)) {
                 page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT);
                 if (flags & FOLL_GET)
                         get_page(page);
         } else {
-                if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) {
+                if (is_hugetlb_entry_migration(pte)) {
                         spin_unlock(ptl);
                         __migration_entry_wait(mm, (pte_t *)pmd, ptl);
                         goto retry;
diff --git a/mm/internal.h b/mm/internal.h
index ccfc2a2969f4..266efaeaa370 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -481,6 +481,13 @@ unsigned long reclaim_clean_pages_from_list(struct zone *zone,
 enum ttu_flags;
 struct tlbflush_unmap_batch;
 
+
+/*
+ * only for MM internal work items which do not depend on
+ * any allocations or locks which might depend on allocations
+ */
+extern struct workqueue_struct *mm_percpu_wq;
+
 #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
 void try_to_unmap_flush(void);
 void try_to_unmap_flush_dirty(void);
diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
index 1c260e6b3b3c..dd2dea8eb077 100644
--- a/mm/kasan/kasan.h
+++ b/mm/kasan/kasan.h
@@ -96,11 +96,6 @@ static inline const void *kasan_shadow_to_mem(const void *shadow_addr)
                 << KASAN_SHADOW_SCALE_SHIFT);
 }
 
-static inline bool kasan_report_enabled(void)
-{
-        return !current->kasan_depth;
-}
-
 void kasan_report(unsigned long addr, size_t size,
                 bool is_write, unsigned long ip);
 void kasan_report_double_free(struct kmem_cache *cache, void *object,
diff --git a/mm/kasan/kasan_init.c b/mm/kasan/kasan_init.c
index 31238dad85fb..b96a5f773d88 100644
--- a/mm/kasan/kasan_init.c
+++ b/mm/kasan/kasan_init.c
@@ -30,6 +30,9 @@
  */
 unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
 
+#if CONFIG_PGTABLE_LEVELS > 4
+p4d_t kasan_zero_p4d[PTRS_PER_P4D] __page_aligned_bss;
+#endif
 #if CONFIG_PGTABLE_LEVELS > 3
 pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
 #endif
@@ -82,10 +85,10 @@ static void __init zero_pmd_populate(pud_t *pud, unsigned long addr,
         } while (pmd++, addr = next, addr != end);
 }
 
-static void __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
+static void __init zero_pud_populate(p4d_t *p4d, unsigned long addr,
                                 unsigned long end)
 {
-        pud_t *pud = pud_offset(pgd, addr);
+        pud_t *pud = pud_offset(p4d, addr);
         unsigned long next;
 
         do {
@@ -107,6 +110,23 @@ static void __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
         } while (pud++, addr = next, addr != end);
 }
 
+static void __init zero_p4d_populate(pgd_t *pgd, unsigned long addr,
+                                unsigned long end)
+{
+        p4d_t *p4d = p4d_offset(pgd, addr);
+        unsigned long next;
+
+        do {
+                next = p4d_addr_end(addr, end);
+
+                if (p4d_none(*p4d)) {
+                        p4d_populate(&init_mm, p4d,
+                                early_alloc(PAGE_SIZE, NUMA_NO_NODE));
+                }
+                zero_pud_populate(p4d, addr, next);
+        } while (p4d++, addr = next, addr != end);
+}
+
 /**
  * kasan_populate_zero_shadow - populate shadow memory region with
  *                               kasan_zero_page
@@ -125,6 +145,7 @@ void __init kasan_populate_zero_shadow(const void *shadow_start,
                 next = pgd_addr_end(addr, end);
 
                 if (IS_ALIGNED(addr, PGDIR_SIZE) && end - addr >= PGDIR_SIZE) {
+                        p4d_t *p4d;
                         pud_t *pud;
                         pmd_t *pmd;
 
@@ -135,9 +156,22 @@ void __init kasan_populate_zero_shadow(const void *shadow_start,
                          * 3,2 - level page tables where we don't have
                          * puds,pmds, so pgd_populate(), pud_populate()
                          * is noops.
+                         *
+                         * The ifndef is required to avoid build breakage.
+                         *
+                         * With 5level-fixup.h, pgd_populate() is not nop and
+                         * we reference kasan_zero_p4d. It's not defined
+                         * unless 5-level paging enabled.
+                         *
+                         * The ifndef can be dropped once all KASAN-enabled
+                         * architectures will switch to pgtable-nop4d.h.
                          */
-                        pgd_populate(&init_mm, pgd, lm_alias(kasan_zero_pud));
-                        pud = pud_offset(pgd, addr);
+#ifndef __ARCH_HAS_5LEVEL_HACK
+                        pgd_populate(&init_mm, pgd, lm_alias(kasan_zero_p4d));
+#endif
+                        p4d = p4d_offset(pgd, addr);
+                        p4d_populate(&init_mm, p4d, lm_alias(kasan_zero_pud));
+                        pud = pud_offset(p4d, addr);
                         pud_populate(&init_mm, pud, lm_alias(kasan_zero_pmd));
                         pmd = pmd_offset(pud, addr);
                         pmd_populate_kernel(&init_mm, pmd, lm_alias(kasan_zero_pte));
@@ -148,6 +182,6 @@ void __init kasan_populate_zero_shadow(const void *shadow_start,
                         pgd_populate(&init_mm, pgd,
                                 early_alloc(PAGE_SIZE, NUMA_NO_NODE));
                 }
-                zero_pud_populate(pgd, addr, next);
+                zero_p4d_populate(pgd, addr, next);
         } while (pgd++, addr = next, addr != end);
 }
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index 6f1ed1630873..3a8ddf8baf7d 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -25,6 +25,7 @@
 #include <linux/printk.h>
 #include <linux/shrinker.h>
 #include <linux/slab.h>
+#include <linux/srcu.h>
 #include <linux/string.h>
 #include <linux/types.h>
 
@@ -103,6 +104,7 @@ static int quarantine_tail;
 /* Total size of all objects in global_quarantine across all batches. */
 static unsigned long quarantine_size;
 static DEFINE_SPINLOCK(quarantine_lock);
+DEFINE_STATIC_SRCU(remove_cache_srcu);
 
 /* Maximum size of the global queue. */
 static unsigned long quarantine_max_size;
@@ -173,17 +175,22 @@ void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache)
         struct qlist_head *q;
         struct qlist_head temp = QLIST_INIT;
 
+        /*
+         * Note: irq must be disabled until after we move the batch to the
+         * global quarantine. Otherwise quarantine_remove_cache() can miss
+         * some objects belonging to the cache if they are in our local temp
+         * list. quarantine_remove_cache() executes on_each_cpu() at the
+         * beginning which ensures that it either sees the objects in per-cpu
+         * lists or in the global quarantine.
+         */
         local_irq_save(flags);
 
         q = this_cpu_ptr(&cpu_quarantine);
         qlist_put(q, &info->quarantine_link, cache->size);
-        if (unlikely(q->bytes > QUARANTINE_PERCPU_SIZE))
+        if (unlikely(q->bytes > QUARANTINE_PERCPU_SIZE)) {
                 qlist_move_all(q, &temp);
 
-        local_irq_restore(flags);
-
-        if (unlikely(!qlist_empty(&temp))) {
-                spin_lock_irqsave(&quarantine_lock, flags);
+                spin_lock(&quarantine_lock);
                 WRITE_ONCE(quarantine_size, quarantine_size + temp.bytes);
                 qlist_move_all(&temp, &global_quarantine[quarantine_tail]);
                 if (global_quarantine[quarantine_tail].bytes >=
@@ -196,20 +203,33 @@ void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache)
                         if (new_tail != quarantine_head)
                                 quarantine_tail = new_tail;
                 }
-                spin_unlock_irqrestore(&quarantine_lock, flags);
+                spin_unlock(&quarantine_lock);
         }
+
+        local_irq_restore(flags);
 }
 
 void quarantine_reduce(void)
 {
         size_t total_size, new_quarantine_size, percpu_quarantines;
         unsigned long flags;
+        int srcu_idx;
         struct qlist_head to_free = QLIST_INIT;
 
         if (likely(READ_ONCE(quarantine_size) <=
                    READ_ONCE(quarantine_max_size)))
                 return;
 
+        /*
+         * srcu critical section ensures that quarantine_remove_cache()
+         * will not miss objects belonging to the cache while they are in our
+         * local to_free list. srcu is chosen because (1) it gives us private
+         * grace period domain that does not interfere with anything else,
+         * and (2) it allows synchronize_srcu() to return without waiting
+         * if there are no pending read critical sections (which is the
+         * expected case).
+         */
+        srcu_idx = srcu_read_lock(&remove_cache_srcu);
         spin_lock_irqsave(&quarantine_lock, flags);
 
         /*
@@ -237,6 +257,7 @@ void quarantine_reduce(void)
         spin_unlock_irqrestore(&quarantine_lock, flags);
 
         qlist_free_all(&to_free, NULL);
+        srcu_read_unlock(&remove_cache_srcu, srcu_idx);
 }
 
 static void qlist_move_cache(struct qlist_head *from,
@@ -280,12 +301,28 @@ void quarantine_remove_cache(struct kmem_cache *cache)
         unsigned long flags, i;
         struct qlist_head to_free = QLIST_INIT;
 
+        /*
+         * Must be careful to not miss any objects that are being moved from
+         * per-cpu list to the global quarantine in quarantine_put(),
+         * nor objects being freed in quarantine_reduce(). on_each_cpu()
+         * achieves the first goal, while synchronize_srcu() achieves the
+         * second.
+         */
         on_each_cpu(per_cpu_remove_cache, cache, 1);
 
         spin_lock_irqsave(&quarantine_lock, flags);
-        for (i = 0; i < QUARANTINE_BATCHES; i++)
+        for (i = 0; i < QUARANTINE_BATCHES; i++) {
+                if (qlist_empty(&global_quarantine[i]))
+                        continue;
                 qlist_move_cache(&global_quarantine[i], &to_free, cache);
+                /* Scanning whole quarantine can take a while. */
+                spin_unlock_irqrestore(&quarantine_lock, flags);
+                cond_resched();
+                spin_lock_irqsave(&quarantine_lock, flags);
+        }
         spin_unlock_irqrestore(&quarantine_lock, flags);
 
         qlist_free_all(&to_free, cache);
+
+        synchronize_srcu(&remove_cache_srcu);
 }
diff --git a/mm/kasan/report.c b/mm/kasan/report.c
index f479365530b6..ab42a0803f16 100644
--- a/mm/kasan/report.c
+++ b/mm/kasan/report.c
@@ -13,7 +13,9 @@
  *
  */
 
+#include <linux/bitops.h>
 #include <linux/ftrace.h>
+#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/printk.h>
@@ -293,6 +295,40 @@ static void kasan_report_error(struct kasan_access_info *info)
         kasan_end_report(&flags);
 }
 
+static unsigned long kasan_flags;
+
+#define KASAN_BIT_REPORTED      0
+#define KASAN_BIT_MULTI_SHOT    1
+
+bool kasan_save_enable_multi_shot(void)
+{
+        return test_and_set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+}
+EXPORT_SYMBOL_GPL(kasan_save_enable_multi_shot);
+
+void kasan_restore_multi_shot(bool enabled)
+{
+        if (!enabled)
+                clear_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+}
+EXPORT_SYMBOL_GPL(kasan_restore_multi_shot);
+
+static int __init kasan_set_multi_shot(char *str)
+{
+        set_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags);
+        return 1;
+}
+__setup("kasan_multi_shot", kasan_set_multi_shot);
+
+static inline bool kasan_report_enabled(void)
+{
+        if (current->kasan_depth)
+                return false;
+        if (test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags))
+                return true;
+        return !test_and_set_bit(KASAN_BIT_REPORTED, &kasan_flags);
+}
+
 void kasan_report(unsigned long addr, size_t size,
                 bool is_write, unsigned long ip)
 {
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 26c874e90b12..20036d4f9f13 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1416,7 +1416,7 @@ static void kmemleak_scan(void)
         /* data/bss scanning */
         scan_large_block(_sdata, _edata);
         scan_large_block(__bss_start, __bss_stop);
-        scan_large_block(__start_data_ro_after_init, __end_data_ro_after_init);
+        scan_large_block(__start_ro_after_init, __end_ro_after_init);
 
 #ifdef CONFIG_SMP
         /* per-cpu sections scanning */
diff --git a/mm/madvise.c b/mm/madvise.c
index dc5927c812d3..7a2abf0127ae 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -513,7 +513,43 @@ static long madvise_dontneed(struct vm_area_struct *vma,
         if (!can_madv_dontneed_vma(vma))
                 return -EINVAL;
 
-        userfaultfd_remove(vma, prev, start, end);
+        if (!userfaultfd_remove(vma, start, end)) {
+                *prev = NULL; /* mmap_sem has been dropped, prev is stale */
+
+                down_read(&current->mm->mmap_sem);
+                vma = find_vma(current->mm, start);
+                if (!vma)
+                        return -ENOMEM;
+                if (start < vma->vm_start) {
+                        /*
+                         * This "vma" under revalidation is the one
+                         * with the lowest vma->vm_start where start
+                         * is also < vma->vm_end. If start <
+                         * vma->vm_start it means an hole materialized
+                         * in the user address space within the
+                         * virtual range passed to MADV_DONTNEED.
+                         */
+                        return -ENOMEM;
+                }
+                if (!can_madv_dontneed_vma(vma))
+                        return -EINVAL;
+                if (end > vma->vm_end) {
+                        /*
+                         * Don't fail if end > vma->vm_end. If the old
+                         * vma was splitted while the mmap_sem was
+                         * released the effect of the concurrent
+                         * operation may not cause MADV_DONTNEED to
+                         * have an undefined result. There may be an
+                         * adjacent next vma that we'll walk
+                         * next. userfaultfd_remove() will generate an
+                         * UFFD_EVENT_REMOVE repetition on the
+                         * end-vma->vm_end range, but the manager can
+                         * handle a repetition fine.
+                         */
+                        end = vma->vm_end;
+                }
+                VM_WARN_ON(start >= end);
+        }
         zap_page_range(vma, start, end - start);
         return 0;
 }
@@ -554,8 +590,10 @@ static long madvise_remove(struct vm_area_struct *vma,
          * mmap_sem.
          */
         get_file(f);
-        userfaultfd_remove(vma, prev, start, end);
-        up_read(&current->mm->mmap_sem);
+        if (userfaultfd_remove(vma, start, end)) {
+                /* mmap_sem was not released by userfaultfd_remove() */
+                up_read(&current->mm->mmap_sem);
+        }
         error = vfs_fallocate(f,
                                 FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
                                 offset, end - start);
diff --git a/mm/memblock.c b/mm/memblock.c
index b64b47803e52..696f06d17c4e 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -1118,7 +1118,10 @@ unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn,
                 }
         } while (left < right);
 
-        return min(PHYS_PFN(type->regions[right].base), max_pfn);
+        if (right == type->cnt)
+                return max_pfn;
+        else
+                return min(PHYS_PFN(type->regions[right].base), max_pfn);
 }
 
 /**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c52ec893e241..2bd7541d7c11 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -466,6 +466,8 @@ static void mem_cgroup_update_tree(struct mem_cgroup *memcg, struct page *page)
         struct mem_cgroup_tree_per_node *mctz;
 
         mctz = soft_limit_tree_from_page(page);
+        if (!mctz)
+                return;
         /*
          * Necessary to update all ancestors when hierarchy is used.
          * because their event counter is not touched.
@@ -503,7 +505,8 @@ static void mem_cgroup_remove_from_trees(struct mem_cgroup *memcg)
         for_each_node(nid) {
                 mz = mem_cgroup_nodeinfo(memcg, nid);
                 mctz = soft_limit_tree_node(nid);
-                mem_cgroup_remove_exceeded(mz, mctz);
+                if (mctz)
+                        mem_cgroup_remove_exceeded(mz, mctz);
         }
 }
 
@@ -2558,7 +2561,7 @@ unsigned long mem_cgroup_soft_limit_reclaim(pg_data_t *pgdat, int order,
          * is empty. Do it lockless to prevent lock bouncing. Races
          * are acceptable as soft limit is best effort anyway.
          */
-        if (RB_EMPTY_ROOT(&mctz->rb_root))
+        if (!mctz || RB_EMPTY_ROOT(&mctz->rb_root))
                 return 0;
 
         /*
@@ -4135,17 +4138,22 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node)
         kfree(memcg->nodeinfo[node]);
 }
 
-static void mem_cgroup_free(struct mem_cgroup *memcg)
+static void __mem_cgroup_free(struct mem_cgroup *memcg)
 {
         int node;
 
-        memcg_wb_domain_exit(memcg);
         for_each_node(node)
                 free_mem_cgroup_per_node_info(memcg, node);
         free_percpu(memcg->stat);
         kfree(memcg);
 }
 
+static void mem_cgroup_free(struct mem_cgroup *memcg)
+{
+        memcg_wb_domain_exit(memcg);
+        __mem_cgroup_free(memcg);
+}
+
 static struct mem_cgroup *mem_cgroup_alloc(void)
 {
         struct mem_cgroup *memcg;
@@ -4196,7 +4204,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 fail:
         if (memcg->id.id > 0)
                 idr_remove(&mem_cgroup_idr, memcg->id.id);
-        mem_cgroup_free(memcg);
+        __mem_cgroup_free(memcg);
         return NULL;
 }
 
diff --git a/mm/memory.c b/mm/memory.c
index a97a4cec2e1f..235ba51b2fbf 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -445,7 +445,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
         mm_dec_nr_pmds(tlb->mm);
 }
 
-static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
+static inline void free_pud_range(struct mmu_gather *tlb, p4d_t *p4d,
                                 unsigned long addr, unsigned long end,
                                 unsigned long floor, unsigned long ceiling)
 {
@@ -454,7 +454,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
         unsigned long start;
 
         start = addr;
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_none_or_clear_bad(pud))
@@ -462,6 +462,39 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
                 free_pmd_range(tlb, pud, addr, next, floor, ceiling);
         } while (pud++, addr = next, addr != end);
 
+        start &= P4D_MASK;
+        if (start < floor)
+                return;
+        if (ceiling) {
+                ceiling &= P4D_MASK;
+                if (!ceiling)
+                        return;
+        }
+        if (end - 1 > ceiling - 1)
+                return;
+
+        pud = pud_offset(p4d, start);
+        p4d_clear(p4d);
+        pud_free_tlb(tlb, pud, start);
+}
+
+static inline void free_p4d_range(struct mmu_gather *tlb, pgd_t *pgd,
+                                unsigned long addr, unsigned long end,
+                                unsigned long floor, unsigned long ceiling)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        unsigned long start;
+
+        start = addr;
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                free_pud_range(tlb, p4d, addr, next, floor, ceiling);
+        } while (p4d++, addr = next, addr != end);
+
         start &= PGDIR_MASK;
         if (start < floor)
                 return;
@@ -473,9 +506,9 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
         if (end - 1 > ceiling - 1)
                 return;
 
-        pud = pud_offset(pgd, start);
+        p4d = p4d_offset(pgd, start);
         pgd_clear(pgd);
-        pud_free_tlb(tlb, pud, start);
+        p4d_free_tlb(tlb, p4d, start);
 }
 
 /*
@@ -539,7 +572,7 @@ void free_pgd_range(struct mmu_gather *tlb,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                free_pud_range(tlb, pgd, addr, next, floor, ceiling);
+                free_p4d_range(tlb, pgd, addr, next, floor, ceiling);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -658,7 +691,8 @@ static void print_bad_pte(struct vm_area_struct *vma, unsigned long addr,
                           pte_t pte, struct page *page)
 {
         pgd_t *pgd = pgd_offset(vma->vm_mm, addr);
-        pud_t *pud = pud_offset(pgd, addr);
+        p4d_t *p4d = p4d_offset(pgd, addr);
+        pud_t *pud = pud_offset(p4d, addr);
         pmd_t *pmd = pmd_offset(pud, addr);
         struct address_space *mapping;
         pgoff_t index;
@@ -1023,16 +1057,16 @@ static inline int copy_pmd_range(struct mm_struct *dst_mm, struct mm_struct *src
 }
 
 static inline int copy_pud_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
-                pgd_t *dst_pgd, pgd_t *src_pgd, struct vm_area_struct *vma,
+                p4d_t *dst_p4d, p4d_t *src_p4d, struct vm_area_struct *vma,
                 unsigned long addr, unsigned long end)
 {
         pud_t *src_pud, *dst_pud;
         unsigned long next;
 
-        dst_pud = pud_alloc(dst_mm, dst_pgd, addr);
+        dst_pud = pud_alloc(dst_mm, dst_p4d, addr);
         if (!dst_pud)
                 return -ENOMEM;
-        src_pud = pud_offset(src_pgd, addr);
+        src_pud = pud_offset(src_p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_trans_huge(*src_pud) || pud_devmap(*src_pud)) {
@@ -1056,6 +1090,28 @@ static inline int copy_pud_range(struct mm_struct *dst_mm, struct mm_struct *src
         return 0;
 }
 
+static inline int copy_p4d_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+                pgd_t *dst_pgd, pgd_t *src_pgd, struct vm_area_struct *vma,
+                unsigned long addr, unsigned long end)
+{
+        p4d_t *src_p4d, *dst_p4d;
+        unsigned long next;
+
+        dst_p4d = p4d_alloc(dst_mm, dst_pgd, addr);
+        if (!dst_p4d)
+                return -ENOMEM;
+        src_p4d = p4d_offset(src_pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(src_p4d))
+                        continue;
+                if (copy_pud_range(dst_mm, src_mm, dst_p4d, src_p4d,
+                                                vma, addr, next))
+                        return -ENOMEM;
+        } while (dst_p4d++, src_p4d++, addr = next, addr != end);
+        return 0;
+}
+
 int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 struct vm_area_struct *vma)
 {
@@ -1111,7 +1167,7 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(src_pgd))
                         continue;
-                if (unlikely(copy_pud_range(dst_mm, src_mm, dst_pgd, src_pgd,
+                if (unlikely(copy_p4d_range(dst_mm, src_mm, dst_pgd, src_pgd,
                                             vma, addr, next))) {
                         ret = -ENOMEM;
                         break;
@@ -1267,14 +1323,14 @@ next:
 }
 
 static inline unsigned long zap_pud_range(struct mmu_gather *tlb,
-                                struct vm_area_struct *vma, pgd_t *pgd,
+                                struct vm_area_struct *vma, p4d_t *p4d,
                                 unsigned long addr, unsigned long end,
                                 struct zap_details *details)
 {
         pud_t *pud;
         unsigned long next;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_trans_huge(*pud) || pud_devmap(*pud)) {
@@ -1295,6 +1351,25 @@ next:
         return addr;
 }
 
+static inline unsigned long zap_p4d_range(struct mmu_gather *tlb,
+                                struct vm_area_struct *vma, pgd_t *pgd,
+                                unsigned long addr, unsigned long end,
+                                struct zap_details *details)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                next = zap_pud_range(tlb, vma, p4d, addr, next, details);
+        } while (p4d++, addr = next, addr != end);
+
+        return addr;
+}
+
 void unmap_page_range(struct mmu_gather *tlb,
                              struct vm_area_struct *vma,
                              unsigned long addr, unsigned long end,
@@ -1310,7 +1385,7 @@ void unmap_page_range(struct mmu_gather *tlb,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                next = zap_pud_range(tlb, vma, pgd, addr, next, details);
+                next = zap_p4d_range(tlb, vma, pgd, addr, next, details);
         } while (pgd++, addr = next, addr != end);
         tlb_end_vma(tlb, vma);
 }
@@ -1465,16 +1540,24 @@ EXPORT_SYMBOL_GPL(zap_vma_ptes);
 pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
                         spinlock_t **ptl)
 {
-        pgd_t *pgd = pgd_offset(mm, addr);
-        pud_t *pud = pud_alloc(mm, pgd, addr);
-        if (pud) {
-                pmd_t *pmd = pmd_alloc(mm, pud, addr);
-                if (pmd) {
-                        VM_BUG_ON(pmd_trans_huge(*pmd));
-                        return pte_alloc_map_lock(mm, pmd, addr, ptl);
-                }
-        }
-        return NULL;
+        pgd_t *pgd;
+        p4d_t *p4d;
+        pud_t *pud;
+        pmd_t *pmd;
+
+        pgd = pgd_offset(mm, addr);
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return NULL;
+        pud = pud_alloc(mm, p4d, addr);
+        if (!pud)
+                return NULL;
+        pmd = pmd_alloc(mm, pud, addr);
+        if (!pmd)
+                return NULL;
+
+        VM_BUG_ON(pmd_trans_huge(*pmd));
+        return pte_alloc_map_lock(mm, pmd, addr, ptl);
 }
 
 /*
@@ -1740,7 +1823,7 @@ static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud,
         return 0;
 }
 
-static inline int remap_pud_range(struct mm_struct *mm, pgd_t *pgd,
+static inline int remap_pud_range(struct mm_struct *mm, p4d_t *p4d,
                         unsigned long addr, unsigned long end,
                         unsigned long pfn, pgprot_t prot)
 {
@@ -1748,7 +1831,7 @@ static inline int remap_pud_range(struct mm_struct *mm, pgd_t *pgd,
         unsigned long next;
 
         pfn -= addr >> PAGE_SHIFT;
-        pud = pud_alloc(mm, pgd, addr);
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -1760,6 +1843,26 @@ static inline int remap_pud_range(struct mm_struct *mm, pgd_t *pgd,
         return 0;
 }
 
+static inline int remap_p4d_range(struct mm_struct *mm, pgd_t *pgd,
+                        unsigned long addr, unsigned long end,
+                        unsigned long pfn, pgprot_t prot)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        pfn -= addr >> PAGE_SHIFT;
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+                if (remap_pud_range(mm, p4d, addr, next,
+                                pfn + (addr >> PAGE_SHIFT), prot))
+                        return -ENOMEM;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 /**
  * remap_pfn_range - remap kernel memory to userspace
  * @vma: user vma to map to
@@ -1816,7 +1919,7 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
         flush_cache_range(vma, addr, end);
         do {
                 next = pgd_addr_end(addr, end);
-                err = remap_pud_range(mm, pgd, addr, next,
+                err = remap_p4d_range(mm, pgd, addr, next,
                                 pfn + (addr >> PAGE_SHIFT), prot);
                 if (err)
                         break;
@@ -1932,7 +2035,7 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
         return err;
 }
 
-static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+static int apply_to_pud_range(struct mm_struct *mm, p4d_t *p4d,
                                      unsigned long addr, unsigned long end,
                                      pte_fn_t fn, void *data)
 {
@@ -1940,7 +2043,7 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
         unsigned long next;
         int err;
 
-        pud = pud_alloc(mm, pgd, addr);
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -1952,6 +2055,26 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
         return err;
 }
 
+static int apply_to_p4d_range(struct mm_struct *mm, pgd_t *pgd,
+                                     unsigned long addr, unsigned long end,
+                                     pte_fn_t fn, void *data)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        int err;
+
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+                err = apply_to_pud_range(mm, p4d, addr, next, fn, data);
+                if (err)
+                        break;
+        } while (p4d++, addr = next, addr != end);
+        return err;
+}
+
 /*
  * Scan a region of virtual memory, filling in page tables as necessary
  * and calling a provided function on each leaf page table.
@@ -1970,7 +2093,7 @@ int apply_to_page_range(struct mm_struct *mm, unsigned long addr,
         pgd = pgd_offset(mm, addr);
         do {
                 next = pgd_addr_end(addr, end);
-                err = apply_to_pud_range(mm, pgd, addr, next, fn, data);
+                err = apply_to_p4d_range(mm, pgd, addr, next, fn, data);
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
@@ -3653,11 +3776,15 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
         };
         struct mm_struct *mm = vma->vm_mm;
         pgd_t *pgd;
+        p4d_t *p4d;
         int ret;
 
         pgd = pgd_offset(mm, address);
+        p4d = p4d_alloc(mm, pgd, address);
+        if (!p4d)
+                return VM_FAULT_OOM;
 
-        vmf.pud = pud_alloc(mm, pgd, address);
+        vmf.pud = pud_alloc(mm, p4d, address);
         if (!vmf.pud)
                 return VM_FAULT_OOM;
         if (pud_none(*vmf.pud) && transparent_hugepage_enabled(vma)) {
@@ -3779,12 +3906,35 @@ int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 }
 EXPORT_SYMBOL_GPL(handle_mm_fault);
 
+#ifndef __PAGETABLE_P4D_FOLDED
+/*
+ * Allocate p4d page table.
+ * We've already handled the fast-path in-line.
+ */
+int __p4d_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+{
+        p4d_t *new = p4d_alloc_one(mm, address);
+        if (!new)
+                return -ENOMEM;
+
+        smp_wmb(); /* See comment in __pte_alloc */
+
+        spin_lock(&mm->page_table_lock);
+        if (pgd_present(*pgd))          /* Another has populated it */
+                p4d_free(mm, new);
+        else
+                pgd_populate(mm, pgd, new);
+        spin_unlock(&mm->page_table_lock);
+        return 0;
+}
+#endif /* __PAGETABLE_P4D_FOLDED */
+
 #ifndef __PAGETABLE_PUD_FOLDED
 /*
  * Allocate page upper directory.
  * We've already handled the fast-path in-line.
  */
-int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+int __pud_alloc(struct mm_struct *mm, p4d_t *p4d, unsigned long address)
 {
         pud_t *new = pud_alloc_one(mm, address);
         if (!new)
@@ -3793,10 +3943,17 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
         smp_wmb(); /* See comment in __pte_alloc */
 
         spin_lock(&mm->page_table_lock);
-        if (pgd_present(*pgd))          /* Another has populated it */
+#ifndef __ARCH_HAS_5LEVEL_HACK
+        if (p4d_present(*p4d))          /* Another has populated it */
                 pud_free(mm, new);
         else
-                pgd_populate(mm, pgd, new);
+                p4d_populate(mm, p4d, new);
+#else
+        if (pgd_present(*p4d))          /* Another has populated it */
+                pud_free(mm, new);
+        else
+                pgd_populate(mm, p4d, new);
+#endif /* __ARCH_HAS_5LEVEL_HACK */
         spin_unlock(&mm->page_table_lock);
         return 0;
 }
@@ -3839,6 +3996,7 @@ static int __follow_pte_pmd(struct mm_struct *mm, unsigned long address,
                 pte_t **ptepp, pmd_t **pmdpp, spinlock_t **ptlp)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *ptep;
@@ -3847,7 +4005,11 @@ static int __follow_pte_pmd(struct mm_struct *mm, unsigned long address,
         if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
                 goto out;
 
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (p4d_none(*p4d) || unlikely(p4d_bad(*p4d)))
+                goto out;
+
+        pud = pud_offset(p4d, address);
         if (pud_none(*pud) || unlikely(pud_bad(*pud)))
                 goto out;
 
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 295479b792ec..6fa7208bcd56 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -125,9 +125,12 @@ void put_online_mems(void)
 
 }
 
+/* Serializes write accesses to mem_hotplug.active_writer. */
+static DEFINE_MUTEX(memory_add_remove_lock);
+
 void mem_hotplug_begin(void)
 {
-        assert_held_device_hotplug();
+        mutex_lock(&memory_add_remove_lock);
 
         mem_hotplug.active_writer = current;
 
@@ -147,6 +150,7 @@ void mem_hotplug_done(void)
         mem_hotplug.active_writer = NULL;
         mutex_unlock(&mem_hotplug.lock);
         memhp_lock_release();
+        mutex_unlock(&memory_add_remove_lock);
 }
 
 /* add this memory to iomem resource */
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 75b2745bac41..37d0b334bfe9 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1529,7 +1529,6 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
 COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
                        compat_ulong_t, maxnode)
 {
-        long err = 0;
         unsigned long __user *nm = NULL;
         unsigned long nr_bits, alloc_size;
         DECLARE_BITMAP(bm, MAX_NUMNODES);
@@ -1538,14 +1537,13 @@ COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask,
         alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
         if (nmask) {
-                err = compat_get_bitmap(bm, nmask, nr_bits);
+                if (compat_get_bitmap(bm, nmask, nr_bits))
+                        return -EFAULT;
                 nm = compat_alloc_user_space(alloc_size);
-                err |= copy_to_user(nm, bm, alloc_size);
+                if (copy_to_user(nm, bm, alloc_size))
+                        return -EFAULT;
         }
 
-        if (err)
-                return -EFAULT;
-
         return sys_set_mempolicy(mode, nm, nr_bits+1);
 }
 
@@ -1553,7 +1551,6 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
                        compat_ulong_t, mode, compat_ulong_t __user *, nmask,
                        compat_ulong_t, maxnode, compat_ulong_t, flags)
 {
-        long err = 0;
         unsigned long __user *nm = NULL;
         unsigned long nr_bits, alloc_size;
         nodemask_t bm;
@@ -1562,14 +1559,13 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
         alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
 
         if (nmask) {
-                err = compat_get_bitmap(nodes_addr(bm), nmask, nr_bits);
+                if (compat_get_bitmap(nodes_addr(bm), nmask, nr_bits))
+                        return -EFAULT;
                 nm = compat_alloc_user_space(alloc_size);
-                err |= copy_to_user(nm, nodes_addr(bm), alloc_size);
+                if (copy_to_user(nm, nodes_addr(bm), alloc_size))
+                        return -EFAULT;
         }
 
-        if (err)
-                return -EFAULT;
-
         return sys_mbind(start, len, mode, nm, nr_bits+1, flags);
 }
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 9a0897a14d37..738f1d5f8350 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -184,9 +184,9 @@ void putback_movable_pages(struct list_head *l)
                         unlock_page(page);
                         put_page(page);
                 } else {
-                        putback_lru_page(page);
                         dec_node_page_state(page, NR_ISOLATED_ANON +
                                         page_is_file_cache(page));
+                        putback_lru_page(page);
                 }
         }
 }
@@ -209,8 +209,11 @@ static int remove_migration_pte(struct page *page, struct vm_area_struct *vma,
 
         VM_BUG_ON_PAGE(PageTail(page), page);
         while (page_vma_mapped_walk(&pvmw)) {
-                new = page - pvmw.page->index +
-                        linear_page_index(vma, pvmw.address);
+                if (PageKsm(page))
+                        new = page;
+                else
+                        new = page - pvmw.page->index +
+                                linear_page_index(vma, pvmw.address);
 
                 get_page(new);
                 pte = pte_mkold(mk_pte(new, READ_ONCE(vma->vm_page_prot)));
diff --git a/mm/mlock.c b/mm/mlock.c
index 1050511f8b2b..0dd9ca18e19e 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -380,6 +380,7 @@ static unsigned long __munlock_pagevec_fill(struct pagevec *pvec,
         pte = get_locked_pte(vma->vm_mm, start, &ptl);
         /* Make sure we do not cross the page table boundary */
         end = pgd_addr_end(start, end);
+        end = p4d_addr_end(start, end);
         end = pud_addr_end(start, end);
         end = pmd_addr_end(start, end);
 
@@ -442,7 +443,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
 
         while (start < end) {
                 struct page *page;
-                unsigned int page_mask;
+                unsigned int page_mask = 0;
                 unsigned long page_increm;
                 struct pagevec pvec;
                 struct zone *zone;
@@ -456,8 +457,7 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
                  * suits munlock very well (and if somehow an abnormal page
                  * has sneaked into the range, we won't oops here: great).
                  */
-                page = follow_page_mask(vma, start, FOLL_GET | FOLL_DUMP,
-                                &page_mask);
+                page = follow_page(vma, start, FOLL_GET | FOLL_DUMP);
 
                 if (page && !IS_ERR(page)) {
                         if (PageTransTail(page)) {
@@ -468,8 +468,8 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
                                 /*
                                  * Any THP page found by follow_page_mask() may
                                  * have gotten split before reaching
-                                 * munlock_vma_page(), so we need to recompute
-                                 * the page_mask here.
+                                 * munlock_vma_page(), so we need to compute
+                                 * the page_mask here instead.
                                  */
                                 page_mask = munlock_vma_page(page);
                                 unlock_page(page);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 848e946b08e5..8edd0d576254 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -193,14 +193,14 @@ static inline unsigned long change_pmd_range(struct vm_area_struct *vma,
 }
 
 static inline unsigned long change_pud_range(struct vm_area_struct *vma,
-                pgd_t *pgd, unsigned long addr, unsigned long end,
+                p4d_t *p4d, unsigned long addr, unsigned long end,
                 pgprot_t newprot, int dirty_accountable, int prot_numa)
 {
         pud_t *pud;
         unsigned long next;
         unsigned long pages = 0;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_none_or_clear_bad(pud))
@@ -212,6 +212,26 @@ static inline unsigned long change_pud_range(struct vm_area_struct *vma,
         return pages;
 }
 
+static inline unsigned long change_p4d_range(struct vm_area_struct *vma,
+                pgd_t *pgd, unsigned long addr, unsigned long end,
+                pgprot_t newprot, int dirty_accountable, int prot_numa)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        unsigned long pages = 0;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                pages += change_pud_range(vma, p4d, addr, next, newprot,
+                                 dirty_accountable, prot_numa);
+        } while (p4d++, addr = next, addr != end);
+
+        return pages;
+}
+
 static unsigned long change_protection_range(struct vm_area_struct *vma,
                 unsigned long addr, unsigned long end, pgprot_t newprot,
                 int dirty_accountable, int prot_numa)
@@ -230,7 +250,7 @@ static unsigned long change_protection_range(struct vm_area_struct *vma,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                pages += change_pud_range(vma, pgd, addr, next, newprot,
+                pages += change_p4d_range(vma, pgd, addr, next, newprot,
                                  dirty_accountable, prot_numa);
         } while (pgd++, addr = next, addr != end);
 
diff --git a/mm/mremap.c b/mm/mremap.c
index 8233b0105c82..cd8a1b199ef9 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -32,6 +32,7 @@
 static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
 
@@ -39,7 +40,11 @@ static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
         if (pgd_none_or_clear_bad(pgd))
                 return NULL;
 
-        pud = pud_offset(pgd, addr);
+        p4d = p4d_offset(pgd, addr);
+        if (p4d_none_or_clear_bad(p4d))
+                return NULL;
+
+        pud = pud_offset(p4d, addr);
         if (pud_none_or_clear_bad(pud))
                 return NULL;
 
@@ -54,11 +59,15 @@ static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
                             unsigned long addr)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
 
         pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return NULL;
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return NULL;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index eaa64d2ffdc5..07efbc3a8656 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -873,7 +873,8 @@ done_merging:
                 higher_page = page + (combined_pfn - pfn);
                 buddy_pfn = __find_buddy_pfn(combined_pfn, order + 1);
                 higher_buddy = higher_page + (buddy_pfn - combined_pfn);
-                if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
+                if (pfn_valid_within(buddy_pfn) &&
+                    page_is_buddy(higher_page, higher_buddy, order + 1)) {
                         list_add_tail(&page->lru,
                                 &zone->free_area[order].free_list[migratetype]);
                         goto out;
@@ -1089,10 +1090,10 @@ static void free_pcppages_bulk(struct zone *zone, int count,
 {
         int migratetype = 0;
         int batch_free = 0;
-        unsigned long nr_scanned, flags;
+        unsigned long nr_scanned;
         bool isolated_pageblocks;
 
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
         isolated_pageblocks = has_isolate_pageblock(zone);
         nr_scanned = node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED);
         if (nr_scanned)
@@ -1141,7 +1142,7 @@ static void free_pcppages_bulk(struct zone *zone, int count,
                         trace_mm_page_pcpu_drain(page, 0, mt);
                 } while (--count && --batch_free && !list_empty(list));
         }
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
 }
 
 static void free_one_page(struct zone *zone,
@@ -1149,9 +1150,8 @@ static void free_one_page(struct zone *zone,
                                 unsigned int order,
                                 int migratetype)
 {
-        unsigned long nr_scanned, flags;
-        spin_lock_irqsave(&zone->lock, flags);
-        __count_vm_events(PGFREE, 1 << order);
+        unsigned long nr_scanned;
+        spin_lock(&zone->lock);
         nr_scanned = node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED);
         if (nr_scanned)
                 __mod_node_page_state(zone->zone_pgdat, NR_PAGES_SCANNED, -nr_scanned);
@@ -1161,7 +1161,7 @@ static void free_one_page(struct zone *zone,
                 migratetype = get_pfnblock_migratetype(page, pfn);
         }
         __free_one_page(page, pfn, zone, order, migratetype);
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
 }
 
 static void __meminit __init_single_page(struct page *page, unsigned long pfn,
@@ -1239,6 +1239,7 @@ void __meminit reserve_bootmem_region(phys_addr_t start, phys_addr_t end)
 
 static void __free_pages_ok(struct page *page, unsigned int order)
 {
+        unsigned long flags;
         int migratetype;
         unsigned long pfn = page_to_pfn(page);
 
@@ -1246,7 +1247,10 @@ static void __free_pages_ok(struct page *page, unsigned int order)
                 return;
 
         migratetype = get_pfnblock_migratetype(page, pfn);
+        local_irq_save(flags);
+        __count_vm_events(PGFREE, 1 << order);
         free_one_page(page_zone(page), page, pfn, order, migratetype);
+        local_irq_restore(flags);
 }
 
 static void __init __free_pages_boot_core(struct page *page, unsigned int order)
@@ -2218,9 +2222,8 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
                         int migratetype, bool cold)
 {
         int i, alloced = 0;
-        unsigned long flags;
 
-        spin_lock_irqsave(&zone->lock, flags);
+        spin_lock(&zone->lock);
         for (i = 0; i < count; ++i) {
                 struct page *page = __rmqueue(zone, order, migratetype);
                 if (unlikely(page == NULL))
@@ -2256,7 +2259,7 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
          * pages added to the pcp list.
          */
         __mod_zone_page_state(zone, NR_FREE_PAGES, -(i << order));
-        spin_unlock_irqrestore(&zone->lock, flags);
+        spin_unlock(&zone->lock);
         return alloced;
 }
 
@@ -2372,6 +2375,13 @@ void drain_all_pages(struct zone *zone)
          */
         static cpumask_t cpus_with_pcps;
 
+        /*
+         * Make sure nobody triggers this path before mm_percpu_wq is fully
+         * initialized.
+         */
+        if (WARN_ON_ONCE(!mm_percpu_wq))
+                return;
+
         /* Workqueues cannot recurse */
         if (current->flags & PF_WQ_WORKER)
                 return;
@@ -2421,7 +2431,7 @@ void drain_all_pages(struct zone *zone)
         for_each_cpu(cpu, &cpus_with_pcps) {
                 struct work_struct *work = per_cpu_ptr(&pcpu_drain, cpu);
                 INIT_WORK(work, drain_local_pages_wq);
-                schedule_work_on(cpu, work);
+                queue_work_on(cpu, mm_percpu_wq, work);
         }
         for_each_cpu(cpu, &cpus_with_pcps)
                 flush_work(per_cpu_ptr(&pcpu_drain, cpu));
@@ -2477,20 +2487,17 @@ void free_hot_cold_page(struct page *page, bool cold)
 {
         struct zone *zone = page_zone(page);
         struct per_cpu_pages *pcp;
+        unsigned long flags;
         unsigned long pfn = page_to_pfn(page);
         int migratetype;
 
-        if (in_interrupt()) {
-                __free_pages_ok(page, 0);
-                return;
-        }
-
         if (!free_pcp_prepare(page))
                 return;
 
         migratetype = get_pfnblock_migratetype(page, pfn);
         set_pcppage_migratetype(page, migratetype);
-        preempt_disable();
+        local_irq_save(flags);
+        __count_vm_event(PGFREE);
 
         /*
          * We only track unmovable, reclaimable and movable on pcp lists.
@@ -2507,7 +2514,6 @@ void free_hot_cold_page(struct page *page, bool cold)
                 migratetype = MIGRATE_MOVABLE;
         }
 
-        __count_vm_event(PGFREE);
         pcp = &this_cpu_ptr(zone->pageset)->pcp;
         if (!cold)
                 list_add(&page->lru, &pcp->lists[migratetype]);
@@ -2521,7 +2527,7 @@ void free_hot_cold_page(struct page *page, bool cold)
         }
 
 out:
-        preempt_enable();
+        local_irq_restore(flags);
 }
 
 /*
@@ -2646,8 +2652,6 @@ static struct page *__rmqueue_pcplist(struct zone *zone, int migratetype,
 {
         struct page *page;
 
-        VM_BUG_ON(in_interrupt());
-
         do {
                 if (list_empty(list)) {
                         pcp->count += rmqueue_bulk(zone, 0,
@@ -2678,8 +2682,9 @@ static struct page *rmqueue_pcplist(struct zone *preferred_zone,
         struct list_head *list;
         bool cold = ((gfp_flags & __GFP_COLD) != 0);
         struct page *page;
+        unsigned long flags;
 
-        preempt_disable();
+        local_irq_save(flags);
         pcp = &this_cpu_ptr(zone->pageset)->pcp;
         list = &pcp->lists[migratetype];
         page = __rmqueue_pcplist(zone,  migratetype, cold, pcp, list);
@@ -2687,7 +2692,7 @@ static struct page *rmqueue_pcplist(struct zone *preferred_zone,
                 __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order);
                 zone_statistics(preferred_zone, zone);
         }
-        preempt_enable();
+        local_irq_restore(flags);
         return page;
 }
 
@@ -2703,7 +2708,7 @@ struct page *rmqueue(struct zone *preferred_zone,
         unsigned long flags;
         struct page *page;
 
-        if (likely(order == 0) && !in_interrupt()) {
+        if (likely(order == 0)) {
                 page = rmqueue_pcplist(preferred_zone, zone, order,
                                 gfp_flags, migratetype);
                 goto out;
@@ -4518,13 +4523,13 @@ void show_free_areas(unsigned int filter, nodemask_t *nodemask)
                         K(node_page_state(pgdat, NR_FILE_MAPPED)),
                         K(node_page_state(pgdat, NR_FILE_DIRTY)),
                         K(node_page_state(pgdat, NR_WRITEBACK)),
+                        K(node_page_state(pgdat, NR_SHMEM)),
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
                         K(node_page_state(pgdat, NR_SHMEM_THPS) * HPAGE_PMD_NR),
                         K(node_page_state(pgdat, NR_SHMEM_PMDMAPPED)
                                         * HPAGE_PMD_NR),
                         K(node_page_state(pgdat, NR_ANON_THPS) * HPAGE_PMD_NR),
 #endif
-                        K(node_page_state(pgdat, NR_SHMEM)),
                         K(node_page_state(pgdat, NR_WRITEBACK_TEMP)),
                         K(node_page_state(pgdat, NR_UNSTABLE_NFS)),
                         node_page_state(pgdat, NR_PAGES_SCANNED),
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index a23001a22c15..de9c40d7304a 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -104,18 +104,15 @@ bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
         struct mm_struct *mm = pvmw->vma->vm_mm;
         struct page *page = pvmw->page;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
 
         /* The only possible pmd mapping has been handled on last iteration */
         if (pvmw->pmd && !pvmw->pte)
                 return not_found(pvmw);
 
-        /* Only for THP, seek to next pte entry makes sense */
-        if (pvmw->pte) {
-                if (!PageTransHuge(pvmw->page) || PageHuge(pvmw->page))
-                        return not_found(pvmw);
+        if (pvmw->pte)
                 goto next_pte;
-        }
 
         if (unlikely(PageHuge(pvmw->page))) {
                 /* when pud is not present, pte will be NULL */
@@ -133,7 +130,10 @@ restart:
         pgd = pgd_offset(mm, pvmw->address);
         if (!pgd_present(*pgd))
                 return false;
-        pud = pud_offset(pgd, pvmw->address);
+        p4d = p4d_offset(pgd, pvmw->address);
+        if (!p4d_present(*p4d))
+                return false;
+        pud = pud_offset(p4d, pvmw->address);
         if (!pud_present(*pud))
                 return false;
         pvmw->pmd = pmd_offset(pud, pvmw->address);
@@ -161,9 +161,14 @@ restart:
         while (1) {
                 if (check_pte(pvmw))
                         return true;
-next_pte:       do {
+next_pte:
+                /* Seek to next pte only makes sense for THP */
+                if (!PageTransHuge(pvmw->page) || PageHuge(pvmw->page))
+                        return not_found(pvmw);
+                do {
                         pvmw->address += PAGE_SIZE;
-                        if (pvmw->address >=
+                        if (pvmw->address >= pvmw->vma->vm_end ||
+                            pvmw->address >=
                                         __vma_address(pvmw->page, pvmw->vma) +
                                         hpage_nr_pages(pvmw->page) * PAGE_SIZE)
                                 return not_found(pvmw);
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 03761577ae86..60f7856e508f 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -69,14 +69,14 @@ again:
         return err;
 }
 
-static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
+static int walk_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end,
                           struct mm_walk *walk)
 {
         pud_t *pud;
         unsigned long next;
         int err = 0;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
  again:
                 next = pud_addr_end(addr, end);
@@ -113,6 +113,32 @@ static int walk_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end,
         return err;
 }
 
+static int walk_p4d_range(pgd_t *pgd, unsigned long addr, unsigned long end,
+                          struct mm_walk *walk)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        int err = 0;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d)) {
+                        if (walk->pte_hole)
+                                err = walk->pte_hole(addr, next, walk);
+                        if (err)
+                                break;
+                        continue;
+                }
+                if (walk->pmd_entry || walk->pte_entry)
+                        err = walk_pud_range(p4d, addr, next, walk);
+                if (err)
+                        break;
+        } while (p4d++, addr = next, addr != end);
+
+        return err;
+}
+
 static int walk_pgd_range(unsigned long addr, unsigned long end,
                           struct mm_walk *walk)
 {
@@ -131,7 +157,7 @@ static int walk_pgd_range(unsigned long addr, unsigned long end,
                         continue;
                 }
                 if (walk->pmd_entry || walk->pte_entry)
-                        err = walk_pud_range(pgd, addr, next, walk);
+                        err = walk_p4d_range(pgd, addr, next, walk);
                 if (err)
                         break;
         } while (pgd++, addr = next, addr != end);
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 538998a137d2..9ac639499bd1 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -21,7 +21,6 @@ static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
 
 /**
  * pcpu_get_pages - get temp pages array
- * @chunk: chunk of interest
  *
  * Returns pointer to array of pointers to struct page which can be indexed
  * with pcpu_page_idx().  Note that there is only one array and accesses
@@ -30,7 +29,7 @@ static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
  * RETURNS:
  * Pointer to temp pages array on success.
  */
-static struct page **pcpu_get_pages(struct pcpu_chunk *chunk_alloc)
+static struct page **pcpu_get_pages(void)
 {
         static struct page **pages;
         size_t pages_size = pcpu_nr_units * pcpu_unit_pages * sizeof(pages[0]);
@@ -275,7 +274,7 @@ static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
 {
         struct page **pages;
 
-        pages = pcpu_get_pages(chunk);
+        pages = pcpu_get_pages();
         if (!pages)
                 return -ENOMEM;
 
@@ -313,7 +312,7 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
          * successful population attempt so the temp pages array must
          * be available now.
          */
-        pages = pcpu_get_pages(chunk);
+        pages = pcpu_get_pages();
         BUG_ON(!pages);
 
         /* unmap and free */
diff --git a/mm/percpu.c b/mm/percpu.c
index 5696039b5c07..60a6488e9e6d 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1011,8 +1011,11 @@ area_found:
                 mutex_unlock(&pcpu_alloc_mutex);
         }
 
-        if (chunk != pcpu_reserved_chunk)
+        if (chunk != pcpu_reserved_chunk) {
+                spin_lock_irqsave(&pcpu_lock, flags);
                 pcpu_nr_empty_pop_pages -= occ_pages;
+                spin_unlock_irqrestore(&pcpu_lock, flags);
+        }
 
         if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
                 pcpu_schedule_balance_work();
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index 4ed5908c65b0..c99d9512a45b 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -22,6 +22,12 @@ void pgd_clear_bad(pgd_t *pgd)
         pgd_clear(pgd);
 }
 
+void p4d_clear_bad(p4d_t *p4d)
+{
+        p4d_ERROR(*p4d);
+        p4d_clear(p4d);
+}
+
 void pud_clear_bad(pud_t *pud)
 {
         pud_ERROR(*pud);
diff --git a/mm/rmap.c b/mm/rmap.c
index 2da487d6cea8..f6838015810f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -684,6 +684,7 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd = NULL;
         pmd_t pmde;
@@ -692,7 +693,11 @@ pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address)
         if (!pgd_present(*pgd))
                 goto out;
 
-        pud = pud_offset(pgd, address);
+        p4d = p4d_offset(pgd, address);
+        if (!p4d_present(*p4d))
+                goto out;
+
+        pud = pud_offset(p4d, address);
         if (!pud_present(*pud))
                 goto out;
 
@@ -1154,7 +1159,7 @@ void page_add_file_rmap(struct page *page, bool compound)
                         goto out;
         }
         __mod_node_page_state(page_pgdat(page), NR_FILE_MAPPED, nr);
-        mem_cgroup_inc_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_update_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED, nr);
 out:
         unlock_page_memcg(page);
 }
@@ -1194,7 +1199,7 @@ static void page_remove_file_rmap(struct page *page, bool compound)
          * pte lock(a spinlock) is held, which implies preemption disabled.
          */
         __mod_node_page_state(page_pgdat(page), NR_FILE_MAPPED, -nr);
-        mem_cgroup_dec_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED);
+        mem_cgroup_update_page_stat(page, MEM_CGROUP_STAT_FILE_MAPPED, -nr);
 
         if (unlikely(PageMlocked(page)))
                 clear_page_mlock(page);
@@ -1316,12 +1321,6 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
         }
 
         while (page_vma_mapped_walk(&pvmw)) {
-                subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
-                address = pvmw.address;
-
-                /* Unexpected PMD-mapped THP? */
-                VM_BUG_ON_PAGE(!pvmw.pte, page);
-
                 /*
                  * If the page is mlock()d, we cannot swap it out.
                  * If it's recently referenced (perhaps page_referenced
@@ -1345,6 +1344,13 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                                 continue;
                 }
 
+                /* Unexpected PMD-mapped THP? */
+                VM_BUG_ON_PAGE(!pvmw.pte, page);
+
+                subpage = page - page_to_pfn(page) + pte_pfn(*pvmw.pte);
+                address = pvmw.address;
+
+
                 if (!(flags & TTU_IGNORE_ACCESS)) {
                         if (ptep_clear_flush_young_notify(vma, address,
                                                 pvmw.pte)) {
diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
index 574c67b663fe..a56c3989f773 100644
--- a/mm/sparse-vmemmap.c
+++ b/mm/sparse-vmemmap.c
@@ -196,9 +196,9 @@ pmd_t * __meminit vmemmap_pmd_populate(pud_t *pud, unsigned long addr, int node)
         return pmd;
 }
 
-pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
+pud_t * __meminit vmemmap_pud_populate(p4d_t *p4d, unsigned long addr, int node)
 {
-        pud_t *pud = pud_offset(pgd, addr);
+        pud_t *pud = pud_offset(p4d, addr);
         if (pud_none(*pud)) {
                 void *p = vmemmap_alloc_block(PAGE_SIZE, node);
                 if (!p)
@@ -208,6 +208,18 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
         return pud;
 }
 
+p4d_t * __meminit vmemmap_p4d_populate(pgd_t *pgd, unsigned long addr, int node)
+{
+        p4d_t *p4d = p4d_offset(pgd, addr);
+        if (p4d_none(*p4d)) {
+                void *p = vmemmap_alloc_block(PAGE_SIZE, node);
+                if (!p)
+                        return NULL;
+                p4d_populate(&init_mm, p4d, p);
+        }
+        return p4d;
+}
+
 pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
 {
         pgd_t *pgd = pgd_offset_k(addr);
@@ -225,6 +237,7 @@ int __meminit vmemmap_populate_basepages(unsigned long start,
 {
         unsigned long addr = start;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
@@ -233,7 +246,10 @@ int __meminit vmemmap_populate_basepages(unsigned long start,
                 pgd = vmemmap_pgd_populate(addr, node);
                 if (!pgd)
                         return -ENOMEM;
-                pud = vmemmap_pud_populate(pgd, addr, node);
+                p4d = vmemmap_p4d_populate(pgd, addr, node);
+                if (!p4d)
+                        return -ENOMEM;
+                pud = vmemmap_pud_populate(p4d, addr, node);
                 if (!pud)
                         return -ENOMEM;
                 pmd = vmemmap_pmd_populate(pud, addr, node);
diff --git a/mm/swap.c b/mm/swap.c
index c4910f14f957..5dabf444d724 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -670,30 +670,19 @@ static void lru_add_drain_per_cpu(struct work_struct *dummy)
 
 static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
 
-/*
- * lru_add_drain_wq is used to do lru_add_drain_all() from a WQ_MEM_RECLAIM
- * workqueue, aiding in getting memory freed.
- */
-static struct workqueue_struct *lru_add_drain_wq;
-
-static int __init lru_init(void)
-{
-        lru_add_drain_wq = alloc_workqueue("lru-add-drain", WQ_MEM_RECLAIM, 0);
-
-        if (WARN(!lru_add_drain_wq,
-                "Failed to create workqueue lru_add_drain_wq"))
-                return -ENOMEM;
-
-        return 0;
-}
-early_initcall(lru_init);
-
 void lru_add_drain_all(void)
 {
         static DEFINE_MUTEX(lock);
         static struct cpumask has_work;
         int cpu;
 
+        /*
+         * Make sure nobody triggers this path before mm_percpu_wq is fully
+         * initialized.
+         */
+        if (WARN_ON(!mm_percpu_wq))
+                return;
+
         mutex_lock(&lock);
         get_online_cpus();
         cpumask_clear(&has_work);
@@ -707,7 +696,7 @@ void lru_add_drain_all(void)
                     pagevec_count(&per_cpu(lru_deactivate_pvecs, cpu)) ||
                     need_activate_page_drain(cpu)) {
                         INIT_WORK(work, lru_add_drain_per_cpu);
-                        queue_work_on(cpu, lru_add_drain_wq, work);
+                        queue_work_on(cpu, mm_percpu_wq, work);
                         cpumask_set_cpu(cpu, &has_work);
                 }
         }
diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
index 310ac0b8f974..ac6318a064d3 100644
--- a/mm/swap_cgroup.c
+++ b/mm/swap_cgroup.c
@@ -201,6 +201,8 @@ void swap_cgroup_swapoff(int type)
                         struct page *page = map[i];
                         if (page)
                                 __free_page(page);
+                        if (!(i % SWAP_CLUSTER_MAX))
+                                cond_resched();
                 }
                 vfree(map);
         }
diff --git a/mm/swap_slots.c b/mm/swap_slots.c
index 9b5bc86f96ad..b1ccb58ad397 100644
--- a/mm/swap_slots.c
+++ b/mm/swap_slots.c
@@ -267,8 +267,6 @@ int free_swap_slot(swp_entry_t entry)
 {
         struct swap_slots_cache *cache;
 
-        BUG_ON(!swap_slot_cache_initialized);
-
         cache = &get_cpu_var(swp_slots);
         if (use_swap_slot_cache && cache->slots_ret) {
                 spin_lock_irq(&cache->free_lock);
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 521ef9b6064f..178130880b90 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1517,7 +1517,7 @@ static inline int unuse_pmd_range(struct vm_area_struct *vma, pud_t *pud,
         return 0;
 }
 
-static inline int unuse_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
+static inline int unuse_pud_range(struct vm_area_struct *vma, p4d_t *p4d,
                                 unsigned long addr, unsigned long end,
                                 swp_entry_t entry, struct page *page)
 {
@@ -1525,7 +1525,7 @@ static inline int unuse_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
         unsigned long next;
         int ret;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_none_or_clear_bad(pud))
@@ -1537,6 +1537,26 @@ static inline int unuse_pud_range(struct vm_area_struct *vma, pgd_t *pgd,
         return 0;
 }
 
+static inline int unuse_p4d_range(struct vm_area_struct *vma, pgd_t *pgd,
+                                unsigned long addr, unsigned long end,
+                                swp_entry_t entry, struct page *page)
+{
+        p4d_t *p4d;
+        unsigned long next;
+        int ret;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                ret = unuse_pud_range(vma, p4d, addr, next, entry, page);
+                if (ret)
+                        return ret;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 static int unuse_vma(struct vm_area_struct *vma,
                                 swp_entry_t entry, struct page *page)
 {
@@ -1560,7 +1580,7 @@ static int unuse_vma(struct vm_area_struct *vma,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                ret = unuse_pud_range(vma, pgd, addr, next, entry, page);
+                ret = unuse_p4d_range(vma, pgd, addr, next, entry, page);
                 if (ret)
                         return ret;
         } while (pgd++, addr = next, addr != end);
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 479e631d43c2..8bcb501bce60 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -128,19 +128,22 @@ out_unlock:
 static pmd_t *mm_alloc_pmd(struct mm_struct *mm, unsigned long address)
 {
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
-        pmd_t *pmd = NULL;
 
         pgd = pgd_offset(mm, address);
-        pud = pud_alloc(mm, pgd, address);
-        if (pud)
-                /*
-                 * Note that we didn't run this because the pmd was
-                 * missing, the *pmd may be already established and in
-                 * turn it may also be a trans_huge_pmd.
-                 */
-                pmd = pmd_alloc(mm, pud, address);
-        return pmd;
+        p4d = p4d_alloc(mm, pgd, address);
+        if (!p4d)
+                return NULL;
+        pud = pud_alloc(mm, p4d, address);
+        if (!pud)
+                return NULL;
+        /*
+         * Note that we didn't run this because the pmd was
+         * missing, the *pmd may be already established and in
+         * turn it may also be a trans_huge_pmd.
+         */
+        return pmd_alloc(mm, pud, address);
 }
 
 #ifdef CONFIG_HUGETLB_PAGE
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index b4024d688f38..0b057628a7ba 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -86,12 +86,12 @@ static void vunmap_pmd_range(pud_t *pud, unsigned long addr, unsigned long end)
         } while (pmd++, addr = next, addr != end);
 }
 
-static void vunmap_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end)
+static void vunmap_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end)
 {
         pud_t *pud;
         unsigned long next;
 
-        pud = pud_offset(pgd, addr);
+        pud = pud_offset(p4d, addr);
         do {
                 next = pud_addr_end(addr, end);
                 if (pud_clear_huge(pud))
@@ -102,6 +102,22 @@ static void vunmap_pud_range(pgd_t *pgd, unsigned long addr, unsigned long end)
         } while (pud++, addr = next, addr != end);
 }
 
+static void vunmap_p4d_range(pgd_t *pgd, unsigned long addr, unsigned long end)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        p4d = p4d_offset(pgd, addr);
+        do {
+                next = p4d_addr_end(addr, end);
+                if (p4d_clear_huge(p4d))
+                        continue;
+                if (p4d_none_or_clear_bad(p4d))
+                        continue;
+                vunmap_pud_range(p4d, addr, next);
+        } while (p4d++, addr = next, addr != end);
+}
+
 static void vunmap_page_range(unsigned long addr, unsigned long end)
 {
         pgd_t *pgd;
@@ -113,7 +129,7 @@ static void vunmap_page_range(unsigned long addr, unsigned long end)
                 next = pgd_addr_end(addr, end);
                 if (pgd_none_or_clear_bad(pgd))
                         continue;
-                vunmap_pud_range(pgd, addr, next);
+                vunmap_p4d_range(pgd, addr, next);
         } while (pgd++, addr = next, addr != end);
 }
 
@@ -160,13 +176,13 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
         return 0;
 }
 
-static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
+static int vmap_pud_range(p4d_t *p4d, unsigned long addr,
                 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
 {
         pud_t *pud;
         unsigned long next;
 
-        pud = pud_alloc(&init_mm, pgd, addr);
+        pud = pud_alloc(&init_mm, p4d, addr);
         if (!pud)
                 return -ENOMEM;
         do {
@@ -177,6 +193,23 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
         return 0;
 }
 
+static int vmap_p4d_range(pgd_t *pgd, unsigned long addr,
+                unsigned long end, pgprot_t prot, struct page **pages, int *nr)
+{
+        p4d_t *p4d;
+        unsigned long next;
+
+        p4d = p4d_alloc(&init_mm, pgd, addr);
+        if (!p4d)
+                return -ENOMEM;
+        do {
+                next = p4d_addr_end(addr, end);
+                if (vmap_pud_range(p4d, addr, next, prot, pages, nr))
+                        return -ENOMEM;
+        } while (p4d++, addr = next, addr != end);
+        return 0;
+}
+
 /*
  * Set up page tables in kva (addr, end). The ptes shall have prot "prot", and
  * will have pfns corresponding to the "pages" array.
@@ -196,7 +229,7 @@ static int vmap_page_range_noflush(unsigned long start, unsigned long end,
         pgd = pgd_offset_k(addr);
         do {
                 next = pgd_addr_end(addr, end);
-                err = vmap_pud_range(pgd, addr, next, prot, pages, &nr);
+                err = vmap_p4d_range(pgd, addr, next, prot, pages, &nr);
                 if (err)
                         return err;
         } while (pgd++, addr = next, addr != end);
@@ -237,6 +270,10 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
         unsigned long addr = (unsigned long) vmalloc_addr;
         struct page *page = NULL;
         pgd_t *pgd = pgd_offset_k(addr);
+        p4d_t *p4d;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *ptep, pte;
 
         /*
          * XXX we might need to change this if we add VIRTUAL_BUG_ON for
@@ -244,21 +281,23 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
          */
         VIRTUAL_BUG_ON(!is_vmalloc_or_module_addr(vmalloc_addr));
 
-        if (!pgd_none(*pgd)) {
-                pud_t *pud = pud_offset(pgd, addr);
-                if (!pud_none(*pud)) {
-                        pmd_t *pmd = pmd_offset(pud, addr);
-                        if (!pmd_none(*pmd)) {
-                                pte_t *ptep, pte;
-
-                                ptep = pte_offset_map(pmd, addr);
-                                pte = *ptep;
-                                if (pte_present(pte))
-                                        page = pte_page(pte);
-                                pte_unmap(ptep);
-                        }
-                }
-        }
+        if (pgd_none(*pgd))
+                return NULL;
+        p4d = p4d_offset(pgd, addr);
+        if (p4d_none(*p4d))
+                return NULL;
+        pud = pud_offset(p4d, addr);
+        if (pud_none(*pud))
+                return NULL;
+        pmd = pmd_offset(pud, addr);
+        if (pmd_none(*pmd))
+                return NULL;
+
+        ptep = pte_offset_map(pmd, addr);
+        pte = *ptep;
+        if (pte_present(pte))
+                page = pte_page(pte);
+        pte_unmap(ptep);
         return page;
 }
 EXPORT_SYMBOL(vmalloc_to_page);
@@ -1644,7 +1683,7 @@ static void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
 
                 if (fatal_signal_pending(current)) {
                         area->nr_pages = i;
-                        goto fail;
+                        goto fail_no_warn;
                 }
 
                 if (node == NUMA_NO_NODE)
@@ -1670,6 +1709,7 @@ fail:
         warn_alloc(gfp_mask, NULL,
                           "vmalloc: allocation failure, allocated %ld of %ld bytes",
                           (area->nr_pages*PAGE_SIZE), area->size);
+fail_no_warn:
         vfree(area->addr);
         return NULL;
 }
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 69f9aff39a2e..5a4f5c5a31e8 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1065,6 +1065,9 @@ const char * const vmstat_text[] = {
         "thp_split_page_failed",
         "thp_deferred_split_page",
         "thp_split_pmd",
+#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
+        "thp_split_pud",
+#endif
         "thp_zero_page_alloc",
         "thp_zero_page_alloc_failed",
 #endif
@@ -1549,7 +1552,6 @@ static const struct file_operations proc_vmstat_file_operations = {
 #endif /* CONFIG_PROC_FS */
 
 #ifdef CONFIG_SMP
-static struct workqueue_struct *vmstat_wq;
 static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
 int sysctl_stat_interval __read_mostly = HZ;
 
@@ -1620,7 +1622,7 @@ static void vmstat_update(struct work_struct *w)
                  * to occur in the future. Keep on running the
                  * update worker thread.
                  */
-                queue_delayed_work_on(smp_processor_id(), vmstat_wq,
+                queue_delayed_work_on(smp_processor_id(), mm_percpu_wq,
                                 this_cpu_ptr(&vmstat_work),
                                 round_jiffies_relative(sysctl_stat_interval));
         }
@@ -1699,7 +1701,7 @@ static void vmstat_shepherd(struct work_struct *w)
                 struct delayed_work *dw = &per_cpu(vmstat_work, cpu);
 
                 if (!delayed_work_pending(dw) && need_update(cpu))
-                        queue_delayed_work_on(cpu, vmstat_wq, dw, 0);
+                        queue_delayed_work_on(cpu, mm_percpu_wq, dw, 0);
         }
         put_online_cpus();
 
@@ -1715,7 +1717,6 @@ static void __init start_shepherd_timer(void)
                 INIT_DEFERRABLE_WORK(per_cpu_ptr(&vmstat_work, cpu),
                         vmstat_update);
 
-        vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
         schedule_delayed_work(&shepherd,
                 round_jiffies_relative(sysctl_stat_interval));
 }
@@ -1761,11 +1762,15 @@ static int vmstat_cpu_dead(unsigned int cpu)
 
 #endif
 
-static int __init setup_vmstat(void)
+struct workqueue_struct *mm_percpu_wq;
+
+void __init init_mm_internals(void)
 {
-#ifdef CONFIG_SMP
-        int ret;
+        int ret __maybe_unused;
 
+        mm_percpu_wq = alloc_workqueue("mm_percpu_wq", WQ_MEM_RECLAIM, 0);
+
+#ifdef CONFIG_SMP
         ret = cpuhp_setup_state_nocalls(CPUHP_MM_VMSTAT_DEAD, "mm/vmstat:dead",
                                         NULL, vmstat_cpu_dead);
         if (ret < 0)
@@ -1789,9 +1794,7 @@ static int __init setup_vmstat(void)
         proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
         proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
 #endif
-        return 0;
 }
-module_init(setup_vmstat)
 
 #if defined(CONFIG_DEBUG_FS) && defined(CONFIG_COMPACTION)
 
diff --git a/mm/workingset.c b/mm/workingset.c
index ac839fca0e76..eda05c71fa49 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -532,7 +532,7 @@ static int __init workingset_init(void)
         pr_info("workingset: timestamp_bits=%d max_order=%d bucket_order=%u\n",
                timestamp_bits, max_order, bucket_order);
 
-        ret = list_lru_init_key(&shadow_nodes, &shadow_nodes_key);
+        ret = __list_lru_init(&shadow_nodes, true, &shadow_nodes_key);
         if (ret)
                 goto err;
         ret = register_shrinker(&workingset_shadow_shrinker);
diff --git a/mm/z3fold.c b/mm/z3fold.c
index 8970a2fd3b1a..54f63c4a809a 100644
--- a/mm/z3fold.c
+++ b/mm/z3fold.c
@@ -185,6 +185,12 @@ static inline void z3fold_page_lock(struct z3fold_header *zhdr)
         spin_lock(&zhdr->page_lock);
 }
 
+/* Try to lock a z3fold page */
+static inline int z3fold_page_trylock(struct z3fold_header *zhdr)
+{
+        return spin_trylock(&zhdr->page_lock);
+}
+
 /* Unlock a z3fold page */
 static inline void z3fold_page_unlock(struct z3fold_header *zhdr)
 {
@@ -385,7 +391,7 @@ static int z3fold_alloc(struct z3fold_pool *pool, size_t size, gfp_t gfp,
                         spin_lock(&pool->lock);
                         zhdr = list_first_entry_or_null(&pool->unbuddied[i],
                                                 struct z3fold_header, buddy);
-                        if (!zhdr) {
+                        if (!zhdr || !z3fold_page_trylock(zhdr)) {
                                 spin_unlock(&pool->lock);
                                 continue;
                         }
@@ -394,7 +400,6 @@ static int z3fold_alloc(struct z3fold_pool *pool, size_t size, gfp_t gfp,
                         spin_unlock(&pool->lock);
 
                         page = virt_to_page(zhdr);
-                        z3fold_page_lock(zhdr);
                         if (zhdr->first_chunks == 0) {
                                 if (zhdr->middle_chunks != 0 &&
                                     chunks >= zhdr->start_middle)
@@ -667,6 +672,7 @@ next:
                         z3fold_page_unlock(zhdr);
                         spin_lock(&pool->lock);
                         if (kref_put(&zhdr->refcount, release_z3fold_page)) {
+                                spin_unlock(&pool->lock);
                                 atomic64_dec(&pool->pages_nr);
                                 return 0;
                         }
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index b7ee9c34dbd6..d41edd28298b 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -276,7 +276,7 @@ struct zs_pool {
 struct zspage {
         struct {
                 unsigned int fullness:FULLNESS_BITS;
-                unsigned int class:CLASS_BITS;
+                unsigned int class:CLASS_BITS + 1;
                 unsigned int isolated:ISOLATED_BITS;
                 unsigned int magic:MAGIC_VAL_BITS;
         };
diff --git a/net/atm/svc.c b/net/atm/svc.c
index db9794ec61d8..5589de7086af 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -318,7 +318,8 @@ out:
         return error;
 }
 
-static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
+static int svc_accept(struct socket *sock, struct socket *newsock, int flags,
+                      bool kern)
 {
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
@@ -329,7 +330,7 @@ static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
 
         lock_sock(sk);
 
-        error = svc_create(sock_net(sk), newsock, 0, 0);
+        error = svc_create(sock_net(sk), newsock, 0, kern);
         if (error)
                 goto out;
 
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index a8e42cedf1db..b7c486752b3a 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1320,7 +1320,8 @@ out_release:
         return err;
 }
 
-static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
+static int ax25_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sk_buff *skb;
         struct sock *newsk;
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 7c3d994e90d8..71343d0fec94 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2477,6 +2477,16 @@ static void batadv_iv_iface_activate(struct batadv_hard_iface *hard_iface)
         batadv_iv_ogm_schedule(hard_iface);
 }
 
+/**
+ * batadv_iv_init_sel_class - initialize GW selection class
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+static void batadv_iv_init_sel_class(struct batadv_priv *bat_priv)
+{
+        /* set default TQ difference threshold to 20 */
+        atomic_set(&bat_priv->gw.sel_class, 20);
+}
+
 static struct batadv_gw_node *
 batadv_iv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
 {
@@ -2823,6 +2833,7 @@ static struct batadv_algo_ops batadv_batman_iv __read_mostly = {
                 .del_if = batadv_iv_ogm_orig_del_if,
         },
         .gw = {
+                .init_sel_class = batadv_iv_init_sel_class,
                 .get_best_gw_node = batadv_iv_gw_get_best_gw_node,
                 .is_eligible = batadv_iv_gw_is_eligible,
 #ifdef CONFIG_BATMAN_ADV_DEBUGFS
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 0acd081dd286..a36c8e7291d6 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -668,6 +668,16 @@ err_ifinfo1:
         return ret;
 }
 
+/**
+ * batadv_v_init_sel_class - initialize GW selection class
+ * @bat_priv: the bat priv with all the soft interface information
+ */
+static void batadv_v_init_sel_class(struct batadv_priv *bat_priv)
+{
+        /* set default throughput difference threshold to 5Mbps */
+        atomic_set(&bat_priv->gw.sel_class, 50);
+}
+
 static ssize_t batadv_v_store_sel_class(struct batadv_priv *bat_priv,
                                         char *buff, size_t count)
 {
@@ -1052,6 +1062,7 @@ static struct batadv_algo_ops batadv_batman_v __read_mostly = {
                 .dump = batadv_v_orig_dump,
         },
         .gw = {
+                .init_sel_class = batadv_v_init_sel_class,
                 .store_sel_class = batadv_v_store_sel_class,
                 .show_sel_class = batadv_v_show_sel_class,
                 .get_best_gw_node = batadv_v_gw_get_best_gw_node,
@@ -1092,9 +1103,6 @@ int batadv_v_mesh_init(struct batadv_priv *bat_priv)
         if (ret < 0)
                 return ret;
 
-        /* set default throughput difference threshold to 5Mbps */
-        atomic_set(&bat_priv->gw.sel_class, 50);
-
         return 0;
 }
 
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 11a23fd6e1a0..8f964beaac28 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -404,7 +404,7 @@ out:
  * batadv_frag_create - create a fragment from skb
  * @skb: skb to create fragment from
  * @frag_head: header to use in new fragment
- * @mtu: size of new fragment
+ * @fragment_size: size of new fragment
  *
  * Split the passed skb into two fragments: A new one with size matching the
  * passed mtu and the old one with the rest. The new skb contains data from the
@@ -414,11 +414,11 @@ out:
  */
 static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
                                           struct batadv_frag_packet *frag_head,
-                                          unsigned int mtu)
+                                          unsigned int fragment_size)
 {
         struct sk_buff *skb_fragment;
         unsigned int header_size = sizeof(*frag_head);
-        unsigned int fragment_size = mtu - header_size;
+        unsigned int mtu = fragment_size + header_size;
 
         skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
         if (!skb_fragment)
@@ -456,7 +456,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
         struct sk_buff *skb_fragment;
         unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
         unsigned int header_size = sizeof(frag_header);
-        unsigned int max_fragment_size, max_packet_size;
+        unsigned int max_fragment_size, num_fragments;
         int ret;
 
         /* To avoid merge and refragmentation at next-hops we never send
@@ -464,10 +464,15 @@ int batadv_frag_send_packet(struct sk_buff *skb,
          */
         mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
         max_fragment_size = mtu - header_size;
-        max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
+
+        if (skb->len == 0 || max_fragment_size == 0)
+                return -EINVAL;
+
+        num_fragments = (skb->len - 1) / max_fragment_size + 1;
+        max_fragment_size = (skb->len - 1) / num_fragments + 1;
 
         /* Don't even try to fragment, if we need more than 16 fragments */
-        if (skb->len > max_packet_size) {
+        if (num_fragments > BATADV_FRAG_MAX_FRAGMENTS) {
                 ret = -EAGAIN;
                 goto free_skb;
         }
@@ -507,7 +512,8 @@ int batadv_frag_send_packet(struct sk_buff *skb,
                         goto put_primary_if;
                 }
 
-                skb_fragment = batadv_frag_create(skb, &frag_header, mtu);
+                skb_fragment = batadv_frag_create(skb, &frag_header,
+                                                  max_fragment_size);
                 if (!skb_fragment) {
                         ret = -ENOMEM;
                         goto put_primary_if;
diff --git a/net/batman-adv/gateway_common.c b/net/batman-adv/gateway_common.c
index 5db2e43e3775..33940c5c74a8 100644
--- a/net/batman-adv/gateway_common.c
+++ b/net/batman-adv/gateway_common.c
@@ -253,6 +253,11 @@ static void batadv_gw_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
  */
 void batadv_gw_init(struct batadv_priv *bat_priv)
 {
+        if (bat_priv->algo_ops->gw.init_sel_class)
+                bat_priv->algo_ops->gw.init_sel_class(bat_priv);
+        else
+                atomic_set(&bat_priv->gw.sel_class, 1);
+
         batadv_tvlv_handler_register(bat_priv, batadv_gw_tvlv_ogm_handler_v1,
                                      NULL, BATADV_TVLV_GW, 1,
                                      BATADV_TVLV_HANDLER_OGM_CIFNOTFND);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 5d099b2e6cfc..d042c99af028 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -819,7 +819,6 @@ static int batadv_softif_init_late(struct net_device *dev)
         atomic_set(&bat_priv->mcast.num_want_all_ipv6, 0);
 #endif
         atomic_set(&bat_priv->gw.mode, BATADV_GW_MODE_OFF);
-        atomic_set(&bat_priv->gw.sel_class, 20);
         atomic_set(&bat_priv->gw.bandwidth_down, 100);
         atomic_set(&bat_priv->gw.bandwidth_up, 20);
         atomic_set(&bat_priv->orig_interval, 1000);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 66b25e410a41..246f21b4973b 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1489,6 +1489,7 @@ struct batadv_algo_orig_ops {
 
 /**
  * struct batadv_algo_gw_ops - mesh algorithm callbacks (GW specific)
+ * @init_sel_class: initialize GW selection class (optional)
  * @store_sel_class: parse and stores a new GW selection class (optional)
  * @show_sel_class: prints the current GW selection class (optional)
  * @get_best_gw_node: select the best GW from the list of available nodes
@@ -1499,6 +1500,7 @@ struct batadv_algo_orig_ops {
  * @dump: dump gateways to a netlink socket (optional)
  */
 struct batadv_algo_gw_ops {
+        void (*init_sel_class)(struct batadv_priv *bat_priv);
         ssize_t (*store_sel_class)(struct batadv_priv *bat_priv, char *buff,
                                    size_t count);
         ssize_t (*show_sel_class)(struct batadv_priv *bat_priv, char *buff);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index f307b145ea54..507b80d59dec 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -301,7 +301,7 @@ done:
 }
 
 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
-                             int flags)
+                             int flags, bool kern)
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct sock *sk = sock->sk, *nsk;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index aa1a814ceddc..ac3c650cb234 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -471,7 +471,8 @@ done:
         return err;
 }
 
-static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
+static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags,
+                              bool kern)
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct sock *sk = sock->sk, *nsk;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index e4e9a2da1e7e..728e0c8dc8e7 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -627,7 +627,7 @@ done:
 }
 
 static int sco_sock_accept(struct socket *sock, struct socket *newsock,
-                           int flags)
+                           int flags, bool kern)
 {
         DEFINE_WAIT_FUNC(wait, woken_wake_function);
         struct sock *sk = sock->sk, *ch;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index ea71513fca21..90f49a194249 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -119,6 +119,15 @@ static int br_dev_init(struct net_device *dev)
         return err;
 }
 
+static void br_dev_uninit(struct net_device *dev)
+{
+        struct net_bridge *br = netdev_priv(dev);
+
+        br_multicast_uninit_stats(br);
+        br_vlan_flush(br);
+        free_percpu(br->stats);
+}
+
 static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
@@ -332,6 +341,7 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_open                = br_dev_open,
         .ndo_stop                = br_dev_stop,
         .ndo_init                = br_dev_init,
+        .ndo_uninit              = br_dev_uninit,
         .ndo_start_xmit          = br_dev_xmit,
         .ndo_get_stats64         = br_get_stats64,
         .ndo_set_mac_address     = br_set_mac_address,
@@ -356,14 +366,6 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_features_check      = passthru_features_check,
 };
 
-static void br_dev_free(struct net_device *dev)
-{
-        struct net_bridge *br = netdev_priv(dev);
-
-        free_percpu(br->stats);
-        free_netdev(dev);
-}
-
 static struct device_type br_type = {
         .name   = "bridge",
 };
@@ -376,7 +378,7 @@ void br_dev_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
-        dev->destructor = br_dev_free;
+        dev->destructor = free_netdev;
         dev->ethtool_ops = &br_ethtool_ops;
         SET_NETDEV_DEVTYPE(dev, &br_type);
         dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 4f598dc2d916..6e08b7199dd7 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -106,7 +106,7 @@ static struct net_bridge_fdb_entry *br_fdb_find(struct net_bridge *br,
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
 
-        WARN_ON_ONCE(!br_hash_lock_held(br));
+        lockdep_assert_held_once(&br->hash_lock);
 
         rcu_read_lock();
         fdb = fdb_find_rcu(head, addr, vid);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8ac1770aa222..56a2a72e7738 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -311,7 +311,6 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
 
         br_fdb_delete_by_port(br, NULL, 0, 1);
 
-        br_vlan_flush(br);
         br_multicast_dev_del(br);
         cancel_delayed_work_sync(&br->gc_work);
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 236f34244dbe..013f2290bfa5 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -30,6 +30,7 @@ EXPORT_SYMBOL(br_should_route_hook);
 static int
 br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        br_drop_fake_rtable(skb);
         return netif_receive_skb(skb);
 }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index b760f2620abf..faa7261a992f 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2031,8 +2031,6 @@ void br_multicast_dev_del(struct net_bridge *br)
 
 out:
         spin_unlock_bh(&br->multicast_lock);
-
-        free_percpu(br->mcast_stats);
 }
 
 int br_multicast_set_router(struct net_bridge *br, unsigned long val)
@@ -2531,6 +2529,11 @@ int br_multicast_init_stats(struct net_bridge *br)
         return 0;
 }
 
+void br_multicast_uninit_stats(struct net_bridge *br)
+{
+        free_percpu(br->mcast_stats);
+}
+
 static void mcast_stats_add_dir(u64 *dst, u64 *src)
 {
         dst[BR_MCAST_DIR_RX] += src[BR_MCAST_DIR_RX];
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 95087e6e8258..1f1e62095464 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -521,21 +521,6 @@ static unsigned int br_nf_pre_routing(void *priv,
 }
 
 
-/* PF_BRIDGE/LOCAL_IN ************************************************/
-/* The packet is locally destined, which requires a real
- * dst_entry, so detach the fake one.  On the way up, the
- * packet would pass through PRE_ROUTING again (which already
- * took place when the packet entered the bridge), but we
- * register an IPv4 PRE_ROUTING 'sabotage' hook that will
- * prevent this from happening. */
-static unsigned int br_nf_local_in(void *priv,
-                                   struct sk_buff *skb,
-                                   const struct nf_hook_state *state)
-{
-        br_drop_fake_rtable(skb);
-        return NF_ACCEPT;
-}
-
 /* PF_BRIDGE/FORWARD *************************************************/
 static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
@@ -721,18 +706,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
 
 static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-        struct nf_bridge_info *nf_bridge;
-        unsigned int mtu_reserved;
+        struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
+        unsigned int mtu, mtu_reserved;
 
         mtu_reserved = nf_bridge_mtu_reduction(skb);
+        mtu = skb->dev->mtu;
 
-        if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) {
+        if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+                mtu = nf_bridge->frag_max_size;
+
+        if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) {
                 nf_bridge_info_free(skb);
                 return br_dev_queue_push_xmit(net, sk, skb);
         }
 
-        nf_bridge = nf_bridge_info_get(skb);
-
         /* This is wrong! We should preserve the original fragment
          * boundaries by preserving frag_list rather than refragmenting.
          */
@@ -908,12 +895,6 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
                 .priority = NF_BR_PRI_BRNF,
         },
         {
-                .hook = br_nf_local_in,
-                .pf = NFPROTO_BRIDGE,
-                .hooknum = NF_BR_LOCAL_IN,
-                .priority = NF_BR_PRI_BRNF,
-        },
-        {
                 .hook = br_nf_forward_ip,
                 .pf = NFPROTO_BRIDGE,
                 .hooknum = NF_BR_FORWARD,
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index a8f6acd23e30..225ef7d53701 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1165,11 +1165,14 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev,
                 spin_unlock_bh(&br->lock);
         }
 
-        err = br_changelink(dev, tb, data);
+        err = register_netdevice(dev);
         if (err)
                 return err;
 
-        return register_netdevice(dev);
+        err = br_changelink(dev, tb, data);
+        if (err)
+                unregister_netdevice(dev);
+        return err;
 }
 
 static size_t br_get_size(const struct net_device *brdev)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 2288fca7756c..0d177280aa84 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -531,15 +531,6 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
 int br_fdb_external_learn_del(struct net_bridge *br, struct net_bridge_port *p,
                               const unsigned char *addr, u16 vid);
 
-static inline bool br_hash_lock_held(struct net_bridge *br)
-{
-#ifdef CONFIG_LOCKDEP
-        return lockdep_is_held(&br->hash_lock);
-#else
-        return true;
-#endif
-}
-
 /* br_forward.c */
 enum br_pkt_type {
         BR_PKT_UNICAST,
@@ -629,6 +620,7 @@ void br_rtr_notify(struct net_device *dev, struct net_bridge_port *port,
 void br_multicast_count(struct net_bridge *br, const struct net_bridge_port *p,
                         const struct sk_buff *skb, u8 type, u8 dir);
 int br_multicast_init_stats(struct net_bridge *br);
+void br_multicast_uninit_stats(struct net_bridge *br);
 void br_multicast_get_stats(const struct net_bridge *br,
                             const struct net_bridge_port *p,
                             struct br_mcast_stats *dest);
@@ -769,6 +761,10 @@ static inline int br_multicast_init_stats(struct net_bridge *br)
         return 0;
 }
 
+static inline void br_multicast_uninit_stats(struct net_bridge *br)
+{
+}
+
 static inline int br_multicast_igmp_type(const struct sk_buff *skb)
 {
         return 0;
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 464e88599b9d..108533859a53 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -230,6 +230,7 @@ enum {
         Opt_osdkeepalivetimeout,
         Opt_mount_timeout,
         Opt_osd_idle_ttl,
+        Opt_osd_request_timeout,
         Opt_last_int,
         /* int args above */
         Opt_fsid,
@@ -256,6 +257,7 @@ static match_table_t opt_tokens = {
         {Opt_osdkeepalivetimeout, "osdkeepalive=%d"},
         {Opt_mount_timeout, "mount_timeout=%d"},
         {Opt_osd_idle_ttl, "osd_idle_ttl=%d"},
+        {Opt_osd_request_timeout, "osd_request_timeout=%d"},
         /* int args above */
         {Opt_fsid, "fsid=%s"},
         {Opt_name, "name=%s"},
@@ -361,6 +363,7 @@ ceph_parse_options(char *options, const char *dev_name,
         opt->osd_keepalive_timeout = CEPH_OSD_KEEPALIVE_DEFAULT;
         opt->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT;
         opt->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;
+        opt->osd_request_timeout = CEPH_OSD_REQUEST_TIMEOUT_DEFAULT;
 
         /* get mon ip(s) */
         /* ip1[:port1][,ip2[:port2]...] */
@@ -473,6 +476,15 @@ ceph_parse_options(char *options, const char *dev_name,
                         }
                         opt->mount_timeout = msecs_to_jiffies(intval * 1000);
                         break;
+                case Opt_osd_request_timeout:
+                        /* 0 is "wait forever" (i.e. infinite timeout) */
+                        if (intval < 0 || intval > INT_MAX / 1000) {
+                                pr_err("osd_request_timeout out of range\n");
+                                err = -EINVAL;
+                                goto out;
+                        }
+                        opt->osd_request_timeout = msecs_to_jiffies(intval * 1000);
+                        break;
 
                 case Opt_share:
                         opt->flags &= ~CEPH_OPT_NOSHARE;
@@ -557,6 +569,9 @@ int ceph_print_client_options(struct seq_file *m, struct ceph_client *client)
         if (opt->osd_keepalive_timeout != CEPH_OSD_KEEPALIVE_DEFAULT)
                 seq_printf(m, "osdkeepalivetimeout=%d,",
                     jiffies_to_msecs(opt->osd_keepalive_timeout) / 1000);
+        if (opt->osd_request_timeout != CEPH_OSD_REQUEST_TIMEOUT_DEFAULT)
+                seq_printf(m, "osd_request_timeout=%d,",
+                           jiffies_to_msecs(opt->osd_request_timeout) / 1000);
 
         /* drop redundant comma */
         if (m->count != pos)
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 38dcf1eb427d..f76bb3332613 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -7,6 +7,7 @@
 #include <linux/kthread.h>
 #include <linux/net.h>
 #include <linux/nsproxy.h>
+#include <linux/sched/mm.h>
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/string.h>
@@ -469,11 +470,16 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 {
         struct sockaddr_storage *paddr = &con->peer_addr.in_addr;
         struct socket *sock;
+        unsigned int noio_flag;
         int ret;
 
         BUG_ON(con->sock);
+
+        /* sock_create_kern() allocates with GFP_KERNEL */
+        noio_flag = memalloc_noio_save();
         ret = sock_create_kern(read_pnet(&con->msgr->net), paddr->ss_family,
                                SOCK_STREAM, IPPROTO_TCP, &sock);
+        memalloc_noio_restore(noio_flag);
         if (ret)
                 return ret;
         sock->sk->sk_allocation = GFP_NOFS;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index b65bbf9f45eb..e15ea9e4c495 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1709,6 +1709,8 @@ static void account_request(struct ceph_osd_request *req)
 
         req->r_flags |= CEPH_OSD_FLAG_ONDISK;
         atomic_inc(&req->r_osdc->num_requests);
+
+        req->r_start_stamp = jiffies;
 }
 
 static void submit_request(struct ceph_osd_request *req, bool wrlocked)
@@ -1789,6 +1791,14 @@ static void cancel_request(struct ceph_osd_request *req)
         ceph_osdc_put_request(req);
 }
 
+static void abort_request(struct ceph_osd_request *req, int err)
+{
+        dout("%s req %p tid %llu err %d\n", __func__, req, req->r_tid, err);
+
+        cancel_map_check(req);
+        complete_request(req, err);
+}
+
 static void check_pool_dne(struct ceph_osd_request *req)
 {
         struct ceph_osd_client *osdc = req->r_osdc;
@@ -2487,6 +2497,7 @@ static void handle_timeout(struct work_struct *work)
                 container_of(work, struct ceph_osd_client, timeout_work.work);
         struct ceph_options *opts = osdc->client->options;
         unsigned long cutoff = jiffies - opts->osd_keepalive_timeout;
+        unsigned long expiry_cutoff = jiffies - opts->osd_request_timeout;
         LIST_HEAD(slow_osds);
         struct rb_node *n, *p;
 
@@ -2502,15 +2513,23 @@ static void handle_timeout(struct work_struct *work)
                 struct ceph_osd *osd = rb_entry(n, struct ceph_osd, o_node);
                 bool found = false;
 
-                for (p = rb_first(&osd->o_requests); p; p = rb_next(p)) {
+                for (p = rb_first(&osd->o_requests); p; ) {
                         struct ceph_osd_request *req =
                             rb_entry(p, struct ceph_osd_request, r_node);
 
+                        p = rb_next(p); /* abort_request() */
+
                         if (time_before(req->r_stamp, cutoff)) {
                                 dout(" req %p tid %llu on osd%d is laggy\n",
                                      req, req->r_tid, osd->o_osd);
                                 found = true;
                         }
+                        if (opts->osd_request_timeout &&
+                            time_before(req->r_start_stamp, expiry_cutoff)) {
+                                pr_err_ratelimited("tid %llu on osd%d timeout\n",
+                                       req->r_tid, osd->o_osd);
+                                abort_request(req, -ETIMEDOUT);
+                        }
                 }
                 for (p = rb_first(&osd->o_linger_requests); p; p = rb_next(p)) {
                         struct ceph_osd_linger_request *lreq =
@@ -2530,6 +2549,21 @@ static void handle_timeout(struct work_struct *work)
                         list_move_tail(&osd->o_keepalive_item, &slow_osds);
         }
 
+        if (opts->osd_request_timeout) {
+                for (p = rb_first(&osdc->homeless_osd.o_requests); p; ) {
+                        struct ceph_osd_request *req =
+                            rb_entry(p, struct ceph_osd_request, r_node);
+
+                        p = rb_next(p); /* abort_request() */
+
+                        if (time_before(req->r_start_stamp, expiry_cutoff)) {
+                                pr_err_ratelimited("tid %llu on osd%d timeout\n",
+                                       req->r_tid, osdc->homeless_osd.o_osd);
+                                abort_request(req, -ETIMEDOUT);
+                        }
+                }
+        }
+
         if (atomic_read(&osdc->num_homeless) || !list_empty(&slow_osds))
                 maybe_request_map(osdc);
 
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 6824c0ec8373..ffe9e904d4d1 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -390,9 +390,8 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         dout("crush decode tunable chooseleaf_stable = %d\n",
              c->chooseleaf_stable);
 
-        crush_finalize(c);
-
 done:
+        crush_finalize(c);
         dout("crush_decode success\n");
         return c;
 
@@ -1380,7 +1379,6 @@ static int decode_new_up_state_weight(void **p, void *end,
                 if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
                     (xorstate & CEPH_OSD_EXISTS)) {
                         pr_info("osd%d does not exist\n", osd);
-                        map->osd_weight[osd] = CEPH_OSD_IN;
                         ret = set_primary_affinity(map, osd,
                                                    CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
                         if (ret)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index ea633342ab0d..f4947e737f34 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -398,7 +398,7 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
                            struct iov_iter *to, int len)
 {
         int start = skb_headlen(skb);
-        int i, copy = start - offset;
+        int i, copy = start - offset, start_off = offset, n;
         struct sk_buff *frag_iter;
 
         trace_skb_copy_datagram_iovec(skb, len);
@@ -407,11 +407,12 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
         if (copy > 0) {
                 if (copy > len)
                         copy = len;
-                if (copy_to_iter(skb->data + offset, copy, to) != copy)
+                n = copy_to_iter(skb->data + offset, copy, to);
+                offset += n;
+                if (n != copy)
                         goto short_copy;
                 if ((len -= copy) == 0)
                         return 0;
-                offset += copy;
         }
 
         /* Copy paged appendix. Hmm... why does this look so complicated? */
@@ -425,13 +426,14 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
                 if ((copy = end - offset) > 0) {
                         if (copy > len)
                                 copy = len;
-                        if (copy_page_to_iter(skb_frag_page(frag),
+                        n = copy_page_to_iter(skb_frag_page(frag),
                                               frag->page_offset + offset -
-                                              start, copy, to) != copy)
+                                              start, copy, to);
+                        offset += n;
+                        if (n != copy)
                                 goto short_copy;
                         if (!(len -= copy))
                                 return 0;
-                        offset += copy;
                 }
                 start = end;
         }
@@ -463,6 +465,7 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
          */
 
 fault:
+        iov_iter_revert(to, offset - start_off);
         return -EFAULT;
 
 short_copy:
@@ -613,7 +616,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                       __wsum *csump)
 {
         int start = skb_headlen(skb);
-        int i, copy = start - offset;
+        int i, copy = start - offset, start_off = offset;
         struct sk_buff *frag_iter;
         int pos = 0;
         int n;
@@ -623,11 +626,11 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                 if (copy > len)
                         copy = len;
                 n = csum_and_copy_to_iter(skb->data + offset, copy, csump, to);
+                offset += n;
                 if (n != copy)
                         goto fault;
                 if ((len -= copy) == 0)
                         return 0;
-                offset += copy;
                 pos = copy;
         }
 
@@ -649,12 +652,12 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                                   offset - start, copy,
                                                   &csum2, to);
                         kunmap(page);
+                        offset += n;
                         if (n != copy)
                                 goto fault;
                         *csump = csum_block_add(*csump, csum2, pos);
                         if (!(len -= copy))
                                 return 0;
-                        offset += copy;
                         pos += copy;
                 }
                 start = end;
@@ -687,6 +690,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                 return 0;
 
 fault:
+        iov_iter_revert(to, offset - start_off);
         return -EFAULT;
 }
 
@@ -771,6 +775,7 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
         }
         return 0;
 csum_error:
+        iov_iter_revert(&msg->msg_iter, chunk);
         return -EINVAL;
 fault:
         return -EFAULT;
diff --git a/net/core/dev.c b/net/core/dev.c
index 8637b2b71f3d..533a6d6f6092 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1304,6 +1304,7 @@ void netdev_notify_peers(struct net_device *dev)
 {
         rtnl_lock();
         call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev);
+        call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev);
         rtnl_unlock();
 }
 EXPORT_SYMBOL(netdev_notify_peers);
@@ -6756,7 +6757,6 @@ int dev_change_xdp_fd(struct net_device *dev, int fd, u32 flags)
 
         return err;
 }
-EXPORT_SYMBOL(dev_change_xdp_fd);
 
 /**
  *      dev_new_index   -       allocate an ifindex
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index c35aae13c8d2..d98d4998213d 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -390,7 +390,7 @@ mpls:
                         unsigned char ar_tip[4];
                 } *arp_eth, _arp_eth;
                 const struct arphdr *arp;
-                struct arphdr *_arp;
+                struct arphdr _arp;
 
                 arp = __skb_header_pointer(skb, nhoff, sizeof(_arp), data,
                                            hlen, &_arp);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e7c12caa20c8..4526cbd7e28a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -860,7 +860,8 @@ static void neigh_probe(struct neighbour *neigh)
         if (skb)
                 skb = skb_clone(skb, GFP_ATOMIC);
         write_unlock(&neigh->lock);
-        neigh->ops->solicit(neigh, skb);
+        if (neigh->ops->solicit)
+                neigh->ops->solicit(neigh, skb);
         atomic_inc(&neigh->probes);
         kfree_skb(skb);
 }
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 3945821e9c1f..65ea0ff4017c 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -953,7 +953,7 @@ net_rx_queue_update_kobjects(struct net_device *dev, int old_num, int new_num)
         while (--i >= new_num) {
                 struct kobject *kobj = &dev->_rx[i].kobj;
 
-                if (!list_empty(&dev_net(dev)->exit_list))
+                if (!atomic_read(&dev_net(dev)->count))
                         kobj->uevent_suppress = 1;
                 if (dev->sysfs_rx_queue_group)
                         sysfs_remove_group(kobj, dev->sysfs_rx_queue_group);
@@ -1371,7 +1371,7 @@ netdev_queue_update_kobjects(struct net_device *dev, int old_num, int new_num)
         while (--i >= new_num) {
                 struct netdev_queue *queue = dev->_tx + i;
 
-                if (!list_empty(&dev_net(dev)->exit_list))
+                if (!atomic_read(&dev_net(dev)->count))
                         queue->kobj.uevent_suppress = 1;
 #ifdef CONFIG_BQL
                 sysfs_remove_group(&queue->kobj, &dql_group);
@@ -1558,7 +1558,7 @@ void netdev_unregister_kobject(struct net_device *ndev)
 {
         struct device *dev = &(ndev->dev);
 
-        if (!list_empty(&dev_net(ndev)->exit_list))
+        if (!atomic_read(&dev_net(ndev)->count))
                 dev_set_uevent_suppress(dev, 1);
 
         kobject_get(&dev->kobj);
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 6ae56037bb13..029a61ac6cdd 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -71,27 +71,17 @@ static int update_classid_sock(const void *v, struct file *file, unsigned n)
         return 0;
 }
 
-static void update_classid(struct cgroup_subsys_state *css, void *v)
+static void cgrp_attach(struct cgroup_taskset *tset)
 {
-        struct css_task_iter it;
+        struct cgroup_subsys_state *css;
         struct task_struct *p;
 
-        css_task_iter_start(css, &it);
-        while ((p = css_task_iter_next(&it))) {
+        cgroup_taskset_for_each(p, css, tset) {
                 task_lock(p);
-                iterate_fd(p->files, 0, update_classid_sock, v);
+                iterate_fd(p->files, 0, update_classid_sock,
+                           (void *)(unsigned long)css_cls_state(css)->classid);
                 task_unlock(p);
         }
-        css_task_iter_end(&it);
-}
-
-static void cgrp_attach(struct cgroup_taskset *tset)
-{
-        struct cgroup_subsys_state *css;
-
-        cgroup_taskset_first(tset, &css);
-        update_classid(css,
-                       (void *)(unsigned long)css_cls_state(css)->classid);
 }
 
 static u64 read_classid(struct cgroup_subsys_state *css, struct cftype *cft)
@@ -103,12 +93,22 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
                          u64 value)
 {
         struct cgroup_cls_state *cs = css_cls_state(css);
+        struct css_task_iter it;
+        struct task_struct *p;
 
         cgroup_sk_alloc_disable();
 
         cs->classid = (u32)value;
 
-        update_classid(css, (void *)(unsigned long)cs->classid);
+        css_task_iter_start(css, &it);
+        while ((p = css_task_iter_next(&it))) {
+                task_lock(p);
+                iterate_fd(p->files, 0, update_classid_sock,
+                           (void *)(unsigned long)cs->classid);
+                task_unlock(p);
+        }
+        css_task_iter_end(&it);
+
         return 0;
 }
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9424673009c1..29be2466970c 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -105,15 +105,21 @@ static void queue_process(struct work_struct *work)
         while ((skb = skb_dequeue(&npinfo->txq))) {
                 struct net_device *dev = skb->dev;
                 struct netdev_queue *txq;
+                unsigned int q_index;
 
                 if (!netif_device_present(dev) || !netif_running(dev)) {
                         kfree_skb(skb);
                         continue;
                 }
 
-                txq = skb_get_tx_queue(dev, skb);
-
                 local_irq_save(flags);
+                /* check if skb->queue_mapping is still valid */
+                q_index = skb_get_queue_mapping(skb);
+                if (unlikely(q_index >= dev->real_num_tx_queues)) {
+                        q_index = q_index % dev->real_num_tx_queues;
+                        skb_set_queue_mapping(skb, q_index);
+                }
+                txq = netdev_get_tx_queue(dev, q_index);
                 HARD_TX_LOCK(dev, txq, smp_processor_id());
                 if (netif_xmit_frozen_or_stopped(txq) ||
                     netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 758f140b6bed..d28da7d363f1 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -20,9 +20,11 @@
 #include <net/tcp.h>
 
 static siphash_key_t net_secret __read_mostly;
+static siphash_key_t ts_secret __read_mostly;
 
 static __always_inline void net_secret_init(void)
 {
+        net_get_random_once(&ts_secret, sizeof(ts_secret));
         net_get_random_once(&net_secret, sizeof(net_secret));
 }
 #endif
@@ -45,6 +47,23 @@ static u32 seq_scale(u32 seq)
 #endif
 
 #if IS_ENABLED(CONFIG_IPV6)
+static u32 secure_tcpv6_ts_off(const __be32 *saddr, const __be32 *daddr)
+{
+        const struct {
+                struct in6_addr saddr;
+                struct in6_addr daddr;
+        } __aligned(SIPHASH_ALIGNMENT) combined = {
+                .saddr = *(struct in6_addr *)saddr,
+                .daddr = *(struct in6_addr *)daddr,
+        };
+
+        if (sysctl_tcp_timestamps != 1)
+                return 0;
+
+        return siphash(&combined, offsetofend(typeof(combined), daddr),
+                       &ts_secret);
+}
+
 u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
                                  __be16 sport, __be16 dport, u32 *tsoff)
 {
@@ -63,7 +82,7 @@ u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
         net_secret_init();
         hash = siphash(&combined, offsetofend(typeof(combined), dport),
                        &net_secret);
-        *tsoff = sysctl_tcp_timestamps == 1 ? (hash >> 32) : 0;
+        *tsoff = secure_tcpv6_ts_off(saddr, daddr);
         return seq_scale(hash);
 }
 EXPORT_SYMBOL(secure_tcpv6_sequence_number);
@@ -88,6 +107,14 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
 #endif
 
 #ifdef CONFIG_INET
+static u32 secure_tcp_ts_off(__be32 saddr, __be32 daddr)
+{
+        if (sysctl_tcp_timestamps != 1)
+                return 0;
+
+        return siphash_2u32((__force u32)saddr, (__force u32)daddr,
+                            &ts_secret);
+}
 
 /* secure_tcp_sequence_number(a, b, 0, d) == secure_ipv4_port_ephemeral(a, b, d),
  * but fortunately, `sport' cannot be 0 in any circumstances. If this changes,
@@ -103,7 +130,7 @@ u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
         hash = siphash_3u32((__force u32)saddr, (__force u32)daddr,
                             (__force u32)sport << 16 | (__force u32)dport,
                             &net_secret);
-        *tsoff = sysctl_tcp_timestamps == 1 ? (hash >> 32) : 0;
+        *tsoff = secure_tcp_ts_off(saddr, daddr);
         return seq_scale(hash);
 }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f3557958e9bf..f86bf69cfb8d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3082,22 +3082,32 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
         if (sg && csum && (mss != GSO_BY_FRAGS))  {
                 if (!(features & NETIF_F_GSO_PARTIAL)) {
                         struct sk_buff *iter;
+                        unsigned int frag_len;
 
                         if (!list_skb ||
                             !net_gso_ok(features, skb_shinfo(head_skb)->gso_type))
                                 goto normal;
 
-                        /* Split the buffer at the frag_list pointer.
-                         * This is based on the assumption that all
-                         * buffers in the chain excluding the last
-                         * containing the same amount of data.
+                        /* If we get here then all the required
+                         * GSO features except frag_list are supported.
+                         * Try to split the SKB to multiple GSO SKBs
+                         * with no frag_list.
+                         * Currently we can do that only when the buffers don't
+                         * have a linear part and all the buffers except
+                         * the last are of the same length.
                          */
+                        frag_len = list_skb->len;
                         skb_walk_frags(head_skb, iter) {
+                                if (frag_len != iter->len && iter->next)
+                                        goto normal;
                                 if (skb_headlen(iter))
                                         goto normal;
 
                                 len -= iter->len;
                         }
+
+                        if (len != frag_len)
+                                goto normal;
                 }
 
                 /* GSO partial only requires that we trim off any excess that
@@ -3694,6 +3704,15 @@ static void sock_rmem_free(struct sk_buff *skb)
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
 }
 
+static void skb_set_err_queue(struct sk_buff *skb)
+{
+        /* pkt_type of skbs received on local sockets is never PACKET_OUTGOING.
+         * So, it is safe to (mis)use it to mark skbs on the error queue.
+         */
+        skb->pkt_type = PACKET_OUTGOING;
+        BUILD_BUG_ON(PACKET_OUTGOING == 0);
+}
+
 /*
  * Note: We dont mem charge error packets (no sk_forward_alloc changes)
  */
@@ -3707,6 +3726,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
         skb->sk = sk;
         skb->destructor = sock_rmem_free;
         atomic_add(skb->truesize, &sk->sk_rmem_alloc);
+        skb_set_err_queue(skb);
 
         /* before exiting rcu section, make sure dst is refcounted */
         skb_dst_force(skb);
@@ -3783,16 +3803,21 @@ EXPORT_SYMBOL(skb_clone_sk);
 
 static void __skb_complete_tx_timestamp(struct sk_buff *skb,
                                         struct sock *sk,
-                                        int tstype)
+                                        int tstype,
+                                        bool opt_stats)
 {
         struct sock_exterr_skb *serr;
         int err;
 
+        BUILD_BUG_ON(sizeof(struct sock_exterr_skb) > sizeof(skb->cb));
+
         serr = SKB_EXT_ERR(skb);
         memset(serr, 0, sizeof(*serr));
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
         serr->ee.ee_info = tstype;
+        serr->opt_stats = opt_stats;
+        serr->header.h4.iif = skb->dev ? skb->dev->ifindex : 0;
         if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
                 serr->ee.ee_data = skb_shinfo(skb)->tskey;
                 if (sk->sk_protocol == IPPROTO_TCP &&
@@ -3828,13 +3853,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         if (!skb_may_tx_timestamp(sk, false))
                 return;
 
-        /* take a reference to prevent skb_orphan() from freeing the socket */
-        sock_hold(sk);
-
-        *skb_hwtstamps(skb) = *hwtstamps;
-        __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND);
-
-        sock_put(sk);
+        /* Take a reference to prevent skb_orphan() from freeing the socket,
+         * but only if the socket refcount is not zero.
+         */
+        if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+                *skb_hwtstamps(skb) = *hwtstamps;
+                __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND, false);
+                sock_put(sk);
+        }
 }
 EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp);
 
@@ -3843,7 +3869,7 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                      struct sock *sk, int tstype)
 {
         struct sk_buff *skb;
-        bool tsonly;
+        bool tsonly, opt_stats = false;
 
         if (!sk)
                 return;
@@ -3856,9 +3882,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
 #ifdef CONFIG_INET
                 if ((sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS) &&
                     sk->sk_protocol == IPPROTO_TCP &&
-                    sk->sk_type == SOCK_STREAM)
+                    sk->sk_type == SOCK_STREAM) {
                         skb = tcp_get_timestamping_opt_stats(sk);
-                else
+                        opt_stats = true;
+                } else
 #endif
                         skb = alloc_skb(0, GFP_ATOMIC);
         } else {
@@ -3877,7 +3904,7 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
         else
                 skb->tstamp = ktime_get_real();
 
-        __skb_complete_tx_timestamp(skb, sk, tstype);
+        __skb_complete_tx_timestamp(skb, sk, tstype, opt_stats);
 }
 EXPORT_SYMBOL_GPL(__skb_tstamp_tx);
 
@@ -3893,7 +3920,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
 {
         struct sock *sk = skb->sk;
         struct sock_exterr_skb *serr;
-        int err;
+        int err = 1;
 
         skb->wifi_acked_valid = 1;
         skb->wifi_acked = acked;
@@ -3903,14 +3930,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked)
         serr->ee.ee_errno = ENOMSG;
         serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS;
 
-        /* take a reference to prevent skb_orphan() from freeing the socket */
-        sock_hold(sk);
-
-        err = sock_queue_err_skb(sk, skb);
+        /* Take a reference to prevent skb_orphan() from freeing the socket,
+         * but only if the socket refcount is not zero.
+         */
+        if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) {
+                err = sock_queue_err_skb(sk, skb);
+                sock_put(sk);
+        }
         if (err)
                 kfree_skb(skb);
-
-        sock_put(sk);
 }
 EXPORT_SYMBOL_GPL(skb_complete_wifi_ack);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index f6fd79f33097..2c4f574168fb 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -197,66 +197,55 @@ EXPORT_SYMBOL(sk_net_capable);
 
 /*
  * Each address family might have different locking rules, so we have
- * one slock key per address family:
+ * one slock key per address family and separate keys for internal and
+ * userspace sockets.
  */
 static struct lock_class_key af_family_keys[AF_MAX];
+static struct lock_class_key af_family_kern_keys[AF_MAX];
 static struct lock_class_key af_family_slock_keys[AF_MAX];
+static struct lock_class_key af_family_kern_slock_keys[AF_MAX];
 
 /*
  * Make lock validator output more readable. (we pre-construct these
  * strings build-time, so that runtime initialization of socket
  * locks is fast):
  */
+
+#define _sock_locks(x)                                            \
+  x "AF_UNSPEC",        x "AF_UNIX"     ,       x "AF_INET"     , \
+  x "AF_AX25"  ,        x "AF_IPX"      ,       x "AF_APPLETALK", \
+  x "AF_NETROM",        x "AF_BRIDGE"   ,       x "AF_ATMPVC"   , \
+  x "AF_X25"   ,        x "AF_INET6"    ,       x "AF_ROSE"     , \
+  x "AF_DECnet",        x "AF_NETBEUI"  ,       x "AF_SECURITY" , \
+  x "AF_KEY"   ,        x "AF_NETLINK"  ,       x "AF_PACKET"   , \
+  x "AF_ASH"   ,        x "AF_ECONET"   ,       x "AF_ATMSVC"   , \
+  x "AF_RDS"   ,        x "AF_SNA"      ,       x "AF_IRDA"     , \
+  x "AF_PPPOX" ,        x "AF_WANPIPE"  ,       x "AF_LLC"      , \
+  x "27"       ,        x "28"          ,       x "AF_CAN"      , \
+  x "AF_TIPC"  ,        x "AF_BLUETOOTH",       x "IUCV"        , \
+  x "AF_RXRPC" ,        x "AF_ISDN"     ,       x "AF_PHONET"   , \
+  x "AF_IEEE802154",    x "AF_CAIF"     ,       x "AF_ALG"      , \
+  x "AF_NFC"   ,        x "AF_VSOCK"    ,       x "AF_KCM"      , \
+  x "AF_QIPCRTR",       x "AF_SMC"      ,       x "AF_MAX"
+
 static const char *const af_family_key_strings[AF_MAX+1] = {
-  "sk_lock-AF_UNSPEC", "sk_lock-AF_UNIX"     , "sk_lock-AF_INET"     ,
-  "sk_lock-AF_AX25"  , "sk_lock-AF_IPX"      , "sk_lock-AF_APPLETALK",
-  "sk_lock-AF_NETROM", "sk_lock-AF_BRIDGE"   , "sk_lock-AF_ATMPVC"   ,
-  "sk_lock-AF_X25"   , "sk_lock-AF_INET6"    , "sk_lock-AF_ROSE"     ,
-  "sk_lock-AF_DECnet", "sk_lock-AF_NETBEUI"  , "sk_lock-AF_SECURITY" ,
-  "sk_lock-AF_KEY"   , "sk_lock-AF_NETLINK"  , "sk_lock-AF_PACKET"   ,
-  "sk_lock-AF_ASH"   , "sk_lock-AF_ECONET"   , "sk_lock-AF_ATMSVC"   ,
-  "sk_lock-AF_RDS"   , "sk_lock-AF_SNA"      , "sk_lock-AF_IRDA"     ,
-  "sk_lock-AF_PPPOX" , "sk_lock-AF_WANPIPE"  , "sk_lock-AF_LLC"      ,
-  "sk_lock-27"       , "sk_lock-28"          , "sk_lock-AF_CAN"      ,
-  "sk_lock-AF_TIPC"  , "sk_lock-AF_BLUETOOTH", "sk_lock-IUCV"        ,
-  "sk_lock-AF_RXRPC" , "sk_lock-AF_ISDN"     , "sk_lock-AF_PHONET"   ,
-  "sk_lock-AF_IEEE802154", "sk_lock-AF_CAIF" , "sk_lock-AF_ALG"      ,
-  "sk_lock-AF_NFC"   , "sk_lock-AF_VSOCK"    , "sk_lock-AF_KCM"      ,
-  "sk_lock-AF_QIPCRTR", "sk_lock-AF_SMC"     , "sk_lock-AF_MAX"
+        _sock_locks("sk_lock-")
 };
 static const char *const af_family_slock_key_strings[AF_MAX+1] = {
-  "slock-AF_UNSPEC", "slock-AF_UNIX"     , "slock-AF_INET"     ,
-  "slock-AF_AX25"  , "slock-AF_IPX"      , "slock-AF_APPLETALK",
-  "slock-AF_NETROM", "slock-AF_BRIDGE"   , "slock-AF_ATMPVC"   ,
-  "slock-AF_X25"   , "slock-AF_INET6"    , "slock-AF_ROSE"     ,
-  "slock-AF_DECnet", "slock-AF_NETBEUI"  , "slock-AF_SECURITY" ,
-  "slock-AF_KEY"   , "slock-AF_NETLINK"  , "slock-AF_PACKET"   ,
-  "slock-AF_ASH"   , "slock-AF_ECONET"   , "slock-AF_ATMSVC"   ,
-  "slock-AF_RDS"   , "slock-AF_SNA"      , "slock-AF_IRDA"     ,
-  "slock-AF_PPPOX" , "slock-AF_WANPIPE"  , "slock-AF_LLC"      ,
-  "slock-27"       , "slock-28"          , "slock-AF_CAN"      ,
-  "slock-AF_TIPC"  , "slock-AF_BLUETOOTH", "slock-AF_IUCV"     ,
-  "slock-AF_RXRPC" , "slock-AF_ISDN"     , "slock-AF_PHONET"   ,
-  "slock-AF_IEEE802154", "slock-AF_CAIF" , "slock-AF_ALG"      ,
-  "slock-AF_NFC"   , "slock-AF_VSOCK"    ,"slock-AF_KCM"       ,
-  "slock-AF_QIPCRTR", "slock-AF_SMC"     , "slock-AF_MAX"
+        _sock_locks("slock-")
 };
 static const char *const af_family_clock_key_strings[AF_MAX+1] = {
-  "clock-AF_UNSPEC", "clock-AF_UNIX"     , "clock-AF_INET"     ,
-  "clock-AF_AX25"  , "clock-AF_IPX"      , "clock-AF_APPLETALK",
-  "clock-AF_NETROM", "clock-AF_BRIDGE"   , "clock-AF_ATMPVC"   ,
-  "clock-AF_X25"   , "clock-AF_INET6"    , "clock-AF_ROSE"     ,
-  "clock-AF_DECnet", "clock-AF_NETBEUI"  , "clock-AF_SECURITY" ,
-  "clock-AF_KEY"   , "clock-AF_NETLINK"  , "clock-AF_PACKET"   ,
-  "clock-AF_ASH"   , "clock-AF_ECONET"   , "clock-AF_ATMSVC"   ,
-  "clock-AF_RDS"   , "clock-AF_SNA"      , "clock-AF_IRDA"     ,
-  "clock-AF_PPPOX" , "clock-AF_WANPIPE"  , "clock-AF_LLC"      ,
-  "clock-27"       , "clock-28"          , "clock-AF_CAN"      ,
-  "clock-AF_TIPC"  , "clock-AF_BLUETOOTH", "clock-AF_IUCV"     ,
-  "clock-AF_RXRPC" , "clock-AF_ISDN"     , "clock-AF_PHONET"   ,
-  "clock-AF_IEEE802154", "clock-AF_CAIF" , "clock-AF_ALG"      ,
-  "clock-AF_NFC"   , "clock-AF_VSOCK"    , "clock-AF_KCM"      ,
-  "clock-AF_QIPCRTR", "clock-AF_SMC"     , "clock-AF_MAX"
+        _sock_locks("clock-")
+};
+
+static const char *const af_family_kern_key_strings[AF_MAX+1] = {
+        _sock_locks("k-sk_lock-")
+};
+static const char *const af_family_kern_slock_key_strings[AF_MAX+1] = {
+        _sock_locks("k-slock-")
+};
+static const char *const af_family_kern_clock_key_strings[AF_MAX+1] = {
+        _sock_locks("k-clock-")
 };
 
 /*
@@ -264,6 +253,7 @@ static const char *const af_family_clock_key_strings[AF_MAX+1] = {
  * so split the lock classes by using a per-AF key:
  */
 static struct lock_class_key af_callback_keys[AF_MAX];
+static struct lock_class_key af_kern_callback_keys[AF_MAX];
 
 /* Take into consideration the size of the struct sk_buff overhead in the
  * determination of these values, since that is non-constant across
@@ -1293,7 +1283,16 @@ lenout:
  */
 static inline void sock_lock_init(struct sock *sk)
 {
-        sock_lock_init_class_and_name(sk,
+        if (sk->sk_kern_sock)
+                sock_lock_init_class_and_name(
+                        sk,
+                        af_family_kern_slock_key_strings[sk->sk_family],
+                        af_family_kern_slock_keys + sk->sk_family,
+                        af_family_kern_key_strings[sk->sk_family],
+                        af_family_kern_keys + sk->sk_family);
+        else
+                sock_lock_init_class_and_name(
+                        sk,
                         af_family_slock_key_strings[sk->sk_family],
                         af_family_slock_keys + sk->sk_family,
                         af_family_key_strings[sk->sk_family],
@@ -1399,6 +1398,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                  * why we need sk_prot_creator -acme
                  */
                 sk->sk_prot = sk->sk_prot_creator = prot;
+                sk->sk_kern_sock = kern;
                 sock_lock_init(sk);
                 sk->sk_net_refcnt = kern ? 0 : 1;
                 if (likely(sk->sk_net_refcnt))
@@ -1442,6 +1442,11 @@ static void __sk_destruct(struct rcu_head *head)
                 pr_debug("%s: optmem leakage (%d bytes) detected\n",
                          __func__, atomic_read(&sk->sk_omem_alloc));
 
+        if (sk->sk_frag.page) {
+                put_page(sk->sk_frag.page);
+                sk->sk_frag.page = NULL;
+        }
+
         if (sk->sk_peer_cred)
                 put_cred(sk->sk_peer_cred);
         put_pid(sk->sk_peer_pid);
@@ -1539,6 +1544,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                         is_charged = sk_filter_charge(newsk, filter);
 
                 if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) {
+                        /* We need to make sure that we don't uncharge the new
+                         * socket if we couldn't charge it in the first place
+                         * as otherwise we uncharge the parent's filter.
+                         */
+                        if (!is_charged)
+                                RCU_INIT_POINTER(newsk->sk_filter, NULL);
                         sk_free_unlock_clone(newsk);
                         newsk = NULL;
                         goto out;
@@ -2277,7 +2288,8 @@ int sock_no_socketpair(struct socket *sock1, struct socket *sock2)
 }
 EXPORT_SYMBOL(sock_no_socketpair);
 
-int sock_no_accept(struct socket *sock, struct socket *newsock, int flags)
+int sock_no_accept(struct socket *sock, struct socket *newsock, int flags,
+                   bool kern)
 {
         return -EOPNOTSUPP;
 }
@@ -2481,7 +2493,14 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         }
 
         rwlock_init(&sk->sk_callback_lock);
-        lockdep_set_class_and_name(&sk->sk_callback_lock,
+        if (sk->sk_kern_sock)
+                lockdep_set_class_and_name(
+                        &sk->sk_callback_lock,
+                        af_kern_callback_keys + sk->sk_family,
+                        af_family_kern_clock_key_strings[sk->sk_family]);
+        else
+                lockdep_set_class_and_name(
+                        &sk->sk_callback_lock,
                         af_callback_keys + sk->sk_family,
                         af_family_clock_key_strings[sk->sk_family]);
 
@@ -2779,11 +2798,6 @@ void sk_common_release(struct sock *sk)
 
         sk_refcnt_debug_release(sk);
 
-        if (sk->sk_frag.page) {
-                put_page(sk->sk_frag.page);
-                sk->sk_frag.page = NULL;
-        }
-
         sock_put(sk);
 }
 EXPORT_SYMBOL(sk_common_release);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 4ead336e14ea..7f9cc400eca0 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -408,14 +408,16 @@ static struct ctl_table net_core_table[] = {
                 .data           = &sysctl_net_busy_poll,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
         {
                 .procname       = "busy_read",
                 .data           = &sysctl_net_busy_read,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
 #endif
 #ifdef CONFIG_NET_SCHED
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index f053198e730c..5e3a7302f774 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk)
         for (i = 0; i < hc->tx_seqbufc; i++)
                 kfree(hc->tx_seqbuf[i]);
         hc->tx_seqbufc = 0;
+        dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
 
 static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 409d0cfd3447..b99168b0fabf 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -289,7 +289,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
 
         switch (type) {
         case ICMP_REDIRECT:
-                dccp_do_redirect(skb, sk);
+                if (!sock_owned_by_user(sk))
+                        dccp_do_redirect(skb, sk);
                 goto out;
         case ICMP_SOURCE_QUENCH:
                 /* Just silently ignore these. */
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 233b57367758..d9b6a4e403e7 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -122,10 +122,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
-                if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                        if (dst)
+                                dst->ops->redirect(dst, sk, skb);
+                }
                 goto out;
         }
 
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index e267e6f4c9a5..abd07a443219 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -142,6 +142,13 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
         struct dccp_request_sock *dreq = dccp_rsk(req);
         bool own_req;
 
+        /* TCP/DCCP listeners became lockless.
+         * DCCP stores complex state in its request_sock, so we need
+         * a protection for them, now this code runs without being protected
+         * by the parent (listener) lock.
+         */
+        spin_lock_bh(&dreq->dreq_lock);
+
         /* Check for retransmitted REQUEST */
         if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) {
 
@@ -156,7 +163,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
                         inet_rtx_syn_ack(sk, req);
                 }
                 /* Network Duplicate, discard packet */
-                return NULL;
+                goto out;
         }
 
         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR;
@@ -182,20 +189,20 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb,
 
         child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL,
                                                          req, &own_req);
-        if (!child)
-                goto listen_overflow;
-
-        return inet_csk_complete_hashdance(sk, child, req, own_req);
+        if (child) {
+                child = inet_csk_complete_hashdance(sk, child, req, own_req);
+                goto out;
+        }
 
-listen_overflow:
-        dccp_pr_debug("listen_overflow!\n");
         DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
 drop:
         if (dccp_hdr(skb)->dccph_type != DCCP_PKT_RESET)
                 req->rsk_ops->send_reset(sk, skb);
 
         inet_csk_reqsk_queue_drop(sk, req);
-        return NULL;
+out:
+        spin_unlock_bh(&dreq->dreq_lock);
+        return child;
 }
 
 EXPORT_SYMBOL_GPL(dccp_check_req);
@@ -246,6 +253,7 @@ int dccp_reqsk_init(struct request_sock *req,
 {
         struct dccp_request_sock *dreq = dccp_rsk(req);
 
+        spin_lock_init(&dreq->dreq_lock);
         inet_rsk(req)->ir_rmt_port = dccp_hdr(skb)->dccph_sport;
         inet_rsk(req)->ir_num      = ntohs(dccp_hdr(skb)->dccph_dport);
         inet_rsk(req)->acked       = 0;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index e6e79eda9763..7de5b40a5d0d 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1070,7 +1070,8 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
         return skb == NULL ? ERR_PTR(err) : skb;
 }
 
-static int dn_accept(struct socket *sock, struct socket *newsock, int flags)
+static int dn_accept(struct socket *sock, struct socket *newsock, int flags,
+                     bool kern)
 {
         struct sock *sk = sock->sk, *newsk;
         struct sk_buff *skb = NULL;
@@ -1099,7 +1100,7 @@ static int dn_accept(struct socket *sock, struct socket *newsock, int flags)
 
         cb = DN_SKB_CB(skb);
         sk->sk_ack_backlog--;
-        newsk = dn_alloc_sock(sock_net(sk), newsock, sk->sk_allocation, 0);
+        newsk = dn_alloc_sock(sock_net(sk), newsock, sk->sk_allocation, kern);
         if (newsk == NULL) {
                 release_sock(sk);
                 kfree_skb(skb);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 602d40f43687..6b1fc6e4278e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -689,11 +689,12 @@ EXPORT_SYMBOL(inet_stream_connect);
  *      Accept a pending connection. The TCP layer now gives BSD semantics.
  */
 
-int inet_accept(struct socket *sock, struct socket *newsock, int flags)
+int inet_accept(struct socket *sock, struct socket *newsock, int flags,
+                bool kern)
 {
         struct sock *sk1 = sock->sk;
         int err = -EINVAL;
-        struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err);
+        struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err, kern);
 
         if (!sk2)
                 goto do_err;
@@ -1487,8 +1488,10 @@ int inet_gro_complete(struct sk_buff *skb, int nhoff)
         int proto = iph->protocol;
         int err = -ENOSYS;
 
-        if (skb->encapsulation)
+        if (skb->encapsulation) {
+                skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IP));
                 skb_set_inner_network_header(skb, nhoff);
+        }
 
         csum_replace2(&iph->check, iph->tot_len, newlen);
         iph->tot_len = newlen;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 42bfd08109dd..8f2133ffc2ff 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1083,7 +1083,8 @@ static void nl_fib_input(struct sk_buff *skb)
 
         net = sock_net(skb->sk);
         nlh = nlmsg_hdr(skb);
-        if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len ||
+        if (skb->len < nlmsg_total_size(sizeof(*frn)) ||
+            skb->len < nlh->nlmsg_len ||
             nlmsg_len(nlh) < sizeof(*frn))
                 return;
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index b4d5980ade3b..5e313c1ac94f 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -424,7 +424,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
 /*
  * This will accept the next outstanding connection.
  */
-struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
+struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct request_sock_queue *queue = &icsk->icsk_accept_queue;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index bbe7f72db9c1..b3cdeec85f1f 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -198,6 +198,7 @@ static void ip_expire(unsigned long arg)
         qp = container_of((struct inet_frag_queue *) arg, struct ipq, q);
         net = container_of(qp->q.net, struct net, ipv4.frags);
 
+        rcu_read_lock();
         spin_lock(&qp->q.lock);
 
         if (qp->q.flags & INET_FRAG_COMPLETE)
@@ -207,7 +208,7 @@ static void ip_expire(unsigned long arg)
         __IP_INC_STATS(net, IPSTATS_MIB_REASMFAILS);
 
         if (!inet_frag_evicting(&qp->q)) {
-                struct sk_buff *head = qp->q.fragments;
+                struct sk_buff *clone, *head = qp->q.fragments;
                 const struct iphdr *iph;
                 int err;
 
@@ -216,32 +217,40 @@ static void ip_expire(unsigned long arg)
                 if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments)
                         goto out;
 
-                rcu_read_lock();
                 head->dev = dev_get_by_index_rcu(net, qp->iif);
                 if (!head->dev)
-                        goto out_rcu_unlock;
+                        goto out;
+
 
                 /* skb has no dst, perform route lookup again */
                 iph = ip_hdr(head);
                 err = ip_route_input_noref(head, iph->daddr, iph->saddr,
                                            iph->tos, head->dev);
                 if (err)
-                        goto out_rcu_unlock;
+                        goto out;
 
                 /* Only an end host needs to send an ICMP
                  * "Fragment Reassembly Timeout" message, per RFC792.
                  */
                 if (frag_expire_skip_icmp(qp->user) &&
                     (skb_rtable(head)->rt_type != RTN_LOCAL))
-                        goto out_rcu_unlock;
+                        goto out;
+
+                clone = skb_clone(head, GFP_ATOMIC);
 
                 /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-out_rcu_unlock:
-                rcu_read_unlock();
+                if (clone) {
+                        spin_unlock(&qp->q.lock);
+                        icmp_send(clone, ICMP_TIME_EXCEEDED,
+                                  ICMP_EXC_FRAGTIME, 0);
+                        consume_skb(clone);
+                        goto out_rcu_unlock;
+                }
         }
 out:
         spin_unlock(&qp->q.lock);
+out_rcu_unlock:
+        rcu_read_unlock();
         ipq_put(qp);
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 737ce826d7ec..7a3fd25e8913 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -966,7 +966,7 @@ static int __ip_append_data(struct sock *sk,
         cork->length += length;
         if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
             (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ebd953bc5607..1d46d05efb0f 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -488,16 +488,15 @@ static bool ipv4_datagram_support_cmsg(const struct sock *sk,
                 return false;
 
         /* Support IP_PKTINFO on tstamp packets if requested, to correlate
-         * timestamp with egress dev. Not possible for packets without dev
+         * timestamp with egress dev. Not possible for packets without iif
          * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
          */
-        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
-            (!skb->dev))
+        info = PKTINFO_SKB_CB(skb);
+        if (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG) ||
+            !info->ipi_ifindex)
                 return false;
 
-        info = PKTINFO_SKB_CB(skb);
         info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
-        info->ipi_ifindex = skb->dev->ifindex;
         return true;
 }
 
@@ -591,6 +590,7 @@ static bool setsockopt_needs_rtnl(int optname)
         case MCAST_LEAVE_GROUP:
         case MCAST_LEAVE_SOURCE_GROUP:
         case MCAST_UNBLOCK_SOURCE:
+        case IP_ROUTER_ALERT:
                 return true;
         }
         return false;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index fd9f34bbd740..dfb2ab2dd3c8 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -306,7 +306,7 @@ static void __init ic_close_devs(void)
         while ((d = next)) {
                 next = d->next;
                 dev = d->dev;
-                if ((!ic_dev || dev != ic_dev->dev) && !netdev_uses_dsa(dev)) {
+                if (d != ic_dev && !netdev_uses_dsa(dev)) {
                         pr_debug("IP-Config: Downing %s\n", dev->name);
                         dev_change_flags(dev, d->flags);
                 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index c0317c940bcd..b036e85e093b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1278,7 +1278,7 @@ static void mrtsock_destruct(struct sock *sk)
         struct net *net = sock_net(sk);
         struct mr_table *mrt;
 
-        rtnl_lock();
+        ASSERT_RTNL();
         ipmr_for_each_table(mrt, net) {
                 if (sk == rtnl_dereference(mrt->mroute_sk)) {
                         IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
@@ -1289,7 +1289,6 @@ static void mrtsock_destruct(struct sock *sk)
                         mroute_clean_tables(mrt, false);
                 }
         }
-        rtnl_unlock();
 }
 
 /* Socket options and virtual interface manipulation. The whole
@@ -1353,13 +1352,8 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
                 if (sk != rcu_access_pointer(mrt->mroute_sk)) {
                         ret = -EACCES;
                 } else {
-                        /* We need to unlock here because mrtsock_destruct takes
-                         * care of rtnl itself and we can't change that due to
-                         * the IP_ROUTER_ALERT setsockopt which runs without it.
-                         */
-                        rtnl_unlock();
                         ret = ip_ra_control(sk, 0, NULL);
-                        goto out;
+                        goto out_unlock;
                 }
                 break;
         case MRT_ADD_VIF:
@@ -1470,7 +1464,6 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval,
         }
 out_unlock:
         rtnl_unlock();
-out:
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 52f26459efc3..9b8841316e7b 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -461,7 +461,7 @@ static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
 
         clusterip_config_put(cipinfo->config);
 
-        nf_ct_netns_get(par->net, par->family);
+        nf_ct_netns_put(par->net, par->family);
 }
 
 #ifdef CONFIG_COMPAT
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index bc1486f2c064..2e14ed11a35c 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -165,6 +165,10 @@ static unsigned int ipv4_conntrack_local(void *priv,
         if (skb->len < sizeof(struct iphdr) ||
             ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
+
+        if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+                return NF_ACCEPT;
+
         return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index f8aad03d674b..6f5e8d01b876 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -255,11 +255,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb,
         /* maniptype == SRC for postrouting. */
         enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook);
 
-        /* We never see fragments: conntrack defrags on pre-routing
-         * and local-out, and nf_nat_out protects post-routing.
-         */
-        NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
-
         ct = nf_ct_get(skb, &ctinfo);
         /* Can't track?  It's not due to stress, or conntrack would
          * have dropped it.  Hence it's the user's responsibilty to
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index c9b52c361da2..53e49f5011d3 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -1260,16 +1260,6 @@ static const struct nf_conntrack_expect_policy snmp_exp_policy = {
         .timeout        = 180,
 };
 
-static struct nf_conntrack_helper snmp_helper __read_mostly = {
-        .me                     = THIS_MODULE,
-        .help                   = help,
-        .expect_policy          = &snmp_exp_policy,
-        .name                   = "snmp",
-        .tuple.src.l3num        = AF_INET,
-        .tuple.src.u.udp.port   = cpu_to_be16(SNMP_PORT),
-        .tuple.dst.protonum     = IPPROTO_UDP,
-};
-
 static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
         .me                     = THIS_MODULE,
         .help                   = help,
@@ -1288,22 +1278,16 @@ static struct nf_conntrack_helper snmp_trap_helper __read_mostly = {
 
 static int __init nf_nat_snmp_basic_init(void)
 {
-        int ret = 0;
-
         BUG_ON(nf_nat_snmp_hook != NULL);
         RCU_INIT_POINTER(nf_nat_snmp_hook, help);
 
-        ret = nf_conntrack_helper_register(&snmp_trap_helper);
-        if (ret < 0) {
-                nf_conntrack_helper_unregister(&snmp_helper);
-                return ret;
-        }
-        return ret;
+        return nf_conntrack_helper_register(&snmp_trap_helper);
 }
 
 static void __exit nf_nat_snmp_basic_fini(void)
 {
         RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
+        synchronize_rcu();
         nf_conntrack_helper_unregister(&snmp_trap_helper);
 }
 
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index a0ea8aad1bf1..f18677277119 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -26,10 +26,10 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
         }
         regs->verdict.code = nf_nat_masquerade_ipv4(pkt->skb, nft_hook(pkt),
                                                     &range, nft_out(pkt));
diff --git a/net/ipv4/netfilter/nft_redir_ipv4.c b/net/ipv4/netfilter/nft_redir_ipv4.c
index 1650ed23c15d..5120be1d3118 100644
--- a/net/ipv4/netfilter/nft_redir_ipv4.c
+++ b/net/ipv4/netfilter/nft_redir_ipv4.c
@@ -26,10 +26,10 @@ static void nft_redir_ipv4_eval(const struct nft_expr *expr,
 
         memset(&mr, 0, sizeof(mr));
         if (priv->sreg_proto_min) {
-                mr.range[0].min.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                mr.range[0].max.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                mr.range[0].min.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                mr.range[0].max.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 mr.range[0].flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 2af6244b83e2..ccfbce13a633 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -156,17 +156,18 @@ int ping_hash(struct sock *sk)
 void ping_unhash(struct sock *sk)
 {
         struct inet_sock *isk = inet_sk(sk);
+
         pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
+        write_lock_bh(&ping_table.lock);
         if (sk_hashed(sk)) {
-                write_lock_bh(&ping_table.lock);
                 hlist_nulls_del(&sk->sk_nulls_node);
                 sk_nulls_node_init(&sk->sk_nulls_node);
                 sock_put(sk);
                 isk->inet_num = 0;
                 isk->inet_sport = 0;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
-                write_unlock_bh(&ping_table.lock);
         }
+        write_unlock_bh(&ping_table.lock);
 }
 EXPORT_SYMBOL_GPL(ping_unhash);
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 8119e1f66e03..9d943974de2b 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -682,7 +682,9 @@ static void raw_close(struct sock *sk, long timeout)
         /*
          * Raw sockets may have direct kernel references. Kill them.
          */
+        rtnl_lock();
         ip_ra_control(sk, 0, NULL);
+        rtnl_unlock();
 
         sk_common_release(sk);
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8471dd116771..acd69cfe2951 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2620,7 +2620,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
         skb_reset_network_header(skb);
 
         /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
-        ip_hdr(skb)->protocol = IPPROTO_ICMP;
+        ip_hdr(skb)->protocol = IPPROTO_UDP;
         skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
 
         src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cf4555581282..40ba4249a586 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2322,6 +2322,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
+        tcp_saved_syn_free(tp);
 
         /* Clean up fastopen related fields */
         tcp_free_fastopen_req(tp);
@@ -2770,7 +2771,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 {
         const struct tcp_sock *tp = tcp_sk(sk); /* iff sk_type == SOCK_STREAM */
         const struct inet_connection_sock *icsk = inet_csk(sk);
-        u32 now = tcp_time_stamp, intv;
+        u32 now, intv;
         u64 rate64;
         bool slow;
         u32 rate;
@@ -2839,6 +2840,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_retrans = tp->retrans_out;
         info->tcpi_fackets = tp->fackets_out;
 
+        now = tcp_time_stamp;
         info->tcpi_last_data_sent = jiffies_to_msecs(now - tp->lsndtime);
         info->tcpi_last_data_recv = jiffies_to_msecs(now - icsk->icsk_ack.lrcvtime);
         info->tcpi_last_ack_recv = jiffies_to_msecs(now - tp->rcv_tstamp);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 39c393cc0fd3..659d1baefb2b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -126,7 +126,8 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
 #define REXMIT_LOST     1 /* retransmit packets marked lost */
 #define REXMIT_NEW      2 /* FRTO-style transmit of unsent/new packets */
 
-static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
+static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb,
+                             unsigned int len)
 {
         static bool __once __read_mostly;
 
@@ -137,8 +138,9 @@ static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
 
                 rcu_read_lock();
                 dev = dev_get_by_index_rcu(sock_net(sk), skb->skb_iif);
-                pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
-                        dev ? dev->name : "Unknown driver");
+                if (!dev || len >= dev->mtu)
+                        pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
+                                dev ? dev->name : "Unknown driver");
                 rcu_read_unlock();
         }
 }
@@ -161,8 +163,10 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
         if (len >= icsk->icsk_ack.rcv_mss) {
                 icsk->icsk_ack.rcv_mss = min_t(unsigned int, len,
                                                tcp_sk(sk)->advmss);
-                if (unlikely(icsk->icsk_ack.rcv_mss != len))
-                        tcp_gro_dev_warn(sk, skb);
+                /* Account for possibly-removed options */
+                if (unlikely(len > icsk->icsk_ack.rcv_mss +
+                                   MAX_TCP_OPTION_SPACE))
+                        tcp_gro_dev_warn(sk, skb, len);
         } else {
                 /* Otherwise, we make more careful check taking into account,
                  * that SACKs block is variable.
@@ -874,22 +878,11 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
                                   const int ts)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        if (metric > tp->reordering) {
-                int mib_idx;
+        int mib_idx;
 
+        if (metric > tp->reordering) {
                 tp->reordering = min(sysctl_tcp_max_reordering, metric);
 
-                /* This exciting event is worth to be remembered. 8) */
-                if (ts)
-                        mib_idx = LINUX_MIB_TCPTSREORDER;
-                else if (tcp_is_reno(tp))
-                        mib_idx = LINUX_MIB_TCPRENOREORDER;
-                else if (tcp_is_fack(tp))
-                        mib_idx = LINUX_MIB_TCPFACKREORDER;
-                else
-                        mib_idx = LINUX_MIB_TCPSACKREORDER;
-
-                NET_INC_STATS(sock_net(sk), mib_idx);
 #if FASTRETRANS_DEBUG > 1
                 pr_debug("Disorder%d %d %u f%u s%u rr%d\n",
                          tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
@@ -902,6 +895,18 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
         }
 
         tp->rack.reord = 1;
+
+        /* This exciting event is worth to be remembered. 8) */
+        if (ts)
+                mib_idx = LINUX_MIB_TCPTSREORDER;
+        else if (tcp_is_reno(tp))
+                mib_idx = LINUX_MIB_TCPRENOREORDER;
+        else if (tcp_is_fack(tp))
+                mib_idx = LINUX_MIB_TCPFACKREORDER;
+        else
+                mib_idx = LINUX_MIB_TCPSACKREORDER;
+
+        NET_INC_STATS(sock_net(sk), mib_idx);
 }
 
 /* This must be called before lost_out is incremented */
@@ -1930,6 +1935,7 @@ void tcp_enter_loss(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct net *net = sock_net(sk);
         struct sk_buff *skb;
+        bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery;
         bool is_reneg;                  /* is receiver reneging on SACKs? */
         bool mark_lost;
 
@@ -1989,15 +1995,18 @@ void tcp_enter_loss(struct sock *sk)
         tp->high_seq = tp->snd_nxt;
         tcp_ecn_queue_cwr(tp);
 
-        /* F-RTO RFC5682 sec 3.1 step 1 mandates to disable F-RTO
-         * if a previous recovery is underway, otherwise it may incorrectly
-         * call a timeout spurious if some previously retransmitted packets
-         * are s/acked (sec 3.2). We do not apply that retriction since
-         * retransmitted skbs are permanently tagged with TCPCB_EVER_RETRANS
-         * so FLAG_ORIG_SACK_ACKED is always correct. But we do disable F-RTO
-         * on PTMU discovery to avoid sending new data.
+        /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
+         * loss recovery is underway except recurring timeout(s) on
+         * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing
+         *
+         * In theory F-RTO can be used repeatedly during loss recovery.
+         * In practice this interacts badly with broken middle-boxes that
+         * falsely raise the receive window, which results in repeated
+         * timeouts and stop-and-go behavior.
          */
-        tp->frto = sysctl_tcp_frto && !inet_csk(sk)->icsk_mtup.probe_size;
+        tp->frto = sysctl_tcp_frto &&
+                   (new_recovery || icsk->icsk_retransmits) &&
+                   !inet_csk(sk)->icsk_mtup.probe_size;
 }
 
 /* If ACK arrived pointing to a remembered SACK, it means that our
@@ -5541,6 +5550,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
         struct inet_connection_sock *icsk = inet_csk(sk);
 
         tcp_set_state(sk, TCP_ESTABLISHED);
+        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
         if (skb) {
                 icsk->icsk_af_ops->sk_rx_dst_set(sk, skb);
@@ -5759,7 +5769,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                          * to stand against the temptation 8)     --ANK
                          */
                         inet_csk_schedule_ack(sk);
-                        icsk->icsk_ack.lrcvtime = tcp_time_stamp;
                         tcp_enter_quickack_mode(sk);
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
                                                   TCP_DELACK_MAX, TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9a89b8deafae..575e19dcc017 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -279,10 +279,13 @@ EXPORT_SYMBOL(tcp_v4_connect);
  */
 void tcp_v4_mtu_reduced(struct sock *sk)
 {
-        struct dst_entry *dst;
         struct inet_sock *inet = inet_sk(sk);
-        u32 mtu = tcp_sk(sk)->mtu_info;
+        struct dst_entry *dst;
+        u32 mtu;
 
+        if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+                return;
+        mtu = tcp_sk(sk)->mtu_info;
         dst = inet_csk_update_pmtu(sk, mtu);
         if (!dst)
                 return;
@@ -428,7 +431,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 
         switch (type) {
         case ICMP_REDIRECT:
-                do_redirect(icmp_skb, sk);
+                if (!sock_owned_by_user(sk))
+                        do_redirect(icmp_skb, sk);
                 goto out;
         case ICMP_SOURCE_QUENCH:
                 /* Just silently ignore these. */
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 7e16243cdb58..65c0f3d13eca 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -460,6 +460,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
                 newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT);
                 minmax_reset(&newtp->rtt_min, tcp_time_stamp, ~0U);
                 newicsk->icsk_rto = TCP_TIMEOUT_INIT;
+                newicsk->icsk_ack.lrcvtime = tcp_time_stamp;
 
                 newtp->packets_out = 0;
                 newtp->retrans_out = 0;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 22548b5f05cb..c3c082ed3879 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2999,6 +2999,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
 {
         struct sk_buff *skb;
 
+        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
+
         /* NOTE: No TCP options attached and we never retransmit this. */
         skb = alloc_skb(MAX_TCP_HEADER, priority);
         if (!skb) {
@@ -3014,8 +3016,6 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         /* Send it off. */
         if (tcp_transmit_skb(sk, skb, 0, priority))
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
-
-        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
 }
 
 /* Send a crossed SYN-ACK during socket establishment.
diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c
index 4ecb38ae8504..d8acbd9f477a 100644
--- a/net/ipv4/tcp_recovery.c
+++ b/net/ipv4/tcp_recovery.c
@@ -12,7 +12,8 @@ static void tcp_rack_mark_skb_lost(struct sock *sk, struct sk_buff *skb)
                 /* Account for retransmits that are lost again */
                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                 tp->retrans_out -= tcp_skb_pcount(skb);
-                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSTRETRANSMIT);
+                NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPLOSTRETRANSMIT,
+                              tcp_skb_pcount(skb));
         }
 }
 
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 40d893556e67..b2ab411c6d37 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -249,7 +249,8 @@ void tcp_delack_timer_handler(struct sock *sk)
 
         sk_mem_reclaim_partial(sk);
 
-        if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+        if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+            !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
                 goto out;
 
         if (time_after(icsk->icsk_ack.timeout, jiffies)) {
@@ -552,7 +553,8 @@ void tcp_write_timer_handler(struct sock *sk)
         struct inet_connection_sock *icsk = inet_csk(sk);
         int event;
 
-        if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending)
+        if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
+            !icsk->icsk_pending)
                 goto out;
 
         if (time_after(icsk->icsk_timeout, jiffies)) {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 363172527e43..80ce478c4851 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3626,14 +3626,19 @@ restart:
         INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
                 struct rt6_info *rt = NULL;
+                bool keep;
 
                 addrconf_del_dad_work(ifa);
 
+                keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
+                        !addr_is_local(&ifa->addr);
+                if (!keep)
+                        list_move(&ifa->if_list, &del_list);
+
                 write_unlock_bh(&idev->lock);
                 spin_lock_bh(&ifa->lock);
 
-                if (keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
-                    !addr_is_local(&ifa->addr)) {
+                if (keep) {
                         /* set state to skip the notifier below */
                         state = INET6_IFADDR_STATE_DEAD;
                         ifa->state = 0;
@@ -3645,8 +3650,6 @@ restart:
                 } else {
                         state = ifa->state;
                         ifa->state = INET6_IFADDR_STATE_DEAD;
-
-                        list_move(&ifa->if_list, &del_list);
                 }
 
                 spin_unlock_bh(&ifa->lock);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 04db40620ea6..a9a9553ee63d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -920,12 +920,12 @@ static int __init inet6_init(void)
         err = register_pernet_subsys(&inet6_net_ops);
         if (err)
                 goto register_pernet_fail;
-        err = icmpv6_init();
-        if (err)
-                goto icmp_fail;
         err = ip6_mr_init();
         if (err)
                 goto ipmr_fail;
+        err = icmpv6_init();
+        if (err)
+                goto icmp_fail;
         err = ndisc_init();
         if (err)
                 goto ndisc_fail;
@@ -1061,10 +1061,10 @@ igmp_fail:
         ndisc_cleanup();
 ndisc_fail:
         ip6_mr_cleanup();
-ipmr_fail:
-        icmpv6_cleanup();
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
+ipmr_fail:
+        icmpv6_cleanup();
 register_pernet_fail:
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index eec27f87efac..e011122ebd43 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -405,9 +405,6 @@ static inline bool ipv6_datagram_support_addr(struct sock_exterr_skb *serr)
  * At one point, excluding local errors was a quick test to identify icmp/icmp6
  * errors. This is no longer true, but the test remained, so the v6 stack,
  * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
- *
- * Timestamp code paths do not initialize the fields expected by cmsg:
- * the PKTINFO fields in skb->cb[]. Fill those in here.
  */
 static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
                                       struct sock_exterr_skb *serr)
@@ -419,14 +416,9 @@ static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
         if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
                 return false;
 
-        if (!skb->dev)
+        if (!IP6CB(skb)->iif)
                 return false;
 
-        if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = skb->dev->ifindex;
-        else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
-
         return true;
 }
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 275cac628a95..25192a3b0cd7 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -388,7 +388,6 @@ looped_back:
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
                                   ((&hdr->segments_left) -
                                    skb_network_header(skb)));
-                kfree_skb(skb);
                 return -1;
         }
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index e4266746e4a2..d4bf2c68a545 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -923,6 +923,8 @@ add:
                         ins = &rt->dst.rt6_next;
                         iter = *ins;
                         while (iter) {
+                                if (iter->rt6i_metric > rt->rt6i_metric)
+                                        break;
                                 if (rt6_qualify_for_ecmp(iter)) {
                                         *ins = iter->dst.rt6_next;
                                         fib6_purge_rt(iter, fn, info->nl_net);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index aacfb4bce153..c45b12b4431c 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -122,11 +122,14 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                         max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
         /*
          * RFC4291 2.5.3
+         * The loopback address must not be used as the source address in IPv6
+         * packets that are sent outside of a single node. [..]
          * A packet received on an interface with a destination address
          * of loopback must be dropped.
          */
-        if (!(dev->flags & IFF_LOOPBACK) &&
-            ipv6_addr_loopback(&hdr->daddr))
+        if ((ipv6_addr_loopback(&hdr->saddr) ||
+             ipv6_addr_loopback(&hdr->daddr)) &&
+             !(dev->flags & IFF_LOOPBACK))
                 goto err;
 
         /* RFC4291 Errata ID: 3480
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 0838e6d01d2e..93e58a5e1837 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -294,8 +294,10 @@ static int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
         struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + nhoff);
         int err = -ENOSYS;
 
-        if (skb->encapsulation)
+        if (skb->encapsulation) {
+                skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
                 skb_set_inner_network_header(skb, nhoff);
+        }
 
         iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 528b3c1f3fde..58f6288e9ba5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -768,13 +768,14 @@ slow_path:
          *      Fragment the datagram.
          */
 
-        *prevhdr = NEXTHDR_FRAGMENT;
         troom = rt->dst.dev->needed_tailroom;
 
         /*
          *      Keep copying data until we run out.
          */
         while (left > 0)        {
+                u8 *fragnexthdr_offset;
+
                 len = left;
                 /* IF: it doesn't fit, use 'mtu' - the data space left */
                 if (len > mtu)
@@ -819,6 +820,10 @@ slow_path:
                  */
                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
+                fragnexthdr_offset = skb_network_header(frag);
+                fragnexthdr_offset += prevhdr - skb_network_header(skb);
+                *fragnexthdr_offset = NEXTHDR_FRAGMENT;
+
                 /*
                  *      Build fragment header.
                  */
@@ -1385,7 +1390,7 @@ emsgsize:
         if ((((length + fragheaderlen) > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
             (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 644ba59fbd9d..3d8a3b63b4fd 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -485,11 +485,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
 
-                if (skb->protocol == htons(ETH_P_IPV6))
+                if (skb->protocol == htons(ETH_P_IPV6)) {
+                        if (mtu < IPV6_MIN_MTU)
+                                mtu = IPV6_MIN_MTU;
+
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
-                else
+                } else {
                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                                   htonl(mtu));
+                }
 
                 return -EMSGSIZE;
         }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 6ba6c900ebcf..bf34d0950752 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -774,7 +774,8 @@ failure:
  *      Delete a VIF entry
  */
 
-static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
+static int mif6_delete(struct mr6_table *mrt, int vifi, int notify,
+                       struct list_head *head)
 {
         struct mif_device *v;
         struct net_device *dev;
@@ -820,7 +821,7 @@ static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
                                              dev->ifindex, &in6_dev->cnf);
         }
 
-        if (v->flags & MIFF_REGISTER)
+        if ((v->flags & MIFF_REGISTER) && !notify)
                 unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
@@ -1331,7 +1332,6 @@ static int ip6mr_device_event(struct notifier_block *this,
         struct mr6_table *mrt;
         struct mif_device *v;
         int ct;
-        LIST_HEAD(list);
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
@@ -1340,10 +1340,9 @@ static int ip6mr_device_event(struct notifier_block *this,
                 v = &mrt->vif6_table[0];
                 for (ct = 0; ct < mrt->maxvif; ct++, v++) {
                         if (v->dev == dev)
-                                mif6_delete(mrt, ct, &list);
+                                mif6_delete(mrt, ct, 1, NULL);
                 }
         }
-        unregister_netdevice_many(&list);
 
         return NOTIFY_DONE;
 }
@@ -1552,7 +1551,7 @@ static void mroute_clean_tables(struct mr6_table *mrt, bool all)
         for (i = 0; i < mrt->maxvif; i++) {
                 if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
                         continue;
-                mif6_delete(mrt, i, &list);
+                mif6_delete(mrt, i, 0, &list);
         }
         unregister_netdevice_many(&list);
 
@@ -1707,7 +1706,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                 if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                         return -EFAULT;
                 rtnl_lock();
-                ret = mif6_delete(mrt, mifi, NULL);
+                ret = mif6_delete(mrt, mifi, 0, NULL);
                 rtnl_unlock();
                 return ret;
 
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 6c5b5b1830a7..4146536e9c15 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -27,10 +27,10 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
         memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
         }
         regs->verdict.code = nf_nat_masquerade_ipv6(pkt->skb, &range,
                                                     nft_out(pkt));
diff --git a/net/ipv6/netfilter/nft_redir_ipv6.c b/net/ipv6/netfilter/nft_redir_ipv6.c
index f5ac080fc084..a27e424f690d 100644
--- a/net/ipv6/netfilter/nft_redir_ipv6.c
+++ b/net/ipv6/netfilter/nft_redir_ipv6.c
@@ -26,10 +26,10 @@ static void nft_redir_ipv6_eval(const struct nft_expr *expr,
 
         memset(&range, 0, sizeof(range));
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min],
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max],
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 229bfcc451ef..fb174b590fd3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1854,6 +1854,10 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg)
         int addr_type;
         int err = -EINVAL;
 
+        /* RTF_PCPU is an internal flag; can not be set by userspace */
+        if (cfg->fc_flags & RTF_PCPU)
+                goto out;
+
         if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
                 goto out;
 #ifndef CONFIG_IPV6_SUBTREES
@@ -3299,7 +3303,6 @@ static size_t rt6_nlmsg_size(struct rt6_info *rt)
                 nexthop_len = nla_total_size(0)  /* RTA_MULTIPATH */
                             + NLA_ALIGN(sizeof(struct rtnexthop))
                             + nla_total_size(16) /* RTA_GATEWAY */
-                            + nla_total_size(4)  /* RTA_OIF */
                             + lwtunnel_get_encap_size(rt->dst.lwtstate);
 
                 nexthop_len *= rt->rt6i_nsiblings;
@@ -3323,7 +3326,7 @@ static size_t rt6_nlmsg_size(struct rt6_info *rt)
 }
 
 static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
-                            unsigned int *flags)
+                            unsigned int *flags, bool skip_oif)
 {
         if (!netif_running(rt->dst.dev) || !netif_carrier_ok(rt->dst.dev)) {
                 *flags |= RTNH_F_LINKDOWN;
@@ -3336,7 +3339,8 @@ static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
                         goto nla_put_failure;
         }
 
-        if (rt->dst.dev &&
+        /* not needed for multipath encoding b/c it has a rtnexthop struct */
+        if (!skip_oif && rt->dst.dev &&
             nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
                 goto nla_put_failure;
 
@@ -3350,6 +3354,7 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
+/* add multipath next hop */
 static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
 {
         struct rtnexthop *rtnh;
@@ -3362,7 +3367,7 @@ static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
         rtnh->rtnh_hops = 0;
         rtnh->rtnh_ifindex = rt->dst.dev ? rt->dst.dev->ifindex : 0;
 
-        if (rt6_nexthop_info(skb, rt, &flags) < 0)
+        if (rt6_nexthop_info(skb, rt, &flags, true) < 0)
                 goto nla_put_failure;
 
         rtnh->rtnh_flags = flags;
@@ -3422,6 +3427,8 @@ static int rt6_fill_node(struct net *net,
         }
         else if (rt->rt6i_flags & RTF_LOCAL)
                 rtm->rtm_type = RTN_LOCAL;
+        else if (rt->rt6i_flags & RTF_ANYCAST)
+                rtm->rtm_type = RTN_ANYCAST;
         else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
                 rtm->rtm_type = RTN_LOCAL;
         else
@@ -3515,7 +3522,7 @@ static int rt6_fill_node(struct net *net,
 
                 nla_nest_end(skb, mp);
         } else {
-                if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags) < 0)
+                if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags, false) < 0)
                         goto nla_put_failure;
         }
 
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index a855eb325b03..5f44ffed2576 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -53,6 +53,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
                 struct sr6_tlv *tlv;
                 unsigned int tlv_len;
 
+                if (trailing < sizeof(*tlv))
+                        return false;
+
                 tlv = (struct sr6_tlv *)((unsigned char *)srh + tlv_offset);
                 tlv_len = sizeof(*tlv) + tlv->len;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 60a5295a7de6..49fa2e8c3fa9 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -391,10 +391,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
-                if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                        if (dst)
+                                dst->ops->redirect(dst, sk, skb);
+                }
                 goto out;
         }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4e4c401e3bc6..e28082f0a307 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1035,6 +1035,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         ipc6.hlimit = -1;
         ipc6.tclass = -1;
         ipc6.dontfrag = -1;
+        sockc.tsflags = sk->sk_tsflags;
 
         /* destination address check */
         if (sin6) {
@@ -1159,7 +1160,6 @@ do_udp_sendmsg:
 
         fl6.flowi6_mark = sk->sk_mark;
         fl6.flowi6_uid = sk->sk_uid;
-        sockc.tsflags = sk->sk_tsflags;
 
         if (msg->msg_controllen) {
                 opt = &opt_space;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 81adc29a448d..8d77ad5cadaf 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -828,7 +828,8 @@ out:
  *    Wait for incoming connection
  *
  */
-static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
+static int irda_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct irda_sock *new, *self = irda_sk(sk);
@@ -836,7 +837,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         struct sk_buff *skb = NULL;
         int err;
 
-        err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0);
+        err = irda_create(sock_net(sk), newsock, sk->sk_protocol, kern);
         if (err)
                 return err;
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 89bbde1081ce..84de7b6326dc 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -938,7 +938,7 @@ done:
 
 /* Accept a pending connection */
 static int iucv_sock_accept(struct socket *sock, struct socket *newsock,
-                            int flags)
+                            int flags, bool kern)
 {
         DECLARE_WAITQUEUE(wait, current);
         struct sock *sk = sock->sk, *nsk;
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 309062f3debe..31762f76cdb5 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1687,7 +1687,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 struct kcm_attach info;
 
                 if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
-                        err = -EFAULT;
+                        return -EFAULT;
 
                 err = kcm_attach_ioctl(sock, &info);
 
@@ -1697,7 +1697,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 struct kcm_unattach info;
 
                 if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
-                        err = -EFAULT;
+                        return -EFAULT;
 
                 err = kcm_unattach_ioctl(sock, &info);
 
@@ -1708,7 +1708,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 struct socket *newsock = NULL;
 
                 if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
-                        err = -EFAULT;
+                        return -EFAULT;
 
                 err = kcm_clone(sock, &info, &newsock);
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c6252ed42c1d..be8cecc65002 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -63,8 +63,13 @@ struct pfkey_sock {
                 } u;
                 struct sk_buff  *skb;
         } dump;
+        struct mutex dump_lock;
 };
 
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+                               xfrm_address_t *saddr, xfrm_address_t *daddr,
+                               u16 *family);
+
 static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
 {
         return (struct pfkey_sock *)sk;
@@ -139,6 +144,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
 {
         struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
         struct sock *sk;
+        struct pfkey_sock *pfk;
         int err;
 
         if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
@@ -153,6 +159,9 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
         if (sk == NULL)
                 goto out;
 
+        pfk = pfkey_sk(sk);
+        mutex_init(&pfk->dump_lock);
+
         sock->ops = &pfkey_ops;
         sock_init_data(sock, sk);
 
@@ -281,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
         struct sadb_msg *hdr;
         int rc;
 
+        mutex_lock(&pfk->dump_lock);
+        if (!pfk->dump.dump) {
+                rc = 0;
+                goto out;
+        }
+
         rc = pfk->dump.dump(pfk);
-        if (rc == -ENOBUFS)
-                return 0;
+        if (rc == -ENOBUFS) {
+                rc = 0;
+                goto out;
+        }
 
         if (pfk->dump.skb) {
-                if (!pfkey_can_dump(&pfk->sk))
-                        return 0;
+                if (!pfkey_can_dump(&pfk->sk)) {
+                        rc = 0;
+                        goto out;
+                }
 
                 hdr = (struct sadb_msg *) pfk->dump.skb->data;
                 hdr->sadb_msg_seq = 0;
@@ -298,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
         }
 
         pfkey_terminate_dump(pfk);
+
+out:
+        mutex_unlock(&pfk->dump_lock);
         return rc;
 }
 
@@ -1793,19 +1815,26 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
         struct xfrm_address_filter *filter = NULL;
         struct pfkey_sock *pfk = pfkey_sk(sk);
 
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                 return -EBUSY;
+        }
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
-        if (proto == 0)
+        if (proto == 0) {
+                mutex_unlock(&pfk->dump_lock);
                 return -EINVAL;
+        }
 
         if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
                 struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
 
                 filter = kmalloc(sizeof(*filter), GFP_KERNEL);
-                if (filter == NULL)
+                if (filter == NULL) {
+                        mutex_unlock(&pfk->dump_lock);
                         return -ENOMEM;
+                }
 
                 memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
                        sizeof(xfrm_address_t));
@@ -1821,6 +1850,7 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
         pfk->dump.dump = pfkey_dump_sa;
         pfk->dump.done = pfkey_dump_sa_done;
         xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
+        mutex_unlock(&pfk->dump_lock);
 
         return pfkey_do_dump(pfk);
 }
@@ -1913,19 +1943,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq)
 
         /* addresses present only in tunnel mode */
         if (t->mode == XFRM_MODE_TUNNEL) {
-                u8 *sa = (u8 *) (rq + 1);
-                int family, socklen;
+                int err;
 
-                family = pfkey_sockaddr_extract((struct sockaddr *)sa,
-                                                &t->saddr);
-                if (!family)
-                        return -EINVAL;
-
-                socklen = pfkey_sockaddr_len(family);
-                if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
-                                           &t->id.daddr) != family)
-                        return -EINVAL;
-                t->encap_family = family;
+                err = parse_sockaddr_pair(
+                        (struct sockaddr *)(rq + 1),
+                        rq->sadb_x_ipsecrequest_len - sizeof(*rq),
+                        &t->saddr, &t->id.daddr, &t->encap_family);
+                if (err)
+                        return err;
         } else
                 t->encap_family = xp->family;
 
@@ -1945,7 +1970,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
         if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
                 return -EINVAL;
 
-        while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+        while (len >= sizeof(*rq)) {
+                if (len < rq->sadb_x_ipsecrequest_len ||
+                    rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+                        return -EINVAL;
+
                 if ((err = parse_ipsecrequest(xp, rq)) < 0)
                         return err;
                 len -= rq->sadb_x_ipsecrequest_len;
@@ -2408,7 +2437,6 @@ out:
         return err;
 }
 
-#ifdef CONFIG_NET_KEY_MIGRATE
 static int pfkey_sockaddr_pair_size(sa_family_t family)
 {
         return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2420,7 +2448,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
 {
         int af, socklen;
 
-        if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+        if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
                 return -EINVAL;
 
         af = pfkey_sockaddr_extract(sa, saddr);
@@ -2436,6 +2464,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
         return 0;
 }
 
+#ifdef CONFIG_NET_KEY_MIGRATE
 static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
                                     struct xfrm_migrate *m)
 {
@@ -2443,13 +2472,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
         struct sadb_x_ipsecrequest *rq2;
         int mode;
 
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-            len < rq1->sadb_x_ipsecrequest_len)
+        if (len < sizeof(*rq1) ||
+            len < rq1->sadb_x_ipsecrequest_len ||
+            rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
                 return -EINVAL;
 
         /* old endoints */
         err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
-                                  rq1->sadb_x_ipsecrequest_len,
+                                  rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
                                   &m->old_saddr, &m->old_daddr,
                                   &m->old_family);
         if (err)
@@ -2458,13 +2488,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
         rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
         len -= rq1->sadb_x_ipsecrequest_len;
 
-        if (len <= sizeof(struct sadb_x_ipsecrequest) ||
-            len < rq2->sadb_x_ipsecrequest_len)
+        if (len <= sizeof(*rq2) ||
+            len < rq2->sadb_x_ipsecrequest_len ||
+            rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
                 return -EINVAL;
 
         /* new endpoints */
         err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
-                                  rq2->sadb_x_ipsecrequest_len,
+                                  rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
                                   &m->new_saddr, &m->new_daddr,
                                   &m->new_family);
         if (err)
@@ -2679,14 +2710,18 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb
 {
         struct pfkey_sock *pfk = pfkey_sk(sk);
 
-        if (pfk->dump.dump != NULL)
+        mutex_lock(&pfk->dump_lock);
+        if (pfk->dump.dump != NULL) {
+                mutex_unlock(&pfk->dump_lock);
                 return -EBUSY;
+        }
 
         pfk->dump.msg_version = hdr->sadb_msg_version;
         pfk->dump.msg_portid = hdr->sadb_msg_pid;
         pfk->dump.dump = pfkey_dump_sp;
         pfk->dump.done = pfkey_dump_sp_done;
         xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
+        mutex_unlock(&pfk->dump_lock);
 
         return pfkey_do_dump(pfk);
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 8adab6335ced..e37d9554da7b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -278,7 +278,57 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn
 }
 EXPORT_SYMBOL_GPL(l2tp_session_find);
 
-struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
+/* Like l2tp_session_find() but takes a reference on the returned session.
+ * Optionally calls session->ref() too if do_ref is true.
+ */
+struct l2tp_session *l2tp_session_get(struct net *net,
+                                      struct l2tp_tunnel *tunnel,
+                                      u32 session_id, bool do_ref)
+{
+        struct hlist_head *session_list;
+        struct l2tp_session *session;
+
+        if (!tunnel) {
+                struct l2tp_net *pn = l2tp_pernet(net);
+
+                session_list = l2tp_session_id_hash_2(pn, session_id);
+
+                rcu_read_lock_bh();
+                hlist_for_each_entry_rcu(session, session_list, global_hlist) {
+                        if (session->session_id == session_id) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
+                                rcu_read_unlock_bh();
+
+                                return session;
+                        }
+                }
+                rcu_read_unlock_bh();
+
+                return NULL;
+        }
+
+        session_list = l2tp_session_id_hash(tunnel, session_id);
+        read_lock_bh(&tunnel->hlist_lock);
+        hlist_for_each_entry(session, session_list, hlist) {
+                if (session->session_id == session_id) {
+                        l2tp_session_inc_refcount(session);
+                        if (do_ref && session->ref)
+                                session->ref(session);
+                        read_unlock_bh(&tunnel->hlist_lock);
+
+                        return session;
+                }
+        }
+        read_unlock_bh(&tunnel->hlist_lock);
+
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(l2tp_session_get);
+
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
+                                          bool do_ref)
 {
         int hash;
         struct l2tp_session *session;
@@ -288,6 +338,9 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
         for (hash = 0; hash < L2TP_HASH_SIZE; hash++) {
                 hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) {
                         if (++count > nth) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
                                 read_unlock_bh(&tunnel->hlist_lock);
                                 return session;
                         }
@@ -298,12 +351,13 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth)
 
         return NULL;
 }
-EXPORT_SYMBOL_GPL(l2tp_session_find_nth);
+EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
 
 /* Lookup a session by interface name.
  * This is very inefficient but is only used by management interfaces.
  */
-struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
+struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
+                                                bool do_ref)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
         int hash;
@@ -313,7 +367,11 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
         for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) {
                 hlist_for_each_entry_rcu(session, &pn->l2tp_session_hlist[hash], global_hlist) {
                         if (!strcmp(session->ifname, ifname)) {
+                                l2tp_session_inc_refcount(session);
+                                if (do_ref && session->ref)
+                                        session->ref(session);
                                 rcu_read_unlock_bh();
+
                                 return session;
                         }
                 }
@@ -323,7 +381,49 @@ struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname)
 
         return NULL;
 }
-EXPORT_SYMBOL_GPL(l2tp_session_find_by_ifname);
+EXPORT_SYMBOL_GPL(l2tp_session_get_by_ifname);
+
+static int l2tp_session_add_to_tunnel(struct l2tp_tunnel *tunnel,
+                                      struct l2tp_session *session)
+{
+        struct l2tp_session *session_walk;
+        struct hlist_head *g_head;
+        struct hlist_head *head;
+        struct l2tp_net *pn;
+
+        head = l2tp_session_id_hash(tunnel, session->session_id);
+
+        write_lock_bh(&tunnel->hlist_lock);
+        hlist_for_each_entry(session_walk, head, hlist)
+                if (session_walk->session_id == session->session_id)
+                        goto exist;
+
+        if (tunnel->version == L2TP_HDR_VER_3) {
+                pn = l2tp_pernet(tunnel->l2tp_net);
+                g_head = l2tp_session_id_hash_2(l2tp_pernet(tunnel->l2tp_net),
+                                                session->session_id);
+
+                spin_lock_bh(&pn->l2tp_session_hlist_lock);
+                hlist_for_each_entry(session_walk, g_head, global_hlist)
+                        if (session_walk->session_id == session->session_id)
+                                goto exist_glob;
+
+                hlist_add_head_rcu(&session->global_hlist, g_head);
+                spin_unlock_bh(&pn->l2tp_session_hlist_lock);
+        }
+
+        hlist_add_head(&session->hlist, head);
+        write_unlock_bh(&tunnel->hlist_lock);
+
+        return 0;
+
+exist_glob:
+        spin_unlock_bh(&pn->l2tp_session_hlist_lock);
+exist:
+        write_unlock_bh(&tunnel->hlist_lock);
+
+        return -EEXIST;
+}
 
 /* Lookup a tunnel by id
  */
@@ -633,6 +733,9 @@ discard:
  * a data (not control) frame before coming here. Fields up to the
  * session-id have already been parsed and ptr points to the data
  * after the session-id.
+ *
+ * session->ref() must have been called prior to l2tp_recv_common().
+ * session->deref() will be called automatically after skb is processed.
  */
 void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
                       unsigned char *ptr, unsigned char *optr, u16 hdrflags,
@@ -642,14 +745,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         int offset;
         u32 ns, nr;
 
-        /* The ref count is increased since we now hold a pointer to
-         * the session. Take care to decrement the refcnt when exiting
-         * this function from now on...
-         */
-        l2tp_session_inc_refcount(session);
-        if (session->ref)
-                (*session->ref)(session);
-
         /* Parse and check optional cookie */
         if (session->peer_cookie_len > 0) {
                 if (memcmp(ptr, &session->peer_cookie[0], session->peer_cookie_len)) {
@@ -802,8 +897,6 @@ void l2tp_recv_common(struct l2tp_session *session, struct sk_buff *skb,
         /* Try to dequeue as many skbs from reorder_q as we can. */
         l2tp_recv_dequeue(session);
 
-        l2tp_session_dec_refcount(session);
-
         return;
 
 discard:
@@ -812,8 +905,6 @@ discard:
 
         if (session->deref)
                 (*session->deref)(session);
-
-        l2tp_session_dec_refcount(session);
 }
 EXPORT_SYMBOL(l2tp_recv_common);
 
@@ -920,8 +1011,14 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         }
 
         /* Find the session context */
-        session = l2tp_session_find(tunnel->l2tp_net, tunnel, session_id);
+        session = l2tp_session_get(tunnel->l2tp_net, tunnel, session_id, true);
         if (!session || !session->recv_skb) {
+                if (session) {
+                        if (session->deref)
+                                session->deref(session);
+                        l2tp_session_dec_refcount(session);
+                }
+
                 /* Not found? Pass to userspace to deal with */
                 l2tp_info(tunnel, L2TP_MSG_DATA,
                           "%s: no session found (%u/%u). Passing up.\n",
@@ -930,6 +1027,7 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb,
         }
 
         l2tp_recv_common(session, skb, ptr, optr, hdrflags, length, payload_hook);
+        l2tp_session_dec_refcount(session);
 
         return 0;
 
@@ -1738,6 +1836,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_set_header_len);
 struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id, struct l2tp_session_cfg *cfg)
 {
         struct l2tp_session *session;
+        int err;
 
         session = kzalloc(sizeof(struct l2tp_session) + priv_size, GFP_KERNEL);
         if (session != NULL) {
@@ -1793,6 +1892,13 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
 
                 l2tp_session_set_header_len(session, tunnel->version);
 
+                err = l2tp_session_add_to_tunnel(tunnel, session);
+                if (err) {
+                        kfree(session);
+
+                        return ERR_PTR(err);
+                }
+
                 /* Bump the reference count. The session context is deleted
                  * only when this drops to zero.
                  */
@@ -1802,28 +1908,14 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
                 /* Ensure tunnel socket isn't deleted */
                 sock_hold(tunnel->sock);
 
-                /* Add session to the tunnel's hash list */
-                write_lock_bh(&tunnel->hlist_lock);
-                hlist_add_head(&session->hlist,
-                               l2tp_session_id_hash(tunnel, session_id));
-                write_unlock_bh(&tunnel->hlist_lock);
-
-                /* And to the global session list if L2TPv3 */
-                if (tunnel->version != L2TP_HDR_VER_2) {
-                        struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
-
-                        spin_lock_bh(&pn->l2tp_session_hlist_lock);
-                        hlist_add_head_rcu(&session->global_hlist,
-                                           l2tp_session_id_hash_2(pn, session_id));
-                        spin_unlock_bh(&pn->l2tp_session_hlist_lock);
-                }
-
                 /* Ignore management session in session count value */
                 if (session->session_id != 0)
                         atomic_inc(&l2tp_session_count);
+
+                return session;
         }
 
-        return session;
+        return ERR_PTR(-ENOMEM);
 }
 EXPORT_SYMBOL_GPL(l2tp_session_create);
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index aebf281d09ee..8ce7818c7a9d 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -230,11 +230,16 @@ out:
         return tunnel;
 }
 
+struct l2tp_session *l2tp_session_get(struct net *net,
+                                      struct l2tp_tunnel *tunnel,
+                                      u32 session_id, bool do_ref);
 struct l2tp_session *l2tp_session_find(struct net *net,
                                        struct l2tp_tunnel *tunnel,
                                        u32 session_id);
-struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth);
-struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname);
+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
+                                          bool do_ref);
+struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
+                                                bool do_ref);
 struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id);
 struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth);
 
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 2d6760a2ae34..d100aed3d06f 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -53,7 +53,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
 
 static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd)
 {
-        pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
         pd->session_idx++;
 
         if (pd->session == NULL) {
@@ -238,10 +238,14 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v)
         }
 
         /* Show the tunnel or session context */
-        if (pd->session == NULL)
+        if (!pd->session) {
                 l2tp_dfs_seq_tunnel_show(m, pd->tunnel);
-        else
+        } else {
                 l2tp_dfs_seq_session_show(m, pd->session);
+                if (pd->session->deref)
+                        pd->session->deref(pd->session);
+                l2tp_session_dec_refcount(pd->session);
+        }
 
 out:
         return 0;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 8bf18a5f66e0..6fd41d7afe1e 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -221,12 +221,6 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
                 goto out;
         }
 
-        session = l2tp_session_find(net, tunnel, session_id);
-        if (session) {
-                rc = -EEXIST;
-                goto out;
-        }
-
         if (cfg->ifname) {
                 dev = dev_get_by_name(net, cfg->ifname);
                 if (dev) {
@@ -240,8 +234,8 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
 
         session = l2tp_session_create(sizeof(*spriv), tunnel, session_id,
                                       peer_session_id, cfg);
-        if (!session) {
-                rc = -ENOMEM;
+        if (IS_ERR(session)) {
+                rc = PTR_ERR(session);
                 goto out;
         }
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index d25038cfd64e..4d322c1b7233 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -143,19 +143,19 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(net, NULL, session_id);
-        if (session == NULL)
+        session = l2tp_session_get(net, NULL, session_id, true);
+        if (!session)
                 goto discard;
 
         tunnel = session->tunnel;
-        if (tunnel == NULL)
-                goto discard;
+        if (!tunnel)
+                goto discard_sess;
 
         /* Trace packet contents, if enabled */
         if (tunnel->debug & L2TP_MSG_DATA) {
                 length = min(32u, skb->len);
                 if (!pskb_may_pull(skb, length))
-                        goto discard;
+                        goto discard_sess;
 
                 /* Point to L2TP header */
                 optr = ptr = skb->data;
@@ -165,6 +165,7 @@ static int l2tp_ip_recv(struct sk_buff *skb)
         }
 
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len, tunnel->recv_payload_hook);
+        l2tp_session_dec_refcount(session);
 
         return 0;
 
@@ -178,9 +179,10 @@ pass_up:
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
         tunnel = l2tp_tunnel_find(net, tunnel_id);
-        if (tunnel != NULL)
+        if (tunnel) {
                 sk = tunnel->sock;
-        else {
+                sock_hold(sk);
+        } else {
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
@@ -202,6 +204,12 @@ pass_up:
 
         return sk_receive_skb(sk, skb, 1);
 
+discard_sess:
+        if (session->deref)
+                session->deref(session);
+        l2tp_session_dec_refcount(session);
+        goto discard;
+
 discard_put:
         sock_put(sk);
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index a4abcbc4c09a..88b397c30d86 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -156,19 +156,19 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
         }
 
         /* Ok, this is a data packet. Lookup the session. */
-        session = l2tp_session_find(net, NULL, session_id);
-        if (session == NULL)
+        session = l2tp_session_get(net, NULL, session_id, true);
+        if (!session)
                 goto discard;
 
         tunnel = session->tunnel;
-        if (tunnel == NULL)
-                goto discard;
+        if (!tunnel)
+                goto discard_sess;
 
         /* Trace packet contents, if enabled */
         if (tunnel->debug & L2TP_MSG_DATA) {
                 length = min(32u, skb->len);
                 if (!pskb_may_pull(skb, length))
-                        goto discard;
+                        goto discard_sess;
 
                 /* Point to L2TP header */
                 optr = ptr = skb->data;
@@ -179,6 +179,8 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
 
         l2tp_recv_common(session, skb, ptr, optr, 0, skb->len,
                          tunnel->recv_payload_hook);
+        l2tp_session_dec_refcount(session);
+
         return 0;
 
 pass_up:
@@ -191,9 +193,10 @@ pass_up:
 
         tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
         tunnel = l2tp_tunnel_find(net, tunnel_id);
-        if (tunnel != NULL)
+        if (tunnel) {
                 sk = tunnel->sock;
-        else {
+                sock_hold(sk);
+        } else {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
@@ -215,6 +218,12 @@ pass_up:
 
         return sk_receive_skb(sk, skb, 1);
 
+discard_sess:
+        if (session->deref)
+                session->deref(session);
+        l2tp_session_dec_refcount(session);
+        goto discard;
+
 discard_put:
         sock_put(sk);
 
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 3620fba31786..7e3e669baac4 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -48,7 +48,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq,
 /* Accessed under genl lock */
 static const struct l2tp_nl_cmd_ops *l2tp_nl_cmd_ops[__L2TP_PWTYPE_MAX];
 
-static struct l2tp_session *l2tp_nl_session_find(struct genl_info *info)
+static struct l2tp_session *l2tp_nl_session_get(struct genl_info *info,
+                                                bool do_ref)
 {
         u32 tunnel_id;
         u32 session_id;
@@ -59,14 +60,15 @@ static struct l2tp_session *l2tp_nl_session_find(struct genl_info *info)
 
         if (info->attrs[L2TP_ATTR_IFNAME]) {
                 ifname = nla_data(info->attrs[L2TP_ATTR_IFNAME]);
-                session = l2tp_session_find_by_ifname(net, ifname);
+                session = l2tp_session_get_by_ifname(net, ifname, do_ref);
         } else if ((info->attrs[L2TP_ATTR_SESSION_ID]) &&
                    (info->attrs[L2TP_ATTR_CONN_ID])) {
                 tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
                 session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
                 tunnel = l2tp_tunnel_find(net, tunnel_id);
                 if (tunnel)
-                        session = l2tp_session_find(net, tunnel, session_id);
+                        session = l2tp_session_get(net, tunnel, session_id,
+                                                   do_ref);
         }
 
         return session;
@@ -642,10 +644,12 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
                         session_id, peer_session_id, &cfg);
 
         if (ret >= 0) {
-                session = l2tp_session_find(net, tunnel, session_id);
-                if (session)
+                session = l2tp_session_get(net, tunnel, session_id, false);
+                if (session) {
                         ret = l2tp_session_notify(&l2tp_nl_family, info, session,
                                                   L2TP_CMD_SESSION_CREATE);
+                        l2tp_session_dec_refcount(session);
+                }
         }
 
 out:
@@ -658,7 +662,7 @@ static int l2tp_nl_cmd_session_delete(struct sk_buff *skb, struct genl_info *inf
         struct l2tp_session *session;
         u16 pw_type;
 
-        session = l2tp_nl_session_find(info);
+        session = l2tp_nl_session_get(info, true);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto out;
@@ -672,6 +676,10 @@ static int l2tp_nl_cmd_session_delete(struct sk_buff *skb, struct genl_info *inf
                 if (l2tp_nl_cmd_ops[pw_type] && l2tp_nl_cmd_ops[pw_type]->session_delete)
                         ret = (*l2tp_nl_cmd_ops[pw_type]->session_delete)(session);
 
+        if (session->deref)
+                session->deref(session);
+        l2tp_session_dec_refcount(session);
+
 out:
         return ret;
 }
@@ -681,7 +689,7 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         int ret = 0;
         struct l2tp_session *session;
 
-        session = l2tp_nl_session_find(info);
+        session = l2tp_nl_session_get(info, false);
         if (session == NULL) {
                 ret = -ENODEV;
                 goto out;
@@ -716,6 +724,8 @@ static int l2tp_nl_cmd_session_modify(struct sk_buff *skb, struct genl_info *inf
         ret = l2tp_session_notify(&l2tp_nl_family, info,
                                   session, L2TP_CMD_SESSION_MODIFY);
 
+        l2tp_session_dec_refcount(session);
+
 out:
         return ret;
 }
@@ -811,29 +821,34 @@ static int l2tp_nl_cmd_session_get(struct sk_buff *skb, struct genl_info *info)
         struct sk_buff *msg;
         int ret;
 
-        session = l2tp_nl_session_find(info);
+        session = l2tp_nl_session_get(info, false);
         if (session == NULL) {
                 ret = -ENODEV;
-                goto out;
+                goto err;
         }
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg) {
                 ret = -ENOMEM;
-                goto out;
+                goto err_ref;
         }
 
         ret = l2tp_nl_session_send(msg, info->snd_portid, info->snd_seq,
                                    0, session, L2TP_CMD_SESSION_GET);
         if (ret < 0)
-                goto err_out;
+                goto err_ref_msg;
 
-        return genlmsg_unicast(genl_info_net(info), msg, info->snd_portid);
+        ret = genlmsg_unicast(genl_info_net(info), msg, info->snd_portid);
 
-err_out:
-        nlmsg_free(msg);
+        l2tp_session_dec_refcount(session);
 
-out:
+        return ret;
+
+err_ref_msg:
+        nlmsg_free(msg);
+err_ref:
+        l2tp_session_dec_refcount(session);
+err:
         return ret;
 }
 
@@ -852,7 +867,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                                 goto out;
                 }
 
-                session = l2tp_session_find_nth(tunnel, si);
+                session = l2tp_session_get_nth(tunnel, si, false);
                 if (session == NULL) {
                         ti++;
                         tunnel = NULL;
@@ -862,8 +877,11 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
 
                 if (l2tp_nl_session_send(skb, NETLINK_CB(cb->skb).portid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                         session, L2TP_CMD_SESSION_GET) < 0)
+                                         session, L2TP_CMD_SESSION_GET) < 0) {
+                        l2tp_session_dec_refcount(session);
                         break;
+                }
+                l2tp_session_dec_refcount(session);
 
                 si++;
         }
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 36cc56fd0418..32ea0f3d868c 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -450,6 +450,10 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 static void pppol2tp_session_destruct(struct sock *sk)
 {
         struct l2tp_session *session = sk->sk_user_data;
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+
         if (session) {
                 sk->sk_user_data = NULL;
                 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
@@ -488,9 +492,6 @@ static int pppol2tp_release(struct socket *sock)
                 l2tp_session_queue_purge(session);
                 sock_put(sk);
         }
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-
         release_sock(sk);
 
         /* This will delete the session context via
@@ -582,6 +583,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         int error = 0;
         u32 tunnel_id, peer_tunnel_id;
         u32 session_id, peer_session_id;
+        bool drop_refcnt = false;
         int ver = 2;
         int fd;
 
@@ -683,36 +685,36 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
         if (tunnel->peer_tunnel_id == 0)
                 tunnel->peer_tunnel_id = peer_tunnel_id;
 
-        /* Create session if it doesn't already exist. We handle the
-         * case where a session was previously created by the netlink
-         * interface by checking that the session doesn't already have
-         * a socket and its tunnel socket are what we expect. If any
-         * of those checks fail, return EEXIST to the caller.
-         */
-        session = l2tp_session_find(sock_net(sk), tunnel, session_id);
-        if (session == NULL) {
-                /* Default MTU must allow space for UDP/L2TP/PPP
-                 * headers.
+        session = l2tp_session_get(sock_net(sk), tunnel, session_id, false);
+        if (session) {
+                drop_refcnt = true;
+                ps = l2tp_session_priv(session);
+
+                /* Using a pre-existing session is fine as long as it hasn't
+                 * been connected yet.
                  */
-                cfg.mtu = cfg.mru = 1500 - PPPOL2TP_HEADER_OVERHEAD;
+                if (ps->sock) {
+                        error = -EEXIST;
+                        goto end;
+                }
 
-                /* Allocate and initialize a new session context. */
-                session = l2tp_session_create(sizeof(struct pppol2tp_session),
-                                              tunnel, session_id,
-                                              peer_session_id, &cfg);
-                if (session == NULL) {
-                        error = -ENOMEM;
+                /* consistency checks */
+                if (ps->tunnel_sock != tunnel->sock) {
+                        error = -EEXIST;
                         goto end;
                 }
         } else {
-                ps = l2tp_session_priv(session);
-                error = -EEXIST;
-                if (ps->sock != NULL)
-                        goto end;
+                /* Default MTU must allow space for UDP/L2TP/PPP headers */
+                cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
+                cfg.mru = cfg.mtu;
 
-                /* consistency checks */
-                if (ps->tunnel_sock != tunnel->sock)
+                session = l2tp_session_create(sizeof(struct pppol2tp_session),
+                                              tunnel, session_id,
+                                              peer_session_id, &cfg);
+                if (IS_ERR(session)) {
+                        error = PTR_ERR(session);
                         goto end;
+                }
         }
 
         /* Associate session with its PPPoL2TP socket */
@@ -777,6 +779,8 @@ out_no_ppp:
                   session->name);
 
 end:
+        if (drop_refcnt)
+                l2tp_session_dec_refcount(session);
         release_sock(sk);
 
         return error;
@@ -804,12 +808,6 @@ static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_i
         if (tunnel->sock == NULL)
                 goto out;
 
-        /* Check that this session doesn't already exist */
-        error = -EEXIST;
-        session = l2tp_session_find(net, tunnel, session_id);
-        if (session != NULL)
-                goto out;
-
         /* Default MTU values. */
         if (cfg->mtu == 0)
                 cfg->mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
@@ -817,12 +815,13 @@ static int pppol2tp_session_create(struct net *net, u32 tunnel_id, u32 session_i
                 cfg->mru = cfg->mtu;
 
         /* Allocate and initialize a new session context. */
-        error = -ENOMEM;
         session = l2tp_session_create(sizeof(struct pppol2tp_session),
                                       tunnel, session_id,
                                       peer_session_id, cfg);
-        if (session == NULL)
+        if (IS_ERR(session)) {
+                error = PTR_ERR(session);
                 goto out;
+        }
 
         ps = l2tp_session_priv(session);
         ps->tunnel_sock = tunnel->sock;
@@ -1140,11 +1139,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                 if (stats.session_id != 0) {
                         /* resend to session ioctl handler */
                         struct l2tp_session *session =
-                                l2tp_session_find(sock_net(sk), tunnel, stats.session_id);
-                        if (session != NULL)
-                                err = pppol2tp_session_ioctl(session, cmd, arg);
-                        else
+                                l2tp_session_get(sock_net(sk), tunnel,
+                                                 stats.session_id, true);
+
+                        if (session) {
+                                err = pppol2tp_session_ioctl(session, cmd,
+                                                             arg);
+                                if (session->deref)
+                                        session->deref(session);
+                                l2tp_session_dec_refcount(session);
+                        } else {
                                 err = -EBADR;
+                        }
                         break;
                 }
 #ifdef CONFIG_XFRM
@@ -1377,8 +1383,6 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
         } else
                 err = pppol2tp_session_setsockopt(sk, session, optname, val);
 
-        err = 0;
-
 end_put_sess:
         sock_put(sk);
 end:
@@ -1501,8 +1505,13 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
 
                 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
                 sock_put(ps->tunnel_sock);
-        } else
+                if (err)
+                        goto end_put_sess;
+        } else {
                 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
+                if (err)
+                        goto end_put_sess;
+        }
 
         err = -EFAULT;
         if (put_user(len, optlen))
@@ -1554,7 +1563,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 
 static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd)
 {
-        pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx);
+        pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true);
         pd->session_idx++;
 
         if (pd->session == NULL) {
@@ -1681,10 +1690,14 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v)
 
         /* Show the tunnel or session context.
          */
-        if (pd->session == NULL)
+        if (!pd->session) {
                 pppol2tp_seq_tunnel_show(m, pd->tunnel);
-        else
+        } else {
                 pppol2tp_seq_session_show(m, pd->session);
+                if (pd->session->deref)
+                        pd->session->deref(pd->session);
+                l2tp_session_dec_refcount(pd->session);
+        }
 
 out:
         return 0;
@@ -1843,4 +1856,4 @@ MODULE_DESCRIPTION("PPP over L2TP over UDP");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PPPOL2TP_DRV_VERSION);
 MODULE_ALIAS_NET_PF_PROTO(PF_PPPOX, PX_PROTO_OL2TP);
-MODULE_ALIAS_L2TP_PWTYPE(11);
+MODULE_ALIAS_L2TP_PWTYPE(7);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 06186d608a27..cb4fff785cbf 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -641,11 +641,13 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
  *      @sock: Socket which connections arrive on.
  *      @newsock: Socket to move incoming connection to.
  *      @flags: User specified operational flags.
+ *      @kern: If the socket is kernel internal
  *
  *      Accept a new incoming connection.
  *      Returns 0 upon success, negative otherwise.
  */
-static int llc_ui_accept(struct socket *sock, struct socket *newsock, int flags)
+static int llc_ui_accept(struct socket *sock, struct socket *newsock, int flags,
+                         bool kern)
 {
         struct sock *sk = sock->sk, *newsk;
         struct llc_sock *llc, *newllc;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 40813dd3301c..5bb0c5012819 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -718,7 +718,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
         ieee80211_recalc_ps(local);
 
         if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-            sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+            local->ops->wake_tx_queue) {
                 /* XXX: for AP_VLAN, actually track AP queues */
                 netif_tx_start_all_queues(dev);
         } else if (dev) {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index e48724a6725e..4d7543d1a62c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -208,6 +208,51 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
         return len;
 }
 
+static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
+                                         struct sk_buff *skb,
+                                         int rtap_vendor_space)
+{
+        struct {
+                struct ieee80211_hdr_3addr hdr;
+                u8 category;
+                u8 action_code;
+        } __packed action;
+
+        if (!sdata)
+                return;
+
+        BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
+
+        if (skb->len < rtap_vendor_space + sizeof(action) +
+                       VHT_MUMIMO_GROUPS_DATA_LEN)
+                return;
+
+        if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
+                return;
+
+        skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));
+
+        if (!ieee80211_is_action(action.hdr.frame_control))
+                return;
+
+        if (action.category != WLAN_CATEGORY_VHT)
+                return;
+
+        if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
+                return;
+
+        if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
+                return;
+
+        skb = skb_copy(skb, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
+        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+}
+
 /*
  * ieee80211_add_rx_radiotap_header - add radiotap header
  *
@@ -515,7 +560,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         struct net_device *prev_dev = NULL;
         int present_fcs_len = 0;
         unsigned int rtap_vendor_space = 0;
-        struct ieee80211_mgmt *mgmt;
         struct ieee80211_sub_if_data *monitor_sdata =
                 rcu_dereference(local->monitor_sdata);
 
@@ -553,6 +597,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 return remove_monitor_info(local, origskb, rtap_vendor_space);
         }
 
+        ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);
+
         /* room for the radiotap header based on driver features */
         rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
         needed_headroom = rt_hdrlen - rtap_vendor_space;
@@ -618,23 +664,6 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
                 ieee80211_rx_stats(sdata->dev, skb->len);
         }
 
-        mgmt = (void *)skb->data;
-        if (monitor_sdata &&
-            skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + VHT_MUMIMO_GROUPS_DATA_LEN &&
-            ieee80211_is_action(mgmt->frame_control) &&
-            mgmt->u.action.category == WLAN_CATEGORY_VHT &&
-            mgmt->u.action.u.vht_group_notif.action_code == WLAN_VHT_ACTION_GROUPID_MGMT &&
-            is_valid_ether_addr(monitor_sdata->u.mntr.mu_follow_addr) &&
-            ether_addr_equal(mgmt->da, monitor_sdata->u.mntr.mu_follow_addr)) {
-                struct sk_buff *mu_skb = skb_copy(skb, GFP_ATOMIC);
-
-                if (mu_skb) {
-                        mu_skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
-                        skb_queue_tail(&monitor_sdata->skb_queue, mu_skb);
-                        ieee80211_queue_work(&local->hw, &monitor_sdata->work);
-                }
-        }
-
         if (prev_dev) {
                 skb->dev = prev_dev;
                 netif_receive_skb(skb);
@@ -3610,6 +3639,27 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
                             !ether_addr_equal(bssid, hdr->addr1))
                                 return false;
                 }
+
+                /*
+                 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
+                 * the BSSID - we've checked that already but may have accepted
+                 * the wildcard (ff:ff:ff:ff:ff:ff).
+                 *
+                 * It also says:
+                 *      The BSSID of the Data frame is determined as follows:
+                 *      a) If the STA is contained within an AP or is associated
+                 *         with an AP, the BSSID is the address currently in use
+                 *         by the STA contained in the AP.
+                 *
+                 * So we should not accept data frames with an address that's
+                 * multicast.
+                 *
+                 * Accepting it also opens a security problem because stations
+                 * could encrypt it with the GTK and inject traffic that way.
+                 */
+                if (ieee80211_is_data(hdr->frame_control) && multicast)
+                        return false;
+
                 return true;
         case NL80211_IFTYPE_WDS:
                 if (bssid || !ieee80211_is_data(hdr->frame_control))
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 3818686182b2..6414079aa729 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1269,6 +1269,8 @@ static void mpls_ifdown(struct net_device *dev, int event)
 {
         struct mpls_route __rcu **platform_label;
         struct net *net = dev_net(dev);
+        unsigned int nh_flags = RTNH_F_DEAD | RTNH_F_LINKDOWN;
+        unsigned int alive;
         unsigned index;
 
         platform_label = rtnl_dereference(net->mpls.platform_label);
@@ -1278,9 +1280,11 @@ static void mpls_ifdown(struct net_device *dev, int event)
                 if (!rt)
                         continue;
 
+                alive = 0;
                 change_nexthops(rt) {
                         if (rtnl_dereference(nh->nh_dev) != dev)
-                                continue;
+                                goto next;
+
                         switch (event) {
                         case NETDEV_DOWN:
                         case NETDEV_UNREGISTER:
@@ -1288,12 +1292,16 @@ static void mpls_ifdown(struct net_device *dev, int event)
                                 /* fall through */
                         case NETDEV_CHANGE:
                                 nh->nh_flags |= RTNH_F_LINKDOWN;
-                                ACCESS_ONCE(rt->rt_nhn_alive) = rt->rt_nhn_alive - 1;
                                 break;
                         }
                         if (event == NETDEV_UNREGISTER)
                                 RCU_INIT_POINTER(nh->nh_dev, NULL);
+next:
+                        if (!(nh->nh_flags & nh_flags))
+                                alive++;
                 } endfor_nexthops(rt);
+
+                WRITE_ONCE(rt->rt_nhn_alive, alive);
         }
 }
 
@@ -2028,6 +2036,7 @@ static void mpls_net_exit(struct net *net)
         for (index = 0; index < platform_labels; index++) {
                 struct mpls_route *rt = rtnl_dereference(platform_label[index]);
                 RCU_INIT_POINTER(platform_label[index], NULL);
+                mpls_notify_route(net, index, rt, NULL, NULL);
                 mpls_rt_free(rt);
         }
         rtnl_unlock();
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 071b97fcbefb..ffb78e5f7b70 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -181,7 +181,11 @@ EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 unsigned int nf_conntrack_max __read_mostly;
 seqcount_t nf_conntrack_generation __read_mostly;
 
-DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+/* nf_conn must be 8 bytes aligned, as the 3 LSB bits are used
+ * for the nfctinfo. We cheat by (ab)using the PER CPU cache line
+ * alignment to enforce this.
+ */
+DEFINE_PER_CPU_ALIGNED(struct nf_conn, nf_conntrack_untracked);
 EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
 
 static unsigned int nf_conntrack_hash_rnd __read_mostly;
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index da9df2d56e66..22fc32143e9c 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -290,6 +290,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
         BUG_ON(notify != new);
         RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
         mutex_unlock(&nf_ct_ecache_mutex);
+        /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 
@@ -326,6 +327,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
         BUG_ON(notify != new);
         RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
         mutex_unlock(&nf_ct_ecache_mutex);
+        /* synchronize_rcu() is called from ctnetlink_exit. */
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
 
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 4b2e1fb28bb4..d80073037856 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -57,7 +57,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
         hlist_del_rcu(&exp->hnode);
         net->ct.expect_count--;
 
-        hlist_del(&exp->lnode);
+        hlist_del_rcu(&exp->lnode);
         master_help->expecting[exp->class]--;
 
         nf_ct_expect_event_report(IPEXP_DESTROY, exp, portid, report);
@@ -363,7 +363,7 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         /* two references : one for hash insert, one for the timer */
         atomic_add(2, &exp->use);
 
-        hlist_add_head(&exp->lnode, &master_help->expectations);
+        hlist_add_head_rcu(&exp->lnode, &master_help->expectations);
         master_help->expecting[exp->class]++;
 
         hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]);
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 02bcf00c2492..008299b7f78f 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -53,7 +53,11 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id,
 
         rcu_read_lock();
         t = rcu_dereference(nf_ct_ext_types[id]);
-        BUG_ON(t == NULL);
+        if (!t) {
+                rcu_read_unlock();
+                return NULL;
+        }
+
         off = ALIGN(sizeof(struct nf_ct_ext), t->align);
         len = off + t->len + var_alloc_len;
         alloc_size = t->alloc_size + var_alloc_len;
@@ -88,7 +92,10 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id,
 
         rcu_read_lock();
         t = rcu_dereference(nf_ct_ext_types[id]);
-        BUG_ON(t == NULL);
+        if (!t) {
+                rcu_read_unlock();
+                return NULL;
+        }
 
         newoff = ALIGN(old->len, t->align);
         newlen = newoff + t->len + var_alloc_len;
@@ -175,6 +182,6 @@ void nf_ct_extend_unregister(struct nf_ct_ext_type *type)
         RCU_INIT_POINTER(nf_ct_ext_types[type->id], NULL);
         update_alloc_size(type);
         mutex_unlock(&nf_ct_ext_type_mutex);
-        rcu_barrier(); /* Wait for completion of call_rcu()'s */
+        synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nf_ct_extend_unregister);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 6dc44d9b4190..4eeb3418366a 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -158,16 +158,25 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 {
         struct nf_conntrack_helper *h;
 
+        rcu_read_lock();
+
         h = __nf_conntrack_helper_find(name, l3num, protonum);
 #ifdef CONFIG_MODULES
         if (h == NULL) {
-                if (request_module("nfct-helper-%s", name) == 0)
+                rcu_read_unlock();
+                if (request_module("nfct-helper-%s", name) == 0) {
+                        rcu_read_lock();
                         h = __nf_conntrack_helper_find(name, l3num, protonum);
+                } else {
+                        return h;
+                }
         }
 #endif
         if (h != NULL && !try_module_get(h->me))
                 h = NULL;
 
+        rcu_read_unlock();
+
         return h;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
@@ -311,38 +320,36 @@ void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n)
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister);
 
+/* Caller should hold the rcu lock */
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_name(const char *name)
 {
         struct nf_ct_helper_expectfn *cur;
         bool found = false;
 
-        rcu_read_lock();
         list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) {
                 if (!strcmp(cur->name, name)) {
                         found = true;
                         break;
                 }
         }
-        rcu_read_unlock();
         return found ? cur : NULL;
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_name);
 
+/* Caller should hold the rcu lock */
 struct nf_ct_helper_expectfn *
 nf_ct_helper_expectfn_find_by_symbol(const void *symbol)
 {
         struct nf_ct_helper_expectfn *cur;
         bool found = false;
 
-        rcu_read_lock();
         list_for_each_entry_rcu(cur, &nf_ct_helper_expectfn_list, head) {
                 if (cur->expectfn == symbol) {
                         found = true;
                         break;
                 }
         }
-        rcu_read_unlock();
         return found ? cur : NULL;
 }
 EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_find_by_symbol);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6806b5e73567..dc7dfd68fafe 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1488,11 +1488,16 @@ static int ctnetlink_change_helper(struct nf_conn *ct,
                  * treat the second attempt as a no-op instead of returning
                  * an error.
                  */
-                if (help && help->helper &&
-                    !strcmp(help->helper->name, helpname))
-                        return 0;
-                else
-                        return -EBUSY;
+                err = -EBUSY;
+                if (help) {
+                        rcu_read_lock();
+                        helper = rcu_dereference(help->helper);
+                        if (helper && !strcmp(helper->name, helpname))
+                                err = 0;
+                        rcu_read_unlock();
+                }
+
+                return err;
         }
 
         if (!strcmp(helpname, "")) {
@@ -1929,9 +1934,9 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
 
                         err = 0;
                         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
-                                events = IPCT_RELATED;
+                                events = 1 << IPCT_RELATED;
                         else
-                                events = IPCT_NEW;
+                                events = 1 << IPCT_NEW;
 
                         if (cda[CTA_LABELS] &&
                             ctnetlink_attach_labels(ct, cda) == 0)
@@ -2675,8 +2680,8 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         last = (struct nf_conntrack_expect *)cb->args[1];
         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
-                hlist_for_each_entry(exp, &nf_ct_expect_hash[cb->args[0]],
-                                     hnode) {
+                hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]],
+                                         hnode) {
                         if (l3proto && exp->tuple.src.l3num != l3proto)
                                 continue;
 
@@ -2727,7 +2732,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         last = (struct nf_conntrack_expect *)cb->args[1];
 restart:
-        hlist_for_each_entry(exp, &help->expectations, lnode) {
+        hlist_for_each_entry_rcu(exp, &help->expectations, lnode) {
                 if (l3proto && exp->tuple.src.l3num != l3proto)
                         continue;
                 if (cb->args[1]) {
@@ -2789,6 +2794,12 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
                 return -ENOENT;
 
         ct = nf_ct_tuplehash_to_ctrack(h);
+        /* No expectation linked to this connection tracking. */
+        if (!nfct_help(ct)) {
+                nf_ct_put(ct);
+                return 0;
+        }
+
         c.data = ct;
 
         err = netlink_dump_start(ctnl, skb, nlh, &c);
@@ -3133,23 +3144,27 @@ ctnetlink_create_expect(struct net *net,
                 return -ENOENT;
         ct = nf_ct_tuplehash_to_ctrack(h);
 
+        rcu_read_lock();
         if (cda[CTA_EXPECT_HELP_NAME]) {
                 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
 
                 helper = __nf_conntrack_helper_find(helpname, u3,
                                                     nf_ct_protonum(ct));
                 if (helper == NULL) {
+                        rcu_read_unlock();
 #ifdef CONFIG_MODULES
                         if (request_module("nfct-helper-%s", helpname) < 0) {
                                 err = -EOPNOTSUPP;
                                 goto err_ct;
                         }
+                        rcu_read_lock();
                         helper = __nf_conntrack_helper_find(helpname, u3,
                                                             nf_ct_protonum(ct));
                         if (helper) {
                                 err = -EAGAIN;
-                                goto err_ct;
+                                goto err_rcu;
                         }
+                        rcu_read_unlock();
 #endif
                         err = -EOPNOTSUPP;
                         goto err_ct;
@@ -3159,11 +3174,13 @@ ctnetlink_create_expect(struct net *net,
         exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);
         if (IS_ERR(exp)) {
                 err = PTR_ERR(exp);
-                goto err_ct;
+                goto err_rcu;
         }
 
         err = nf_ct_expect_related_report(exp, portid, report);
         nf_ct_expect_put(exp);
+err_rcu:
+        rcu_read_unlock();
 err_ct:
         nf_ct_put(ct);
         return err;
@@ -3442,6 +3459,7 @@ static void __exit ctnetlink_exit(void)
 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
         RCU_INIT_POINTER(nfnl_ct_hook, NULL);
 #endif
+        synchronize_rcu();
 }
 
 module_init(ctnetlink_init);
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 94b14c5a8b17..82802e4a6640 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -903,6 +903,8 @@ static void __exit nf_nat_cleanup(void)
 #ifdef CONFIG_XFRM
         RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
 #endif
+        synchronize_rcu();
+
         for (i = 0; i < NFPROTO_NUMPROTO; i++)
                 kfree(nf_nat_l4protos[i]);
 
diff --git a/net/netfilter/nf_nat_proto_sctp.c b/net/netfilter/nf_nat_proto_sctp.c
index 31d358691af0..804e8a0ab36e 100644
--- a/net/netfilter/nf_nat_proto_sctp.c
+++ b/net/netfilter/nf_nat_proto_sctp.c
@@ -33,8 +33,16 @@ sctp_manip_pkt(struct sk_buff *skb,
                enum nf_nat_manip_type maniptype)
 {
         sctp_sctphdr_t *hdr;
+        int hdrsize = 8;
 
-        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
+        /* This could be an inner header returned in imcp packet; in such
+         * cases we cannot update the checksum field since it is outside
+         * of the 8 bytes of transport layer headers we are guaranteed.
+         */
+        if (skb->len >= hdroff + sizeof(*hdr))
+                hdrsize = sizeof(*hdr);
+
+        if (!skb_make_writable(skb, hdroff + hdrsize))
                 return false;
 
         hdr = (struct sctphdr *)(skb->data + hdroff);
@@ -47,6 +55,9 @@ sctp_manip_pkt(struct sk_buff *skb,
                 hdr->dest = tuple->dst.u.sctp.port;
         }
 
+        if (hdrsize < sizeof(*hdr))
+                return true;
+
         if (skb->ip_summed != CHECKSUM_PARTIAL) {
                 hdr->checksum = sctp_compute_cksum(skb, hdroff);
                 skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index d43869879fcf..86067560a318 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -101,11 +101,13 @@ nf_nat_redirect_ipv6(struct sk_buff *skb, const struct nf_nat_range *range,
                 rcu_read_lock();
                 idev = __in6_dev_get(skb->dev);
                 if (idev != NULL) {
+                        read_lock_bh(&idev->lock);
                         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                                 newdst = ifa->addr;
                                 addr = true;
                                 break;
                         }
+                        read_unlock_bh(&idev->lock);
                 }
                 rcu_read_unlock();
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5e0ccfd5bb37..434c739dfeca 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3145,7 +3145,6 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                 iter.count      = 0;
                 iter.err        = 0;
                 iter.fn         = nf_tables_bind_check_setelem;
-                iter.flush      = false;
 
                 set->ops->walk(ctx, set, &iter);
                 if (iter.err < 0)
@@ -3399,7 +3398,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         args.iter.count         = 0;
         args.iter.err           = 0;
         args.iter.fn            = nf_tables_dump_setelem;
-        args.iter.flush         = false;
         set->ops->walk(&ctx, set, &args.iter);
 
         nla_nest_end(skb, nest);
@@ -3963,7 +3961,6 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
                 struct nft_set_iter iter = {
                         .genmask        = genmask,
                         .fn             = nft_flush_set,
-                        .flush          = true,
                 };
                 set->ops->walk(&ctx, set, &iter);
 
@@ -5114,7 +5111,6 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
                         iter.count      = 0;
                         iter.err        = 0;
                         iter.fn         = nf_tables_loop_check_setelem;
-                        iter.flush      = false;
 
                         set->ops->walk(ctx, set, &iter);
                         if (iter.err < 0)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index de8782345c86..d45558178da5 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -32,6 +32,13 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
 MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
 
+struct nfnl_cthelper {
+        struct list_head                list;
+        struct nf_conntrack_helper      helper;
+};
+
+static LIST_HEAD(nfnl_cthelper_list);
+
 static int
 nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff,
                         struct nf_conn *ct, enum ip_conntrack_info ctinfo)
@@ -161,6 +168,7 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
         int i, ret;
         struct nf_conntrack_expect_policy *expect_policy;
         struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
+        unsigned int class_max;
 
         ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
                                nfnl_cthelper_expect_policy_set);
@@ -170,19 +178,18 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
         if (!tb[NFCTH_POLICY_SET_NUM])
                 return -EINVAL;
 
-        helper->expect_class_max =
-                ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
-
-        if (helper->expect_class_max != 0 &&
-            helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES)
+        class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+        if (class_max == 0)
+                return -EINVAL;
+        if (class_max > NF_CT_MAX_EXPECT_CLASSES)
                 return -EOVERFLOW;
 
         expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
-                                helper->expect_class_max, GFP_KERNEL);
+                                class_max, GFP_KERNEL);
         if (expect_policy == NULL)
                 return -ENOMEM;
 
-        for (i=0; i<helper->expect_class_max; i++) {
+        for (i = 0; i < class_max; i++) {
                 if (!tb[NFCTH_POLICY_SET+i])
                         goto err;
 
@@ -191,6 +198,8 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
                 if (ret < 0)
                         goto err;
         }
+
+        helper->expect_class_max = class_max - 1;
         helper->expect_policy = expect_policy;
         return 0;
 err:
@@ -203,18 +212,20 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                      struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_helper *helper;
+        struct nfnl_cthelper *nfcth;
         int ret;
 
         if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
                 return -EINVAL;
 
-        helper = kzalloc(sizeof(struct nf_conntrack_helper), GFP_KERNEL);
-        if (helper == NULL)
+        nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL);
+        if (nfcth == NULL)
                 return -ENOMEM;
+        helper = &nfcth->helper;
 
         ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]);
         if (ret < 0)
-                goto err;
+                goto err1;
 
         strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
         helper->data_len = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
@@ -245,15 +256,101 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
 
         ret = nf_conntrack_helper_register(helper);
         if (ret < 0)
-                goto err;
+                goto err2;
 
+        list_add_tail(&nfcth->list, &nfnl_cthelper_list);
         return 0;
-err:
-        kfree(helper);
+err2:
+        kfree(helper->expect_policy);
+err1:
+        kfree(nfcth);
         return ret;
 }
 
 static int
+nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy,
+                                struct nf_conntrack_expect_policy *new_policy,
+                                const struct nlattr *attr)
+{
+        struct nlattr *tb[NFCTH_POLICY_MAX + 1];
+        int err;
+
+        err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr,
+                               nfnl_cthelper_expect_pol);
+        if (err < 0)
+                return err;
+
+        if (!tb[NFCTH_POLICY_NAME] ||
+            !tb[NFCTH_POLICY_EXPECT_MAX] ||
+            !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
+                return -EINVAL;
+
+        if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name))
+                return -EBUSY;
+
+        new_policy->max_expected =
+                ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
+        new_policy->timeout =
+                ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
+
+        return 0;
+}
+
+static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
+                                           struct nf_conntrack_helper *helper)
+{
+        struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1];
+        struct nf_conntrack_expect_policy *policy;
+        int i, err;
+
+        /* Check first that all policy attributes are well-formed, so we don't
+         * leave things in inconsistent state on errors.
+         */
+        for (i = 0; i < helper->expect_class_max + 1; i++) {
+
+                if (!tb[NFCTH_POLICY_SET + i])
+                        return -EINVAL;
+
+                err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
+                                                      &new_policy[i],
+                                                      tb[NFCTH_POLICY_SET + i]);
+                if (err < 0)
+                        return err;
+        }
+        /* Now we can safely update them. */
+        for (i = 0; i < helper->expect_class_max + 1; i++) {
+                policy = (struct nf_conntrack_expect_policy *)
+                                &helper->expect_policy[i];
+                policy->max_expected = new_policy->max_expected;
+                policy->timeout = new_policy->timeout;
+        }
+
+        return 0;
+}
+
+static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper,
+                                       const struct nlattr *attr)
+{
+        struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1];
+        unsigned int class_max;
+        int err;
+
+        err = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
+                               nfnl_cthelper_expect_policy_set);
+        if (err < 0)
+                return err;
+
+        if (!tb[NFCTH_POLICY_SET_NUM])
+                return -EINVAL;
+
+        class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+        if (helper->expect_class_max + 1 != class_max)
+                return -EBUSY;
+
+        return nfnl_cthelper_update_policy_all(tb, helper);
+}
+
+static int
 nfnl_cthelper_update(const struct nlattr * const tb[],
                      struct nf_conntrack_helper *helper)
 {
@@ -263,8 +360,7 @@ nfnl_cthelper_update(const struct nlattr * const tb[],
                 return -EBUSY;
 
         if (tb[NFCTH_POLICY]) {
-                ret = nfnl_cthelper_parse_expect_policy(helper,
-                                                        tb[NFCTH_POLICY]);
+                ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
                 if (ret < 0)
                         return ret;
         }
@@ -293,7 +389,8 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
         const char *helper_name;
         struct nf_conntrack_helper *cur, *helper = NULL;
         struct nf_conntrack_tuple tuple;
-        int ret = 0, i;
+        struct nfnl_cthelper *nlcth;
+        int ret = 0;
 
         if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
                 return -EINVAL;
@@ -304,31 +401,22 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
         if (ret < 0)
                 return ret;
 
-        rcu_read_lock();
-        for (i = 0; i < nf_ct_helper_hsize && !helper; i++) {
-                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
+        list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
 
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+                if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
+                        continue;
 
-                        if (strncmp(cur->name, helper_name,
-                                        NF_CT_HELPER_NAME_LEN) != 0)
-                                continue;
+                if ((tuple.src.l3num != cur->tuple.src.l3num ||
+                     tuple.dst.protonum != cur->tuple.dst.protonum))
+                        continue;
 
-                        if ((tuple.src.l3num != cur->tuple.src.l3num ||
-                             tuple.dst.protonum != cur->tuple.dst.protonum))
-                                continue;
+                if (nlh->nlmsg_flags & NLM_F_EXCL)
+                        return -EEXIST;
 
-                        if (nlh->nlmsg_flags & NLM_F_EXCL) {
-                                ret = -EEXIST;
-                                goto err;
-                        }
-                        helper = cur;
-                        break;
-                }
+                helper = cur;
+                break;
         }
-        rcu_read_unlock();
 
         if (helper == NULL)
                 ret = nfnl_cthelper_create(tb, &tuple);
@@ -336,9 +424,6 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
                 ret = nfnl_cthelper_update(tb, helper);
 
         return ret;
-err:
-        rcu_read_unlock();
-        return ret;
 }
 
 static int
@@ -377,10 +462,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb,
                 goto nla_put_failure;
 
         if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
-                         htonl(helper->expect_class_max)))
+                         htonl(helper->expect_class_max + 1)))
                 goto nla_put_failure;
 
-        for (i=0; i<helper->expect_class_max; i++) {
+        for (i = 0; i < helper->expect_class_max + 1; i++) {
                 nest_parms2 = nla_nest_start(skb,
                                 (NFCTH_POLICY_SET+i) | NLA_F_NESTED);
                 if (nest_parms2 == NULL)
@@ -502,11 +587,12 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
                              struct sk_buff *skb, const struct nlmsghdr *nlh,
                              const struct nlattr * const tb[])
 {
-        int ret = -ENOENT, i;
+        int ret = -ENOENT;
         struct nf_conntrack_helper *cur;
         struct sk_buff *skb2;
         char *helper_name = NULL;
         struct nf_conntrack_tuple tuple;
+        struct nfnl_cthelper *nlcth;
         bool tuple_set = false;
 
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
@@ -527,45 +613,39 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
-        for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) {
+        list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
+                if (helper_name &&
+                    strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
+                        continue;
 
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+                if (tuple_set &&
+                    (tuple.src.l3num != cur->tuple.src.l3num ||
+                     tuple.dst.protonum != cur->tuple.dst.protonum))
+                        continue;
 
-                        if (helper_name && strncmp(cur->name, helper_name,
-                                                NF_CT_HELPER_NAME_LEN) != 0) {
-                                continue;
-                        }
-                        if (tuple_set &&
-                            (tuple.src.l3num != cur->tuple.src.l3num ||
-                             tuple.dst.protonum != cur->tuple.dst.protonum))
-                                continue;
-
-                        skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-                        if (skb2 == NULL) {
-                                ret = -ENOMEM;
-                                break;
-                        }
+                skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                if (skb2 == NULL) {
+                        ret = -ENOMEM;
+                        break;
+                }
 
-                        ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
-                                                nlh->nlmsg_seq,
-                                                NFNL_MSG_TYPE(nlh->nlmsg_type),
-                                                NFNL_MSG_CTHELPER_NEW, cur);
-                        if (ret <= 0) {
-                                kfree_skb(skb2);
-                                break;
-                        }
+                ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
+                                              nlh->nlmsg_seq,
+                                              NFNL_MSG_TYPE(nlh->nlmsg_type),
+                                              NFNL_MSG_CTHELPER_NEW, cur);
+                if (ret <= 0) {
+                        kfree_skb(skb2);
+                        break;
+                }
 
-                        ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
-                                                MSG_DONTWAIT);
-                        if (ret > 0)
-                                ret = 0;
+                ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
+                                      MSG_DONTWAIT);
+                if (ret > 0)
+                        ret = 0;
 
-                        /* this avoids a loop in nfnetlink. */
-                        return ret == -EAGAIN ? -ENOBUFS : ret;
-                }
+                /* this avoids a loop in nfnetlink. */
+                return ret == -EAGAIN ? -ENOBUFS : ret;
         }
         return ret;
 }
@@ -576,10 +656,10 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
 {
         char *helper_name = NULL;
         struct nf_conntrack_helper *cur;
-        struct hlist_node *tmp;
         struct nf_conntrack_tuple tuple;
         bool tuple_set = false, found = false;
-        int i, j = 0, ret;
+        struct nfnl_cthelper *nlcth, *n;
+        int j = 0, ret;
 
         if (tb[NFCTH_NAME])
                 helper_name = nla_data(tb[NFCTH_NAME]);
@@ -592,28 +672,27 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
-        for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
-                                                                hnode) {
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+        list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
+                j++;
 
-                        j++;
+                if (helper_name &&
+                    strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
+                        continue;
 
-                        if (helper_name && strncmp(cur->name, helper_name,
-                                                NF_CT_HELPER_NAME_LEN) != 0) {
-                                continue;
-                        }
-                        if (tuple_set &&
-                            (tuple.src.l3num != cur->tuple.src.l3num ||
-                             tuple.dst.protonum != cur->tuple.dst.protonum))
-                                continue;
+                if (tuple_set &&
+                    (tuple.src.l3num != cur->tuple.src.l3num ||
+                     tuple.dst.protonum != cur->tuple.dst.protonum))
+                        continue;
 
-                        found = true;
-                        nf_conntrack_helper_unregister(cur);
-                }
+                found = true;
+                nf_conntrack_helper_unregister(cur);
+                kfree(cur->expect_policy);
+
+                list_del(&nlcth->list);
+                kfree(nlcth);
         }
+
         /* Make sure we return success if we flush and there is no helpers */
         return (found || j == 0) ? 0 : -ENOENT;
 }
@@ -662,20 +741,16 @@ err_out:
 static void __exit nfnl_cthelper_exit(void)
 {
         struct nf_conntrack_helper *cur;
-        struct hlist_node *tmp;
-        int i;
+        struct nfnl_cthelper *nlcth, *n;
 
         nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
 
-        for (i=0; i<nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i],
-                                                                        hnode) {
-                        /* skip non-userspace conntrack helpers. */
-                        if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
-                                continue;
+        list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
+                cur = &nlcth->helper;
 
-                        nf_conntrack_helper_unregister(cur);
-                }
+                nf_conntrack_helper_unregister(cur);
+                kfree(cur->expect_policy);
+                kfree(nlcth);
         }
 }
 
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 139e0867e56e..47d6656c9119 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -646,8 +646,8 @@ static void __exit cttimeout_exit(void)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
         RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
+        synchronize_rcu();
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
-        rcu_barrier();
 }
 
 module_init(cttimeout_init);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 3ee0b8a000a4..933509ebf3d3 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -443,7 +443,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         skb = alloc_skb(size, GFP_ATOMIC);
         if (!skb) {
                 skb_tx_error(entskb);
-                return NULL;
+                goto nlmsg_failure;
         }
 
         nlh = nlmsg_put(skb, 0, 0,
@@ -452,7 +452,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         if (!nlh) {
                 skb_tx_error(entskb);
                 kfree_skb(skb);
-                return NULL;
+                goto nlmsg_failure;
         }
         nfmsg = nlmsg_data(nlh);
         nfmsg->nfgen_family = entry->state.pf;
@@ -598,12 +598,17 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
         }
 
         nlh->nlmsg_len = skb->len;
+        if (seclen)
+                security_release_secctx(secdata, seclen);
         return skb;
 
 nla_put_failure:
         skb_tx_error(entskb);
         kfree_skb(skb);
         net_err_ratelimited("nf_queue: error creating packet message\n");
+nlmsg_failure:
+        if (seclen)
+                security_release_secctx(secdata, seclen);
         return NULL;
 }
 
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index bf548a7a71ec..0264258c46fe 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -83,7 +83,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 
         switch (priv->key) {
         case NFT_CT_DIRECTION:
-                *dest = CTINFO2DIR(ctinfo);
+                nft_reg_store8(dest, CTINFO2DIR(ctinfo));
                 return;
         case NFT_CT_STATUS:
                 *dest = ct->status;
@@ -151,20 +151,22 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                 return;
         }
         case NFT_CT_L3PROTOCOL:
-                *dest = nf_ct_l3num(ct);
+                nft_reg_store8(dest, nf_ct_l3num(ct));
                 return;
         case NFT_CT_PROTOCOL:
-                *dest = nf_ct_protonum(ct);
+                nft_reg_store8(dest, nf_ct_protonum(ct));
                 return;
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         case NFT_CT_ZONE: {
                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
+                u16 zoneid;
 
                 if (priv->dir < IP_CT_DIR_MAX)
-                        *dest = nf_ct_zone_id(zone, priv->dir);
+                        zoneid = nf_ct_zone_id(zone, priv->dir);
                 else
-                        *dest = zone->id;
+                        zoneid = zone->id;
 
+                nft_reg_store16(dest, zoneid);
                 return;
         }
 #endif
@@ -183,10 +185,10 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
                 return;
         case NFT_CT_PROTO_SRC:
-                *dest = (__force __u16)tuple->src.u.all;
+                nft_reg_store16(dest, (__force u16)tuple->src.u.all);
                 return;
         case NFT_CT_PROTO_DST:
-                *dest = (__force __u16)tuple->dst.u.all;
+                nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
                 return;
         default:
                 break;
@@ -205,7 +207,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr,
         const struct nft_ct *priv = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
         enum ip_conntrack_info ctinfo;
-        u16 value = regs->data[priv->sreg];
+        u16 value = nft_reg_load16(&regs->data[priv->sreg]);
         struct nf_conn *ct;
 
         ct = nf_ct_get(skb, &ctinfo);
@@ -542,7 +544,8 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
                 case IP_CT_DIR_REPLY:
                         break;
                 default:
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto err1;
                 }
         }
 
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index eb2721af898d..c4dad1254ead 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -21,6 +21,7 @@ struct nft_hash {
         enum nft_registers      sreg:8;
         enum nft_registers      dreg:8;
         u8                      len;
+        bool                    autogen_seed:1;
         u32                     modulus;
         u32                     seed;
         u32                     offset;
@@ -82,10 +83,12 @@ static int nft_hash_init(const struct nft_ctx *ctx,
         if (priv->offset + priv->modulus - 1 < priv->offset)
                 return -EOVERFLOW;
 
-        if (tb[NFTA_HASH_SEED])
+        if (tb[NFTA_HASH_SEED]) {
                 priv->seed = ntohl(nla_get_be32(tb[NFTA_HASH_SEED]));
-        else
+        } else {
+                priv->autogen_seed = true;
                 get_random_bytes(&priv->seed, sizeof(priv->seed));
+        }
 
         return nft_validate_register_load(priv->sreg, len) &&
                nft_validate_register_store(ctx, priv->dreg, NULL,
@@ -105,7 +108,8 @@ static int nft_hash_dump(struct sk_buff *skb,
                 goto nla_put_failure;
         if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
                 goto nla_put_failure;
-        if (nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
+        if (!priv->autogen_seed &&
+            nla_put_be32(skb, NFTA_HASH_SEED, htonl(priv->seed)))
                 goto nla_put_failure;
         if (priv->offset != 0)
                 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index e1f5ca9b423b..7b60e01f38ff 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -45,16 +45,15 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                 *dest = skb->len;
                 break;
         case NFT_META_PROTOCOL:
-                *dest = 0;
-                *(__be16 *)dest = skb->protocol;
+                nft_reg_store16(dest, (__force u16)skb->protocol);
                 break;
         case NFT_META_NFPROTO:
-                *dest = nft_pf(pkt);
+                nft_reg_store8(dest, nft_pf(pkt));
                 break;
         case NFT_META_L4PROTO:
                 if (!pkt->tprot_set)
                         goto err;
-                *dest = pkt->tprot;
+                nft_reg_store8(dest, pkt->tprot);
                 break;
         case NFT_META_PRIORITY:
                 *dest = skb->priority;
@@ -85,14 +84,12 @@ void nft_meta_get_eval(const struct nft_expr *expr,
         case NFT_META_IIFTYPE:
                 if (in == NULL)
                         goto err;
-                *dest = 0;
-                *(u16 *)dest = in->type;
+                nft_reg_store16(dest, in->type);
                 break;
         case NFT_META_OIFTYPE:
                 if (out == NULL)
                         goto err;
-                *dest = 0;
-                *(u16 *)dest = out->type;
+                nft_reg_store16(dest, out->type);
                 break;
         case NFT_META_SKUID:
                 sk = skb_to_full_sk(skb);
@@ -142,19 +139,19 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 #endif
         case NFT_META_PKTTYPE:
                 if (skb->pkt_type != PACKET_LOOPBACK) {
-                        *dest = skb->pkt_type;
+                        nft_reg_store8(dest, skb->pkt_type);
                         break;
                 }
 
                 switch (nft_pf(pkt)) {
                 case NFPROTO_IPV4:
                         if (ipv4_is_multicast(ip_hdr(skb)->daddr))
-                                *dest = PACKET_MULTICAST;
+                                nft_reg_store8(dest, PACKET_MULTICAST);
                         else
-                                *dest = PACKET_BROADCAST;
+                                nft_reg_store8(dest, PACKET_BROADCAST);
                         break;
                 case NFPROTO_IPV6:
-                        *dest = PACKET_MULTICAST;
+                        nft_reg_store8(dest, PACKET_MULTICAST);
                         break;
                 case NFPROTO_NETDEV:
                         switch (skb->protocol) {
@@ -168,14 +165,14 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                                         goto err;
 
                                 if (ipv4_is_multicast(iph->daddr))
-                                        *dest = PACKET_MULTICAST;
+                                        nft_reg_store8(dest, PACKET_MULTICAST);
                                 else
-                                        *dest = PACKET_BROADCAST;
+                                        nft_reg_store8(dest, PACKET_BROADCAST);
 
                                 break;
                         }
                         case htons(ETH_P_IPV6):
-                                *dest = PACKET_MULTICAST;
+                                nft_reg_store8(dest, PACKET_MULTICAST);
                                 break;
                         default:
                                 WARN_ON_ONCE(1);
@@ -230,7 +227,9 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 {
         const struct nft_meta *meta = nft_expr_priv(expr);
         struct sk_buff *skb = pkt->skb;
-        u32 value = regs->data[meta->sreg];
+        u32 *sreg = &regs->data[meta->sreg];
+        u32 value = *sreg;
+        u8 pkt_type;
 
         switch (meta->key) {
         case NFT_META_MARK:
@@ -240,9 +239,12 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                 skb->priority = value;
                 break;
         case NFT_META_PKTTYPE:
-                if (skb->pkt_type != value &&
-                    skb_pkt_type_ok(value) && skb_pkt_type_ok(skb->pkt_type))
-                        skb->pkt_type = value;
+                pkt_type = nft_reg_load8(sreg);
+
+                if (skb->pkt_type != pkt_type &&
+                    skb_pkt_type_ok(pkt_type) &&
+                    skb_pkt_type_ok(skb->pkt_type))
+                        skb->pkt_type = pkt_type;
                 break;
         case NFT_META_NFTRACE:
                 skb->nf_trace = !!value;
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index 19a7bf3236f9..439e0bd152a0 100644
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -65,10 +65,10 @@ static void nft_nat_eval(const struct nft_expr *expr,
         }
 
         if (priv->sreg_proto_min) {
-                range.min_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_min];
-                range.max_proto.all =
-                        *(__be16 *)&regs->data[priv->sreg_proto_max];
+                range.min_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_min]);
+                range.max_proto.all = (__force __be16)nft_reg_load16(
+                        &regs->data[priv->sreg_proto_max]);
                 range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
 
diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 152d226552c1..8ebbc2940f4c 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -15,6 +15,11 @@
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
 
+struct nft_bitmap_elem {
+        struct list_head        head;
+        struct nft_set_ext      ext;
+};
+
 /* This bitmap uses two bits to represent one element. These two bits determine
  * the element state in the current and the future generation.
  *
@@ -41,13 +46,22 @@
  *      restore its previous state.
  */
 struct nft_bitmap {
-        u16     bitmap_size;
-        u8      bitmap[];
+        struct  list_head       list;
+        u16                     bitmap_size;
+        u8                      bitmap[];
 };
 
-static inline void nft_bitmap_location(u32 key, u32 *idx, u32 *off)
+static inline void nft_bitmap_location(const struct nft_set *set,
+                                       const void *key,
+                                       u32 *idx, u32 *off)
 {
-        u32 k = (key << 1);
+        u32 k;
+
+        if (set->klen == 2)
+                k = *(u16 *)key;
+        else
+                k = *(u8 *)key;
+        k <<= 1;
 
         *idx = k / BITS_PER_BYTE;
         *off = k % BITS_PER_BYTE;
@@ -69,26 +83,48 @@ static bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
         u8 genmask = nft_genmask_cur(net);
         u32 idx, off;
 
-        nft_bitmap_location(*key, &idx, &off);
+        nft_bitmap_location(set, key, &idx, &off);
 
         return nft_bitmap_active(priv->bitmap, idx, off, genmask);
 }
 
+static struct nft_bitmap_elem *
+nft_bitmap_elem_find(const struct nft_set *set, struct nft_bitmap_elem *this,
+                     u8 genmask)
+{
+        const struct nft_bitmap *priv = nft_set_priv(set);
+        struct nft_bitmap_elem *be;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (memcmp(nft_set_ext_key(&be->ext),
+                           nft_set_ext_key(&this->ext), set->klen) ||
+                    !nft_set_elem_active(&be->ext, genmask))
+                        continue;
+
+                return be;
+        }
+        return NULL;
+}
+
 static int nft_bitmap_insert(const struct net *net, const struct nft_set *set,
                              const struct nft_set_elem *elem,
-                             struct nft_set_ext **_ext)
+                             struct nft_set_ext **ext)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *new = elem->priv, *be;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
-        if (nft_bitmap_active(priv->bitmap, idx, off, genmask))
+        be = nft_bitmap_elem_find(set, new, genmask);
+        if (be) {
+                *ext = &be->ext;
                 return -EEXIST;
+        }
 
+        nft_bitmap_location(set, nft_set_ext_key(&new->ext), &idx, &off);
         /* Enter 01 state. */
         priv->bitmap[idx] |= (genmask << off);
+        list_add_tail_rcu(&new->head, &priv->list);
 
         return 0;
 }
@@ -98,13 +134,14 @@ static void nft_bitmap_remove(const struct net *net,
                               const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *be = elem->priv;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 00 state. */
         priv->bitmap[idx] &= ~(genmask << off);
+        list_del_rcu(&be->head);
 }
 
 static void nft_bitmap_activate(const struct net *net,
@@ -112,74 +149,52 @@ static void nft_bitmap_activate(const struct net *net,
                                 const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext *ext = elem->priv;
+        struct nft_bitmap_elem *be = elem->priv;
         u8 genmask = nft_genmask_next(net);
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 11 state. */
         priv->bitmap[idx] |= (genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 }
 
 static bool nft_bitmap_flush(const struct net *net,
-                             const struct nft_set *set, void *ext)
+                             const struct nft_set *set, void *_be)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
         u8 genmask = nft_genmask_next(net);
+        struct nft_bitmap_elem *be = _be;
         u32 idx, off;
 
-        nft_bitmap_location(nft_set_ext_key(ext)->data[0], &idx, &off);
+        nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
         /* Enter 10 state, similar to deactivation. */
         priv->bitmap[idx] &= ~(genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 
         return true;
 }
 
-static struct nft_set_ext *nft_bitmap_ext_alloc(const struct nft_set *set,
-                                                const struct nft_set_elem *elem)
-{
-        struct nft_set_ext_tmpl tmpl;
-        struct nft_set_ext *ext;
-
-        nft_set_ext_prepare(&tmpl);
-        nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
-
-        ext = kzalloc(tmpl.len, GFP_KERNEL);
-        if (!ext)
-                return NULL;
-
-        nft_set_ext_init(ext, &tmpl);
-        memcpy(nft_set_ext_key(ext), elem->key.val.data, set->klen);
-
-        return ext;
-}
-
 static void *nft_bitmap_deactivate(const struct net *net,
                                    const struct nft_set *set,
                                    const struct nft_set_elem *elem)
 {
         struct nft_bitmap *priv = nft_set_priv(set);
+        struct nft_bitmap_elem *this = elem->priv, *be;
         u8 genmask = nft_genmask_next(net);
-        struct nft_set_ext *ext;
-        u32 idx, off, key = 0;
-
-        memcpy(&key, elem->key.val.data, set->klen);
-        nft_bitmap_location(key, &idx, &off);
+        u32 idx, off;
 
-        if (!nft_bitmap_active(priv->bitmap, idx, off, genmask))
-                return NULL;
+        nft_bitmap_location(set, elem->key.val.data, &idx, &off);
 
-        /* We have no real set extension since this is a bitmap, allocate this
-         * dummy object that is released from the commit/abort path.
-         */
-        ext = nft_bitmap_ext_alloc(set, elem);
-        if (!ext)
+        be = nft_bitmap_elem_find(set, this, genmask);
+        if (!be)
                 return NULL;
 
         /* Enter 10 state. */
         priv->bitmap[idx] &= ~(genmask << off);
+        nft_set_elem_change_active(net, set, &be->ext);
 
-        return ext;
+        return be;
 }
 
 static void nft_bitmap_walk(const struct nft_ctx *ctx,
@@ -187,47 +202,23 @@ static void nft_bitmap_walk(const struct nft_ctx *ctx,
                             struct nft_set_iter *iter)
 {
         const struct nft_bitmap *priv = nft_set_priv(set);
-        struct nft_set_ext_tmpl tmpl;
+        struct nft_bitmap_elem *be;
         struct nft_set_elem elem;
-        struct nft_set_ext *ext;
-        int idx, off;
-        u16 key;
-
-        nft_set_ext_prepare(&tmpl);
-        nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
-
-        for (idx = 0; idx < priv->bitmap_size; idx++) {
-                for (off = 0; off < BITS_PER_BYTE; off += 2) {
-                        if (iter->count < iter->skip)
-                                goto cont;
-
-                        if (!nft_bitmap_active(priv->bitmap, idx, off,
-                                               iter->genmask))
-                                goto cont;
-
-                        ext = kzalloc(tmpl.len, GFP_KERNEL);
-                        if (!ext) {
-                                iter->err = -ENOMEM;
-                                return;
-                        }
-                        nft_set_ext_init(ext, &tmpl);
-                        key = ((idx * BITS_PER_BYTE) + off) >> 1;
-                        memcpy(nft_set_ext_key(ext), &key, set->klen);
-
-                        elem.priv = ext;
-                        iter->err = iter->fn(ctx, set, iter, &elem);
-
-                        /* On set flush, this dummy extension object is released
-                         * from the commit/abort path.
-                         */
-                        if (!iter->flush)
-                                kfree(ext);
-
-                        if (iter->err < 0)
-                                return;
+
+        list_for_each_entry_rcu(be, &priv->list, head) {
+                if (iter->count < iter->skip)
+                        goto cont;
+                if (!nft_set_elem_active(&be->ext, iter->genmask))
+                        goto cont;
+
+                elem.priv = be;
+
+                iter->err = iter->fn(ctx, set, iter, &elem);
+
+                if (iter->err < 0)
+                        return;
 cont:
-                        iter->count++;
-                }
+                iter->count++;
         }
 }
 
@@ -258,6 +249,7 @@ static int nft_bitmap_init(const struct nft_set *set,
 {
         struct nft_bitmap *priv = nft_set_priv(set);
 
+        INIT_LIST_HEAD(&priv->list);
         priv->bitmap_size = nft_bitmap_size(set->klen);
 
         return 0;
@@ -283,6 +275,7 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
 
 static struct nft_set_ops nft_bitmap_ops __read_mostly = {
         .privsize       = nft_bitmap_privsize,
+        .elemsize       = offsetof(struct nft_bitmap_elem, ext),
         .estimate       = nft_bitmap_estimate,
         .init           = nft_bitmap_init,
         .destroy        = nft_bitmap_destroy,
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 27241a767f17..c64aca611ac5 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
         tcp_hdrlen = tcph->doff * 4;
 
-        if (len < tcp_hdrlen)
+        if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr))
                 return -1;
 
         if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -152,6 +152,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         if (len > tcp_hdrlen)
                 return 0;
 
+        /* tcph->doff has 4 bits, do not wrap it to 0 */
+        if (tcp_hdrlen >= 15 * 4)
+                return 0;
+
         /*
          * MSS Option not found ?! add it..
          */
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 80cb7babeb64..df7f1df00330 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -393,7 +393,8 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
 
         rcu_read_lock();
         indev = __in6_dev_get(skb->dev);
-        if (indev)
+        if (indev) {
+                read_lock_bh(&indev->lock);
                 list_for_each_entry(ifa, &indev->addr_list, if_list) {
                         if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DEPRECATED))
                                 continue;
@@ -401,6 +402,8 @@ tproxy_laddr6(struct sk_buff *skb, const struct in6_addr *user_laddr,
                         laddr = &ifa->addr;
                         break;
                 }
+                read_unlock_bh(&indev->lock);
+        }
         rcu_read_unlock();
 
         return laddr ? laddr : daddr;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7b73c7c161a9..596eaff66649 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -96,6 +96,44 @@ EXPORT_SYMBOL_GPL(nl_table);
 
 static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait);
 
+static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS];
+
+static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
+        "nlk_cb_mutex-ROUTE",
+        "nlk_cb_mutex-1",
+        "nlk_cb_mutex-USERSOCK",
+        "nlk_cb_mutex-FIREWALL",
+        "nlk_cb_mutex-SOCK_DIAG",
+        "nlk_cb_mutex-NFLOG",
+        "nlk_cb_mutex-XFRM",
+        "nlk_cb_mutex-SELINUX",
+        "nlk_cb_mutex-ISCSI",
+        "nlk_cb_mutex-AUDIT",
+        "nlk_cb_mutex-FIB_LOOKUP",
+        "nlk_cb_mutex-CONNECTOR",
+        "nlk_cb_mutex-NETFILTER",
+        "nlk_cb_mutex-IP6_FW",
+        "nlk_cb_mutex-DNRTMSG",
+        "nlk_cb_mutex-KOBJECT_UEVENT",
+        "nlk_cb_mutex-GENERIC",
+        "nlk_cb_mutex-17",
+        "nlk_cb_mutex-SCSITRANSPORT",
+        "nlk_cb_mutex-ECRYPTFS",
+        "nlk_cb_mutex-RDMA",
+        "nlk_cb_mutex-CRYPTO",
+        "nlk_cb_mutex-SMC",
+        "nlk_cb_mutex-23",
+        "nlk_cb_mutex-24",
+        "nlk_cb_mutex-25",
+        "nlk_cb_mutex-26",
+        "nlk_cb_mutex-27",
+        "nlk_cb_mutex-28",
+        "nlk_cb_mutex-29",
+        "nlk_cb_mutex-30",
+        "nlk_cb_mutex-31",
+        "nlk_cb_mutex-MAX_LINKS"
+};
+
 static int netlink_dump(struct sock *sk);
 static void netlink_skb_destructor(struct sk_buff *skb);
 
@@ -585,6 +623,9 @@ static int __netlink_create(struct net *net, struct socket *sock,
         } else {
                 nlk->cb_mutex = &nlk->cb_def_mutex;
                 mutex_init(nlk->cb_mutex);
+                lockdep_set_class_and_name(nlk->cb_mutex,
+                                           nlk_cb_mutex_keys + protocol,
+                                           nlk_cb_mutex_key_strings[protocol]);
         }
         init_waitqueue_head(&nlk->wait);
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index fb6e10fdb217..92e0981f7404 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -783,8 +783,10 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
 
                 if (ctrl_fill_info(rt, NETLINK_CB(cb->skb).portid,
                                    cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                   skb, CTRL_CMD_NEWFAMILY) < 0)
+                                   skb, CTRL_CMD_NEWFAMILY) < 0) {
+                        n--;
                         break;
+                }
         }
 
         cb->args[0] = n;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 4bbf4526b885..ebf16f7f9089 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -765,7 +765,8 @@ out_release:
         return err;
 }
 
-static int nr_accept(struct socket *sock, struct socket *newsock, int flags)
+static int nr_accept(struct socket *sock, struct socket *newsock, int flags,
+                     bool kern)
 {
         struct sk_buff *skb;
         struct sock *newsk;
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 879885b31cce..2ffb18e73df6 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -441,7 +441,7 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
 }
 
 static int llcp_sock_accept(struct socket *sock, struct socket *newsock,
-                            int flags)
+                            int flags, bool kern)
 {
         DECLARE_WAITQUEUE(wait, current);
         struct sock *sk = sock->sk, *new_sk;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e0a87776a010..7b2c2fce408a 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -643,8 +643,8 @@ static bool skb_nfct_cached(struct net *net,
                  */
                 if (nf_ct_is_confirmed(ct))
                         nf_ct_delete(ct, 0, 0);
-                else
-                        nf_conntrack_put(&ct->ct_general);
+
+                nf_conntrack_put(&ct->ct_general);
                 nf_ct_set(skb, NULL, 0);
                 return false;
         }
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 9d4bb8eb63f2..3f76cb765e5b 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -527,7 +527,7 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 
         /* Link layer. */
         clear_vlan(key);
-        if (key->mac_proto == MAC_PROTO_NONE) {
+        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
                 if (unlikely(eth_type_vlan(skb->protocol)))
                         return -EINVAL;
 
@@ -745,7 +745,13 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 
 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key)
 {
-        return key_extract(skb, key);
+        int res;
+
+        res = key_extract(skb, key);
+        if (!res)
+                key->mac_proto &= ~SW_FLOW_KEY_INVALID;
+
+        return res;
 }
 
 static int key_extract_mac_proto(struct sk_buff *skb)
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 6f5fa50f716d..1105a838bab8 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -604,7 +604,7 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         ipv4 = true;
                         break;
                 case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
-                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
+                        SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
                                         nla_get_in6_addr(a), is_mask);
                         ipv6 = true;
                         break;
@@ -665,6 +665,8 @@ static int ip_tun_from_nlattr(const struct nlattr *attr,
                         tun_flags |= TUNNEL_VXLAN_OPT;
                         opts_type = type;
                         break;
+                case OVS_TUNNEL_KEY_ATTR_PAD:
+                        break;
                 default:
                         OVS_NLERR(log, "Unknown IP tunnel attribute %d",
                                   type);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a0dbe7ca8f72..8489beff5c25 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3665,6 +3665,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                         return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
+                if (val > INT_MAX)
+                        return -EINVAL;
                 po->tp_reserve = val;
                 return 0;
         }
@@ -4193,8 +4195,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
                         goto out;
                 if (po->tp_version >= TPACKET_V3 &&
-                    (int)(req->tp_block_size -
-                          BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
+                    req->tp_block_size <=
+                          BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
                         goto out;
                 if (unlikely(req->tp_frame_size < po->tp_hdrlen +
                                         po->tp_reserve))
@@ -4205,6 +4207,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
                 if (unlikely(rb->frames_per_block == 0))
                         goto out;
+                if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
+                        goto out;
                 if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
                                         req->tp_frame_nr))
                         goto out;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 222bedcd9575..e81537991ddf 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -772,7 +772,8 @@ static void pep_sock_close(struct sock *sk, long timeout)
         sock_put(sk);
 }
 
-static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
+static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
+                                    bool kern)
 {
         struct pep_sock *pn = pep_sk(sk), *newpn;
         struct sock *newsk = NULL;
@@ -846,7 +847,8 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
         }
 
         /* Create a new to-be-accepted sock */
-        newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot, 0);
+        newsk = sk_alloc(sock_net(sk), PF_PHONET, GFP_KERNEL, sk->sk_prot,
+                         kern);
         if (!newsk) {
                 pep_reject_conn(sk, skb, PN_PIPE_ERR_OVERLOAD, GFP_KERNEL);
                 err = -ENOBUFS;
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index a6c8da3ee893..64634e3ec2fc 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -305,7 +305,7 @@ out:
 }
 
 static int pn_socket_accept(struct socket *sock, struct socket *newsock,
-                                int flags)
+                            int flags, bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *newsk;
@@ -314,7 +314,7 @@ static int pn_socket_accept(struct socket *sock, struct socket *newsock,
         if (unlikely(sk->sk_state != TCP_LISTEN))
                 return -EINVAL;
 
-        newsk = sk->sk_prot->accept(sk, flags, &err);
+        newsk = sk->sk_prot->accept(sk, flags, &err, kern);
         if (!newsk)
                 return err;
 
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index ae5ac175b2be..9da7368b0140 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -658,7 +658,9 @@ static int qrtr_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
         }
 
         if (plen != len) {
-                skb_pad(skb, plen - len);
+                rc = skb_pad(skb, plen - len);
+                if (rc)
+                        goto out_node;
                 skb_put(skb, plen - len);
         }
 
diff --git a/net/rds/connection.c b/net/rds/connection.c
index 0e04dcceb1d4..1fa75ab7b733 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -429,6 +429,7 @@ void rds_conn_destroy(struct rds_connection *conn)
          */
         rds_cong_remove_conn(conn);
 
+        put_net(conn->c_net);
         kmem_cache_free(rds_conn_slab, conn);
 
         spin_lock_irqsave(&rds_conn_lock, flags);
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index ce3775abc6e7..1c38d2c7caa8 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -442,7 +442,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 ic->i_send_cq = NULL;
                 ibdev_put_vector(rds_ibdev, ic->i_scq_vector);
                 rdsdebug("ib_create_cq send failed: %d\n", ret);
-                goto out;
+                goto rds_ibdev_out;
         }
 
         ic->i_rcq_vector = ibdev_get_unused_vector(rds_ibdev);
@@ -456,19 +456,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                 ic->i_recv_cq = NULL;
                 ibdev_put_vector(rds_ibdev, ic->i_rcq_vector);
                 rdsdebug("ib_create_cq recv failed: %d\n", ret);
-                goto out;
+                goto send_cq_out;
         }
 
         ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP);
         if (ret) {
                 rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
-                goto out;
+                goto recv_cq_out;
         }
 
         ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
         if (ret) {
                 rdsdebug("ib_req_notify_cq recv failed: %d\n", ret);
-                goto out;
+                goto recv_cq_out;
         }
 
         /* XXX negotiate max send/recv with remote? */
@@ -494,7 +494,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, &attr);
         if (ret) {
                 rdsdebug("rdma_create_qp failed: %d\n", ret);
-                goto out;
+                goto recv_cq_out;
         }
 
         ic->i_send_hdrs = ib_dma_alloc_coherent(dev,
@@ -504,7 +504,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_send_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent send failed\n");
-                goto out;
+                goto qp_out;
         }
 
         ic->i_recv_hdrs = ib_dma_alloc_coherent(dev,
@@ -514,7 +514,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_recv_hdrs) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent recv failed\n");
-                goto out;
+                goto send_hdrs_dma_out;
         }
 
         ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
@@ -522,7 +522,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_ack) {
                 ret = -ENOMEM;
                 rdsdebug("ib_dma_alloc_coherent ack failed\n");
-                goto out;
+                goto recv_hdrs_dma_out;
         }
 
         ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work),
@@ -530,7 +530,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_sends) {
                 ret = -ENOMEM;
                 rdsdebug("send allocation failed\n");
-                goto out;
+                goto ack_dma_out;
         }
 
         ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work),
@@ -538,7 +538,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         if (!ic->i_recvs) {
                 ret = -ENOMEM;
                 rdsdebug("recv allocation failed\n");
-                goto out;
+                goto sends_out;
         }
 
         rds_ib_recv_init_ack(ic);
@@ -546,8 +546,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
         rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
                  ic->i_send_cq, ic->i_recv_cq);
 
-out:
+        return ret;
+
+sends_out:
+        vfree(ic->i_sends);
+ack_dma_out:
+        ib_dma_free_coherent(dev, sizeof(struct rds_header),
+                             ic->i_ack, ic->i_ack_dma);
+recv_hdrs_dma_out:
+        ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr *
+                                        sizeof(struct rds_header),
+                                        ic->i_recv_hdrs, ic->i_recv_hdrs_dma);
+send_hdrs_dma_out:
+        ib_dma_free_coherent(dev, ic->i_send_ring.w_nr *
+                                        sizeof(struct rds_header),
+                                        ic->i_send_hdrs, ic->i_send_hdrs_dma);
+qp_out:
+        rdma_destroy_qp(ic->i_cm_id);
+recv_cq_out:
+        if (!ib_destroy_cq(ic->i_recv_cq))
+                ic->i_recv_cq = NULL;
+send_cq_out:
+        if (!ib_destroy_cq(ic->i_send_cq))
+                ic->i_send_cq = NULL;
+rds_ibdev_out:
+        rds_ib_remove_conn(rds_ibdev, conn);
         rds_ib_dev_put(rds_ibdev);
+
         return ret;
 }
 
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 39518ef7af4d..82d38ccf5e8b 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -147,7 +147,7 @@ struct rds_connection {
 
         /* Protocol version */
         unsigned int            c_version;
-        possible_net_t          c_net;
+        struct net              *c_net;
 
         struct list_head        c_map_item;
         unsigned long           c_map_queued;
@@ -162,13 +162,13 @@ struct rds_connection {
 static inline
 struct net *rds_conn_net(struct rds_connection *conn)
 {
-        return read_pnet(&conn->c_net);
+        return conn->c_net;
 }
 
 static inline
 void rds_conn_net_set(struct rds_connection *conn, struct net *net)
 {
-        write_pnet(&conn->c_net, net);
+        conn->c_net = get_net(net);
 }
 
 #define RDS_FLAG_CONG_BITMAP    0x01
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index a973d3b4dff0..225690076773 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -484,9 +484,10 @@ static void __net_exit rds_tcp_exit_net(struct net *net)
          * we do need to clean up the listen socket here.
          */
         if (rtn->rds_tcp_listen_sock) {
-                rds_tcp_listen_stop(rtn->rds_tcp_listen_sock);
+                struct socket *lsock = rtn->rds_tcp_listen_sock;
+
                 rtn->rds_tcp_listen_sock = NULL;
-                flush_work(&rtn->rds_tcp_accept_w);
+                rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
         }
 }
 
@@ -523,13 +524,13 @@ static void rds_tcp_kill_sock(struct net *net)
         struct rds_tcp_connection *tc, *_tc;
         LIST_HEAD(tmp_list);
         struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
+        struct socket *lsock = rtn->rds_tcp_listen_sock;
 
-        rds_tcp_listen_stop(rtn->rds_tcp_listen_sock);
         rtn->rds_tcp_listen_sock = NULL;
-        flush_work(&rtn->rds_tcp_accept_w);
+        rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
         spin_lock_irq(&rds_tcp_conn_lock);
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
-                struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+                struct net *c_net = tc->t_cpath->cp_conn->c_net;
 
                 if (net != c_net || !tc->t_sock)
                         continue;
@@ -546,8 +547,12 @@ static void rds_tcp_kill_sock(struct net *net)
 void *rds_tcp_listen_sock_def_readable(struct net *net)
 {
         struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
+        struct socket *lsock = rtn->rds_tcp_listen_sock;
+
+        if (!lsock)
+                return NULL;
 
-        return rtn->rds_tcp_listen_sock->sk->sk_user_data;
+        return lsock->sk->sk_user_data;
 }
 
 static int rds_tcp_dev_event(struct notifier_block *this,
@@ -584,7 +589,7 @@ static void rds_tcp_sysctl_reset(struct net *net)
 
         spin_lock_irq(&rds_tcp_conn_lock);
         list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
-                struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+                struct net *c_net = tc->t_cpath->cp_conn->c_net;
 
                 if (net != c_net || !tc->t_sock)
                         continue;
@@ -638,19 +643,19 @@ static int rds_tcp_init(void)
                 goto out;
         }
 
-        ret = register_netdevice_notifier(&rds_tcp_dev_notifier);
-        if (ret) {
-                pr_warn("could not register rds_tcp_dev_notifier\n");
+        ret = rds_tcp_recv_init();
+        if (ret)
                 goto out_slab;
-        }
 
         ret = register_pernet_subsys(&rds_tcp_net_ops);
         if (ret)
-                goto out_notifier;
+                goto out_recv;
 
-        ret = rds_tcp_recv_init();
-        if (ret)
+        ret = register_netdevice_notifier(&rds_tcp_dev_notifier);
+        if (ret) {
+                pr_warn("could not register rds_tcp_dev_notifier\n");
                 goto out_pernet;
+        }
 
         rds_trans_register(&rds_tcp_transport);
 
@@ -660,9 +665,8 @@ static int rds_tcp_init(void)
 
 out_pernet:
         unregister_pernet_subsys(&rds_tcp_net_ops);
-out_notifier:
-        if (unregister_netdevice_notifier(&rds_tcp_dev_notifier))
-                pr_warn("could not unregister rds_tcp_dev_notifier\n");
+out_recv:
+        rds_tcp_recv_exit();
 out_slab:
         kmem_cache_destroy(rds_tcp_conn_slab);
 out:
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 9a1cc8906576..56ea6620fcf9 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -66,7 +66,7 @@ void rds_tcp_state_change(struct sock *sk);
 
 /* tcp_listen.c */
 struct socket *rds_tcp_listen_init(struct net *);
-void rds_tcp_listen_stop(struct socket *);
+void rds_tcp_listen_stop(struct socket *sock, struct work_struct *acceptor);
 void rds_tcp_listen_data_ready(struct sock *sk);
 int rds_tcp_accept_one(struct socket *sock);
 int rds_tcp_keepalive(struct socket *sock);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 67d0929c7d3d..507678853e6c 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -133,7 +133,7 @@ int rds_tcp_accept_one(struct socket *sock)
 
         new_sock->type = sock->type;
         new_sock->ops = sock->ops;
-        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK);
+        ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, true);
         if (ret < 0)
                 goto out;
 
@@ -223,6 +223,9 @@ void rds_tcp_listen_data_ready(struct sock *sk)
          * before it has been accepted and the accepter has set up their
          * data_ready.. we only want to queue listen work for our listening
          * socket
+         *
+         * (*ready)() may be null if we are racing with netns delete, and
+         * the listen socket is being torn down.
          */
         if (sk->sk_state == TCP_LISTEN)
                 rds_tcp_accept_work(sk);
@@ -231,7 +234,8 @@ void rds_tcp_listen_data_ready(struct sock *sk)
 
 out:
         read_unlock_bh(&sk->sk_callback_lock);
-        ready(sk);
+        if (ready)
+                ready(sk);
 }
 
 struct socket *rds_tcp_listen_init(struct net *net)
@@ -271,7 +275,7 @@ out:
         return NULL;
 }
 
-void rds_tcp_listen_stop(struct socket *sock)
+void rds_tcp_listen_stop(struct socket *sock, struct work_struct *acceptor)
 {
         struct sock *sk;
 
@@ -292,5 +296,6 @@ void rds_tcp_listen_stop(struct socket *sock)
 
         /* wait for accepts to stop and close the socket */
         flush_workqueue(rds_wq);
+        flush_work(acceptor);
         sock_release(sock);
 }
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index b8a1df2c9785..4a9729257023 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -871,7 +871,8 @@ out_release:
         return err;
 }
 
-static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
+static int rose_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sk_buff *skb;
         struct sock *newsk;
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 3f9d8d7ec632..b099b64366f3 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -275,6 +275,10 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                 rxrpc_conn_retransmit_call(conn, skb);
                 return 0;
 
+        case RXRPC_PACKET_TYPE_BUSY:
+                /* Just ignore BUSY packets for now. */
+                return 0;
+
         case RXRPC_PACKET_TYPE_ABORT:
                 if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
                                   &wtmp, sizeof(wtmp)) < 0)
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 9f4cfa25af7c..18b2ad8be8e2 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -420,6 +420,7 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
                              u16 skew)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+        enum rxrpc_call_state state;
         unsigned int offset = sizeof(struct rxrpc_wire_header);
         unsigned int ix;
         rxrpc_serial_t serial = sp->hdr.serial, ack_serial = 0;
@@ -434,14 +435,15 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
         _proto("Rx DATA %%%u { #%u f=%02x }",
                sp->hdr.serial, seq, sp->hdr.flags);
 
-        if (call->state >= RXRPC_CALL_COMPLETE)
+        state = READ_ONCE(call->state);
+        if (state >= RXRPC_CALL_COMPLETE)
                 return;
 
         /* Received data implicitly ACKs all of the request packets we sent
          * when we're acting as a client.
          */
-        if ((call->state == RXRPC_CALL_CLIENT_SEND_REQUEST ||
-             call->state == RXRPC_CALL_CLIENT_AWAIT_REPLY) &&
+        if ((state == RXRPC_CALL_CLIENT_SEND_REQUEST ||
+             state == RXRPC_CALL_CLIENT_AWAIT_REPLY) &&
             !rxrpc_receiving_reply(call))
                 return;
 
@@ -650,6 +652,7 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         struct rxrpc_peer *peer;
         unsigned int mtu;
+        bool wake = false;
         u32 rwind = ntohl(ackinfo->rwind);
 
         _proto("Rx ACK %%%u Info { rx=%u max=%u rwin=%u jm=%u }",
@@ -657,9 +660,14 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
                ntohl(ackinfo->rxMTU), ntohl(ackinfo->maxMTU),
                rwind, ntohl(ackinfo->jumbo_max));
 
-        if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
-                rwind = RXRPC_RXTX_BUFF_SIZE - 1;
-        call->tx_winsize = rwind;
+        if (call->tx_winsize != rwind) {
+                if (rwind > RXRPC_RXTX_BUFF_SIZE - 1)
+                        rwind = RXRPC_RXTX_BUFF_SIZE - 1;
+                if (rwind > call->tx_winsize)
+                        wake = true;
+                call->tx_winsize = rwind;
+        }
+
         if (call->cong_ssthresh > rwind)
                 call->cong_ssthresh = rwind;
 
@@ -673,6 +681,9 @@ static void rxrpc_input_ackinfo(struct rxrpc_call *call, struct sk_buff *skb,
                 spin_unlock_bh(&peer->lock);
                 _net("Net MTU %u (maxdata %u)", peer->mtu, peer->maxdata);
         }
+
+        if (wake)
+                wake_up(&call->waitq);
 }
 
 /*
@@ -799,7 +810,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                 return rxrpc_proto_abort("AK0", call, 0);
 
         /* Ignore ACKs unless we are or have just been transmitting. */
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_CLIENT_SEND_REQUEST:
         case RXRPC_CALL_CLIENT_AWAIT_REPLY:
         case RXRPC_CALL_SERVER_SEND_REPLY:
@@ -940,7 +951,7 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
 static void rxrpc_input_implicit_end_call(struct rxrpc_connection *conn,
                                           struct rxrpc_call *call)
 {
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_SERVER_AWAIT_ACK:
                 rxrpc_call_completed(call);
                 break;
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 6491ca46a03f..3e2f1a8e9c5b 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -527,7 +527,7 @@ try_again:
                 msg->msg_namelen = len;
         }
 
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_SERVER_ACCEPTING:
                 ret = rxrpc_recvmsg_new_call(rx, call, msg, flags);
                 break;
@@ -640,7 +640,7 @@ int rxrpc_kernel_recv_data(struct socket *sock, struct rxrpc_call *call,
 
         mutex_lock(&call->user_mutex);
 
-        switch (call->state) {
+        switch (READ_ONCE(call->state)) {
         case RXRPC_CALL_CLIENT_RECV_REPLY:
         case RXRPC_CALL_SERVER_RECV_REQUEST:
         case RXRPC_CALL_SERVER_ACK_REQUEST:
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index bc2d3dcff9de..97ab214ca411 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -488,6 +488,7 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg,
 int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
         __releases(&rx->sk.sk_lock.slock)
 {
+        enum rxrpc_call_state state;
         enum rxrpc_command cmd;
         struct rxrpc_call *call;
         unsigned long user_call_ID = 0;
@@ -526,13 +527,17 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
                         return PTR_ERR(call);
                 /* ... and we have the call lock. */
         } else {
-                ret = -EBUSY;
-                if (call->state == RXRPC_CALL_UNINITIALISED ||
-                    call->state == RXRPC_CALL_CLIENT_AWAIT_CONN ||
-                    call->state == RXRPC_CALL_SERVER_PREALLOC ||
-                    call->state == RXRPC_CALL_SERVER_SECURING ||
-                    call->state == RXRPC_CALL_SERVER_ACCEPTING)
+                switch (READ_ONCE(call->state)) {
+                case RXRPC_CALL_UNINITIALISED:
+                case RXRPC_CALL_CLIENT_AWAIT_CONN:
+                case RXRPC_CALL_SERVER_PREALLOC:
+                case RXRPC_CALL_SERVER_SECURING:
+                case RXRPC_CALL_SERVER_ACCEPTING:
+                        ret = -EBUSY;
                         goto error_release_sock;
+                default:
+                        break;
+                }
 
                 ret = mutex_lock_interruptible(&call->user_mutex);
                 release_sock(&rx->sk);
@@ -542,10 +547,11 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
                 }
         }
 
+        state = READ_ONCE(call->state);
         _debug("CALL %d USR %lx ST %d on CONN %p",
-               call->debug_id, call->user_call_ID, call->state, call->conn);
+               call->debug_id, call->user_call_ID, state, call->conn);
 
-        if (call->state >= RXRPC_CALL_COMPLETE) {
+        if (state >= RXRPC_CALL_COMPLETE) {
                 /* it's too late for this call */
                 ret = -ESHUTDOWN;
         } else if (cmd == RXRPC_CMD_SEND_ABORT) {
@@ -555,12 +561,12 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
         } else if (cmd != RXRPC_CMD_SEND_DATA) {
                 ret = -EINVAL;
         } else if (rxrpc_is_client_call(call) &&
-                   call->state != RXRPC_CALL_CLIENT_SEND_REQUEST) {
+                   state != RXRPC_CALL_CLIENT_SEND_REQUEST) {
                 /* request phase complete for this client call */
                 ret = -EPROTO;
         } else if (rxrpc_is_service_call(call) &&
-                   call->state != RXRPC_CALL_SERVER_ACK_REQUEST &&
-                   call->state != RXRPC_CALL_SERVER_SEND_REPLY) {
+                   state != RXRPC_CALL_SERVER_ACK_REQUEST &&
+                   state != RXRPC_CALL_SERVER_SEND_REPLY) {
                 /* Reply phase not begun or not complete for service call. */
                 ret = -EPROTO;
         } else {
@@ -605,14 +611,21 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
         _debug("CALL %d USR %lx ST %d on CONN %p",
                call->debug_id, call->user_call_ID, call->state, call->conn);
 
-        if (call->state >= RXRPC_CALL_COMPLETE) {
-                ret = -ESHUTDOWN; /* it's too late for this call */
-        } else if (call->state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
-                   call->state != RXRPC_CALL_SERVER_ACK_REQUEST &&
-                   call->state != RXRPC_CALL_SERVER_SEND_REPLY) {
-                ret = -EPROTO; /* request phase complete for this client call */
-        } else {
+        switch (READ_ONCE(call->state)) {
+        case RXRPC_CALL_CLIENT_SEND_REQUEST:
+        case RXRPC_CALL_SERVER_ACK_REQUEST:
+        case RXRPC_CALL_SERVER_SEND_REPLY:
                 ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len);
+                break;
+        case RXRPC_CALL_COMPLETE:
+                read_lock_bh(&call->state_lock);
+                ret = -call->error;
+                read_unlock_bh(&call->state_lock);
+                break;
+        default:
+                 /* Request phase complete for this client call */
+                ret = -EPROTO;
+                break;
         }
 
         mutex_unlock(&call->user_mutex);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index b70aa57319ea..e05b924618a0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -529,20 +529,20 @@ errout:
         return err;
 }
 
-static int nla_memdup_cookie(struct tc_action *a, struct nlattr **tb)
+static struct tc_cookie *nla_memdup_cookie(struct nlattr **tb)
 {
-        a->act_cookie = kzalloc(sizeof(*a->act_cookie), GFP_KERNEL);
-        if (!a->act_cookie)
-                return -ENOMEM;
+        struct tc_cookie *c = kzalloc(sizeof(*c), GFP_KERNEL);
+        if (!c)
+                return NULL;
 
-        a->act_cookie->data = nla_memdup(tb[TCA_ACT_COOKIE], GFP_KERNEL);
-        if (!a->act_cookie->data) {
-                kfree(a->act_cookie);
-                return -ENOMEM;
+        c->data = nla_memdup(tb[TCA_ACT_COOKIE], GFP_KERNEL);
+        if (!c->data) {
+                kfree(c);
+                return NULL;
         }
-        a->act_cookie->len = nla_len(tb[TCA_ACT_COOKIE]);
+        c->len = nla_len(tb[TCA_ACT_COOKIE]);
 
-        return 0;
+        return c;
 }
 
 struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
@@ -551,6 +551,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
 {
         struct tc_action *a;
         struct tc_action_ops *a_o;
+        struct tc_cookie *cookie = NULL;
         char act_name[IFNAMSIZ];
         struct nlattr *tb[TCA_ACT_MAX + 1];
         struct nlattr *kind;
@@ -566,6 +567,18 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
                         goto err_out;
                 if (nla_strlcpy(act_name, kind, IFNAMSIZ) >= IFNAMSIZ)
                         goto err_out;
+                if (tb[TCA_ACT_COOKIE]) {
+                        int cklen = nla_len(tb[TCA_ACT_COOKIE]);
+
+                        if (cklen > TC_COOKIE_MAX_SIZE)
+                                goto err_out;
+
+                        cookie = nla_memdup_cookie(tb);
+                        if (!cookie) {
+                                err = -ENOMEM;
+                                goto err_out;
+                        }
+                }
         } else {
                 err = -EINVAL;
                 if (strlcpy(act_name, name, IFNAMSIZ) >= IFNAMSIZ)
@@ -604,20 +617,12 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
         if (err < 0)
                 goto err_mod;
 
-        if (tb[TCA_ACT_COOKIE]) {
-                int cklen = nla_len(tb[TCA_ACT_COOKIE]);
-
-                if (cklen > TC_COOKIE_MAX_SIZE) {
-                        err = -EINVAL;
-                        tcf_hash_release(a, bind);
-                        goto err_mod;
-                }
-
-                if (nla_memdup_cookie(a, tb) < 0) {
-                        err = -ENOMEM;
-                        tcf_hash_release(a, bind);
-                        goto err_mod;
+        if (name == NULL && tb[TCA_ACT_COOKIE]) {
+                if (a->act_cookie) {
+                        kfree(a->act_cookie->data);
+                        kfree(a->act_cookie);
                 }
+                a->act_cookie = cookie;
         }
 
         /* module count goes up only when brand new policy is created
@@ -632,6 +637,10 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
 err_mod:
         module_put(a_o->owner);
 err_out:
+        if (cookie) {
+                kfree(cookie->data);
+                kfree(cookie);
+        }
         return ERR_PTR(err);
 }
 
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index ab8062909962..f9bb43c25697 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -113,6 +113,9 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
         if (ret < 0)
                 return ret;
 
+        if (!tb[TCA_CONNMARK_PARMS])
+                return -EINVAL;
+
         parm = nla_data(tb[TCA_CONNMARK_PARMS]);
 
         if (!tcf_hash_check(tn, parm->index, a, bind)) {
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 3b7074e23024..c736627f8f4a 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -228,7 +228,6 @@ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
 
         return skb->len;
 nla_put_failure:
-        rcu_read_unlock();
         nlmsg_trim(skb, b);
         return -1;
 }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 802ac7c2e5e8..5334e309f17f 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -201,9 +201,13 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p);
 
         if (p->set_tc_index) {
+                int wlen = skb_network_offset(skb);
+
                 switch (tc_skb_protocol(skb)) {
                 case htons(ETH_P_IP):
-                        if (skb_cow_head(skb, sizeof(struct iphdr)))
+                        wlen += sizeof(struct iphdr);
+                        if (!pskb_may_pull(skb, wlen) ||
+                            skb_try_make_writable(skb, wlen))
                                 goto drop;
 
                         skb->tc_index = ipv4_get_dsfield(ip_hdr(skb))
@@ -211,7 +215,9 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                         break;
 
                 case htons(ETH_P_IPV6):
-                        if (skb_cow_head(skb, sizeof(struct ipv6hdr)))
+                        wlen += sizeof(struct ipv6hdr);
+                        if (!pskb_may_pull(skb, wlen) ||
+                            skb_try_make_writable(skb, wlen))
                                 goto drop;
 
                         skb->tc_index = ipv6_get_dsfield(ipv6_hdr(skb))
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b052b27a984e..1a2f9e964330 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -794,7 +794,7 @@ static void attach_default_qdiscs(struct net_device *dev)
                 }
         }
 #ifdef CONFIG_NET_SCHED
-        if (dev->qdisc)
+        if (dev->qdisc != &noop_qdisc)
                 qdisc_hash_add(dev->qdisc);
 #endif
 }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 2a6835b4562b..a9708da28eb5 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -71,9 +71,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 {
         struct net *net = sock_net(sk);
         struct sctp_sock *sp;
-        int i;
         sctp_paramhdr_t *p;
-        int err;
+        int i;
 
         /* Retrieve the SCTP per socket area.  */
         sp = sctp_sk((struct sock *)sk);
@@ -247,6 +246,9 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         if (!sctp_ulpq_init(&asoc->ulpq, asoc))
                 goto fail_init;
 
+        if (sctp_stream_new(asoc, gfp))
+                goto fail_init;
+
         /* Assume that peer would support both address types unless we are
          * told otherwise.
          */
@@ -264,9 +266,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         /* AUTH related initializations */
         INIT_LIST_HEAD(&asoc->endpoint_shared_keys);
-        err = sctp_auth_asoc_copy_shkeys(ep, asoc, gfp);
-        if (err)
-                goto fail_init;
+        if (sctp_auth_asoc_copy_shkeys(ep, asoc, gfp))
+                goto stream_free;
 
         asoc->active_key_id = ep->active_key_id;
         asoc->prsctp_enable = ep->prsctp_enable;
@@ -289,6 +290,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
 
         return asoc;
 
+stream_free:
+        sctp_stream_free(asoc->stream);
 fail_init:
         sock_put(asoc->base.sk);
         sctp_endpoint_put(asoc->ep);
@@ -1409,7 +1412,7 @@ sctp_assoc_choose_alter_transport(struct sctp_association *asoc,
 /* Update the association's pmtu and frag_point by going through all the
  * transports. This routine is called when a transport's PMTU has changed.
  */
-void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
+void sctp_assoc_sync_pmtu(struct sctp_association *asoc)
 {
         struct sctp_transport *t;
         __u32 pmtu = 0;
@@ -1421,8 +1424,8 @@ void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
         list_for_each_entry(t, &asoc->peer.transport_addr_list,
                                 transports) {
                 if (t->pmtu_pending && t->dst) {
-                        sctp_transport_update_pmtu(sk, t,
-                                                   SCTP_TRUNC4(dst_mtu(t->dst)));
+                        sctp_transport_update_pmtu(
+                                        t, SCTP_TRUNC4(dst_mtu(t->dst)));
                         t->pmtu_pending = 0;
                 }
                 if (!pmtu || (t->pathmtu < pmtu))
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 2a28ab20487f..0e06a278d2a9 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -401,10 +401,10 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
 
         if (t->param_flags & SPP_PMTUD_ENABLE) {
                 /* Update transports view of the MTU */
-                sctp_transport_update_pmtu(sk, t, pmtu);
+                sctp_transport_update_pmtu(t, pmtu);
 
                 /* Update association pmtu. */
-                sctp_assoc_sync_pmtu(sk, asoc);
+                sctp_assoc_sync_pmtu(asoc);
         }
 
         /* Retransmit with the new pmtu setting.
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 063baac5b9fe..961ee59f696a 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -640,14 +640,15 @@ static sctp_scope_t sctp_v6_scope(union sctp_addr *addr)
 
 /* Create and initialize a new sk for the socket to be returned by accept(). */
 static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
-                                             struct sctp_association *asoc)
+                                             struct sctp_association *asoc,
+                                             bool kern)
 {
         struct sock *newsk;
         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
         struct sctp6_sock *newsctp6sk;
         struct ipv6_txoptions *opt;
 
-        newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, 0);
+        newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot, kern);
         if (!newsk)
                 goto out;
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 71ce6b945dcb..1409a875ad8e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -86,43 +86,53 @@ void sctp_packet_config(struct sctp_packet *packet, __u32 vtag,
 {
         struct sctp_transport *tp = packet->transport;
         struct sctp_association *asoc = tp->asoc;
+        struct sock *sk;
 
         pr_debug("%s: packet:%p vtag:0x%x\n", __func__, packet, vtag);
-
         packet->vtag = vtag;
 
-        if (asoc && tp->dst) {
-                struct sock *sk = asoc->base.sk;
-
-                rcu_read_lock();
-                if (__sk_dst_get(sk) != tp->dst) {
-                        dst_hold(tp->dst);
-                        sk_setup_caps(sk, tp->dst);
-                }
-
-                if (sk_can_gso(sk)) {
-                        struct net_device *dev = tp->dst->dev;
+        /* do the following jobs only once for a flush schedule */
+        if (!sctp_packet_empty(packet))
+                return;
 
-                        packet->max_size = dev->gso_max_size;
-                } else {
-                        packet->max_size = asoc->pathmtu;
-                }
-                rcu_read_unlock();
+        /* set packet max_size with pathmtu */
+        packet->max_size = tp->pathmtu;
+        if (!asoc)
+                return;
 
-        } else {
-                packet->max_size = tp->pathmtu;
+        /* update dst or transport pathmtu if in need */
+        sk = asoc->base.sk;
+        if (!sctp_transport_dst_check(tp)) {
+                sctp_transport_route(tp, NULL, sctp_sk(sk));
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
+        } else if (!sctp_transport_pmtu_check(tp)) {
+                if (asoc->param_flags & SPP_PMTUD_ENABLE)
+                        sctp_assoc_sync_pmtu(asoc);
         }
 
-        if (ecn_capable && sctp_packet_empty(packet)) {
-                struct sctp_chunk *chunk;
+        /* If there a is a prepend chunk stick it on the list before
+         * any other chunks get appended.
+         */
+        if (ecn_capable) {
+                struct sctp_chunk *chunk = sctp_get_ecne_prepend(asoc);
 
-                /* If there a is a prepend chunk stick it on the list before
-                 * any other chunks get appended.
-                 */
-                chunk = sctp_get_ecne_prepend(asoc);
                 if (chunk)
                         sctp_packet_append_chunk(packet, chunk);
         }
+
+        if (!tp->dst)
+                return;
+
+        /* set packet max_size with gso_max_size if gso is enabled*/
+        rcu_read_lock();
+        if (__sk_dst_get(sk) != tp->dst) {
+                dst_hold(tp->dst);
+                sk_setup_caps(sk, tp->dst);
+        }
+        packet->max_size = sk_can_gso(sk) ? tp->dst->dev->gso_max_size
+                                          : asoc->pathmtu;
+        rcu_read_unlock();
 }
 
 /* Initialize the packet structure. */
@@ -546,7 +556,6 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         struct sctp_association *asoc = tp->asoc;
         struct sctp_chunk *chunk, *tmp;
         int pkt_count, gso = 0;
-        int confirm;
         struct dst_entry *dst;
         struct sk_buff *head;
         struct sctphdr *sh;
@@ -583,12 +592,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         sh->vtag = htonl(packet->vtag);
         sh->checksum = 0;
 
-        /* update dst if in need */
-        if (!sctp_transport_dst_check(tp)) {
-                sctp_transport_route(tp, NULL, sctp_sk(sk));
-                if (asoc && asoc->param_flags & SPP_PMTUD_ENABLE)
-                        sctp_assoc_sync_pmtu(sk, asoc);
-        }
+        /* drop packet if no dst */
         dst = dst_clone(tp->dst);
         if (!dst) {
                 IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -625,13 +629,13 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
                         asoc->peer.last_sent_to = tp;
         }
         head->ignore_df = packet->ipfragok;
-        confirm = tp->dst_pending_confirm;
-        if (confirm)
+        if (tp->dst_pending_confirm)
                 skb_set_dst_pending_confirm(head, 1);
         /* neighbour should be confirmed on successful transmission or
          * positive error
          */
-        if (tp->af_specific->sctp_xmit(head, tp) >= 0 && confirm)
+        if (tp->af_specific->sctp_xmit(head, tp) >= 0 &&
+            tp->dst_pending_confirm)
                 tp->dst_pending_confirm = 0;
 
 out:
@@ -705,7 +709,7 @@ static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
          */
 
         if ((sctp_sk(asoc->base.sk)->nodelay || inflight == 0) &&
-            !chunk->msg->force_delay)
+            !asoc->force_delay)
                 /* Nothing unacked */
                 return SCTP_XMIT_OK;
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index db352e5d61f8..8081476ed313 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -382,17 +382,18 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
 }
 
 static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
-                                    struct sctp_sndrcvinfo *sinfo,
-                                    struct list_head *queue, int msg_len)
+                                    struct sctp_sndrcvinfo *sinfo, int msg_len)
 {
+        struct sctp_outq *q = &asoc->outqueue;
         struct sctp_chunk *chk, *temp;
 
-        list_for_each_entry_safe(chk, temp, queue, list) {
+        list_for_each_entry_safe(chk, temp, &q->out_chunk_list, list) {
                 if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
                         continue;
 
                 list_del_init(&chk->list);
+                q->out_qlen -= chk->skb->len;
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
 
@@ -431,9 +432,7 @@ void sctp_prsctp_prune(struct sctp_association *asoc,
                         return;
         }
 
-        sctp_prsctp_prune_unsent(asoc, sinfo,
-                                 &asoc->outqueue.out_chunk_list,
-                                 msg_len);
+        sctp_prsctp_prune_unsent(asoc, sinfo, msg_len);
 }
 
 /* Mark all the eligible packets on a transport for retransmission.  */
@@ -1027,8 +1026,7 @@ static void sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                          * stream identifier.
                          */
-                        if (chunk->sinfo.sinfo_stream >=
-                            asoc->c.sinit_num_ostreams) {
+                        if (chunk->sinfo.sinfo_stream >= asoc->stream->outcnt) {
 
                                 /* Mark as failed send. */
                                 sctp_chunk_fail(chunk, SCTP_ERROR_INV_STRM);
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 206377fe91ec..a0b29d43627f 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -361,8 +361,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         sctp_seq_dump_remote_addrs(seq, assoc);
         seq_printf(seq, "\t%8lu %5d %5d %4d %4d %4d %8d "
                    "%8d %8d %8d %8d",
-                assoc->hbinterval, assoc->c.sinit_max_instreams,
-                assoc->c.sinit_num_ostreams, assoc->max_retrans,
+                assoc->hbinterval, assoc->stream->incnt,
+                assoc->stream->outcnt, assoc->max_retrans,
                 assoc->init_retries, assoc->shutdown_retries,
                 assoc->rtx_data_chunks,
                 atomic_read(&sk->sk_wmem_alloc),
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 1b6d4574d2b0..989a900383b5 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -575,10 +575,11 @@ static int sctp_v4_is_ce(const struct sk_buff *skb)
 
 /* Create and initialize a new sk for the socket returned by accept(). */
 static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
-                                             struct sctp_association *asoc)
+                                             struct sctp_association *asoc,
+                                             bool kern)
 {
         struct sock *newsk = sk_alloc(sock_net(sk), PF_INET, GFP_KERNEL,
-                        sk->sk_prot, 0);
+                        sk->sk_prot, kern);
         struct inet_sock *newinet;
 
         if (!newsk)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 969a30c7bb54..118faff6a332 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2460,15 +2460,10 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
          * association.
          */
         if (!asoc->temp) {
-                int error;
-
-                asoc->stream = sctp_stream_new(asoc->c.sinit_max_instreams,
-                                               asoc->c.sinit_num_ostreams, gfp);
-                if (!asoc->stream)
+                if (sctp_stream_init(asoc, gfp))
                         goto clean_up;
 
-                error = sctp_assoc_set_id(asoc, gfp);
-                if (error)
+                if (sctp_assoc_set_id(asoc, gfp))
                         goto clean_up;
         }
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index e03bb1aab4d0..24c6ccce7539 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3946,7 +3946,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
 
         /* Silently discard the chunk if stream-id is not valid */
         sctp_walk_fwdtsn(skip, chunk) {
-                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                if (ntohs(skip->stream) >= asoc->stream->incnt)
                         goto discard_noforce;
         }
 
@@ -4017,7 +4017,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
 
         /* Silently discard the chunk if stream-id is not valid */
         sctp_walk_fwdtsn(skip, chunk) {
-                if (ntohs(skip->stream) >= asoc->c.sinit_max_instreams)
+                if (ntohs(skip->stream) >= asoc->stream->incnt)
                         goto gen_shutdown;
         }
 
@@ -6353,7 +6353,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * and discard the DATA chunk.
          */
         sid = ntohs(data_hdr->stream);
-        if (sid >= asoc->c.sinit_max_instreams) {
+        if (sid >= asoc->stream->incnt) {
                 /* Mark tsn as received even though we drop it */
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6f0a9be50f50..d9d4c92e06b3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1907,7 +1907,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         }
 
         if (asoc->pmtu_pending)
-                sctp_assoc_pending_pmtu(sk, asoc);
+                sctp_assoc_pending_pmtu(asoc);
 
         /* If fragmentation is disabled and the message length exceeds the
          * association fragmentation point, return EMSGSIZE.  The I-D
@@ -1920,7 +1920,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         }
 
         /* Check for invalid stream. */
-        if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
+        if (sinfo->sinfo_stream >= asoc->stream->outcnt) {
                 err = -EINVAL;
                 goto out_free;
         }
@@ -1965,7 +1965,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
                 err = PTR_ERR(datamsg);
                 goto out_free;
         }
-        datamsg->force_delay = !!(msg->msg_flags & MSG_MORE);
+        asoc->force_delay = !!(msg->msg_flags & MSG_MORE);
 
         /* Now send the (possibly) fragmented message. */
         list_for_each_entry(chunk, &datamsg->chunks, frag_list) {
@@ -2435,7 +2435,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
         if ((params->spp_flags & SPP_PMTUD_DISABLE) && params->spp_pathmtu) {
                 if (trans) {
                         trans->pathmtu = params->spp_pathmtu;
-                        sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
+                        sctp_assoc_sync_pmtu(asoc);
                 } else if (asoc) {
                         asoc->pathmtu = params->spp_pathmtu;
                 } else {
@@ -2451,7 +2451,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                                 (trans->param_flags & ~SPP_PMTUD) | pmtud_change;
                         if (update) {
                                 sctp_transport_pmtu(trans, sctp_opt2sk(sp));
-                                sctp_assoc_sync_pmtu(sctp_opt2sk(sp), asoc);
+                                sctp_assoc_sync_pmtu(asoc);
                         }
                 } else if (asoc) {
                         asoc->param_flags =
@@ -4116,7 +4116,7 @@ static int sctp_disconnect(struct sock *sk, int flags)
  * descriptor will be returned from accept() to represent the newly
  * formed association.
  */
-static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
+static struct sock *sctp_accept(struct sock *sk, int flags, int *err, bool kern)
 {
         struct sctp_sock *sp;
         struct sctp_endpoint *ep;
@@ -4151,7 +4151,7 @@ static struct sock *sctp_accept(struct sock *sk, int flags, int *err)
          */
         asoc = list_entry(ep->asocs.next, struct sctp_association, asocs);
 
-        newsk = sp->pf->create_accept_sk(sk, asoc);
+        newsk = sp->pf->create_accept_sk(sk, asoc, kern);
         if (!newsk) {
                 error = -ENOMEM;
                 goto out;
@@ -4461,8 +4461,8 @@ int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
         info->sctpi_rwnd = asoc->a_rwnd;
         info->sctpi_unackdata = asoc->unack_data;
         info->sctpi_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
-        info->sctpi_instrms = asoc->c.sinit_max_instreams;
-        info->sctpi_outstrms = asoc->c.sinit_num_ostreams;
+        info->sctpi_instrms = asoc->stream->incnt;
+        info->sctpi_outstrms = asoc->stream->outcnt;
         list_for_each(pos, &asoc->base.inqueue.in_chunk_list)
                 info->sctpi_inqueue++;
         list_for_each(pos, &asoc->outqueue.out_chunk_list)
@@ -4691,8 +4691,8 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
         status.sstat_unackdata = asoc->unack_data;
 
         status.sstat_penddata = sctp_tsnmap_pending(&asoc->peer.tsn_map);
-        status.sstat_instrms = asoc->c.sinit_max_instreams;
-        status.sstat_outstrms = asoc->c.sinit_num_ostreams;
+        status.sstat_instrms = asoc->stream->incnt;
+        status.sstat_outstrms = asoc->stream->outcnt;
         status.sstat_fragmentation_point = asoc->frag_point;
         status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
         memcpy(&status.sstat_primary.spinfo_address, &transport->ipaddr,
@@ -7034,6 +7034,9 @@ int sctp_inet_listen(struct socket *sock, int backlog)
         if (sock->state != SS_UNCONNECTED)
                 goto out;
 
+        if (!sctp_sstate(sk, LISTENING) && !sctp_sstate(sk, CLOSED))
+                goto out;
+
         /* If backlog is zero, disable listening. */
         if (!backlog) {
                 if (sctp_sstate(sk, CLOSED))
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 1c6cc04fa3a4..bbed997e1c5f 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -35,33 +35,60 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-struct sctp_stream *sctp_stream_new(__u16 incnt, __u16 outcnt, gfp_t gfp)
+int sctp_stream_new(struct sctp_association *asoc, gfp_t gfp)
 {
         struct sctp_stream *stream;
         int i;
 
         stream = kzalloc(sizeof(*stream), gfp);
         if (!stream)
-                return NULL;
+                return -ENOMEM;
 
-        stream->outcnt = outcnt;
+        stream->outcnt = asoc->c.sinit_num_ostreams;
         stream->out = kcalloc(stream->outcnt, sizeof(*stream->out), gfp);
         if (!stream->out) {
                 kfree(stream);
-                return NULL;
+                return -ENOMEM;
         }
         for (i = 0; i < stream->outcnt; i++)
                 stream->out[i].state = SCTP_STREAM_OPEN;
 
-        stream->incnt = incnt;
+        asoc->stream = stream;
+
+        return 0;
+}
+
+int sctp_stream_init(struct sctp_association *asoc, gfp_t gfp)
+{
+        struct sctp_stream *stream = asoc->stream;
+        int i;
+
+        /* Initial stream->out size may be very big, so free it and alloc
+         * a new one with new outcnt to save memory.
+         */
+        kfree(stream->out);
+        stream->outcnt = asoc->c.sinit_num_ostreams;
+        stream->out = kcalloc(stream->outcnt, sizeof(*stream->out), gfp);
+        if (!stream->out)
+                goto nomem;
+
+        for (i = 0; i < stream->outcnt; i++)
+                stream->out[i].state = SCTP_STREAM_OPEN;
+
+        stream->incnt = asoc->c.sinit_max_instreams;
         stream->in = kcalloc(stream->incnt, sizeof(*stream->in), gfp);
         if (!stream->in) {
                 kfree(stream->out);
-                kfree(stream);
-                return NULL;
+                goto nomem;
         }
 
-        return stream;
+        return 0;
+
+nomem:
+        asoc->stream = NULL;
+        kfree(stream);
+
+        return -ENOMEM;
 }
 
 void sctp_stream_free(struct sctp_stream *stream)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 3379668af368..721eeebfcd8a 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -251,14 +251,13 @@ void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
 
-void sctp_transport_update_pmtu(struct sock *sk, struct sctp_transport *t, u32 pmtu)
+void sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu)
 {
-        struct dst_entry *dst;
+        struct dst_entry *dst = sctp_transport_dst_check(t);
 
         if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
                 pr_warn("%s: Reported pmtu %d too low, using default minimum of %d\n",
-                        __func__, pmtu,
-                        SCTP_DEFAULT_MINSEGMENT);
+                        __func__, pmtu, SCTP_DEFAULT_MINSEGMENT);
                 /* Use default minimum segment size and disable
                  * pmtu discovery on this transport.
                  */
@@ -267,17 +266,13 @@ void sctp_transport_update_pmtu(struct sock *sk, struct sctp_transport *t, u32 p
                 t->pathmtu = pmtu;
         }
 
-        dst = sctp_transport_dst_check(t);
-        if (!dst)
-                t->af_specific->get_dst(t, &t->saddr, &t->fl, sk);
-
         if (dst) {
-                dst->ops->update_pmtu(dst, sk, NULL, pmtu);
-
+                dst->ops->update_pmtu(dst, t->asoc->base.sk, NULL, pmtu);
                 dst = sctp_transport_dst_check(t);
-                if (!dst)
-                        t->af_specific->get_dst(t, &t->saddr, &t->fl, sk);
         }
+
+        if (!dst)
+                t->af_specific->get_dst(t, &t->saddr, &t->fl, t->asoc->base.sk);
 }
 
 /* Caches the dst entry and source address for a transport's destination
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 85837ab90e89..093803786eac 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -944,7 +944,7 @@ out:
 }
 
 static int smc_accept(struct socket *sock, struct socket *new_sock,
-                      int flags)
+                      int flags, bool kern)
 {
         struct sock *sk = sock->sk, *nsk;
         DECLARE_WAITQUEUE(wait, current);
diff --git a/net/socket.c b/net/socket.c
index 2c1e8677ff2d..985ef06792d6 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -652,6 +652,16 @@ int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
 }
 EXPORT_SYMBOL(kernel_sendmsg);
 
+static bool skb_is_err_queue(const struct sk_buff *skb)
+{
+        /* pkt_type of skbs enqueued on the error queue are set to
+         * PACKET_OUTGOING in skb_set_err_queue(). This is only safe to do
+         * in recvmsg, since skbs received on a local socket will never
+         * have a pkt_type of PACKET_OUTGOING.
+         */
+        return skb->pkt_type == PACKET_OUTGOING;
+}
+
 /*
  * called from sock_recv_timestamp() if sock_flag(sk, SOCK_RCVTSTAMP)
  */
@@ -695,7 +705,8 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
                 put_cmsg(msg, SOL_SOCKET,
                          SCM_TIMESTAMPING, sizeof(tss), &tss);
 
-                if (skb->len && (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_STATS))
+                if (skb_is_err_queue(skb) && skb->len &&
+                    SKB_EXT_ERR(skb)->opt_stats)
                         put_cmsg(msg, SOL_SOCKET, SCM_TIMESTAMPING_OPT_STATS,
                                  skb->len, skb->data);
         }
@@ -1506,7 +1517,7 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
         if (err)
                 goto out_fd;
 
-        err = sock->ops->accept(sock, newsock, sock->file->f_flags);
+        err = sock->ops->accept(sock, newsock, sock->file->f_flags, false);
         if (err < 0)
                 goto out_fd;
 
@@ -1731,6 +1742,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
         /* We assume all kernel code knows the size of sockaddr_storage */
         msg.msg_namelen = 0;
         msg.msg_iocb = NULL;
+        msg.msg_flags = 0;
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
         err = sock_recvmsg(sock, &msg, flags);
@@ -3238,7 +3250,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
         if (err < 0)
                 goto done;
 
-        err = sock->ops->accept(sock, *newsock, flags);
+        err = sock->ops->accept(sock, *newsock, flags, true);
         if (err < 0) {
                 sock_release(*newsock);
                 *newsock = NULL;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 8931e33b6541..2b720fa35c4f 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1635,6 +1635,7 @@ static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
 
         xprt = &svsk->sk_xprt;
         svc_xprt_init(net, &svc_tcp_bc_class, xprt, serv);
+        set_bit(XPT_CONG_CTRL, &svsk->sk_xprt.xpt_flags);
 
         serv->sv_bc_xprt = xprt;
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index c13a5c35ce14..fc8f14c7bfec 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -127,6 +127,7 @@ static struct svc_xprt *svc_rdma_bc_create(struct svc_serv *serv,
         xprt = &cma_xprt->sc_xprt;
 
         svc_xprt_init(net, &svc_rdma_bc_class, xprt, serv);
+        set_bit(XPT_CONG_CTRL, &xprt->xpt_flags);
         serv->sv_bc_xprt = xprt;
 
         dprintk("svcrdma: %s(%p)\n", __func__, xprt);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 81cd31acf690..3b332b395045 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -503,7 +503,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
         struct ib_cq *sendcq, *recvcq;
         int rc;
 
-        max_sge = min(ia->ri_device->attrs.max_sge, RPCRDMA_MAX_SEND_SGES);
+        max_sge = min_t(unsigned int, ia->ri_device->attrs.max_sge,
+                        RPCRDMA_MAX_SEND_SGES);
         if (max_sge < RPCRDMA_MIN_SEND_SGES) {
                 pr_warn("rpcrdma: HCA provides only %d send SGEs\n", max_sge);
                 return -ENOMEM;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 43e4045e72bc..7130e73bd42c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -115,7 +115,8 @@ static void tipc_data_ready(struct sock *sk);
 static void tipc_write_space(struct sock *sk);
 static void tipc_sock_destruct(struct sock *sk);
 static int tipc_release(struct socket *sock);
-static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags);
+static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
+                       bool kern);
 static void tipc_sk_timeout(unsigned long data);
 static int tipc_sk_publish(struct tipc_sock *tsk, uint scope,
                            struct tipc_name_seq const *seq);
@@ -2029,7 +2030,8 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo)
  *
  * Returns 0 on success, errno otherwise
  */
-static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
+static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
+                       bool kern)
 {
         struct sock *new_sk, *sk = sock->sk;
         struct sk_buff *buf;
@@ -2051,7 +2053,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
 
         buf = skb_peek(&sk->sk_receive_queue);
 
-        res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 0);
+        res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, kern);
         if (res)
                 goto exit;
         security_sk_clone(sock->sk, new_sock->sk);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 9d94e65d0894..271cd66e4b3b 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -141,6 +141,11 @@ void tipc_subscrp_report_overlap(struct tipc_subscription *sub, u32 found_lower,
 static void tipc_subscrp_timeout(unsigned long data)
 {
         struct tipc_subscription *sub = (struct tipc_subscription *)data;
+        struct tipc_subscriber *subscriber = sub->subscriber;
+
+        spin_lock_bh(&subscriber->lock);
+        tipc_nametbl_unsubscribe(sub);
+        spin_unlock_bh(&subscriber->lock);
 
         /* Notify subscriber of timeout */
         tipc_subscrp_send_event(sub, sub->evt.s.seq.lower, sub->evt.s.seq.upper,
@@ -173,7 +178,6 @@ static void tipc_subscrp_kref_release(struct kref *kref)
         struct tipc_subscriber *subscriber = sub->subscriber;
 
         spin_lock_bh(&subscriber->lock);
-        tipc_nametbl_unsubscribe(sub);
         list_del(&sub->subscrp_list);
         atomic_dec(&tn->subscription_count);
         spin_unlock_bh(&subscriber->lock);
@@ -205,6 +209,7 @@ static void tipc_subscrb_subscrp_delete(struct tipc_subscriber *subscriber,
                 if (s && memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr)))
                         continue;
 
+                tipc_nametbl_unsubscribe(sub);
                 tipc_subscrp_get(sub);
                 spin_unlock_bh(&subscriber->lock);
                 tipc_subscrp_delete(sub);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ee37b390260a..928691c43408 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -636,7 +636,7 @@ static int unix_bind(struct socket *, struct sockaddr *, int);
 static int unix_stream_connect(struct socket *, struct sockaddr *,
                                int addr_len, int flags);
 static int unix_socketpair(struct socket *, struct socket *);
-static int unix_accept(struct socket *, struct socket *, int);
+static int unix_accept(struct socket *, struct socket *, int, bool);
 static int unix_getname(struct socket *, struct sockaddr *, int *, int);
 static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
 static unsigned int unix_dgram_poll(struct file *, struct socket *,
@@ -1402,7 +1402,8 @@ static void unix_sock_inherit_flags(const struct socket *old,
                 set_bit(SOCK_PASSSEC, &new->flags);
 }
 
-static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
+static int unix_accept(struct socket *sock, struct socket *newsock, int flags,
+                       bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *tsk;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6a0d48525fcf..c36757e72844 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
+                BUG_ON(!atomic_long_read(&u->inflight));
                 BUG_ON(list_empty(&u->link));
 
                 if (atomic_long_dec_and_test(&u->inflight))
@@ -341,6 +342,14 @@ void unix_gc(void)
         }
         list_del(&cursor);
 
+        /* Now gc_candidates contains only garbage.  Restore original
+         * inflight counters for these as well, and remove the skbuffs
+         * which are creating the cycle(s).
+         */
+        skb_queue_head_init(&hitlist);
+        list_for_each_entry(u, &gc_candidates, link)
+                scan_children(&u->sk, inc_inflight, &hitlist);
+
         /* not_cycle_list contains those sockets which do not make up a
          * cycle.  Restore these to the inflight list.
          */
@@ -350,14 +359,6 @@ void unix_gc(void)
                 list_move_tail(&u->link, &gc_inflight_list);
         }
 
-        /* Now gc_candidates contains only garbage.  Restore original
-         * inflight counters for these as well, and remove the skbuffs
-         * which are creating the cycle(s).
-         */
-        skb_queue_head_init(&hitlist);
-        list_for_each_entry(u, &gc_candidates, link)
-        scan_children(&u->sk, inc_inflight, &hitlist);
-
         spin_unlock(&unix_gc_lock);
 
         /* Here we are. Hitlist is filled. Die. */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 9192ead66751..6f7f6757ceef 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1102,10 +1102,19 @@ static const struct proto_ops vsock_dgram_ops = {
         .sendpage = sock_no_sendpage,
 };
 
+static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        if (!transport->cancel_pkt)
+                return -EOPNOTSUPP;
+
+        return transport->cancel_pkt(vsk);
+}
+
 static void vsock_connect_timeout(struct work_struct *work)
 {
         struct sock *sk;
         struct vsock_sock *vsk;
+        int cancel = 0;
 
         vsk = container_of(work, struct vsock_sock, dwork.work);
         sk = sk_vsock(vsk);
@@ -1116,8 +1125,11 @@ static void vsock_connect_timeout(struct work_struct *work)
                 sk->sk_state = SS_UNCONNECTED;
                 sk->sk_err = ETIMEDOUT;
                 sk->sk_error_report(sk);
+                cancel = 1;
         }
         release_sock(sk);
+        if (cancel)
+                vsock_transport_cancel_pkt(vsk);
 
         sock_put(sk);
 }
@@ -1224,11 +1236,13 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
                         err = sock_intr_errno(timeout);
                         sk->sk_state = SS_UNCONNECTED;
                         sock->state = SS_UNCONNECTED;
+                        vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 } else if (timeout == 0) {
                         err = -ETIMEDOUT;
                         sk->sk_state = SS_UNCONNECTED;
                         sock->state = SS_UNCONNECTED;
+                        vsock_transport_cancel_pkt(vsk);
                         goto out_wait;
                 }
 
@@ -1250,7 +1264,8 @@ out:
         return err;
 }
 
-static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
+static int vsock_accept(struct socket *sock, struct socket *newsock, int flags,
+                        bool kern)
 {
         struct sock *listener;
         int err;
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 9d24c0e958b1..68675a151f22 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -213,6 +213,47 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
         return len;
 }
 
+static int
+virtio_transport_cancel_pkt(struct vsock_sock *vsk)
+{
+        struct virtio_vsock *vsock;
+        struct virtio_vsock_pkt *pkt, *n;
+        int cnt = 0;
+        LIST_HEAD(freeme);
+
+        vsock = virtio_vsock_get();
+        if (!vsock) {
+                return -ENODEV;
+        }
+
+        spin_lock_bh(&vsock->send_pkt_list_lock);
+        list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
+                if (pkt->vsk != vsk)
+                        continue;
+                list_move(&pkt->list, &freeme);
+        }
+        spin_unlock_bh(&vsock->send_pkt_list_lock);
+
+        list_for_each_entry_safe(pkt, n, &freeme, list) {
+                if (pkt->reply)
+                        cnt++;
+                list_del(&pkt->list);
+                virtio_transport_free_pkt(pkt);
+        }
+
+        if (cnt) {
+                struct virtqueue *rx_vq = vsock->vqs[VSOCK_VQ_RX];
+                int new_cnt;
+
+                new_cnt = atomic_sub_return(cnt, &vsock->queued_replies);
+                if (new_cnt + cnt >= virtqueue_get_vring_size(rx_vq) &&
+                    new_cnt < virtqueue_get_vring_size(rx_vq))
+                        queue_work(virtio_vsock_workqueue, &vsock->rx_work);
+        }
+
+        return 0;
+}
+
 static void virtio_vsock_rx_fill(struct virtio_vsock *vsock)
 {
         int buf_len = VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE;
@@ -462,6 +503,7 @@ static struct virtio_transport virtio_transport = {
                 .release                  = virtio_transport_release,
                 .connect                  = virtio_transport_connect,
                 .shutdown                 = virtio_transport_shutdown,
+                .cancel_pkt               = virtio_transport_cancel_pkt,
 
                 .dgram_bind               = virtio_transport_dgram_bind,
                 .dgram_dequeue            = virtio_transport_dgram_dequeue,
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 8d592a45b597..af087b44ceea 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -58,6 +58,7 @@ virtio_transport_alloc_pkt(struct virtio_vsock_pkt_info *info,
         pkt->len                = len;
         pkt->hdr.len            = cpu_to_le32(len);
         pkt->reply              = info->reply;
+        pkt->vsk                = info->vsk;
 
         if (info->msg && len > 0) {
                 pkt->buf = kmalloc(len, GFP_KERNEL);
@@ -180,6 +181,7 @@ static int virtio_transport_send_credit_update(struct vsock_sock *vsk,
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_CREDIT_UPDATE,
                 .type = type,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -519,6 +521,7 @@ int virtio_transport_connect(struct vsock_sock *vsk)
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_REQUEST,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -534,6 +537,7 @@ int virtio_transport_shutdown(struct vsock_sock *vsk, int mode)
                           VIRTIO_VSOCK_SHUTDOWN_RCV : 0) |
                          (mode & SEND_SHUTDOWN ?
                           VIRTIO_VSOCK_SHUTDOWN_SEND : 0),
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -560,6 +564,7 @@ virtio_transport_stream_enqueue(struct vsock_sock *vsk,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
                 .msg = msg,
                 .pkt_len = len,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
@@ -581,6 +586,7 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
                 .op = VIRTIO_VSOCK_OP_RST,
                 .type = VIRTIO_VSOCK_TYPE_STREAM,
                 .reply = !!pkt,
+                .vsk = vsk,
         };
 
         /* Send RST only if the original pkt is not a RST pkt */
@@ -826,6 +832,7 @@ virtio_transport_send_response(struct vsock_sock *vsk,
                 .remote_cid = le64_to_cpu(pkt->hdr.src_cid),
                 .remote_port = le32_to_cpu(pkt->hdr.src_port),
                 .reply = true,
+                .vsk = vsk,
         };
 
         return virtio_transport_send_pkt_info(vsk, &info);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d7f8be4e321a..2312dc2ffdb9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -545,22 +545,18 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 {
         int err;
 
-        rtnl_lock();
-
         if (!cb->args[0]) {
                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                                   genl_family_attrbuf(&nl80211_fam),
                                   nl80211_fam.maxattr, nl80211_policy);
                 if (err)
-                        goto out_unlock;
+                        return err;
 
                 *wdev = __cfg80211_wdev_from_attrs(
                                         sock_net(skb->sk),
                                         genl_family_attrbuf(&nl80211_fam));
-                if (IS_ERR(*wdev)) {
-                        err = PTR_ERR(*wdev);
-                        goto out_unlock;
-                }
+                if (IS_ERR(*wdev))
+                        return PTR_ERR(*wdev);
                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
                 /* 0 is the first index - add 1 to parse only once */
                 cb->args[0] = (*rdev)->wiphy_idx + 1;
@@ -570,10 +566,8 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
-                if (!wiphy) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!wiphy)
+                        return -ENODEV;
                 *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
@@ -584,21 +578,11 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         }
                 }
 
-                if (!*wdev) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!*wdev)
+                        return -ENODEV;
         }
 
         return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
-}
-
-static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
-{
-        rtnl_unlock();
 }
 
 /* IE validation */
@@ -2608,17 +2592,17 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         int filter_wiphy = -1;
         struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
+        int ret;
 
         rtnl_lock();
         if (!cb->args[2]) {
                 struct nl80211_dump_wiphy_state state = {
                         .filter_wiphy = -1,
                 };
-                int ret;
 
                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
                 if (ret)
-                        return ret;
+                        goto out_unlock;
 
                 filter_wiphy = state.filter_wiphy;
 
@@ -2663,12 +2647,14 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 wp_idx++;
         }
  out:
-        rtnl_unlock();
-
         cb->args[0] = wp_idx;
         cb->args[1] = if_idx;
 
-        return skb->len;
+        ret = skb->len;
+ out_unlock:
+        rtnl_unlock();
+
+        return ret;
 }
 
 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
@@ -4452,9 +4438,10 @@ static int nl80211_dump_station(struct sk_buff *skb,
         int sta_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!wdev->netdev) {
                 err = -EINVAL;
@@ -4489,7 +4476,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         cb->args[2] = sta_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
 
         return err;
 }
@@ -5275,9 +5262,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         int path_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!rdev->ops->dump_mpath) {
                 err = -EOPNOTSUPP;
@@ -5310,7 +5298,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -5470,9 +5458,10 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
         int path_idx = cb->args[2];
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out_err;
 
         if (!rdev->ops->dump_mpp) {
                 err = -EOPNOTSUPP;
@@ -5505,7 +5494,7 @@ static int nl80211_dump_mpp(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -7674,9 +7663,12 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
         int start = cb->args[2], idx = 0;
         int err;
 
+        rtnl_lock();
         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
-        if (err)
+        if (err) {
+                rtnl_unlock();
                 return err;
+        }
 
         wdev_lock(wdev);
         spin_lock_bh(&rdev->bss_lock);
@@ -7699,7 +7691,7 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
         wdev_unlock(wdev);
 
         cb->args[2] = idx;
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
 
         return skb->len;
 }
@@ -7784,9 +7776,10 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
         int res;
         bool radio_stats;
 
+        rtnl_lock();
         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (res)
-                return res;
+                goto out_err;
 
         /* prepare_wdev_dump parsed the attributes */
         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
@@ -7827,7 +7820,7 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
         cb->args[2] = survey_idx;
         res = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(rdev);
+        rtnl_unlock();
         return res;
 }
 
@@ -11508,17 +11501,13 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
         void *data = NULL;
         unsigned int data_len = 0;
 
-        rtnl_lock();
-
         if (cb->args[0]) {
                 /* subtract the 1 again here */
                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
-                if (!wiphy) {
-                        err = -ENODEV;
-                        goto out_unlock;
-                }
+                if (!wiphy)
+                        return -ENODEV;
                 *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
@@ -11538,23 +11527,19 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                           attrbuf, nl80211_fam.maxattr, nl80211_policy);
         if (err)
-                goto out_unlock;
+                return err;
 
         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
-            !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
-                err = -EINVAL;
-                goto out_unlock;
-        }
+            !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
+                return -EINVAL;
 
         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
         if (IS_ERR(*wdev))
                 *wdev = NULL;
 
         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
-        if (IS_ERR(*rdev)) {
-                err = PTR_ERR(*rdev);
-                goto out_unlock;
-        }
+        if (IS_ERR(*rdev))
+                return PTR_ERR(*rdev);
 
         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
@@ -11567,19 +11552,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
                         continue;
 
-                if (!vcmd->dumpit) {
-                        err = -EOPNOTSUPP;
-                        goto out_unlock;
-                }
+                if (!vcmd->dumpit)
+                        return -EOPNOTSUPP;
 
                 vcmd_idx = i;
                 break;
         }
 
-        if (vcmd_idx < 0) {
-                err = -EOPNOTSUPP;
-                goto out_unlock;
-        }
+        if (vcmd_idx < 0)
+                return -EOPNOTSUPP;
 
         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
@@ -11596,9 +11577,6 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
 
         /* keep rtnl locked in successful case */
         return 0;
- out_unlock:
-        rtnl_unlock();
-        return err;
 }
 
 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
@@ -11613,9 +11591,10 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
         int err;
         struct nlattr *vendor_data;
 
+        rtnl_lock();
         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
         if (err)
-                return err;
+                goto out;
 
         vcmd_idx = cb->args[2];
         data = (void *)cb->args[3];
@@ -11624,15 +11603,21 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
 
         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
-                if (!wdev)
-                        return -EINVAL;
+                if (!wdev) {
+                        err = -EINVAL;
+                        goto out;
+                }
                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
-                    !wdev->netdev)
-                        return -EINVAL;
+                    !wdev->netdev) {
+                        err = -EINVAL;
+                        goto out;
+                }
 
                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
-                        if (!wdev_running(wdev))
-                                return -ENETDOWN;
+                        if (!wdev_running(wdev)) {
+                                err = -ENETDOWN;
+                                goto out;
+                        }
                 }
         }
 
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 16b6b5988be9..570a2b67ca10 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -132,12 +132,10 @@ static int wiphy_resume(struct device *dev)
         /* Age scan results with time spent in suspend */
         cfg80211_bss_age(rdev, get_seconds() - rdev->suspend_at);
 
-        if (rdev->ops->resume) {
-                rtnl_lock();
-                if (rdev->wiphy.registered)
-                        ret = rdev_resume(rdev);
-                rtnl_unlock();
-        }
+        rtnl_lock();
+        if (rdev->wiphy.registered && rdev->ops->resume)
+                ret = rdev_resume(rdev);
+        rtnl_unlock();
 
         return ret;
 }
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index fd28a49dbe8f..8b911c29860e 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -852,7 +852,8 @@ static int x25_wait_for_data(struct sock *sk, long timeout)
         return rc;
 }
 
-static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
+static int x25_accept(struct socket *sock, struct socket *newsock, int flags,
+                      bool kern)
 {
         struct sock *sk = sock->sk;
         struct sock *newsk;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0806dccdf507..236cbbc0ab9c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1243,7 +1243,7 @@ static inline int policy_to_flow_dir(int dir)
 }
 
 static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
-                                                 const struct flowi *fl)
+                                                 const struct flowi *fl, u16 family)
 {
         struct xfrm_policy *pol;
 
@@ -1251,8 +1251,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
  again:
         pol = rcu_dereference(sk->sk_policy[dir]);
         if (pol != NULL) {
-                bool match = xfrm_selector_match(&pol->selector, fl,
-                                                 sk->sk_family);
+                bool match = xfrm_selector_match(&pol->selector, fl, family);
                 int err = 0;
 
                 if (match) {
@@ -2239,7 +2238,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
         sk = sk_const_to_full_sk(sk);
         if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
                 num_pols = 1;
-                pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
                 err = xfrm_expand_policies(fl, family, pols,
                                            &num_pols, &num_xfrms);
                 if (err < 0)
@@ -2518,7 +2517,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
         pol = NULL;
         sk = sk_to_full_sk(sk);
         if (sk && sk->sk_policy[dir]) {
-                pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
                 if (IS_ERR(pol)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
                         return 0;
@@ -3069,6 +3068,11 @@ static int __net_init xfrm_net_init(struct net *net)
 {
         int rv;
 
+        /* Initialize the per-net locks here */
+        spin_lock_init(&net->xfrm.xfrm_state_lock);
+        spin_lock_init(&net->xfrm.xfrm_policy_lock);
+        mutex_init(&net->xfrm.xfrm_cfg_mutex);
+
         rv = xfrm_statistics_init(net);
         if (rv < 0)
                 goto out_statistics;
@@ -3085,11 +3089,6 @@ static int __net_init xfrm_net_init(struct net *net)
         if (rv < 0)
                 goto out;
 
-        /* Initialize the per-net locks here */
-        spin_lock_init(&net->xfrm.xfrm_state_lock);
-        spin_lock_init(&net->xfrm.xfrm_policy_lock);
-        mutex_init(&net->xfrm.xfrm_cfg_mutex);
-
         return 0;
 
 out:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 9705c279494b..40a8aa39220d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
         up = nla_data(rp);
         ulen = xfrm_replay_state_esn_len(up);
 
-        if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
+        /* Check the overall length and the internal bitmap length to avoid
+         * potential overflow. */
+        if (nla_len(rp) < ulen ||
+            xfrm_replay_state_esn_len(replay_esn) != ulen ||
+            replay_esn->bmp_len != up->bmp_len)
+                return -EINVAL;
+
+        if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
                 return -EINVAL;
 
         return 0;
diff --git a/samples/statx/test-statx.c b/samples/statx/test-statx.c
index 8571d766331d..d4d77b09412c 100644
--- a/samples/statx/test-statx.c
+++ b/samples/statx/test-statx.c
@@ -141,8 +141,8 @@ static void dump_statx(struct statx *stx)
         if (stx->stx_mask & STATX_BTIME)
                 print_time(" Birth: ", &stx->stx_btime);
 
-        if (stx->stx_attributes) {
-                unsigned char bits;
+        if (stx->stx_attributes_mask) {
+                unsigned char bits, mbits;
                 int loop, byte;
 
                 static char attr_representation[64 + 1] =
@@ -160,14 +160,18 @@ static void dump_statx(struct statx *stx)
                 printf("Attributes: %016llx (", stx->stx_attributes);
                 for (byte = 64 - 8; byte >= 0; byte -= 8) {
                         bits = stx->stx_attributes >> byte;
+                        mbits = stx->stx_attributes_mask >> byte;
                         for (loop = 7; loop >= 0; loop--) {
                                 int bit = byte + loop;
 
-                                if (bits & 0x80)
+                                if (!(mbits & 0x80))
+                                        putchar('.');   /* Not supported */
+                                else if (bits & 0x80)
                                         putchar(attr_representation[63 - bit]);
                                 else
-                                        putchar('-');
+                                        putchar('-');   /* Not set */
                                 bits <<= 1;
+                                mbits <<= 1;
                         }
                         if (byte)
                                 putchar(' ');
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index d6ca649cb0e9..afe3fd3af1e4 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -148,6 +148,10 @@ cc-fullversion = $(shell $(CONFIG_SHELL) \
 # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
 cc-ifversion = $(shell [ $(cc-version) $(1) $(2) ] && echo $(3) || echo $(4))
 
+# cc-if-fullversion
+# Usage:  EXTRA_CFLAGS += $(call cc-if-fullversion, -lt, 040502, -O1)
+cc-if-fullversion = $(shell [ $(cc-fullversion) $(1) $(2) ] && echo $(3) || echo $(4))
+
 # cc-ldoption
 # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
 cc-ldoption = $(call try-run,\
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 0a07f9014944..7234e61e7ce3 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -155,7 +155,7 @@ else
 # $(call addtree,-I$(obj)) locates .h files in srctree, from generated .c files
 #   and locates generated .h files
 # FIXME: Replace both with specific CFLAGS* statements in the makefiles
-__c_flags       = $(if $(obj),-I$(srctree)/$(src) -I$(obj)) \
+__c_flags       = $(if $(obj),$(call addtree,-I$(src)) -I$(obj)) \
                   $(call flags,_c_flags)
 __a_flags       = $(call flags,_a_flags)
 __cpp_flags     = $(call flags,_cpp_flags)
diff --git a/scripts/gcc-plugins/sancov_plugin.c b/scripts/gcc-plugins/sancov_plugin.c
index 9b0b5cbc5b89..0f98634c20a0 100644
--- a/scripts/gcc-plugins/sancov_plugin.c
+++ b/scripts/gcc-plugins/sancov_plugin.c
@@ -133,7 +133,7 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gc
 #if BUILDING_GCC_VERSION < 6000
         register_callback(plugin_name, PLUGIN_START_UNIT, &sancov_start_unit, NULL);
         register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_sancov);
-        register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &sancov_plugin_pass_info);
+        register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &sancov_pass_info);
 #endif
 
         return 0;
diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c
index 26d208b435a0..cfddddb9c9d7 100644
--- a/scripts/kconfig/gconf.c
+++ b/scripts/kconfig/gconf.c
@@ -914,7 +914,7 @@ on_treeview2_button_press_event(GtkWidget * widget,
                         current = menu;
                         display_tree_part();
                         gtk_widget_set_sensitive(back_btn, TRUE);
-                } else if ((col == COL_OPTION)) {
+                } else if (col == COL_OPTION) {
                         toggle_sym_value(menu);
                         gtk_tree_view_expand_row(view, path, TRUE);
                 }
diff --git a/scripts/module-common.lds b/scripts/module-common.lds
index cf7e52e4781b..9b6e246a45d0 100644
--- a/scripts/module-common.lds
+++ b/scripts/module-common.lds
@@ -22,4 +22,6 @@ SECTIONS {
 
         . = ALIGN(8);
         .init_array             0 : { *(SORT(.init_array.*)) *(.init_array) }
+
+        __jump_table            0 : ALIGN(8) { KEEP(*(__jump_table)) }
 }
diff --git a/scripts/spelling.txt b/scripts/spelling.txt
index 0458b037c8a1..0545f5a8cabe 100644
--- a/scripts/spelling.txt
+++ b/scripts/spelling.txt
@@ -372,6 +372,8 @@ disassocation||disassociation
 disapear||disappear
 disapeared||disappeared
 disappared||disappeared
+disble||disable
+disbled||disabled
 disconnet||disconnect
 discontinous||discontinuous
 dispertion||dispersion
@@ -732,6 +734,7 @@ oustanding||outstanding
 overaall||overall
 overhread||overhead
 overlaping||overlapping
+overide||override
 overrided||overridden
 overriden||overridden
 overun||overrun
diff --git a/security/keys/gc.c b/security/keys/gc.c
index addf060399e0..9cb4fe4478a1 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -46,7 +46,7 @@ static unsigned long key_gc_flags;
  * immediately unlinked.
  */
 struct key_type key_type_dead = {
-        .name = "dead",
+        .name = ".dead",
 };
 
 /*
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 52c34532c785..4ad3212adebe 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -273,7 +273,8 @@ error:
  * Create and join an anonymous session keyring or join a named session
  * keyring, creating it if necessary.  A named session keyring must have Search
  * permission for it to be joined.  Session keyrings without this permit will
- * be skipped over.
+ * be skipped over.  It is not permitted for userspace to create or join
+ * keyrings whose name begin with a dot.
  *
  * If successful, the ID of the joined session keyring will be returned.
  */
@@ -290,12 +291,16 @@ long keyctl_join_session_keyring(const char __user *_name)
                         ret = PTR_ERR(name);
                         goto error;
                 }
+
+                ret = -EPERM;
+                if (name[0] == '.')
+                        goto error_name;
         }
 
         /* join the session */
         ret = join_session_keyring(name);
+error_name:
         kfree(name);
-
 error:
         return ret;
 }
@@ -1253,8 +1258,8 @@ error:
  * Read or set the default keyring in which request_key() will cache keys and
  * return the old setting.
  *
- * If a process keyring is specified then this will be created if it doesn't
- * yet exist.  The old setting will be returned if successful.
+ * If a thread or process keyring is specified then it will be created if it
+ * doesn't yet exist.  The old setting will be returned if successful.
  */
 long keyctl_set_reqkey_keyring(int reqkey_defl)
 {
@@ -1279,11 +1284,8 @@ long keyctl_set_reqkey_keyring(int reqkey_defl)
 
         case KEY_REQKEY_DEFL_PROCESS_KEYRING:
                 ret = install_process_keyring_to_cred(new);
-                if (ret < 0) {
-                        if (ret != -EEXIST)
-                                goto error;
-                        ret = 0;
-                }
+                if (ret < 0)
+                        goto error;
                 goto set;
 
         case KEY_REQKEY_DEFL_DEFAULT:
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index b6fdd22205b1..9139b18fc863 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -128,13 +128,18 @@ error:
 }
 
 /*
- * Install a fresh thread keyring directly to new credentials.  This keyring is
- * allowed to overrun the quota.
+ * Install a thread keyring to the given credentials struct if it didn't have
+ * one already.  This is allowed to overrun the quota.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
  */
 int install_thread_keyring_to_cred(struct cred *new)
 {
         struct key *keyring;
 
+        if (new->thread_keyring)
+                return 0;
+
         keyring = keyring_alloc("_tid", new->uid, new->gid, new,
                                 KEY_POS_ALL | KEY_USR_VIEW,
                                 KEY_ALLOC_QUOTA_OVERRUN,
@@ -147,7 +152,9 @@ int install_thread_keyring_to_cred(struct cred *new)
 }
 
 /*
- * Install a fresh thread keyring, discarding the old one.
+ * Install a thread keyring to the current task if it didn't have one already.
+ *
+ * Return: 0 if a thread keyring is now present; -errno on failure.
  */
 static int install_thread_keyring(void)
 {
@@ -158,8 +165,6 @@ static int install_thread_keyring(void)
         if (!new)
                 return -ENOMEM;
 
-        BUG_ON(new->thread_keyring);
-
         ret = install_thread_keyring_to_cred(new);
         if (ret < 0) {
                 abort_creds(new);
@@ -170,17 +175,17 @@ static int install_thread_keyring(void)
 }
 
 /*
- * Install a process keyring directly to a credentials struct.
+ * Install a process keyring to the given credentials struct if it didn't have
+ * one already.  This is allowed to overrun the quota.
  *
- * Returns -EEXIST if there was already a process keyring, 0 if one installed,
- * and other value on any other error
+ * Return: 0 if a process keyring is now present; -errno on failure.
  */
 int install_process_keyring_to_cred(struct cred *new)
 {
         struct key *keyring;
 
         if (new->process_keyring)
-                return -EEXIST;
+                return 0;
 
         keyring = keyring_alloc("_pid", new->uid, new->gid, new,
                                 KEY_POS_ALL | KEY_USR_VIEW,
@@ -194,11 +199,9 @@ int install_process_keyring_to_cred(struct cred *new)
 }
 
 /*
- * Make sure a process keyring is installed for the current process.  The
- * existing process keyring is not replaced.
+ * Install a process keyring to the current task if it didn't have one already.
  *
- * Returns 0 if there is a process keyring by the end of this function, some
- * error otherwise.
+ * Return: 0 if a process keyring is now present; -errno on failure.
  */
 static int install_process_keyring(void)
 {
@@ -212,14 +215,18 @@ static int install_process_keyring(void)
         ret = install_process_keyring_to_cred(new);
         if (ret < 0) {
                 abort_creds(new);
-                return ret != -EEXIST ? ret : 0;
+                return ret;
         }
 
         return commit_creds(new);
 }
 
 /*
- * Install a session keyring directly to a credentials struct.
+ * Install the given keyring as the session keyring of the given credentials
+ * struct, replacing the existing one if any.  If the given keyring is NULL,
+ * then install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
  */
 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 {
@@ -254,8 +261,11 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 }
 
 /*
- * Install a session keyring, discarding the old one.  If a keyring is not
- * supplied, an empty one is invented.
+ * Install the given keyring as the session keyring of the current task,
+ * replacing the existing one if any.  If the given keyring is NULL, then
+ * install a new anonymous session keyring.
+ *
+ * Return: 0 on success; -errno on failure.
  */
 static int install_session_keyring(struct key *keyring)
 {
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index 4c935202ce23..f3b1d7f50b81 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1832,6 +1832,7 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client,
              info->output_pool != client->pool->size)) {
                 if (snd_seq_write_pool_allocated(client)) {
                         /* remove all existing cells */
+                        snd_seq_pool_mark_closing(client->pool);
                         snd_seq_queue_client_leave_cells(client->number);
                         snd_seq_pool_done(client->pool);
                 }
diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
index 448efd4e980e..01c4cfe30c9f 100644
--- a/sound/core/seq/seq_fifo.c
+++ b/sound/core/seq/seq_fifo.c
@@ -72,6 +72,9 @@ void snd_seq_fifo_delete(struct snd_seq_fifo **fifo)
                 return;
         *fifo = NULL;
 
+        if (f->pool)
+                snd_seq_pool_mark_closing(f->pool);
+
         snd_seq_fifo_clear(f);
 
         /* wake up clients if any */
@@ -264,6 +267,10 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
         /* NOTE: overflow flag is not cleared */
         spin_unlock_irqrestore(&f->lock, flags);
 
+        /* close the old pool and wait until all users are gone */
+        snd_seq_pool_mark_closing(oldpool);
+        snd_use_lock_sync(&f->use_lock);
+
         /* release cells in old pool */
         for (cell = oldhead; cell; cell = next) {
                 next = cell->next;
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index 1a1acf3ddda4..d4c61ec9be13 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -415,6 +415,18 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
         return 0;
 }
 
+/* refuse the further insertion to the pool */
+void snd_seq_pool_mark_closing(struct snd_seq_pool *pool)
+{
+        unsigned long flags;
+
+        if (snd_BUG_ON(!pool))
+                return;
+        spin_lock_irqsave(&pool->lock, flags);
+        pool->closing = 1;
+        spin_unlock_irqrestore(&pool->lock, flags);
+}
+
 /* remove events */
 int snd_seq_pool_done(struct snd_seq_pool *pool)
 {
@@ -425,10 +437,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
                 return -EINVAL;
 
         /* wait for closing all threads */
-        spin_lock_irqsave(&pool->lock, flags);
-        pool->closing = 1;
-        spin_unlock_irqrestore(&pool->lock, flags);
-
         if (waitqueue_active(&pool->output_sleep))
                 wake_up(&pool->output_sleep);
 
@@ -485,6 +493,7 @@ int snd_seq_pool_delete(struct snd_seq_pool **ppool)
         *ppool = NULL;
         if (pool == NULL)
                 return 0;
+        snd_seq_pool_mark_closing(pool);
         snd_seq_pool_done(pool);
         kfree(pool);
         return 0;
diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h
index 4a2ec779b8a7..32f959c17786 100644
--- a/sound/core/seq/seq_memory.h
+++ b/sound/core/seq/seq_memory.h
@@ -84,6 +84,7 @@ static inline int snd_seq_total_cells(struct snd_seq_pool *pool)
 int snd_seq_pool_init(struct snd_seq_pool *pool);
 
 /* done pool - free events */
+void snd_seq_pool_mark_closing(struct snd_seq_pool *pool);
 int snd_seq_pool_done(struct snd_seq_pool *pool);
 
 /* create pool */
diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
index 043065867656..6f1e99c9fed9 100644
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -268,7 +268,7 @@ int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus)
         unsigned int offset;
         unsigned int counter = 0;
 
-        offset = snd_hdac_chip_readl(bus, LLCH);
+        offset = snd_hdac_chip_readw(bus, LLCH);
 
         /* Lets walk the linked capabilities list */
         do {
diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c
index ab4cdab5cfa5..79edd88d5cd0 100644
--- a/sound/pci/ctxfi/cthw20k1.c
+++ b/sound/pci/ctxfi/cthw20k1.c
@@ -1905,7 +1905,7 @@ static int hw_card_start(struct hw *hw)
                 return err;
 
         /* Set DMA transfer mask */
-        if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
+        if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
                 dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
         } else {
                 dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index c15c51bea26d..69266b8ea2ad 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -261,6 +261,7 @@ enum {
         CXT_FIXUP_HP_530,
         CXT_FIXUP_CAP_MIX_AMP_5047,
         CXT_FIXUP_MUTE_LED_EAPD,
+        CXT_FIXUP_HP_DOCK,
         CXT_FIXUP_HP_SPECTRE,
         CXT_FIXUP_HP_GATE_MIC,
 };
@@ -778,6 +779,14 @@ static const struct hda_fixup cxt_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = cxt_fixup_mute_led_eapd,
         },
+        [CXT_FIXUP_HP_DOCK] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x16, 0x21011020 }, /* line-out */
+                        { 0x18, 0x2181103f }, /* line-in */
+                        { }
+                }
+        },
         [CXT_FIXUP_HP_SPECTRE] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
@@ -839,6 +848,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
         SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
         SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
         SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+        SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
         SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
         SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
         SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
@@ -871,6 +881,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
         { .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" },
         { .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" },
         { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" },
+        { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" },
         {}
 };
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4e112221d825..299835d1fbaa 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4847,6 +4847,7 @@ enum {
         ALC286_FIXUP_HP_GPIO_LED,
         ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
         ALC280_FIXUP_HP_DOCK_PINS,
+        ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED,
         ALC280_FIXUP_HP_9480M,
         ALC288_FIXUP_DELL_HEADSET_MODE,
         ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -4857,6 +4858,7 @@ enum {
         ALC292_FIXUP_DISABLE_AAMIX,
         ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK,
         ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+        ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
         ALC275_FIXUP_DELL_XPS,
         ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE,
         ALC293_FIXUP_LENOVO_SPK_NOISE,
@@ -5388,6 +5390,16 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC280_FIXUP_HP_GPIO4
         },
+        [ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1b, 0x21011020 }, /* line-out */
+                        { 0x18, 0x2181103f }, /* line-in */
+                        { },
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HP_GPIO_MIC1_LED
+        },
         [ALC280_FIXUP_HP_9480M] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc280_fixup_hp_9480m,
@@ -5459,6 +5471,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC269_FIXUP_HEADSET_MODE
         },
+        [ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MODE
+        },
         [ALC275_FIXUP_DELL_XPS] = {
                 .type = HDA_FIXUP_VERBS,
                 .v.verbs = (const struct hda_verb[]) {
@@ -5531,7 +5552,7 @@ static const struct hda_fixup alc269_fixups[] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc298_fixup_speaker_volume,
                 .chained = true,
-                .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+                .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
         },
         [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
                 .type = HDA_FIXUP_PINS,
@@ -5647,7 +5668,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x2256, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2257, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2259, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
-        SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
+        SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2263, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x2264, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
@@ -5816,6 +5837,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"},
         {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"},
         {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"},
+        {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"},
         {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
         {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"},
         {.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"},
@@ -6090,6 +6112,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 ALC295_STANDARD_PINS,
                 {0x17, 0x21014040},
                 {0x18, 0x21a19050}),
+        SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC295_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC298_STANDARD_PINS,
                 {0x17, 0x90170110}),
diff --git a/sound/soc/Kconfig b/sound/soc/Kconfig
index 182d92efc7c8..9df9658b552b 100644
--- a/sound/soc/Kconfig
+++ b/sound/soc/Kconfig
@@ -47,6 +47,7 @@ source "sound/soc/cirrus/Kconfig"
 source "sound/soc/davinci/Kconfig"
 source "sound/soc/dwc/Kconfig"
 source "sound/soc/fsl/Kconfig"
+source "sound/soc/hisilicon/Kconfig"
 source "sound/soc/jz4740/Kconfig"
 source "sound/soc/nuc900/Kconfig"
 source "sound/soc/omap/Kconfig"
diff --git a/sound/soc/Makefile b/sound/soc/Makefile
index 9a30f21d16ee..2f6aabb8b4c3 100644
--- a/sound/soc/Makefile
+++ b/sound/soc/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_SND_SOC)	+= cirrus/
 obj-$(CONFIG_SND_SOC)   += davinci/
 obj-$(CONFIG_SND_SOC)   += dwc/
 obj-$(CONFIG_SND_SOC)   += fsl/
+obj-$(CONFIG_SND_SOC)   += hisilicon/
 obj-$(CONFIG_SND_SOC)   += jz4740/
 obj-$(CONFIG_SND_SOC)   += img/
 obj-$(CONFIG_SND_SOC)   += intel/
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index ec1067a679da..08b1399d1da2 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -89,7 +89,7 @@ static void acp_reg_write(u32 val, void __iomem *acp_mmio, u32 reg)
         writel(val, acp_mmio + (reg * 4));
 }
 
-/* Configure a given dma channel parameters - enable/disble,
+/* Configure a given dma channel parameters - enable/disable,
  * number of descriptors, priority
  */
 static void config_acp_dma_channel(void __iomem *acp_mmio, u8 ch_num,
diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c
index 89ac5f5a93eb..7ae46c2647d4 100644
--- a/sound/soc/atmel/atmel-classd.c
+++ b/sound/soc/atmel/atmel-classd.c
@@ -349,7 +349,7 @@ static int atmel_classd_codec_dai_digital_mute(struct snd_soc_dai *codec_dai,
 }
 
 #define CLASSD_ACLK_RATE_11M2896_MPY_8 (112896 * 100 * 8)
-#define CLASSD_ACLK_RATE_12M288_MPY_8  (12228 * 1000 * 8)
+#define CLASSD_ACLK_RATE_12M288_MPY_8  (12288 * 1000 * 8)
 
 static struct {
         int rate;
diff --git a/sound/soc/blackfin/bfin-eval-adau1373.c b/sound/soc/blackfin/bfin-eval-adau1373.c
index 72ac78988426..64b88fdc1f6c 100644
--- a/sound/soc/blackfin/bfin-eval-adau1373.c
+++ b/sound/soc/blackfin/bfin-eval-adau1373.c
@@ -119,7 +119,7 @@ static int bfin_eval_adau1373_codec_init(struct snd_soc_pcm_runtime *rtd)
 
         return ret;
 }
-static struct snd_soc_ops bfin_eval_adau1373_ops = {
+static const struct snd_soc_ops bfin_eval_adau1373_ops = {
         .hw_params = bfin_eval_adau1373_hw_params,
 };
 
diff --git a/sound/soc/blackfin/bfin-eval-adav80x.c b/sound/soc/blackfin/bfin-eval-adav80x.c
index 1037477d10b2..99e5ecabdcda 100644
--- a/sound/soc/blackfin/bfin-eval-adav80x.c
+++ b/sound/soc/blackfin/bfin-eval-adav80x.c
@@ -64,7 +64,7 @@ static int bfin_eval_adav80x_codec_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static struct snd_soc_ops bfin_eval_adav80x_ops = {
+static const struct snd_soc_ops bfin_eval_adav80x_ops = {
         .hw_params = bfin_eval_adav80x_hw_params,
 };
 
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index e49e9da7f1f6..883ed4c8a551 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -49,6 +49,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_CS35L32 if I2C
         select SND_SOC_CS35L33 if I2C
         select SND_SOC_CS35L34 if I2C
+        select SND_SOC_CS35L35 if I2C
         select SND_SOC_CS42L42 if I2C
         select SND_SOC_CS42L51_I2C if I2C
         select SND_SOC_CS42L52 if I2C && INPUT
@@ -69,9 +70,11 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_DA7219 if I2C
         select SND_SOC_DA732X if I2C
         select SND_SOC_DA9055 if I2C
+        select SND_SOC_DIO2125
         select SND_SOC_DMIC
         select SND_SOC_ES8328_SPI if SPI_MASTER
         select SND_SOC_ES8328_I2C if I2C
+        select SND_SOC_ES7134
         select SND_SOC_GTM601
         select SND_SOC_HDAC_HDMI
         select SND_SOC_ICS43432
@@ -89,6 +92,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_MAX9867 if I2C
         select SND_SOC_MAX98925 if I2C
         select SND_SOC_MAX98926 if I2C
+        select SND_SOC_MAX98927 if I2C
         select SND_SOC_MAX9850 if I2C
         select SND_SOC_MAX9860 if I2C
         select SND_SOC_MAX9768 if I2C
@@ -97,6 +101,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_ML26124 if I2C
         select SND_SOC_NAU8540 if I2C
         select SND_SOC_NAU8810 if I2C
+        select SND_SOC_NAU8824 if I2C
         select SND_SOC_NAU8825 if I2C
         select SND_SOC_HDMI_CODEC
         select SND_SOC_PCM1681 if I2C
@@ -303,12 +308,14 @@ config SND_SOC_ADAU1761
         select SND_SOC_ADAU17X1
 
 config SND_SOC_ADAU1761_I2C
-        tristate
+        tristate "Analog Devices AU1761 CODEC - I2C"
+        depends on I2C
         select SND_SOC_ADAU1761
         select REGMAP_I2C
 
 config SND_SOC_ADAU1761_SPI
-        tristate
+        tristate "Analog Devices AU1761 CODEC - SPI"
+        depends on SPI
         select SND_SOC_ADAU1761
         select REGMAP_SPI
 
@@ -408,6 +415,10 @@ config SND_SOC_CS35L34
         tristate "Cirrus Logic CS35L34 CODEC"
         depends on I2C
 
+config SND_SOC_CS35L35
+        tristate "Cirrus Logic CS35L35 CODEC"
+        depends on I2C
+
 config SND_SOC_CS42L42
         tristate "Cirrus Logic CS42L42 CODEC"
         depends on I2C
@@ -516,6 +527,10 @@ config SND_SOC_DA732X
 config SND_SOC_DA9055
         tristate
 
+config SND_SOC_DIO2125
+        tristate "Dioo DIO2125 Amplifier"
+        select GPIOLIB
+
 config SND_SOC_DMIC
         tristate
 
@@ -525,6 +540,9 @@ config SND_SOC_HDMI_CODEC
         select SND_PCM_IEC958
         select HDMI
 
+config SND_SOC_ES7134
+       tristate "Everest Semi ES7134 CODEC"
+
 config SND_SOC_ES8328
         tristate
 
@@ -588,6 +606,10 @@ config SND_SOC_MAX98925
 config SND_SOC_MAX98926
         tristate
 
+config SND_SOC_MAX98927
+        tristate "Maxim Integrated MAX98927 Speaker Amplifier"
+        depends on I2C
+
 config SND_SOC_MAX9850
         tristate
 
@@ -1116,6 +1138,10 @@ config SND_SOC_NAU8810
         tristate "Nuvoton Technology Corporation NAU88C10 CODEC"
         depends on I2C
 
+config SND_SOC_NAU8824
+        tristate "Nuvoton Technology Corporation NAU88L24 CODEC"
+        depends on I2C
+
 config SND_SOC_NAU8825
         tristate
 
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 1796cb987e71..28a63fdaf982 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -39,6 +39,7 @@ snd-soc-cq93vc-objs := cq93vc.o
 snd-soc-cs35l32-objs := cs35l32.o
 snd-soc-cs35l33-objs := cs35l33.o
 snd-soc-cs35l34-objs := cs35l34.o
+snd-soc-cs35l35-objs := cs35l35.o
 snd-soc-cs42l42-objs := cs42l42.o
 snd-soc-cs42l51-objs := cs42l51.o
 snd-soc-cs42l51-i2c-objs := cs42l51-i2c.o
@@ -63,6 +64,7 @@ snd-soc-da7219-objs := da7219.o da7219-aad.o
 snd-soc-da732x-objs := da732x.o
 snd-soc-da9055-objs := da9055.o
 snd-soc-dmic-objs := dmic.o
+snd-soc-es7134-objs := es7134.o
 snd-soc-es8328-objs := es8328.o
 snd-soc-es8328-i2c-objs := es8328-i2c.o
 snd-soc-es8328-spi-objs := es8328-spi.o
@@ -84,6 +86,7 @@ snd-soc-max98371-objs := max98371.o
 snd-soc-max9867-objs := max9867.o
 snd-soc-max98925-objs := max98925.o
 snd-soc-max98926-objs := max98926.o
+snd-soc-max98927-objs := max98927.o
 snd-soc-max9850-objs := max9850.o
 snd-soc-max9860-objs := max9860.o
 snd-soc-mc13783-objs := mc13783.o
@@ -92,6 +95,7 @@ snd-soc-msm8916-analog-objs := msm8916-wcd-analog.o
 snd-soc-msm8916-digital-objs := msm8916-wcd-digital.o
 snd-soc-nau8540-objs := nau8540.o
 snd-soc-nau8810-objs := nau8810.o
+snd-soc-nau8824-objs := nau8824.o
 snd-soc-nau8825-objs := nau8825.o
 snd-soc-hdmi-codec-objs := hdmi-codec.o
 snd-soc-pcm1681-objs := pcm1681.o
@@ -221,6 +225,7 @@ snd-soc-wm9712-objs := wm9712.o
 snd-soc-wm9713-objs := wm9713.o
 snd-soc-wm-hubs-objs := wm_hubs.o
 # Amp
+snd-soc-dio2125-objs := dio2125.o
 snd-soc-max9877-objs := max9877.o
 snd-soc-max98504-objs := max98504.o
 snd-soc-tpa6130a2-objs := tpa6130a2.o
@@ -269,6 +274,7 @@ obj-$(CONFIG_SND_SOC_CQ0093VC) += snd-soc-cq93vc.o
 obj-$(CONFIG_SND_SOC_CS35L32)   += snd-soc-cs35l32.o
 obj-$(CONFIG_SND_SOC_CS35L33)   += snd-soc-cs35l33.o
 obj-$(CONFIG_SND_SOC_CS35L34)   += snd-soc-cs35l34.o
+obj-$(CONFIG_SND_SOC_CS35L35)   += snd-soc-cs35l35.o
 obj-$(CONFIG_SND_SOC_CS42L42)   += snd-soc-cs42l42.o
 obj-$(CONFIG_SND_SOC_CS42L51)   += snd-soc-cs42l51.o
 obj-$(CONFIG_SND_SOC_CS42L51_I2C)       += snd-soc-cs42l51-i2c.o
@@ -293,6 +299,7 @@ obj-$(CONFIG_SND_SOC_DA7219)	+= snd-soc-da7219.o
 obj-$(CONFIG_SND_SOC_DA732X)    += snd-soc-da732x.o
 obj-$(CONFIG_SND_SOC_DA9055)    += snd-soc-da9055.o
 obj-$(CONFIG_SND_SOC_DMIC)      += snd-soc-dmic.o
+obj-$(CONFIG_SND_SOC_ES7134)    += snd-soc-es7134.o
 obj-$(CONFIG_SND_SOC_ES8328)    += snd-soc-es8328.o
 obj-$(CONFIG_SND_SOC_ES8328_I2C)+= snd-soc-es8328-i2c.o
 obj-$(CONFIG_SND_SOC_ES8328_SPI)+= snd-soc-es8328-spi.o
@@ -313,6 +320,7 @@ obj-$(CONFIG_SND_SOC_MAX98357A)	+= snd-soc-max98357a.o
 obj-$(CONFIG_SND_SOC_MAX9867)   += snd-soc-max9867.o
 obj-$(CONFIG_SND_SOC_MAX98925)  += snd-soc-max98925.o
 obj-$(CONFIG_SND_SOC_MAX98926)  += snd-soc-max98926.o
+obj-$(CONFIG_SND_SOC_MAX98927)  += snd-soc-max98927.o
 obj-$(CONFIG_SND_SOC_MAX9850)   += snd-soc-max9850.o
 obj-$(CONFIG_SND_SOC_MAX9860)   += snd-soc-max9860.o
 obj-$(CONFIG_SND_SOC_MC13783)   += snd-soc-mc13783.o
@@ -321,6 +329,7 @@ obj-$(CONFIG_SND_SOC_MSM8916_WCD_ANALOG) +=snd-soc-msm8916-analog.o
 obj-$(CONFIG_SND_SOC_MSM8916_WCD_DIGITAL) +=snd-soc-msm8916-digital.o
 obj-$(CONFIG_SND_SOC_NAU8540)   += snd-soc-nau8540.o
 obj-$(CONFIG_SND_SOC_NAU8810)   += snd-soc-nau8810.o
+obj-$(CONFIG_SND_SOC_NAU8824)   += snd-soc-nau8824.o
 obj-$(CONFIG_SND_SOC_NAU8825)   += snd-soc-nau8825.o
 obj-$(CONFIG_SND_SOC_HDMI_CODEC)        += snd-soc-hdmi-codec.o
 obj-$(CONFIG_SND_SOC_PCM1681)   += snd-soc-pcm1681.o
@@ -448,6 +457,7 @@ obj-$(CONFIG_SND_SOC_WM_ADSP)	+= snd-soc-wm-adsp.o
 obj-$(CONFIG_SND_SOC_WM_HUBS)   += snd-soc-wm-hubs.o
 
 # Amp
+obj-$(CONFIG_SND_SOC_DIO2125)   += snd-soc-dio2125.o
 obj-$(CONFIG_SND_SOC_MAX9877)   += snd-soc-max9877.o
 obj-$(CONFIG_SND_SOC_MAX98504)  += snd-soc-max98504.o
 obj-$(CONFIG_SND_SOC_TPA6130A2) += snd-soc-tpa6130a2.o
diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c
index e819dd8c82fd..b2dfddead227 100644
--- a/sound/soc/codecs/ak4613.c
+++ b/sound/soc/codecs/ak4613.c
@@ -75,6 +75,12 @@
 #define DFS_DOUBLE_SPEED        (1 << 2)
 #define DFS_QUAD_SPEED          (2 << 2)
 
+/* ICTRL */
+#define ICTRL_MASK      (0x3)
+
+/* OCTRL */
+#define OCTRL_MASK      (0x3F)
+
 struct ak4613_formats {
         unsigned int width;
         unsigned int fmt;
@@ -365,8 +371,8 @@ static int ak4613_dai_hw_params(struct snd_pcm_substream *substream,
         snd_soc_update_bits(codec, CTRL1, FMT_MASK, fmt_ctrl);
         snd_soc_update_bits(codec, CTRL2, DFS_MASK, ctrl2);
 
-        snd_soc_write(codec, ICTRL, priv->ic);
-        snd_soc_write(codec, OCTRL, priv->oc);
+        snd_soc_update_bits(codec, ICTRL, ICTRL_MASK, priv->ic);
+        snd_soc_update_bits(codec, OCTRL, OCTRL_MASK, priv->oc);
 
 hw_params_end:
         if (ret < 0)
diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
new file mode 100644
index 000000000000..f8aef5869b03
--- /dev/null
+++ b/sound/soc/codecs/cs35l35.c
@@ -0,0 +1,1580 @@
+/*
+ * cs35l35.c -- CS35L35 ALSA SoC audio driver
+ *
+ * Copyright 2017 Cirrus Logic, Inc.
+ *
+ * Author: Brian Austin <brian.austin@cirrus.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/gpio/consumer.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
+#include <linux/regmap.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <linux/gpio.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+#include <sound/cs35l35.h>
+#include <linux/of_irq.h>
+#include <linux/completion.h>
+
+#include "cs35l35.h"
+
+/*
+ * Some fields take zero as a valid value so use a high bit flag that won't
+ * get written to the device to mark those.
+ */
+#define CS35L35_VALID_PDATA 0x80000000
+
+static const struct reg_default cs35l35_reg[] = {
+        {CS35L35_PWRCTL1,               0x01},
+        {CS35L35_PWRCTL2,               0x11},
+        {CS35L35_PWRCTL3,               0x00},
+        {CS35L35_CLK_CTL1,              0x04},
+        {CS35L35_CLK_CTL2,              0x12},
+        {CS35L35_CLK_CTL3,              0xCF},
+        {CS35L35_SP_FMT_CTL1,           0x20},
+        {CS35L35_SP_FMT_CTL2,           0x00},
+        {CS35L35_SP_FMT_CTL3,           0x02},
+        {CS35L35_MAG_COMP_CTL,          0x00},
+        {CS35L35_AMP_INP_DRV_CTL,       0x01},
+        {CS35L35_AMP_DIG_VOL_CTL,       0x12},
+        {CS35L35_AMP_DIG_VOL,           0x00},
+        {CS35L35_ADV_DIG_VOL,           0x00},
+        {CS35L35_PROTECT_CTL,           0x06},
+        {CS35L35_AMP_GAIN_AUD_CTL,      0x13},
+        {CS35L35_AMP_GAIN_PDM_CTL,      0x00},
+        {CS35L35_AMP_GAIN_ADV_CTL,      0x00},
+        {CS35L35_GPI_CTL,               0x00},
+        {CS35L35_BST_CVTR_V_CTL,        0x00},
+        {CS35L35_BST_PEAK_I,            0x07},
+        {CS35L35_BST_RAMP_CTL,          0x85},
+        {CS35L35_BST_CONV_COEF_1,       0x24},
+        {CS35L35_BST_CONV_COEF_2,       0x24},
+        {CS35L35_BST_CONV_SLOPE_COMP,   0x4E},
+        {CS35L35_BST_CONV_SW_FREQ,      0x04},
+        {CS35L35_CLASS_H_CTL,           0x0B},
+        {CS35L35_CLASS_H_HEADRM_CTL,    0x0B},
+        {CS35L35_CLASS_H_RELEASE_RATE,  0x08},
+        {CS35L35_CLASS_H_FET_DRIVE_CTL, 0x41},
+        {CS35L35_CLASS_H_VP_CTL,        0xC5},
+        {CS35L35_VPBR_CTL,              0x0A},
+        {CS35L35_VPBR_VOL_CTL,          0x90},
+        {CS35L35_VPBR_TIMING_CTL,       0x6A},
+        {CS35L35_VPBR_MODE_VOL_CTL,     0x00},
+        {CS35L35_SPKR_MON_CTL,          0xC0},
+        {CS35L35_IMON_SCALE_CTL,        0x30},
+        {CS35L35_AUDIN_RXLOC_CTL,       0x00},
+        {CS35L35_ADVIN_RXLOC_CTL,       0x80},
+        {CS35L35_VMON_TXLOC_CTL,        0x00},
+        {CS35L35_IMON_TXLOC_CTL,        0x80},
+        {CS35L35_VPMON_TXLOC_CTL,       0x04},
+        {CS35L35_VBSTMON_TXLOC_CTL,     0x84},
+        {CS35L35_VPBR_STATUS_TXLOC_CTL, 0x04},
+        {CS35L35_ZERO_FILL_LOC_CTL,     0x00},
+        {CS35L35_AUDIN_DEPTH_CTL,       0x0F},
+        {CS35L35_SPKMON_DEPTH_CTL,      0x0F},
+        {CS35L35_SUPMON_DEPTH_CTL,      0x0F},
+        {CS35L35_ZEROFILL_DEPTH_CTL,    0x00},
+        {CS35L35_MULT_DEV_SYNCH1,       0x02},
+        {CS35L35_MULT_DEV_SYNCH2,       0x80},
+        {CS35L35_PROT_RELEASE_CTL,      0x00},
+        {CS35L35_DIAG_MODE_REG_LOCK,    0x00},
+        {CS35L35_DIAG_MODE_CTL_1,       0x40},
+        {CS35L35_DIAG_MODE_CTL_2,       0x00},
+        {CS35L35_INT_MASK_1,            0xFF},
+        {CS35L35_INT_MASK_2,            0xFF},
+        {CS35L35_INT_MASK_3,            0xFF},
+        {CS35L35_INT_MASK_4,            0xFF},
+
+};
+
+static bool cs35l35_volatile_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case CS35L35_INT_STATUS_1:
+        case CS35L35_INT_STATUS_2:
+        case CS35L35_INT_STATUS_3:
+        case CS35L35_INT_STATUS_4:
+        case CS35L35_PLL_STATUS:
+        case CS35L35_OTP_TRIM_STATUS:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool cs35l35_readable_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case CS35L35_DEVID_AB ... CS35L35_PWRCTL3:
+        case CS35L35_CLK_CTL1 ... CS35L35_SP_FMT_CTL3:
+        case CS35L35_MAG_COMP_CTL ... CS35L35_AMP_GAIN_AUD_CTL:
+        case CS35L35_AMP_GAIN_PDM_CTL ... CS35L35_BST_PEAK_I:
+        case CS35L35_BST_RAMP_CTL ... CS35L35_BST_CONV_SW_FREQ:
+        case CS35L35_CLASS_H_CTL ... CS35L35_CLASS_H_VP_CTL:
+        case CS35L35_CLASS_H_STATUS:
+        case CS35L35_VPBR_CTL ... CS35L35_VPBR_MODE_VOL_CTL:
+        case CS35L35_VPBR_ATTEN_STATUS:
+        case CS35L35_SPKR_MON_CTL:
+        case CS35L35_IMON_SCALE_CTL ... CS35L35_ZEROFILL_DEPTH_CTL:
+        case CS35L35_MULT_DEV_SYNCH1 ... CS35L35_PROT_RELEASE_CTL:
+        case CS35L35_DIAG_MODE_REG_LOCK ... CS35L35_DIAG_MODE_CTL_2:
+        case CS35L35_INT_MASK_1 ... CS35L35_PLL_STATUS:
+        case CS35L35_OTP_TRIM_STATUS:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool cs35l35_precious_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case CS35L35_INT_STATUS_1:
+        case CS35L35_INT_STATUS_2:
+        case CS35L35_INT_STATUS_3:
+        case CS35L35_INT_STATUS_4:
+        case CS35L35_PLL_STATUS:
+        case CS35L35_OTP_TRIM_STATUS:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static int cs35l35_wait_for_pdn(struct cs35l35_private *cs35l35)
+{
+        int ret;
+
+        if (cs35l35->pdata.ext_bst) {
+                usleep_range(5000, 5500);
+                return 0;
+        }
+
+        reinit_completion(&cs35l35->pdn_done);
+
+        ret = wait_for_completion_timeout(&cs35l35->pdn_done,
+                                          msecs_to_jiffies(100));
+        if (ret == 0) {
+                dev_err(cs35l35->dev, "PDN_DONE did not complete\n");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static int cs35l35_sdin_event(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        int ret = 0;
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                        CS35L35_MCLK_DIS_MASK,
+                                        0 << CS35L35_MCLK_DIS_SHIFT);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                        CS35L35_DISCHG_FILT_MASK,
+                                        0 << CS35L35_DISCHG_FILT_SHIFT);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                        CS35L35_PDN_ALL_MASK, 0);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                        CS35L35_DISCHG_FILT_MASK,
+                                        1 << CS35L35_DISCHG_FILT_SHIFT);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                                          CS35L35_PDN_ALL_MASK, 1);
+
+                /* Already muted, so disable volume ramp for faster shutdown */
+                regmap_update_bits(cs35l35->regmap, CS35L35_AMP_DIG_VOL_CTL,
+                                   CS35L35_AMP_DIGSFT_MASK, 0);
+
+                ret = cs35l35_wait_for_pdn(cs35l35);
+
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                        CS35L35_MCLK_DIS_MASK,
+                                        1 << CS35L35_MCLK_DIS_SHIFT);
+
+                regmap_update_bits(cs35l35->regmap, CS35L35_AMP_DIG_VOL_CTL,
+                                   CS35L35_AMP_DIGSFT_MASK,
+                                   1 << CS35L35_AMP_DIGSFT_SHIFT);
+                break;
+        default:
+                dev_err(codec->dev, "Invalid event = 0x%x\n", event);
+                ret = -EINVAL;
+        }
+        return ret;
+}
+
+static int cs35l35_main_amp_event(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        unsigned int reg[4];
+        int i;
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                if (cs35l35->pdata.bst_pdn_fet_on)
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                0 << CS35L35_PDN_BST_FETON_SHIFT);
+                else
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                0 << CS35L35_PDN_BST_FETOFF_SHIFT);
+                break;
+        case SND_SOC_DAPM_POST_PMU:
+                usleep_range(5000, 5100);
+                /* If in PDM mode we must use VP for Voltage control */
+                if (cs35l35->pdm_mode)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_BST_CVTR_V_CTL,
+                                        CS35L35_BST_CTL_MASK,
+                                        0 << CS35L35_BST_CTL_SHIFT);
+
+                regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                        CS35L35_AMP_MUTE_MASK, 0);
+
+                for (i = 0; i < 2; i++)
+                        regmap_bulk_read(cs35l35->regmap, CS35L35_INT_STATUS_1,
+                                        &reg, ARRAY_SIZE(reg));
+
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                                CS35L35_AMP_MUTE_MASK,
+                                1 << CS35L35_AMP_MUTE_SHIFT);
+                if (cs35l35->pdata.bst_pdn_fet_on)
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                1 << CS35L35_PDN_BST_FETON_SHIFT);
+                else
+                        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                CS35L35_PDN_BST_MASK,
+                                1 << CS35L35_PDN_BST_FETOFF_SHIFT);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                usleep_range(5000, 5100);
+                /*
+                 * If PDM mode we should switch back to pdata value
+                 * for Voltage control when we go down
+                 */
+                if (cs35l35->pdm_mode)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_BST_CVTR_V_CTL,
+                                        CS35L35_BST_CTL_MASK,
+                                        cs35l35->pdata.bst_vctl
+                                        << CS35L35_BST_CTL_SHIFT);
+
+                break;
+        default:
+                dev_err(codec->dev, "Invalid event = 0x%x\n", event);
+        }
+        return 0;
+}
+
+static DECLARE_TLV_DB_SCALE(amp_gain_tlv, 0, 1, 1);
+static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10200, 50, 0);
+
+static const struct snd_kcontrol_new cs35l35_aud_controls[] = {
+        SOC_SINGLE_SX_TLV("Digital Audio Volume", CS35L35_AMP_DIG_VOL,
+                      0, 0x34, 0xE4, dig_vol_tlv),
+        SOC_SINGLE_TLV("Analog Audio Volume", CS35L35_AMP_GAIN_AUD_CTL, 0, 19, 0,
+                        amp_gain_tlv),
+        SOC_SINGLE_TLV("PDM Volume", CS35L35_AMP_GAIN_PDM_CTL, 0, 19, 0,
+                        amp_gain_tlv),
+};
+
+static const struct snd_kcontrol_new cs35l35_adv_controls[] = {
+        SOC_SINGLE_SX_TLV("Digital Advisory Volume", CS35L35_ADV_DIG_VOL,
+                      0, 0x34, 0xE4, dig_vol_tlv),
+        SOC_SINGLE_TLV("Analog Advisory Volume", CS35L35_AMP_GAIN_ADV_CTL, 0, 19, 0,
+                        amp_gain_tlv),
+};
+
+static const struct snd_soc_dapm_widget cs35l35_dapm_widgets[] = {
+        SND_SOC_DAPM_AIF_IN_E("SDIN", NULL, 0, CS35L35_PWRCTL3, 1, 1,
+                                cs35l35_sdin_event, SND_SOC_DAPM_PRE_PMU |
+                                SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_AIF_OUT("SDOUT", NULL, 0, CS35L35_PWRCTL3, 2, 1),
+
+        SND_SOC_DAPM_OUTPUT("SPK"),
+
+        SND_SOC_DAPM_INPUT("VP"),
+        SND_SOC_DAPM_INPUT("VBST"),
+        SND_SOC_DAPM_INPUT("ISENSE"),
+        SND_SOC_DAPM_INPUT("VSENSE"),
+
+        SND_SOC_DAPM_ADC("VMON ADC", NULL, CS35L35_PWRCTL2, 7, 1),
+        SND_SOC_DAPM_ADC("IMON ADC", NULL, CS35L35_PWRCTL2, 6, 1),
+        SND_SOC_DAPM_ADC("VPMON ADC", NULL, CS35L35_PWRCTL3, 3, 1),
+        SND_SOC_DAPM_ADC("VBSTMON ADC", NULL, CS35L35_PWRCTL3, 4, 1),
+        SND_SOC_DAPM_ADC("CLASS H", NULL, CS35L35_PWRCTL2, 5, 1),
+
+        SND_SOC_DAPM_OUT_DRV_E("Main AMP", CS35L35_PWRCTL2, 0, 1, NULL, 0,
+                cs35l35_main_amp_event, SND_SOC_DAPM_PRE_PMU |
+                                SND_SOC_DAPM_POST_PMD | SND_SOC_DAPM_POST_PMU |
+                                SND_SOC_DAPM_PRE_PMD),
+};
+
+static const struct snd_soc_dapm_route cs35l35_audio_map[] = {
+        {"VPMON ADC", NULL, "VP"},
+        {"VBSTMON ADC", NULL, "VBST"},
+        {"IMON ADC", NULL, "ISENSE"},
+        {"VMON ADC", NULL, "VSENSE"},
+        {"SDOUT", NULL, "IMON ADC"},
+        {"SDOUT", NULL, "VMON ADC"},
+        {"SDOUT", NULL, "VBSTMON ADC"},
+        {"SDOUT", NULL, "VPMON ADC"},
+        {"AMP Capture", NULL, "SDOUT"},
+
+        {"SDIN", NULL, "AMP Playback"},
+        {"CLASS H", NULL, "SDIN"},
+        {"Main AMP", NULL, "CLASS H"},
+        {"SPK", NULL, "Main AMP"},
+};
+
+static int cs35l35_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                    CS35L35_MS_MASK, 1 << CS35L35_MS_SHIFT);
+                cs35l35->slave_mode = false;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                    CS35L35_MS_MASK, 0 << CS35L35_MS_SHIFT);
+                cs35l35->slave_mode = true;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                cs35l35->i2s_mode = true;
+                cs35l35->pdm_mode = false;
+                break;
+        case SND_SOC_DAIFMT_PDM:
+                cs35l35->pdm_mode = true;
+                cs35l35->i2s_mode = false;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+struct cs35l35_sysclk_config {
+        int sysclk;
+        int srate;
+        u8 clk_cfg;
+};
+
+static struct cs35l35_sysclk_config cs35l35_clk_ctl[] = {
+
+        /* SYSCLK, Sample Rate, Serial Port Cfg */
+        {5644800, 44100, 0x00},
+        {5644800, 88200, 0x40},
+        {6144000, 48000, 0x10},
+        {6144000, 96000, 0x50},
+        {11289600, 44100, 0x01},
+        {11289600, 88200, 0x41},
+        {11289600, 176400, 0x81},
+        {12000000, 44100, 0x03},
+        {12000000, 48000, 0x13},
+        {12000000, 88200, 0x43},
+        {12000000, 96000, 0x53},
+        {12000000, 176400, 0x83},
+        {12000000, 192000, 0x93},
+        {12288000, 48000, 0x11},
+        {12288000, 96000, 0x51},
+        {12288000, 192000, 0x91},
+        {13000000, 44100, 0x07},
+        {13000000, 48000, 0x17},
+        {13000000, 88200, 0x47},
+        {13000000, 96000, 0x57},
+        {13000000, 176400, 0x87},
+        {13000000, 192000, 0x97},
+        {22579200, 44100, 0x02},
+        {22579200, 88200, 0x42},
+        {22579200, 176400, 0x82},
+        {24000000, 44100, 0x0B},
+        {24000000, 48000, 0x1B},
+        {24000000, 88200, 0x4B},
+        {24000000, 96000, 0x5B},
+        {24000000, 176400, 0x8B},
+        {24000000, 192000, 0x9B},
+        {24576000, 48000, 0x12},
+        {24576000, 96000, 0x52},
+        {24576000, 192000, 0x92},
+        {26000000, 44100, 0x0F},
+        {26000000, 48000, 0x1F},
+        {26000000, 88200, 0x4F},
+        {26000000, 96000, 0x5F},
+        {26000000, 176400, 0x8F},
+        {26000000, 192000, 0x9F},
+};
+
+static int cs35l35_get_clk_config(int sysclk, int srate)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cs35l35_clk_ctl); i++) {
+                if (cs35l35_clk_ctl[i].sysclk == sysclk &&
+                        cs35l35_clk_ctl[i].srate == srate)
+                        return cs35l35_clk_ctl[i].clk_cfg;
+        }
+        return -EINVAL;
+}
+
+static int cs35l35_hw_params(struct snd_pcm_substream *substream,
+                                 struct snd_pcm_hw_params *params,
+                                 struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        struct classh_cfg *classh = &cs35l35->pdata.classh_algo;
+        int srate = params_rate(params);
+        int ret = 0;
+        u8 sp_sclks;
+        int audin_format;
+        int errata_chk;
+
+        int clk_ctl = cs35l35_get_clk_config(cs35l35->sysclk, srate);
+
+        if (clk_ctl < 0) {
+                dev_err(codec->dev, "Invalid CLK:Rate %d:%d\n",
+                        cs35l35->sysclk, srate);
+                return -EINVAL;
+        }
+
+        ret = regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL2,
+                          CS35L35_CLK_CTL2_MASK, clk_ctl);
+        if (ret != 0) {
+                dev_err(codec->dev, "Failed to set port config %d\n", ret);
+                return ret;
+        }
+
+        /*
+         * Rev A0 Errata
+         * When configured for the weak-drive detection path (CH_WKFET_DIS = 0)
+         * the Class H algorithm does not enable weak-drive operation for
+         * nonzero values of CH_WKFET_DELAY if SP_RATE = 01 or 10
+         */
+        errata_chk = clk_ctl & CS35L35_SP_RATE_MASK;
+
+        if (classh->classh_wk_fet_disable == 0x00 &&
+                (errata_chk == 0x01 || errata_chk == 0x03)) {
+                ret = regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_DEL_MASK,
+                                        0 << CS35L35_CH_WKFET_DEL_SHIFT);
+                if (ret != 0) {
+                        dev_err(codec->dev, "Failed to set fet config %d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        /*
+         * You can pull more Monitor data from the SDOUT pin than going to SDIN
+         * Just make sure your SCLK is fast enough to fill the frame
+         */
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                switch (params_width(params)) {
+                case 8:
+                        audin_format = CS35L35_SDIN_DEPTH_8;
+                        break;
+                case 16:
+                        audin_format = CS35L35_SDIN_DEPTH_16;
+                        break;
+                case 24:
+                        audin_format = CS35L35_SDIN_DEPTH_24;
+                        break;
+                default:
+                        dev_err(codec->dev, "Unsupported Width %d\n",
+                                params_width(params));
+                        return -EINVAL;
+                }
+                regmap_update_bits(cs35l35->regmap,
+                                CS35L35_AUDIN_DEPTH_CTL,
+                                CS35L35_AUDIN_DEPTH_MASK,
+                                audin_format <<
+                                CS35L35_AUDIN_DEPTH_SHIFT);
+                if (cs35l35->pdata.stereo) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_AUDIN_DEPTH_CTL,
+                                        CS35L35_ADVIN_DEPTH_MASK,
+                                        audin_format <<
+                                        CS35L35_ADVIN_DEPTH_SHIFT);
+                }
+        }
+
+        if (cs35l35->i2s_mode) {
+                /* We have to take the SCLK to derive num sclks
+                 * to configure the CLOCK_CTL3 register correctly
+                 */
+                if ((cs35l35->sclk / srate) % 4) {
+                        dev_err(codec->dev, "Unsupported sclk/fs ratio %d:%d\n",
+                                        cs35l35->sclk, srate);
+                        return -EINVAL;
+                }
+                sp_sclks = ((cs35l35->sclk / srate) / 4) - 1;
+
+                /* Only certain ratios are supported in I2S Slave Mode */
+                if (cs35l35->slave_mode) {
+                        switch (sp_sclks) {
+                        case CS35L35_SP_SCLKS_32FS:
+                        case CS35L35_SP_SCLKS_48FS:
+                        case CS35L35_SP_SCLKS_64FS:
+                                break;
+                        default:
+                                dev_err(codec->dev, "ratio not supported\n");
+                                return -EINVAL;
+                        }
+                } else {
+                        /* Only certain ratios supported in I2S MASTER Mode */
+                        switch (sp_sclks) {
+                        case CS35L35_SP_SCLKS_32FS:
+                        case CS35L35_SP_SCLKS_64FS:
+                                break;
+                        default:
+                                dev_err(codec->dev, "ratio not supported\n");
+                                return -EINVAL;
+                        }
+                }
+                ret = regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLK_CTL3,
+                                        CS35L35_SP_SCLKS_MASK, sp_sclks <<
+                                        CS35L35_SP_SCLKS_SHIFT);
+                if (ret != 0) {
+                        dev_err(codec->dev, "Failed to set fsclk %d\n", ret);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
+static const unsigned int cs35l35_src_rates[] = {
+        44100, 48000, 88200, 96000, 176400, 192000
+};
+
+static const struct snd_pcm_hw_constraint_list cs35l35_constraints = {
+        .count  = ARRAY_SIZE(cs35l35_src_rates),
+        .list   = cs35l35_src_rates,
+};
+
+static int cs35l35_pcm_startup(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        if (!substream->runtime)
+                return 0;
+
+        snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE, &cs35l35_constraints);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_AMP_INP_DRV_CTL,
+                                        CS35L35_PDM_MODE_MASK,
+                                        0 << CS35L35_PDM_MODE_SHIFT);
+
+        return 0;
+}
+
+static const unsigned int cs35l35_pdm_rates[] = {
+        44100, 48000, 88200, 96000
+};
+
+static const struct snd_pcm_hw_constraint_list cs35l35_pdm_constraints = {
+        .count  = ARRAY_SIZE(cs35l35_pdm_rates),
+        .list   = cs35l35_pdm_rates,
+};
+
+static int cs35l35_pdm_startup(struct snd_pcm_substream *substream,
+                               struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        if (!substream->runtime)
+                return 0;
+
+        snd_pcm_hw_constraint_list(substream->runtime, 0,
+                                SNDRV_PCM_HW_PARAM_RATE,
+                                &cs35l35_pdm_constraints);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_AMP_INP_DRV_CTL,
+                                        CS35L35_PDM_MODE_MASK,
+                                        1 << CS35L35_PDM_MODE_SHIFT);
+
+        return 0;
+}
+
+static int cs35l35_dai_set_sysclk(struct snd_soc_dai *dai,
+                                int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+
+        /* Need the SCLK Frequency regardless of sysclk source for I2S */
+        cs35l35->sclk = freq;
+
+        return 0;
+}
+
+static const struct snd_soc_dai_ops cs35l35_ops = {
+        .startup = cs35l35_pcm_startup,
+        .set_fmt = cs35l35_set_dai_fmt,
+        .hw_params = cs35l35_hw_params,
+        .set_sysclk = cs35l35_dai_set_sysclk,
+};
+
+static const struct snd_soc_dai_ops cs35l35_pdm_ops = {
+        .startup = cs35l35_pdm_startup,
+        .set_fmt = cs35l35_set_dai_fmt,
+        .hw_params = cs35l35_hw_params,
+};
+
+static struct snd_soc_dai_driver cs35l35_dai[] = {
+        {
+                .name = "cs35l35-pcm",
+                .id = 0,
+                .playback = {
+                        .stream_name = "AMP Playback",
+                        .channels_min = 1,
+                        .channels_max = 8,
+                        .rates = SNDRV_PCM_RATE_KNOT,
+                        .formats = CS35L35_FORMATS,
+                },
+                .capture = {
+                        .stream_name = "AMP Capture",
+                        .channels_min = 1,
+                        .channels_max = 8,
+                        .rates = SNDRV_PCM_RATE_KNOT,
+                        .formats = CS35L35_FORMATS,
+                },
+                .ops = &cs35l35_ops,
+                .symmetric_rates = 1,
+        },
+        {
+                .name = "cs35l35-pdm",
+                .id = 1,
+                .playback = {
+                        .stream_name = "PDM Playback",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = SNDRV_PCM_RATE_KNOT,
+                        .formats = CS35L35_FORMATS,
+                },
+                .ops = &cs35l35_pdm_ops,
+        },
+};
+
+static int cs35l35_codec_set_sysclk(struct snd_soc_codec *codec,
+                                int clk_id, int source, unsigned int freq,
+                                int dir)
+{
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        int clksrc;
+        int ret = 0;
+
+        switch (clk_id) {
+        case 0:
+                clksrc = CS35L35_CLK_SOURCE_MCLK;
+                break;
+        case 1:
+                clksrc = CS35L35_CLK_SOURCE_SCLK;
+                break;
+        case 2:
+                clksrc = CS35L35_CLK_SOURCE_PDM;
+                break;
+        default:
+                dev_err(codec->dev, "Invalid CLK Source\n");
+                return -EINVAL;
+        }
+
+        switch (freq) {
+        case 5644800:
+        case 6144000:
+        case 11289600:
+        case 12000000:
+        case 12288000:
+        case 13000000:
+        case 22579200:
+        case 24000000:
+        case 24576000:
+        case 26000000:
+                cs35l35->sysclk = freq;
+                break;
+        default:
+                dev_err(codec->dev, "Invalid CLK Frequency Input : %d\n", freq);
+                return -EINVAL;
+        }
+
+        ret = regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                CS35L35_CLK_SOURCE_MASK,
+                                clksrc << CS35L35_CLK_SOURCE_SHIFT);
+        if (ret != 0) {
+                dev_err(codec->dev, "Failed to set sysclk %d\n", ret);
+                return ret;
+        }
+
+        return ret;
+}
+
+static int cs35l35_codec_probe(struct snd_soc_codec *codec)
+{
+        struct cs35l35_private *cs35l35 = snd_soc_codec_get_drvdata(codec);
+        struct classh_cfg *classh = &cs35l35->pdata.classh_algo;
+        struct monitor_cfg *monitor_config = &cs35l35->pdata.mon_cfg;
+        int ret;
+
+        /* Set Platform Data */
+        if (cs35l35->pdata.bst_vctl)
+                regmap_update_bits(cs35l35->regmap, CS35L35_BST_CVTR_V_CTL,
+                                CS35L35_BST_CTL_MASK,
+                                cs35l35->pdata.bst_vctl);
+
+        if (cs35l35->pdata.bst_ipk)
+                regmap_update_bits(cs35l35->regmap, CS35L35_BST_PEAK_I,
+                                CS35L35_BST_IPK_MASK,
+                                cs35l35->pdata.bst_ipk <<
+                                CS35L35_BST_IPK_SHIFT);
+
+        if (cs35l35->pdata.gain_zc)
+                regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                                CS35L35_AMP_GAIN_ZC_MASK,
+                                cs35l35->pdata.gain_zc <<
+                                CS35L35_AMP_GAIN_ZC_SHIFT);
+
+        if (cs35l35->pdata.aud_channel)
+                regmap_update_bits(cs35l35->regmap,
+                                CS35L35_AUDIN_RXLOC_CTL,
+                                CS35L35_AUD_IN_LR_MASK,
+                                cs35l35->pdata.aud_channel <<
+                                CS35L35_AUD_IN_LR_SHIFT);
+
+        if (cs35l35->pdata.stereo) {
+                regmap_update_bits(cs35l35->regmap,
+                                CS35L35_ADVIN_RXLOC_CTL,
+                                CS35L35_ADV_IN_LR_MASK,
+                                cs35l35->pdata.adv_channel <<
+                                CS35L35_ADV_IN_LR_SHIFT);
+                if (cs35l35->pdata.shared_bst)
+                        regmap_update_bits(cs35l35->regmap, CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_STEREO_MASK,
+                                        1 << CS35L35_CH_STEREO_SHIFT);
+                ret = snd_soc_add_codec_controls(codec, cs35l35_adv_controls,
+                                        ARRAY_SIZE(cs35l35_adv_controls));
+                if (ret)
+                        return ret;
+        }
+
+        if (cs35l35->pdata.sp_drv_str)
+                regmap_update_bits(cs35l35->regmap, CS35L35_CLK_CTL1,
+                                CS35L35_SP_DRV_MASK,
+                                cs35l35->pdata.sp_drv_str <<
+                                CS35L35_SP_DRV_SHIFT);
+        if (cs35l35->pdata.sp_drv_unused)
+                regmap_update_bits(cs35l35->regmap, CS35L35_SP_FMT_CTL3,
+                                   CS35L35_SP_I2S_DRV_MASK,
+                                   cs35l35->pdata.sp_drv_unused <<
+                                   CS35L35_SP_I2S_DRV_SHIFT);
+
+        if (classh->classh_algo_enable) {
+                if (classh->classh_bst_override)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_BST_OVR_MASK,
+                                        classh->classh_bst_override <<
+                                        CS35L35_CH_BST_OVR_SHIFT);
+                if (classh->classh_bst_max_limit)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_BST_LIM_MASK,
+                                        classh->classh_bst_max_limit <<
+                                        CS35L35_CH_BST_LIM_SHIFT);
+                if (classh->classh_mem_depth)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_CTL,
+                                        CS35L35_CH_MEM_DEPTH_MASK,
+                                        classh->classh_mem_depth <<
+                                        CS35L35_CH_MEM_DEPTH_SHIFT);
+                if (classh->classh_headroom)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_HEADRM_CTL,
+                                        CS35L35_CH_HDRM_CTL_MASK,
+                                        classh->classh_headroom <<
+                                        CS35L35_CH_HDRM_CTL_SHIFT);
+                if (classh->classh_release_rate)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_RELEASE_RATE,
+                                        CS35L35_CH_REL_RATE_MASK,
+                                        classh->classh_release_rate <<
+                                        CS35L35_CH_REL_RATE_SHIFT);
+                if (classh->classh_wk_fet_disable)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_DIS_MASK,
+                                        classh->classh_wk_fet_disable <<
+                                        CS35L35_CH_WKFET_DIS_SHIFT);
+                if (classh->classh_wk_fet_delay)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_DEL_MASK,
+                                        classh->classh_wk_fet_delay <<
+                                        CS35L35_CH_WKFET_DEL_SHIFT);
+                if (classh->classh_wk_fet_thld)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_FET_DRIVE_CTL,
+                                        CS35L35_CH_WKFET_THLD_MASK,
+                                        classh->classh_wk_fet_thld <<
+                                        CS35L35_CH_WKFET_THLD_SHIFT);
+                if (classh->classh_vpch_auto)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_VP_CTL,
+                                        CS35L35_CH_VP_AUTO_MASK,
+                                        classh->classh_vpch_auto <<
+                                        CS35L35_CH_VP_AUTO_SHIFT);
+                if (classh->classh_vpch_rate)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_VP_CTL,
+                                        CS35L35_CH_VP_RATE_MASK,
+                                        classh->classh_vpch_rate <<
+                                        CS35L35_CH_VP_RATE_SHIFT);
+                if (classh->classh_vpch_man)
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_CLASS_H_VP_CTL,
+                                        CS35L35_CH_VP_MAN_MASK,
+                                        classh->classh_vpch_man <<
+                                        CS35L35_CH_VP_MAN_SHIFT);
+        }
+
+        if (monitor_config->is_present) {
+                if (monitor_config->vmon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SPKMON_DEPTH_CTL,
+                                        CS35L35_VMON_DEPTH_MASK,
+                                        monitor_config->vmon_dpth <<
+                                        CS35L35_VMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vmon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vmon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->imon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SPKMON_DEPTH_CTL,
+                                        CS35L35_IMON_DEPTH_MASK,
+                                        monitor_config->imon_dpth <<
+                                        CS35L35_IMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_IMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->imon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_IMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->imon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_IMON_SCALE_CTL,
+                                        CS35L35_IMON_SCALE_MASK,
+                                        monitor_config->imon_scale <<
+                                        CS35L35_IMON_SCALE_SHIFT);
+                }
+                if (monitor_config->vpmon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_VPMON_DEPTH_MASK,
+                                        monitor_config->vpmon_dpth <<
+                                        CS35L35_VPMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vpmon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vpmon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->vbstmon_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_VBSTMON_DEPTH_MASK,
+                                        monitor_config->vpmon_dpth <<
+                                        CS35L35_VBSTMON_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VBSTMON_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vbstmon_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VBSTMON_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vbstmon_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->vpbrstat_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_VPBRSTAT_DEPTH_MASK,
+                                        monitor_config->vpbrstat_dpth <<
+                                        CS35L35_VPBRSTAT_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPBR_STATUS_TXLOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->vpbrstat_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_VPBR_STATUS_TXLOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->vpbrstat_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+                if (monitor_config->zerofill_specs) {
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_SUPMON_DEPTH_CTL,
+                                        CS35L35_ZEROFILL_DEPTH_MASK,
+                                        monitor_config->zerofill_dpth <<
+                                        CS35L35_ZEROFILL_DEPTH_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_ZERO_FILL_LOC_CTL,
+                                        CS35L35_MON_TXLOC_MASK,
+                                        monitor_config->zerofill_loc <<
+                                        CS35L35_MON_TXLOC_SHIFT);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_ZERO_FILL_LOC_CTL,
+                                        CS35L35_MON_FRM_MASK,
+                                        monitor_config->zerofill_frm <<
+                                        CS35L35_MON_FRM_SHIFT);
+                }
+        }
+
+        return 0;
+}
+
+static struct snd_soc_codec_driver soc_codec_dev_cs35l35 = {
+        .probe = cs35l35_codec_probe,
+        .set_sysclk = cs35l35_codec_set_sysclk,
+        .component_driver = {
+                .dapm_widgets = cs35l35_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(cs35l35_dapm_widgets),
+
+                .dapm_routes = cs35l35_audio_map,
+                .num_dapm_routes = ARRAY_SIZE(cs35l35_audio_map),
+
+                .controls = cs35l35_aud_controls,
+                .num_controls = ARRAY_SIZE(cs35l35_aud_controls),
+        },
+
+};
+
+static struct regmap_config cs35l35_regmap = {
+        .reg_bits = 8,
+        .val_bits = 8,
+
+        .max_register = CS35L35_MAX_REGISTER,
+        .reg_defaults = cs35l35_reg,
+        .num_reg_defaults = ARRAY_SIZE(cs35l35_reg),
+        .volatile_reg = cs35l35_volatile_register,
+        .readable_reg = cs35l35_readable_register,
+        .precious_reg = cs35l35_precious_register,
+        .cache_type = REGCACHE_RBTREE,
+};
+
+static irqreturn_t cs35l35_irq(int irq, void *data)
+{
+        struct cs35l35_private *cs35l35 = data;
+        unsigned int sticky1, sticky2, sticky3, sticky4;
+        unsigned int mask1, mask2, mask3, mask4, current1;
+
+        /* ack the irq by reading all status registers */
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_4, &sticky4);
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_3, &sticky3);
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_2, &sticky2);
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_1, &sticky1);
+
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_4, &mask4);
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_3, &mask3);
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_2, &mask2);
+        regmap_read(cs35l35->regmap, CS35L35_INT_MASK_1, &mask1);
+
+        /* Check to see if unmasked bits are active */
+        if (!(sticky1 & ~mask1) && !(sticky2 & ~mask2) && !(sticky3 & ~mask3)
+                        && !(sticky4 & ~mask4))
+                return IRQ_NONE;
+
+        if (sticky2 & CS35L35_PDN_DONE)
+                complete(&cs35l35->pdn_done);
+
+        /* read the current values */
+        regmap_read(cs35l35->regmap, CS35L35_INT_STATUS_1, &current1);
+
+        /* handle the interrupts */
+        if (sticky1 & CS35L35_CAL_ERR) {
+                dev_crit(cs35l35->dev, "Calibration Error\n");
+
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_CAL_ERR)) {
+                        pr_debug("%s : Cal error release\n", __func__);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_CAL_ERR_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_CAL_ERR_RLS,
+                                        CS35L35_CAL_ERR_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_CAL_ERR_RLS, 0);
+                }
+        }
+
+        if (sticky1 & CS35L35_AMP_SHORT) {
+                dev_crit(cs35l35->dev, "AMP Short Error\n");
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_AMP_SHORT)) {
+                        dev_dbg(cs35l35->dev, "Amp short error release\n");
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_SHORT_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_SHORT_RLS,
+                                        CS35L35_SHORT_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_SHORT_RLS, 0);
+                }
+        }
+
+        if (sticky1 & CS35L35_OTW) {
+                dev_warn(cs35l35->dev, "Over temperature warning\n");
+
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_OTW)) {
+                        dev_dbg(cs35l35->dev, "Over temperature warn release\n");
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTW_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTW_RLS,
+                                        CS35L35_OTW_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTW_RLS, 0);
+                }
+        }
+
+        if (sticky1 & CS35L35_OTE) {
+                dev_crit(cs35l35->dev, "Over temperature error\n");
+                /* error is no longer asserted; safe to reset */
+                if (!(current1 & CS35L35_OTE)) {
+                        dev_dbg(cs35l35->dev, "Over temperature error release\n");
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTE_RLS, 0);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTE_RLS,
+                                        CS35L35_OTE_RLS);
+                        regmap_update_bits(cs35l35->regmap,
+                                        CS35L35_PROT_RELEASE_CTL,
+                                        CS35L35_OTE_RLS, 0);
+                }
+        }
+
+        if (sticky3 & CS35L35_BST_HIGH) {
+                dev_crit(cs35l35->dev, "VBST error: powering off!\n");
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                        CS35L35_PDN_AMP, CS35L35_PDN_AMP);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                        CS35L35_PDN_ALL, CS35L35_PDN_ALL);
+        }
+
+        if (sticky3 & CS35L35_LBST_SHORT) {
+                dev_crit(cs35l35->dev, "LBST error: powering off!\n");
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                        CS35L35_PDN_AMP, CS35L35_PDN_AMP);
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL1,
+                        CS35L35_PDN_ALL, CS35L35_PDN_ALL);
+        }
+
+        if (sticky2 & CS35L35_VPBR_ERR)
+                dev_dbg(cs35l35->dev, "Error: Reactive Brownout\n");
+
+        if (sticky4 & CS35L35_VMON_OVFL)
+                dev_dbg(cs35l35->dev, "Error: VMON overflow\n");
+
+        if (sticky4 & CS35L35_IMON_OVFL)
+                dev_dbg(cs35l35->dev, "Error: IMON overflow\n");
+
+        return IRQ_HANDLED;
+}
+
+
+static int cs35l35_handle_of_data(struct i2c_client *i2c_client,
+                                struct cs35l35_platform_data *pdata)
+{
+        struct device_node *np = i2c_client->dev.of_node;
+        struct device_node *classh, *signal_format;
+        struct classh_cfg *classh_config = &pdata->classh_algo;
+        struct monitor_cfg *monitor_config = &pdata->mon_cfg;
+        unsigned int val32 = 0;
+        u8 monitor_array[4];
+        const int imon_array_size = ARRAY_SIZE(monitor_array);
+        const int mon_array_size = imon_array_size - 1;
+        int ret = 0;
+
+        if (!np)
+                return 0;
+
+        pdata->bst_pdn_fet_on = of_property_read_bool(np,
+                                        "cirrus,boost-pdn-fet-on");
+
+        ret = of_property_read_u32(np, "cirrus,boost-ctl-millivolt", &val32);
+        if (ret >= 0) {
+                if (val32 < 2600 || val32 > 9000) {
+                        dev_err(&i2c_client->dev,
+                                "Invalid Boost Voltage %d mV\n", val32);
+                        return -EINVAL;
+                }
+                pdata->bst_vctl = ((val32 - 2600) / 100) + 1;
+        }
+
+        ret = of_property_read_u32(np, "cirrus,boost-peak-milliamp", &val32);
+        if (ret >= 0) {
+                if (val32 < 1680 || val32 > 4480) {
+                        dev_err(&i2c_client->dev,
+                                "Invalid Boost Peak Current %u mA\n", val32);
+                        return -EINVAL;
+                }
+
+                pdata->bst_ipk = (val32 - 1680) / 110;
+        }
+
+        if (of_property_read_u32(np, "cirrus,sp-drv-strength", &val32) >= 0)
+                pdata->sp_drv_str = val32;
+        if (of_property_read_u32(np, "cirrus,sp-drv-unused", &val32) >= 0)
+                pdata->sp_drv_unused = val32 | CS35L35_VALID_PDATA;
+
+        pdata->stereo = of_property_read_bool(np, "cirrus,stereo-config");
+
+        if (pdata->stereo) {
+                ret = of_property_read_u32(np, "cirrus,audio-channel", &val32);
+                if (ret >= 0)
+                        pdata->aud_channel = val32;
+
+                ret = of_property_read_u32(np, "cirrus,advisory-channel",
+                                           &val32);
+                if (ret >= 0)
+                        pdata->adv_channel = val32;
+
+                pdata->shared_bst = of_property_read_bool(np,
+                                                "cirrus,shared-boost");
+        }
+
+        pdata->ext_bst = of_property_read_bool(np, "cirrus,external-boost");
+
+        pdata->gain_zc = of_property_read_bool(np, "cirrus,amp-gain-zc");
+
+        classh = of_get_child_by_name(np, "cirrus,classh-internal-algo");
+        classh_config->classh_algo_enable = classh ? true : false;
+
+        if (classh_config->classh_algo_enable) {
+                classh_config->classh_bst_override =
+                        of_property_read_bool(np, "cirrus,classh-bst-overide");
+
+                ret = of_property_read_u32(classh,
+                                           "cirrus,classh-bst-max-limit",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_bst_max_limit = val32;
+                }
+
+                ret = of_property_read_u32(classh,
+                                           "cirrus,classh-bst-max-limit",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_bst_max_limit = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-mem-depth",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_mem_depth = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-release-rate",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_release_rate = val32;
+
+                ret = of_property_read_u32(classh, "cirrus,classh-headroom",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_headroom = val32;
+                }
+
+                ret = of_property_read_u32(classh,
+                                           "cirrus,classh-wk-fet-disable",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_wk_fet_disable = val32;
+
+                ret = of_property_read_u32(classh, "cirrus,classh-wk-fet-delay",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_wk_fet_delay = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-wk-fet-thld",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_wk_fet_thld = val32;
+
+                ret = of_property_read_u32(classh, "cirrus,classh-vpch-auto",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_vpch_auto = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-vpch-rate",
+                                           &val32);
+                if (ret >= 0) {
+                        val32 |= CS35L35_VALID_PDATA;
+                        classh_config->classh_vpch_rate = val32;
+                }
+
+                ret = of_property_read_u32(classh, "cirrus,classh-vpch-man",
+                                           &val32);
+                if (ret >= 0)
+                        classh_config->classh_vpch_man = val32;
+        }
+        of_node_put(classh);
+
+        /* frame depth location */
+        signal_format = of_get_child_by_name(np, "cirrus,monitor-signal-format");
+        monitor_config->is_present = signal_format ? true : false;
+        if (monitor_config->is_present) {
+                ret = of_property_read_u8_array(signal_format, "cirrus,imon",
+                                                monitor_array, imon_array_size);
+                if (!ret) {
+                        monitor_config->imon_specs = true;
+                        monitor_config->imon_dpth = monitor_array[0];
+                        monitor_config->imon_loc = monitor_array[1];
+                        monitor_config->imon_frm = monitor_array[2];
+                        monitor_config->imon_scale = monitor_array[3];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vmon",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vmon_specs = true;
+                        monitor_config->vmon_dpth = monitor_array[0];
+                        monitor_config->vmon_loc = monitor_array[1];
+                        monitor_config->vmon_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vpmon",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vpmon_specs = true;
+                        monitor_config->vpmon_dpth = monitor_array[0];
+                        monitor_config->vpmon_loc = monitor_array[1];
+                        monitor_config->vpmon_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vbstmon",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vbstmon_specs = true;
+                        monitor_config->vbstmon_dpth = monitor_array[0];
+                        monitor_config->vbstmon_loc = monitor_array[1];
+                        monitor_config->vbstmon_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,vpbrstat",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->vpbrstat_specs = true;
+                        monitor_config->vpbrstat_dpth = monitor_array[0];
+                        monitor_config->vpbrstat_loc = monitor_array[1];
+                        monitor_config->vpbrstat_frm = monitor_array[2];
+                }
+                ret = of_property_read_u8_array(signal_format, "cirrus,zerofill",
+                                                monitor_array, mon_array_size);
+                if (!ret) {
+                        monitor_config->zerofill_specs = true;
+                        monitor_config->zerofill_dpth = monitor_array[0];
+                        monitor_config->zerofill_loc = monitor_array[1];
+                        monitor_config->zerofill_frm = monitor_array[2];
+                }
+        }
+        of_node_put(signal_format);
+
+        return 0;
+}
+
+/* Errata Rev A0 */
+static const struct reg_sequence cs35l35_errata_patch[] = {
+
+        { 0x7F, 0x99 },
+        { 0x00, 0x99 },
+        { 0x52, 0x22 },
+        { 0x04, 0x14 },
+        { 0x6D, 0x44 },
+        { 0x24, 0x10 },
+        { 0x58, 0xC4 },
+        { 0x00, 0x98 },
+        { 0x18, 0x08 },
+        { 0x00, 0x00 },
+        { 0x7F, 0x00 },
+};
+
+static int cs35l35_i2c_probe(struct i2c_client *i2c_client,
+                              const struct i2c_device_id *id)
+{
+        struct cs35l35_private *cs35l35;
+        struct device *dev = &i2c_client->dev;
+        struct cs35l35_platform_data *pdata = dev_get_platdata(dev);
+        int i;
+        int ret;
+        unsigned int devid = 0;
+        unsigned int reg;
+
+        cs35l35 = devm_kzalloc(dev, sizeof(struct cs35l35_private), GFP_KERNEL);
+        if (!cs35l35)
+                return -ENOMEM;
+
+        cs35l35->dev = dev;
+
+        i2c_set_clientdata(i2c_client, cs35l35);
+        cs35l35->regmap = devm_regmap_init_i2c(i2c_client, &cs35l35_regmap);
+        if (IS_ERR(cs35l35->regmap)) {
+                ret = PTR_ERR(cs35l35->regmap);
+                dev_err(dev, "regmap_init() failed: %d\n", ret);
+                goto err;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(cs35l35_supplies); i++)
+                cs35l35->supplies[i].supply = cs35l35_supplies[i];
+
+        cs35l35->num_supplies = ARRAY_SIZE(cs35l35_supplies);
+
+        ret = devm_regulator_bulk_get(dev, cs35l35->num_supplies,
+                                      cs35l35->supplies);
+        if (ret != 0) {
+                dev_err(dev, "Failed to request core supplies: %d\n", ret);
+                return ret;
+        }
+
+        if (pdata) {
+                cs35l35->pdata = *pdata;
+        } else {
+                pdata = devm_kzalloc(dev, sizeof(struct cs35l35_platform_data),
+                                     GFP_KERNEL);
+                if (!pdata)
+                        return -ENOMEM;
+                if (i2c_client->dev.of_node) {
+                        ret = cs35l35_handle_of_data(i2c_client, pdata);
+                        if (ret != 0)
+                                return ret;
+
+                }
+                cs35l35->pdata = *pdata;
+        }
+
+        ret = regulator_bulk_enable(cs35l35->num_supplies,
+                                        cs35l35->supplies);
+        if (ret != 0) {
+                dev_err(dev, "Failed to enable core supplies: %d\n", ret);
+                return ret;
+        }
+
+        /* returning NULL can be valid if in stereo mode */
+        cs35l35->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+                                                      GPIOD_OUT_LOW);
+        if (IS_ERR(cs35l35->reset_gpio)) {
+                ret = PTR_ERR(cs35l35->reset_gpio);
+                cs35l35->reset_gpio = NULL;
+                if (ret == -EBUSY) {
+                        dev_info(dev,
+                                 "Reset line busy, assuming shared reset\n");
+                } else {
+                        dev_err(dev, "Failed to get reset GPIO: %d\n", ret);
+                        goto err;
+                }
+        }
+
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 1);
+
+        init_completion(&cs35l35->pdn_done);
+
+        ret = devm_request_threaded_irq(dev, i2c_client->irq, NULL, cs35l35_irq,
+                                        IRQF_ONESHOT | IRQF_TRIGGER_LOW |
+                                        IRQF_SHARED, "cs35l35", cs35l35);
+        if (ret != 0) {
+                dev_err(dev, "Failed to request IRQ: %d\n", ret);
+                goto err;
+        }
+        /* initialize codec */
+        ret = regmap_read(cs35l35->regmap, CS35L35_DEVID_AB, &reg);
+
+        devid = (reg & 0xFF) << 12;
+        ret = regmap_read(cs35l35->regmap, CS35L35_DEVID_CD, &reg);
+        devid |= (reg & 0xFF) << 4;
+        ret = regmap_read(cs35l35->regmap, CS35L35_DEVID_E, &reg);
+        devid |= (reg & 0xF0) >> 4;
+
+        if (devid != CS35L35_CHIP_ID) {
+                dev_err(dev, "CS35L35 Device ID (%X). Expected ID %X\n",
+                        devid, CS35L35_CHIP_ID);
+                ret = -ENODEV;
+                goto err;
+        }
+
+        ret = regmap_read(cs35l35->regmap, CS35L35_REV_ID, &reg);
+        if (ret < 0) {
+                dev_err(dev, "Get Revision ID failed: %d\n", ret);
+                goto err;
+        }
+
+        ret = regmap_register_patch(cs35l35->regmap, cs35l35_errata_patch,
+                                    ARRAY_SIZE(cs35l35_errata_patch));
+        if (ret < 0) {
+                dev_err(dev, "Failed to apply errata patch: %d\n", ret);
+                goto err;
+        }
+
+        dev_info(dev, "Cirrus Logic CS35L35 (%x), Revision: %02X\n",
+                 devid, reg & 0xFF);
+
+        /* Set the INT Masks for critical errors */
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_1,
+                                CS35L35_INT1_CRIT_MASK);
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_2,
+                                CS35L35_INT2_CRIT_MASK);
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_3,
+                                CS35L35_INT3_CRIT_MASK);
+        regmap_write(cs35l35->regmap, CS35L35_INT_MASK_4,
+                                CS35L35_INT4_CRIT_MASK);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                        CS35L35_PWR2_PDN_MASK,
+                        CS35L35_PWR2_PDN_MASK);
+
+        if (cs35l35->pdata.bst_pdn_fet_on)
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                        CS35L35_PDN_BST_MASK,
+                                        1 << CS35L35_PDN_BST_FETON_SHIFT);
+        else
+                regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL2,
+                                        CS35L35_PDN_BST_MASK,
+                                        1 << CS35L35_PDN_BST_FETOFF_SHIFT);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_PWRCTL3,
+                        CS35L35_PWR3_PDN_MASK,
+                        CS35L35_PWR3_PDN_MASK);
+
+        regmap_update_bits(cs35l35->regmap, CS35L35_PROTECT_CTL,
+                CS35L35_AMP_MUTE_MASK, 1 << CS35L35_AMP_MUTE_SHIFT);
+
+        ret =  snd_soc_register_codec(dev, &soc_codec_dev_cs35l35, cs35l35_dai,
+                                      ARRAY_SIZE(cs35l35_dai));
+        if (ret < 0) {
+                dev_err(dev, "Failed to register codec: %d\n", ret);
+                goto err;
+        }
+
+        return 0;
+
+err:
+        regulator_bulk_disable(cs35l35->num_supplies,
+                               cs35l35->supplies);
+        gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
+
+        return ret;
+}
+
+static int cs35l35_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct of_device_id cs35l35_of_match[] = {
+        {.compatible = "cirrus,cs35l35"},
+        {},
+};
+MODULE_DEVICE_TABLE(of, cs35l35_of_match);
+
+static const struct i2c_device_id cs35l35_id[] = {
+        {"cs35l35", 0},
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, cs35l35_id);
+
+static struct i2c_driver cs35l35_i2c_driver = {
+        .driver = {
+                .name = "cs35l35",
+                .of_match_table = cs35l35_of_match,
+        },
+        .id_table = cs35l35_id,
+        .probe = cs35l35_i2c_probe,
+        .remove = cs35l35_i2c_remove,
+};
+
+module_i2c_driver(cs35l35_i2c_driver);
+
+MODULE_DESCRIPTION("ASoC CS35L35 driver");
+MODULE_AUTHOR("Brian Austin, Cirrus Logic Inc, <brian.austin@cirrus.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/cs35l35.h b/sound/soc/codecs/cs35l35.h
new file mode 100644
index 000000000000..5a6e43a87c4d
--- /dev/null
+++ b/sound/soc/codecs/cs35l35.h
@@ -0,0 +1,294 @@
+/*
+ * cs35l35.h -- CS35L35 ALSA SoC audio driver
+ *
+ * Copyright 2016 Cirrus Logic, Inc.
+ *
+ * Author: Brian Austin <brian.austin@cirrus.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef __CS35L35_H__
+#define __CS35L35_H__
+
+#define CS35L35_FIRSTREG                0x01
+#define CS35L35_LASTREG                 0x7E
+#define CS35L35_CHIP_ID                 0x00035A35
+#define CS35L35_DEVID_AB                0x01    /* Device ID A & B [RO] */
+#define CS35L35_DEVID_CD                0x02    /* Device ID C & D [RO] */
+#define CS35L35_DEVID_E                 0x03    /* Device ID E [RO] */
+#define CS35L35_FAB_ID                  0x04    /* Fab ID [RO] */
+#define CS35L35_REV_ID                  0x05    /* Revision ID [RO] */
+#define CS35L35_PWRCTL1                 0x06    /* Power Ctl 1 */
+#define CS35L35_PWRCTL2                 0x07    /* Power Ctl 2 */
+#define CS35L35_PWRCTL3                 0x08    /* Power Ctl 3 */
+#define CS35L35_CLK_CTL1                0x0A    /* Clocking Ctl 1 */
+#define CS35L35_CLK_CTL2                0x0B    /* Clocking Ctl 2 */
+#define CS35L35_CLK_CTL3                0x0C    /* Clocking Ctl 3 */
+#define CS35L35_SP_FMT_CTL1             0x0D    /* Serial Port Format CTL1 */
+#define CS35L35_SP_FMT_CTL2             0x0E    /* Serial Port Format CTL2 */
+#define CS35L35_SP_FMT_CTL3             0x0F    /* Serial Port Format CTL3 */
+#define CS35L35_MAG_COMP_CTL            0x13    /* Magnitude Comp CTL */
+#define CS35L35_AMP_INP_DRV_CTL         0x14    /* Amp Input Drive Ctl */
+#define CS35L35_AMP_DIG_VOL_CTL         0x15    /* Amplifier Dig Volume Ctl */
+#define CS35L35_AMP_DIG_VOL             0x16    /* Amplifier Dig Volume */
+#define CS35L35_ADV_DIG_VOL             0x17    /* Advisory Digital Volume */
+#define CS35L35_PROTECT_CTL             0x18    /* Amp Gain - Prot Ctl Param */
+#define CS35L35_AMP_GAIN_AUD_CTL        0x19    /* Amp Serial Port Gain Ctl */
+#define CS35L35_AMP_GAIN_PDM_CTL        0x1A    /* Amplifier Gain PDM Ctl */
+#define CS35L35_AMP_GAIN_ADV_CTL        0x1B    /* Amplifier Gain Ctl */
+#define CS35L35_GPI_CTL                 0x1C    /* GPI Ctl */
+#define CS35L35_BST_CVTR_V_CTL          0x1D    /* Boost Conv Voltage Ctl */
+#define CS35L35_BST_PEAK_I              0x1E    /* Boost Conv Peak Current */
+#define CS35L35_BST_RAMP_CTL            0x20    /* Boost Conv Soft Ramp Ctl */
+#define CS35L35_BST_CONV_COEF_1         0x21    /* Boost Conv Coefficients 1 */
+#define CS35L35_BST_CONV_COEF_2         0x22    /* Boost Conv Coefficients 2 */
+#define CS35L35_BST_CONV_SLOPE_COMP     0x23    /* Boost Conv Slope Comp */
+#define CS35L35_BST_CONV_SW_FREQ        0x24    /* Boost Conv L BST SW Freq */
+#define CS35L35_CLASS_H_CTL             0x30    /* CLS H Control */
+#define CS35L35_CLASS_H_HEADRM_CTL      0x31    /* CLS H Headroom Ctl */
+#define CS35L35_CLASS_H_RELEASE_RATE    0x32    /* CLS H Release Rate */
+#define CS35L35_CLASS_H_FET_DRIVE_CTL   0x33    /* CLS H Weak FET Drive Ctl */
+#define CS35L35_CLASS_H_VP_CTL          0x34    /* CLS H VP Ctl */
+#define CS35L35_CLASS_H_STATUS          0x38    /* CLS H Status */
+#define CS35L35_VPBR_CTL                0x3A    /* VPBR Ctl */
+#define CS35L35_VPBR_VOL_CTL            0x3B    /* VPBR Volume Ctl */
+#define CS35L35_VPBR_TIMING_CTL         0x3C    /* VPBR Timing Ctl */
+#define CS35L35_VPBR_MODE_VOL_CTL       0x3D    /* VPBR Mode/Attack Vol Ctl */
+#define CS35L35_VPBR_ATTEN_STATUS       0x4B    /* VPBR Attenuation Status */
+#define CS35L35_SPKR_MON_CTL            0x4E    /* Speaker Monitoring Ctl */
+#define CS35L35_IMON_SCALE_CTL          0x51    /* IMON Scale Ctl */
+#define CS35L35_AUDIN_RXLOC_CTL         0x52    /* Audio Input RX Loc Ctl */
+#define CS35L35_ADVIN_RXLOC_CTL         0x53    /* Advisory Input RX Loc Ctl */
+#define CS35L35_VMON_TXLOC_CTL          0x54    /* VMON TX Loc Ctl */
+#define CS35L35_IMON_TXLOC_CTL          0x55    /* IMON TX Loc Ctl */
+#define CS35L35_VPMON_TXLOC_CTL         0x56    /* VPMON TX Loc Ctl */
+#define CS35L35_VBSTMON_TXLOC_CTL       0x57    /* VBSTMON TX Loc Ctl */
+#define CS35L35_VPBR_STATUS_TXLOC_CTL   0x58    /* VPBR Status TX Loc Ctl */
+#define CS35L35_ZERO_FILL_LOC_CTL       0x59    /* Zero Fill Loc Ctl */
+#define CS35L35_AUDIN_DEPTH_CTL         0x5A    /* Audio Input Depth Ctl */
+#define CS35L35_SPKMON_DEPTH_CTL        0x5B    /* SPK Mon Output Depth Ctl */
+#define CS35L35_SUPMON_DEPTH_CTL        0x5C    /* Supply Mon Out Depth Ctl */
+#define CS35L35_ZEROFILL_DEPTH_CTL      0x5D    /* Zero Fill Mon Output Ctl */
+#define CS35L35_MULT_DEV_SYNCH1         0x62    /* Multidevice Synch */
+#define CS35L35_MULT_DEV_SYNCH2         0x63    /* Multidevice Synch 2 */
+#define CS35L35_PROT_RELEASE_CTL        0x64    /* Protection Release Ctl */
+#define CS35L35_DIAG_MODE_REG_LOCK      0x68    /* Diagnostic Mode Reg Lock */
+#define CS35L35_DIAG_MODE_CTL_1         0x69    /* Diagnostic Mode Ctl 1 */
+#define CS35L35_DIAG_MODE_CTL_2         0x6A    /* Diagnostic Mode Ctl 2 */
+#define CS35L35_INT_MASK_1              0x70    /* Interrupt Mask 1 */
+#define CS35L35_INT_MASK_2              0x71    /* Interrupt Mask 2 */
+#define CS35L35_INT_MASK_3              0x72    /* Interrupt Mask 3 */
+#define CS35L35_INT_MASK_4              0x73    /* Interrupt Mask 4 */
+#define CS35L35_INT_STATUS_1            0x74    /* Interrupt Status 1 */
+#define CS35L35_INT_STATUS_2            0x75    /* Interrupt Status 2 */
+#define CS35L35_INT_STATUS_3            0x76    /* Interrupt Status 3 */
+#define CS35L35_INT_STATUS_4            0x77    /* Interrupt Status 4 */
+#define CS35L35_PLL_STATUS              0x78    /* PLL Status */
+#define CS35L35_OTP_TRIM_STATUS         0x7E    /* OTP Trim Status */
+
+#define CS35L35_MAX_REGISTER            0x7F
+
+/* CS35L35_PWRCTL1 */
+#define CS35L35_SFT_RST                 0x80
+#define CS35L35_DISCHG_FLT              0x02
+#define CS35L35_PDN_ALL                 0x01
+
+/* CS35L35_PWRCTL2 */
+#define CS35L35_PDN_VMON                0x80
+#define CS35L35_PDN_IMON                0x40
+#define CS35L35_PDN_CLASSH              0x20
+#define CS35L35_PDN_VPBR                0x10
+#define CS35L35_PDN_BST                 0x04
+#define CS35L35_PDN_AMP                 0x01
+
+/* CS35L35_PWRCTL3 */
+#define CS35L35_PDN_VBSTMON_OUT         0x10
+#define CS35L35_PDN_VMON_OUT            0x08
+
+#define CS35L35_AUDIN_DEPTH_MASK        0x03
+#define CS35L35_AUDIN_DEPTH_SHIFT       0
+#define CS35L35_ADVIN_DEPTH_MASK        0x0C
+#define CS35L35_ADVIN_DEPTH_SHIFT       2
+#define CS35L35_SDIN_DEPTH_8            0x01
+#define CS35L35_SDIN_DEPTH_16           0x02
+#define CS35L35_SDIN_DEPTH_24           0x03
+
+#define CS35L35_SDOUT_DEPTH_8           0x01
+#define CS35L35_SDOUT_DEPTH_12          0x02
+#define CS35L35_SDOUT_DEPTH_16          0x03
+
+#define CS35L35_AUD_IN_LR_MASK          0x80
+#define CS35L35_AUD_IN_LR_SHIFT         7
+#define CS35L35_ADV_IN_LR_MASK          0x80
+#define CS35L35_ADV_IN_LR_SHIFT         7
+#define CS35L35_AUD_IN_LOC_MASK         0x0F
+#define CS35L35_AUD_IN_LOC_SHIFT        0
+#define CS35L35_ADV_IN_LOC_MASK         0x0F
+#define CS35L35_ADV_IN_LOC_SHIFT        0
+
+#define CS35L35_IMON_DEPTH_MASK         0x03
+#define CS35L35_IMON_DEPTH_SHIFT        0
+#define CS35L35_VMON_DEPTH_MASK         0x0C
+#define CS35L35_VMON_DEPTH_SHIFT        2
+#define CS35L35_VBSTMON_DEPTH_MASK      0x03
+#define CS35L35_VBSTMON_DEPTH_SHIFT     0
+#define CS35L35_VPMON_DEPTH_MASK        0x0C
+#define CS35L35_VPMON_DEPTH_SHIFT       2
+#define CS35L35_VPBRSTAT_DEPTH_MASK     0x30
+#define CS35L35_VPBRSTAT_DEPTH_SHIFT    4
+#define CS35L35_ZEROFILL_DEPTH_MASK     0x03
+#define CS35L35_ZEROFILL_DEPTH_SHIFT    0x00
+
+#define CS35L35_MON_TXLOC_MASK          0x3F
+#define CS35L35_MON_TXLOC_SHIFT         0
+#define CS35L35_MON_FRM_MASK            0x80
+#define CS35L35_MON_FRM_SHIFT           7
+
+#define CS35L35_IMON_SCALE_MASK         0xF8
+#define CS35L35_IMON_SCALE_SHIFT        3
+
+#define CS35L35_MS_MASK                 0x80
+#define CS35L35_MS_SHIFT                7
+#define CS35L35_SPMODE_MASK             0x40
+#define CS35L35_SP_DRV_MASK             0x10
+#define CS35L35_SP_DRV_SHIFT            4
+#define CS35L35_CLK_CTL2_MASK           0xFF
+#define CS35L35_PDM_MODE_MASK           0x40
+#define CS35L35_PDM_MODE_SHIFT          6
+#define CS35L35_CLK_SOURCE_MASK         0x03
+#define CS35L35_CLK_SOURCE_SHIFT        0
+#define CS35L35_CLK_SOURCE_MCLK         0
+#define CS35L35_CLK_SOURCE_SCLK         1
+#define CS35L35_CLK_SOURCE_PDM          2
+
+#define CS35L35_SP_SCLKS_MASK           0x0F
+#define CS35L35_SP_SCLKS_SHIFT          0x00
+#define CS35L35_SP_SCLKS_16FS           0x03
+#define CS35L35_SP_SCLKS_32FS           0x07
+#define CS35L35_SP_SCLKS_48FS           0x0B
+#define CS35L35_SP_SCLKS_64FS           0x0F
+#define CS35L35_SP_RATE_MASK            0xC0
+
+#define CS35L35_PDN_BST_MASK            0x06
+#define CS35L35_PDN_BST_FETON_SHIFT     1
+#define CS35L35_PDN_BST_FETOFF_SHIFT    2
+#define CS35L35_PWR2_PDN_MASK           0xE0
+#define CS35L35_PWR3_PDN_MASK           0x1E
+#define CS35L35_PDN_ALL_MASK            0x01
+#define CS35L35_DISCHG_FILT_MASK        0x02
+#define CS35L35_DISCHG_FILT_SHIFT       1
+#define CS35L35_MCLK_DIS_MASK           0x04
+#define CS35L35_MCLK_DIS_SHIFT          2
+
+#define CS35L35_BST_CTL_MASK            0x7F
+#define CS35L35_BST_CTL_SHIFT           0
+#define CS35L35_BST_IPK_MASK            0x1F
+#define CS35L35_BST_IPK_SHIFT           0
+#define CS35L35_AMP_MUTE_MASK           0x20
+#define CS35L35_AMP_MUTE_SHIFT          5
+#define CS35L35_AMP_GAIN_ZC_MASK        0x10
+#define CS35L35_AMP_GAIN_ZC_SHIFT       4
+
+#define CS35L35_AMP_DIGSFT_MASK         0x02
+#define CS35L35_AMP_DIGSFT_SHIFT        1
+
+/* CS35L35_SP_FMT_CTL3 */
+#define CS35L35_SP_I2S_DRV_MASK         0x03
+#define CS35L35_SP_I2S_DRV_SHIFT        0
+
+/* Class H Algorithm Control */
+#define CS35L35_CH_STEREO_MASK          0x40
+#define CS35L35_CH_STEREO_SHIFT         6
+#define CS35L35_CH_BST_OVR_MASK         0x04
+#define CS35L35_CH_BST_OVR_SHIFT        2
+#define CS35L35_CH_BST_LIM_MASK         0x08
+#define CS35L35_CH_BST_LIM_SHIFT        3
+#define CS35L35_CH_MEM_DEPTH_MASK       0x01
+#define CS35L35_CH_MEM_DEPTH_SHIFT      0
+#define CS35L35_CH_HDRM_CTL_MASK        0x3F
+#define CS35L35_CH_HDRM_CTL_SHIFT       0
+#define CS35L35_CH_REL_RATE_MASK        0xFF
+#define CS35L35_CH_REL_RATE_SHIFT       0
+#define CS35L35_CH_WKFET_DIS_MASK       0x80
+#define CS35L35_CH_WKFET_DIS_SHIFT      7
+#define CS35L35_CH_WKFET_DEL_MASK       0x70
+#define CS35L35_CH_WKFET_DEL_SHIFT      4
+#define CS35L35_CH_WKFET_THLD_MASK      0x0F
+#define CS35L35_CH_WKFET_THLD_SHIFT     0
+#define CS35L35_CH_VP_AUTO_MASK         0x80
+#define CS35L35_CH_VP_AUTO_SHIFT        7
+#define CS35L35_CH_VP_RATE_MASK         0x60
+#define CS35L35_CH_VP_RATE_SHIFT        5
+#define CS35L35_CH_VP_MAN_MASK          0x1F
+#define CS35L35_CH_VP_MAN_SHIFT         0
+
+/* CS35L35_PROT_RELEASE_CTL */
+#define CS35L35_CAL_ERR_RLS             0x80
+#define CS35L35_SHORT_RLS               0x04
+#define CS35L35_OTW_RLS                 0x02
+#define CS35L35_OTE_RLS                 0x01
+
+/* INT Mask Registers */
+#define CS35L35_INT1_CRIT_MASK          0x38
+#define CS35L35_INT2_CRIT_MASK          0xEF
+#define CS35L35_INT3_CRIT_MASK          0xEE
+#define CS35L35_INT4_CRIT_MASK          0xFF
+
+/* PDN DONE Masks */
+#define CS35L35_M_PDN_DONE_SHIFT        4
+#define CS35L35_M_PDN_DONE_MASK         0x10
+
+/* CS35L35_INT_1 */
+#define CS35L35_CAL_ERR                 0x80
+#define CS35L35_OTP_ERR                 0x40
+#define CS35L35_LRCLK_ERR               0x20
+#define CS35L35_SPCLK_ERR               0x10
+#define CS35L35_MCLK_ERR                0x08
+#define CS35L35_AMP_SHORT               0x04
+#define CS35L35_OTW                     0x02
+#define CS35L35_OTE                     0x01
+
+/* CS35L35_INT_2 */
+#define CS35L35_PDN_DONE                0x10
+#define CS35L35_VPBR_ERR                0x02
+#define CS35L35_VPBR_CLR                0x01
+
+/* CS35L35_INT_3 */
+#define CS35L35_BST_HIGH                0x10
+#define CS35L35_BST_HIGH_FLAG           0x08
+#define CS35L35_BST_IPK_FLAG            0x04
+#define CS35L35_LBST_SHORT              0x01
+
+/* CS35L35_INT_4 */
+#define CS35L35_VMON_OVFL               0x08
+#define CS35L35_IMON_OVFL               0x04
+
+#define CS35L35_FORMATS (SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE | \
+                        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+struct  cs35l35_private {
+        struct device *dev;
+        struct cs35l35_platform_data pdata;
+        struct regmap *regmap;
+        struct regulator_bulk_data supplies[2];
+        int num_supplies;
+        int sysclk;
+        int sclk;
+        bool pdm_mode;
+        bool i2s_mode;
+        bool slave_mode;
+        /* GPIO for /RST */
+        struct gpio_desc *reset_gpio;
+        struct completion pdn_done;
+};
+
+static const char * const cs35l35_supplies[] = {
+        "VA",
+        "VP",
+};
+
+#endif
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 8c0f3b89b5bc..e78b5f055f25 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -498,7 +498,7 @@ static int cs4271_reset(struct snd_soc_codec *codec)
         struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
 
         if (gpio_is_valid(cs4271->gpio_nreset)) {
-                gpio_set_value(cs4271->gpio_nreset, 0);
+                gpio_direction_output(cs4271->gpio_nreset, 0);
                 mdelay(1);
                 gpio_set_value(cs4271->gpio_nreset, 1);
                 mdelay(1);
diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c
index cb47fb595ff4..1e0d5973b758 100644
--- a/sound/soc/codecs/cs53l30.c
+++ b/sound/soc/codecs/cs53l30.c
@@ -1130,6 +1130,7 @@ MODULE_DEVICE_TABLE(i2c, cs53l30_id);
 static struct i2c_driver cs53l30_i2c_driver = {
         .driver = {
                 .name = "cs53l30",
+                .of_match_table = cs53l30_of_match,
                 .pm = &cs53l30_runtime_pm,
         },
         .id_table = cs53l30_id,
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index 12da55882c06..6dd7578f0bb8 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -12,6 +12,7 @@
  * option) any later version.
  */
 
+#include <linux/acpi.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
@@ -1528,12 +1529,23 @@ static int da7213_set_bias_level(struct snd_soc_codec *codec,
         return 0;
 }
 
+#if defined(CONFIG_OF)
 /* DT */
 static const struct of_device_id da7213_of_match[] = {
         { .compatible = "dlg,da7213", },
         { }
 };
 MODULE_DEVICE_TABLE(of, da7213_of_match);
+#endif
+
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id da7213_acpi_match[] = {
+        { "DLGS7212", 0},
+        { "DLGS7213", 0},
+        { },
+};
+MODULE_DEVICE_TABLE(acpi, da7213_acpi_match);
+#endif
 
 static enum da7213_micbias_voltage
         da7213_of_micbias_lvl(struct snd_soc_codec *codec, u32 val)
@@ -1844,6 +1856,7 @@ static struct i2c_driver da7213_i2c_driver = {
         .driver = {
                 .name = "da7213",
                 .of_match_table = of_match_ptr(da7213_of_match),
+                .acpi_match_table = ACPI_PTR(da7213_acpi_match),
         },
         .probe          = da7213_i2c_probe,
         .remove         = da7213_remove,
diff --git a/sound/soc/codecs/dio2125.c b/sound/soc/codecs/dio2125.c
new file mode 100644
index 000000000000..09451cd44f9b
--- /dev/null
+++ b/sound/soc/codecs/dio2125.c
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2017 BayLibre, SAS.
+ * Author: Jerome Brunet <jbrunet@baylibre.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ */
+
+#include <linux/gpio/consumer.h>
+#include <linux/module.h>
+#include <sound/soc.h>
+
+#define DRV_NAME "dio2125"
+
+struct dio2125 {
+        struct gpio_desc *gpiod_enable;
+};
+
+static int drv_event(struct snd_soc_dapm_widget *w,
+                     struct snd_kcontrol *control, int event)
+{
+        struct snd_soc_component *c = snd_soc_dapm_to_component(w->dapm);
+        struct dio2125 *priv = snd_soc_component_get_drvdata(c);
+        int val;
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                val = 1;
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                val = 0;
+                break;
+        default:
+                WARN(1, "Unexpected event");
+                return -EINVAL;
+        }
+
+        gpiod_set_value_cansleep(priv->gpiod_enable, val);
+
+        return 0;
+}
+
+static const struct snd_soc_dapm_widget dio2125_dapm_widgets[] = {
+        SND_SOC_DAPM_INPUT("INL"),
+        SND_SOC_DAPM_INPUT("INR"),
+        SND_SOC_DAPM_OUT_DRV_E("DRV", SND_SOC_NOPM, 0, 0, NULL, 0, drv_event,
+                               (SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD)),
+        SND_SOC_DAPM_OUTPUT("OUTL"),
+        SND_SOC_DAPM_OUTPUT("OUTR"),
+};
+
+static const struct snd_soc_dapm_route dio2125_dapm_routes[] = {
+        { "DRV", NULL, "INL" },
+        { "DRV", NULL, "INR" },
+        { "OUTL", NULL, "DRV" },
+        { "OUTR", NULL, "DRV" },
+};
+
+static const struct snd_soc_component_driver dio2125_component_driver = {
+        .dapm_widgets           = dio2125_dapm_widgets,
+        .num_dapm_widgets       = ARRAY_SIZE(dio2125_dapm_widgets),
+        .dapm_routes            = dio2125_dapm_routes,
+        .num_dapm_routes        = ARRAY_SIZE(dio2125_dapm_routes),
+};
+
+static int dio2125_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct dio2125 *priv;
+        int err;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (priv == NULL)
+                return -ENOMEM;
+        platform_set_drvdata(pdev, priv);
+
+        priv->gpiod_enable = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
+        if (IS_ERR(priv->gpiod_enable)) {
+                err = PTR_ERR(priv->gpiod_enable);
+                if (err != -EPROBE_DEFER)
+                        dev_err(dev, "Failed to get 'enable' gpio: %d", err);
+                return err;
+        }
+
+        return devm_snd_soc_register_component(dev, &dio2125_component_driver,
+                                               NULL, 0);
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id dio2125_ids[] = {
+        { .compatible = "dioo,dio2125", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, dio2125_ids);
+#endif
+
+static struct platform_driver dio2125_driver = {
+        .driver = {
+                .name = DRV_NAME,
+                .of_match_table = of_match_ptr(dio2125_ids),
+        },
+        .probe = dio2125_probe,
+};
+
+module_platform_driver(dio2125_driver);
+
+MODULE_DESCRIPTION("ASoC DIO2125 output driver");
+MODULE_AUTHOR("Jerome Brunet <jbrunet@baylibre.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/es7134.c b/sound/soc/codecs/es7134.c
new file mode 100644
index 000000000000..25ede825d349
--- /dev/null
+++ b/sound/soc/codecs/es7134.c
@@ -0,0 +1,116 @@
+/*
+ * Copyright (c) 2017 BayLibre, SAS.
+ * Author: Jerome Brunet <jbrunet@baylibre.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ */
+
+#include <linux/module.h>
+#include <sound/soc.h>
+
+/*
+ * The everest 7134 is a very simple DA converter with no register
+ */
+
+static int es7134_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+{
+        fmt &= (SND_SOC_DAIFMT_FORMAT_MASK | SND_SOC_DAIFMT_INV_MASK |
+                SND_SOC_DAIFMT_MASTER_MASK);
+
+        if (fmt != (SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                    SND_SOC_DAIFMT_CBS_CFS)) {
+                dev_err(codec_dai->dev, "Invalid DAI format\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_dai_ops es7134_dai_ops = {
+        .set_fmt        = es7134_set_fmt,
+};
+
+static struct snd_soc_dai_driver es7134_dai = {
+        .name = "es7134-hifi",
+        .playback = {
+                .stream_name = "Playback",
+                .channels_min = 2,
+                .channels_max = 2,
+                .rates = SNDRV_PCM_RATE_8000_192000,
+                .formats = (SNDRV_PCM_FMTBIT_S16_LE  |
+                            SNDRV_PCM_FMTBIT_S18_3LE |
+                            SNDRV_PCM_FMTBIT_S20_3LE |
+                            SNDRV_PCM_FMTBIT_S24_3LE |
+                            SNDRV_PCM_FMTBIT_S24_LE),
+        },
+        .ops = &es7134_dai_ops,
+};
+
+static const struct snd_soc_dapm_widget es7134_dapm_widgets[] = {
+        SND_SOC_DAPM_OUTPUT("AOUTL"),
+        SND_SOC_DAPM_OUTPUT("AOUTR"),
+        SND_SOC_DAPM_DAC("DAC", "Playback", SND_SOC_NOPM, 0, 0),
+};
+
+static const struct snd_soc_dapm_route es7134_dapm_routes[] = {
+        { "AOUTL", NULL, "DAC" },
+        { "AOUTR", NULL, "DAC" },
+};
+
+static struct snd_soc_codec_driver es7134_codec_driver = {
+        .component_driver = {
+                .dapm_widgets           = es7134_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(es7134_dapm_widgets),
+                .dapm_routes            = es7134_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(es7134_dapm_routes),
+        },
+};
+
+static int es7134_probe(struct platform_device *pdev)
+{
+        return snd_soc_register_codec(&pdev->dev,
+                                      &es7134_codec_driver,
+                                      &es7134_dai, 1);
+}
+
+static int es7134_remove(struct platform_device *pdev)
+{
+        snd_soc_unregister_codec(&pdev->dev);
+        return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id es7134_ids[] = {
+        { .compatible = "everest,es7134", },
+        { .compatible = "everest,es7144", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, es7134_ids);
+#endif
+
+static struct platform_driver es7134_driver = {
+        .driver = {
+                .name = "es7134",
+                .of_match_table = of_match_ptr(es7134_ids),
+        },
+        .probe = es7134_probe,
+        .remove = es7134_remove,
+};
+
+module_platform_driver(es7134_driver);
+
+MODULE_DESCRIPTION("ASoC ES7134 audio codec driver");
+MODULE_AUTHOR("Jerome Brunet <jbrunet@baylibre.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index 3f84fbd071e2..ed7cc42d1ee2 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -69,14 +69,10 @@ static const char * const supply_names[ES8328_SUPPLY_NUM] = {
         "HPVDD",
 };
 
-#define ES8328_RATES (SNDRV_PCM_RATE_96000 | \
-                SNDRV_PCM_RATE_48000 | \
-                SNDRV_PCM_RATE_44100 | \
-                SNDRV_PCM_RATE_32000 | \
-                SNDRV_PCM_RATE_22050 | \
-                SNDRV_PCM_RATE_16000 | \
-                SNDRV_PCM_RATE_11025 | \
-                SNDRV_PCM_RATE_8000)
+#define ES8328_RATES (SNDRV_PCM_RATE_192000 | \
+                SNDRV_PCM_RATE_96000 | \
+                SNDRV_PCM_RATE_88200 | \
+                SNDRV_PCM_RATE_8000_48000)
 #define ES8328_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | \
                 SNDRV_PCM_FMTBIT_S18_3LE | \
                 SNDRV_PCM_FMTBIT_S20_3LE | \
@@ -91,6 +87,7 @@ struct es8328_priv {
         int mclkdiv2;
         const struct snd_pcm_hw_constraint_list *sysclk_constraints;
         const int *mclk_ratios;
+        bool master;
         struct regulator_bulk_data supplies[ES8328_SUPPLY_NUM];
 };
 
@@ -469,7 +466,7 @@ static int es8328_startup(struct snd_pcm_substream *substream,
         struct snd_soc_codec *codec = dai->codec;
         struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
 
-        if (es8328->sysclk_constraints)
+        if (es8328->master && es8328->sysclk_constraints)
                 snd_pcm_hw_constraint_list(substream->runtime, 0,
                                 SNDRV_PCM_HW_PARAM_RATE,
                                 es8328->sysclk_constraints);
@@ -488,27 +485,34 @@ static int es8328_hw_params(struct snd_pcm_substream *substream,
         int wl;
         int ratio;
 
-        if (!es8328->sysclk_constraints) {
-                dev_err(codec->dev, "No MCLK configured\n");
-                return -EINVAL;
-        }
-
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 reg = ES8328_DACCONTROL2;
         else
                 reg = ES8328_ADCCONTROL5;
 
-        for (i = 0; i < es8328->sysclk_constraints->count; i++)
-                if (es8328->sysclk_constraints->list[i] == params_rate(params))
-                        break;
+        if (es8328->master) {
+                if (!es8328->sysclk_constraints) {
+                        dev_err(codec->dev, "No MCLK configured\n");
+                        return -EINVAL;
+                }
 
-        if (i == es8328->sysclk_constraints->count) {
-                dev_err(codec->dev, "LRCLK %d unsupported with current clock\n",
-                        params_rate(params));
-                return -EINVAL;
+                for (i = 0; i < es8328->sysclk_constraints->count; i++)
+                        if (es8328->sysclk_constraints->list[i] ==
+                            params_rate(params))
+                                break;
+
+                if (i == es8328->sysclk_constraints->count) {
+                        dev_err(codec->dev,
+                                "LRCLK %d unsupported with current clock\n",
+                                params_rate(params));
+                        return -EINVAL;
+                }
+                ratio = es8328->mclk_ratios[i];
+        } else {
+                ratio = 0;
+                es8328->mclkdiv2 = 0;
         }
 
-        ratio = es8328->mclk_ratios[i];
         snd_soc_update_bits(codec, ES8328_MASTERMODE,
                         ES8328_MASTERMODE_MCLKDIV2,
                         es8328->mclkdiv2 ? ES8328_MASTERMODE_MCLKDIV2 : 0);
@@ -586,6 +590,7 @@ static int es8328_set_dai_fmt(struct snd_soc_dai *codec_dai,
                 unsigned int fmt)
 {
         struct snd_soc_codec *codec = codec_dai->codec;
+        struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
         u8 dac_mode = 0;
         u8 adc_mode = 0;
 
@@ -595,11 +600,13 @@ static int es8328_set_dai_fmt(struct snd_soc_dai *codec_dai,
                 snd_soc_update_bits(codec, ES8328_MASTERMODE,
                                     ES8328_MASTERMODE_MSC,
                                     ES8328_MASTERMODE_MSC);
+                es8328->master = true;
                 break;
         case SND_SOC_DAIFMT_CBS_CFS:
                 /* Slave serial port mode */
                 snd_soc_update_bits(codec, ES8328_MASTERMODE,
                                     ES8328_MASTERMODE_MSC, 0);
+                es8328->master = false;
                 break;
         default:
                 return -EINVAL;
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 78fca8acd3ec..bc2e74ff3b2d 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -469,7 +469,7 @@ static int hdac_hdmi_set_hw_params(struct snd_pcm_substream *substream,
 
         format = snd_hdac_calc_stream_format(params_rate(hparams),
                         params_channels(hparams), params_format(hparams),
-                        24, 0);
+                        dai->driver->playback.sig_bits, 0);
 
         pcm = hdac_hdmi_get_pcm_from_cvt(hdmi, dai_map->cvt);
         if (!pcm)
@@ -1419,8 +1419,8 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdac,
                 hdmi_dais[i].playback.rate_min = rate_min;
                 hdmi_dais[i].playback.channels_min = 2;
                 hdmi_dais[i].playback.channels_max = 2;
+                hdmi_dais[i].playback.sig_bits = bps;
                 hdmi_dais[i].ops = &hdmi_dai_ops;
-
                 i++;
         }
 
@@ -1534,21 +1534,20 @@ static void hdac_hdmi_eld_notify_cb(void *aptr, int port, int pipe)
                         pin->mst_capable = false;
                         /* if not MST, default is port[0] */
                         hport = &pin->ports[0];
-                        goto out;
                 } else {
                         for (i = 0; i < pin->num_ports; i++) {
                                 pin->mst_capable = true;
                                 if (pin->ports[i].id == pipe) {
                                         hport = &pin->ports[i];
-                                        goto out;
+                                        break;
                                 }
                         }
                 }
+
+                if (hport)
+                        hdac_hdmi_present_sense(pin, hport);
         }
 
-out:
-        if (pin && hport)
-                hdac_hdmi_present_sense(pin, hport);
 }
 
 static struct i915_audio_component_audio_ops aops = {
@@ -1998,7 +1997,7 @@ static int hdac_hdmi_dev_remove(struct hdac_ext_device *edev)
         struct hdac_hdmi_pin *pin, *pin_next;
         struct hdac_hdmi_cvt *cvt, *cvt_next;
         struct hdac_hdmi_pcm *pcm, *pcm_next;
-        struct hdac_hdmi_port *port;
+        struct hdac_hdmi_port *port, *port_next;
         int i;
 
         snd_soc_unregister_codec(&edev->hdac.dev);
@@ -2008,8 +2007,9 @@ static int hdac_hdmi_dev_remove(struct hdac_ext_device *edev)
                 if (list_empty(&pcm->port_list))
                         continue;
 
-                list_for_each_entry(port, &pcm->port_list, head)
-                        port = NULL;
+                list_for_each_entry_safe(port, port_next,
+                                        &pcm->port_list, head)
+                        list_del(&port->head);
 
                 list_del(&pcm->head);
                 kfree(pcm);
diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c
index 6cdf15ab46de..0247edc9c84e 100644
--- a/sound/soc/codecs/max9867.c
+++ b/sound/soc/codecs/max9867.c
@@ -516,13 +516,13 @@ static const struct i2c_device_id max9867_i2c_id[] = {
         { "max9867", 0 },
         { }
 };
+MODULE_DEVICE_TABLE(i2c, max9867_i2c_id);
 
 static const struct of_device_id max9867_of_match[] = {
         { .compatible = "maxim,max9867", },
         { }
 };
-
-MODULE_DEVICE_TABLE(i2c, max9867_i2c_id);
+MODULE_DEVICE_TABLE(of, max9867_of_match);
 
 static const struct dev_pm_ops max9867_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(max9867_suspend, max9867_resume)
diff --git a/sound/soc/codecs/max98927.c b/sound/soc/codecs/max98927.c
new file mode 100644
index 000000000000..b5ee29499e16
--- /dev/null
+++ b/sound/soc/codecs/max98927.c
@@ -0,0 +1,841 @@
+/*
+ * max98927.c  --  MAX98927 ALSA Soc Audio driver
+ *
+ * Copyright (C) 2016 Maxim Integrated Products
+ * Author: Ryan Lee <ryans.lee@maximintegrated.com>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ */
+
+#include <linux/acpi.h>
+#include <linux/i2c.h>
+#include <linux/module.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <sound/tlv.h>
+#include "max98927.h"
+
+static struct reg_default max98927_reg[] = {
+        {MAX98927_R0001_INT_RAW1,  0x00},
+        {MAX98927_R0002_INT_RAW2,  0x00},
+        {MAX98927_R0003_INT_RAW3,  0x00},
+        {MAX98927_R0004_INT_STATE1,  0x00},
+        {MAX98927_R0005_INT_STATE2,  0x00},
+        {MAX98927_R0006_INT_STATE3,  0x00},
+        {MAX98927_R0007_INT_FLAG1,  0x00},
+        {MAX98927_R0008_INT_FLAG2,  0x00},
+        {MAX98927_R0009_INT_FLAG3,  0x00},
+        {MAX98927_R000A_INT_EN1,  0x00},
+        {MAX98927_R000B_INT_EN2,  0x00},
+        {MAX98927_R000C_INT_EN3,  0x00},
+        {MAX98927_R000D_INT_FLAG_CLR1,  0x00},
+        {MAX98927_R000E_INT_FLAG_CLR2,  0x00},
+        {MAX98927_R000F_INT_FLAG_CLR3,  0x00},
+        {MAX98927_R0010_IRQ_CTRL,  0x00},
+        {MAX98927_R0011_CLK_MON,  0x00},
+        {MAX98927_R0012_WDOG_CTRL,  0x00},
+        {MAX98927_R0013_WDOG_RST,  0x00},
+        {MAX98927_R0014_MEAS_ADC_THERM_WARN_THRESH,  0x00},
+        {MAX98927_R0015_MEAS_ADC_THERM_SHDN_THRESH,  0x00},
+        {MAX98927_R0016_MEAS_ADC_THERM_HYSTERESIS,  0x00},
+        {MAX98927_R0017_PIN_CFG,  0x55},
+        {MAX98927_R0018_PCM_RX_EN_A,  0x00},
+        {MAX98927_R0019_PCM_RX_EN_B,  0x00},
+        {MAX98927_R001A_PCM_TX_EN_A,  0x00},
+        {MAX98927_R001B_PCM_TX_EN_B,  0x00},
+        {MAX98927_R001C_PCM_TX_HIZ_CTRL_A,  0x00},
+        {MAX98927_R001D_PCM_TX_HIZ_CTRL_B,  0x00},
+        {MAX98927_R001E_PCM_TX_CH_SRC_A,  0x00},
+        {MAX98927_R001F_PCM_TX_CH_SRC_B,  0x00},
+        {MAX98927_R0020_PCM_MODE_CFG,  0x40},
+        {MAX98927_R0021_PCM_MASTER_MODE,  0x00},
+        {MAX98927_R0022_PCM_CLK_SETUP,  0x22},
+        {MAX98927_R0023_PCM_SR_SETUP1,  0x00},
+        {MAX98927_R0024_PCM_SR_SETUP2,  0x00},
+        {MAX98927_R0025_PCM_TO_SPK_MONOMIX_A,  0x00},
+        {MAX98927_R0026_PCM_TO_SPK_MONOMIX_B,  0x00},
+        {MAX98927_R0027_ICC_RX_EN_A,  0x00},
+        {MAX98927_R0028_ICC_RX_EN_B,  0x00},
+        {MAX98927_R002B_ICC_TX_EN_A,  0x00},
+        {MAX98927_R002C_ICC_TX_EN_B,  0x00},
+        {MAX98927_R002E_ICC_HIZ_MANUAL_MODE,  0x00},
+        {MAX98927_R002F_ICC_TX_HIZ_EN_A,  0x00},
+        {MAX98927_R0030_ICC_TX_HIZ_EN_B,  0x00},
+        {MAX98927_R0031_ICC_LNK_EN,  0x00},
+        {MAX98927_R0032_PDM_TX_EN,  0x00},
+        {MAX98927_R0033_PDM_TX_HIZ_CTRL,  0x00},
+        {MAX98927_R0034_PDM_TX_CTRL,  0x00},
+        {MAX98927_R0035_PDM_RX_CTRL,  0x00},
+        {MAX98927_R0036_AMP_VOL_CTRL,  0x00},
+        {MAX98927_R0037_AMP_DSP_CFG,  0x02},
+        {MAX98927_R0038_TONE_GEN_DC_CFG,  0x00},
+        {MAX98927_R0039_DRE_CTRL,  0x01},
+        {MAX98927_R003A_AMP_EN,  0x00},
+        {MAX98927_R003B_SPK_SRC_SEL,  0x00},
+        {MAX98927_R003C_SPK_GAIN,  0x00},
+        {MAX98927_R003D_SSM_CFG,  0x01},
+        {MAX98927_R003E_MEAS_EN,  0x00},
+        {MAX98927_R003F_MEAS_DSP_CFG,  0x04},
+        {MAX98927_R0040_BOOST_CTRL0,  0x00},
+        {MAX98927_R0041_BOOST_CTRL3,  0x00},
+        {MAX98927_R0042_BOOST_CTRL1,  0x00},
+        {MAX98927_R0043_MEAS_ADC_CFG,  0x00},
+        {MAX98927_R0044_MEAS_ADC_BASE_MSB,  0x00},
+        {MAX98927_R0045_MEAS_ADC_BASE_LSB,  0x00},
+        {MAX98927_R0046_ADC_CH0_DIVIDE,  0x00},
+        {MAX98927_R0047_ADC_CH1_DIVIDE,  0x00},
+        {MAX98927_R0048_ADC_CH2_DIVIDE,  0x00},
+        {MAX98927_R0049_ADC_CH0_FILT_CFG,  0x00},
+        {MAX98927_R004A_ADC_CH1_FILT_CFG,  0x00},
+        {MAX98927_R004B_ADC_CH2_FILT_CFG,  0x00},
+        {MAX98927_R004C_MEAS_ADC_CH0_READ,  0x00},
+        {MAX98927_R004D_MEAS_ADC_CH1_READ,  0x00},
+        {MAX98927_R004E_MEAS_ADC_CH2_READ,  0x00},
+        {MAX98927_R0051_BROWNOUT_STATUS,  0x00},
+        {MAX98927_R0052_BROWNOUT_EN,  0x00},
+        {MAX98927_R0053_BROWNOUT_INFINITE_HOLD,  0x00},
+        {MAX98927_R0054_BROWNOUT_INFINITE_HOLD_CLR,  0x00},
+        {MAX98927_R0055_BROWNOUT_LVL_HOLD,  0x00},
+        {MAX98927_R005A_BROWNOUT_LVL1_THRESH,  0x00},
+        {MAX98927_R005B_BROWNOUT_LVL2_THRESH,  0x00},
+        {MAX98927_R005C_BROWNOUT_LVL3_THRESH,  0x00},
+        {MAX98927_R005D_BROWNOUT_LVL4_THRESH,  0x00},
+        {MAX98927_R005E_BROWNOUT_THRESH_HYSTERYSIS,  0x00},
+        {MAX98927_R005F_BROWNOUT_AMP_LIMITER_ATK_REL,  0x00},
+        {MAX98927_R0060_BROWNOUT_AMP_GAIN_ATK_REL,  0x00},
+        {MAX98927_R0061_BROWNOUT_AMP1_CLIP_MODE,  0x00},
+        {MAX98927_R0072_BROWNOUT_LVL1_CUR_LIMIT,  0x00},
+        {MAX98927_R0073_BROWNOUT_LVL1_AMP1_CTRL1,  0x00},
+        {MAX98927_R0074_BROWNOUT_LVL1_AMP1_CTRL2,  0x00},
+        {MAX98927_R0075_BROWNOUT_LVL1_AMP1_CTRL3,  0x00},
+        {MAX98927_R0076_BROWNOUT_LVL2_CUR_LIMIT,  0x00},
+        {MAX98927_R0077_BROWNOUT_LVL2_AMP1_CTRL1,  0x00},
+        {MAX98927_R0078_BROWNOUT_LVL2_AMP1_CTRL2,  0x00},
+        {MAX98927_R0079_BROWNOUT_LVL2_AMP1_CTRL3,  0x00},
+        {MAX98927_R007A_BROWNOUT_LVL3_CUR_LIMIT,  0x00},
+        {MAX98927_R007B_BROWNOUT_LVL3_AMP1_CTRL1,  0x00},
+        {MAX98927_R007C_BROWNOUT_LVL3_AMP1_CTRL2,  0x00},
+        {MAX98927_R007D_BROWNOUT_LVL3_AMP1_CTRL3,  0x00},
+        {MAX98927_R007E_BROWNOUT_LVL4_CUR_LIMIT,  0x00},
+        {MAX98927_R007F_BROWNOUT_LVL4_AMP1_CTRL1,  0x00},
+        {MAX98927_R0080_BROWNOUT_LVL4_AMP1_CTRL2,  0x00},
+        {MAX98927_R0081_BROWNOUT_LVL4_AMP1_CTRL3,  0x00},
+        {MAX98927_R0082_ENV_TRACK_VOUT_HEADROOM,  0x00},
+        {MAX98927_R0083_ENV_TRACK_BOOST_VOUT_DELAY,  0x00},
+        {MAX98927_R0084_ENV_TRACK_REL_RATE,  0x00},
+        {MAX98927_R0085_ENV_TRACK_HOLD_RATE,  0x00},
+        {MAX98927_R0086_ENV_TRACK_CTRL,  0x00},
+        {MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ,  0x00},
+        {MAX98927_R00FF_GLOBAL_SHDN,  0x00},
+        {MAX98927_R0100_SOFT_RESET,  0x00},
+        {MAX98927_R01FF_REV_ID,  0x40},
+};
+
+static int max98927_dai_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+        unsigned int mode = 0;
+        unsigned int format = 0;
+        unsigned int invert = 0;
+
+        dev_dbg(codec->dev, "%s: fmt 0x%08X\n", __func__, fmt);
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBS_CFS:
+                mode = MAX98927_PCM_MASTER_MODE_SLAVE;
+                break;
+        case SND_SOC_DAIFMT_CBM_CFM:
+                max98927->master = true;
+                mode = MAX98927_PCM_MASTER_MODE_MASTER;
+                break;
+        default:
+                dev_err(codec->dev, "DAI clock mode unsupported");
+                return -EINVAL;
+        }
+
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0021_PCM_MASTER_MODE,
+                MAX98927_PCM_MASTER_MODE_MASK,
+                mode);
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                invert = MAX98927_PCM_MODE_CFG_PCM_BCLKEDGE;
+                break;
+        default:
+                dev_err(codec->dev, "DAI invert mode unsupported");
+                return -EINVAL;
+        }
+
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0020_PCM_MODE_CFG,
+                MAX98927_PCM_MODE_CFG_PCM_BCLKEDGE,
+                invert);
+
+        /* interface format */
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                max98927->iface |= SND_SOC_DAIFMT_I2S;
+                format = MAX98927_PCM_FORMAT_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                max98927->iface |= SND_SOC_DAIFMT_LEFT_J;
+                format = MAX98927_PCM_FORMAT_LJ;
+                break;
+        case SND_SOC_DAIFMT_PDM:
+                max98927->iface |= SND_SOC_DAIFMT_PDM;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* pcm channel configuration */
+        if (max98927->iface & (SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_LEFT_J)) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0018_PCM_RX_EN_A,
+                        MAX98927_PCM_RX_CH0_EN | MAX98927_PCM_RX_CH1_EN,
+                        MAX98927_PCM_RX_CH0_EN | MAX98927_PCM_RX_CH1_EN);
+
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0020_PCM_MODE_CFG,
+                        MAX98927_PCM_MODE_CFG_FORMAT_MASK,
+                        format << MAX98927_PCM_MODE_CFG_FORMAT_SHIFT);
+
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003B_SPK_SRC_SEL,
+                        MAX98927_SPK_SRC_MASK, 0);
+
+        } else
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0018_PCM_RX_EN_A,
+                        MAX98927_PCM_RX_CH0_EN | MAX98927_PCM_RX_CH1_EN, 0);
+
+        /* pdm channel configuration */
+        if (max98927->iface & SND_SOC_DAIFMT_PDM) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0035_PDM_RX_CTRL,
+                        MAX98927_PDM_RX_EN_MASK, 1);
+
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003B_SPK_SRC_SEL,
+                        MAX98927_SPK_SRC_MASK, 3);
+        } else
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0035_PDM_RX_CTRL,
+                        MAX98927_PDM_RX_EN_MASK, 0);
+        return 0;
+}
+
+/* codec MCLK rate in master mode */
+static const int rate_table[] = {
+        5644800, 6000000, 6144000, 6500000,
+        9600000, 11289600, 12000000, 12288000,
+        13000000, 19200000,
+};
+
+static int max98927_set_clock(struct max98927_priv *max98927,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_codec *codec = max98927->codec;
+        /* BCLK/LRCLK ratio calculation */
+        int blr_clk_ratio = params_channels(params) * max98927->ch_size;
+        int value;
+
+        if (max98927->master) {
+                int i;
+                /* match rate to closest value */
+                for (i = 0; i < ARRAY_SIZE(rate_table); i++) {
+                        if (rate_table[i] >= max98927->sysclk)
+                                break;
+                }
+                if (i == ARRAY_SIZE(rate_table)) {
+                        dev_err(codec->dev, "failed to find proper clock rate.\n");
+                        return -EINVAL;
+                }
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0021_PCM_MASTER_MODE,
+                        MAX98927_PCM_MASTER_MODE_MCLK_MASK,
+                        i << MAX98927_PCM_MASTER_MODE_MCLK_RATE_SHIFT);
+        }
+
+        switch (blr_clk_ratio) {
+        case 32:
+                value = 2;
+                break;
+        case 48:
+                value = 3;
+                break;
+        case 64:
+                value = 4;
+                break;
+        default:
+                return -EINVAL;
+        }
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0022_PCM_CLK_SETUP,
+                MAX98927_PCM_CLK_SETUP_BSEL_MASK,
+                value);
+        return 0;
+}
+
+static int max98927_dai_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params,
+        struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+        unsigned int sampling_rate = 0;
+        unsigned int chan_sz = 0;
+
+        /* pcm mode configuration */
+        switch (snd_pcm_format_width(params_format(params))) {
+        case 16:
+                chan_sz = MAX98927_PCM_MODE_CFG_CHANSZ_16;
+                break;
+        case 24:
+                chan_sz = MAX98927_PCM_MODE_CFG_CHANSZ_24;
+                break;
+        case 32:
+                chan_sz = MAX98927_PCM_MODE_CFG_CHANSZ_32;
+                break;
+        default:
+                dev_err(codec->dev, "format unsupported %d",
+                        params_format(params));
+                goto err;
+        }
+
+        max98927->ch_size = snd_pcm_format_width(params_format(params));
+
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0020_PCM_MODE_CFG,
+                MAX98927_PCM_MODE_CFG_CHANSZ_MASK, chan_sz);
+
+        dev_dbg(codec->dev, "format supported %d",
+                params_format(params));
+
+        /* sampling rate configuration */
+        switch (params_rate(params)) {
+        case 8000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_8000;
+                break;
+        case 11025:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_11025;
+                break;
+        case 12000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_12000;
+                break;
+        case 16000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_16000;
+                break;
+        case 22050:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_22050;
+                break;
+        case 24000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_24000;
+                break;
+        case 32000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_32000;
+                break;
+        case 44100:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_44100;
+                break;
+        case 48000:
+                sampling_rate = MAX98927_PCM_SR_SET1_SR_48000;
+                break;
+        default:
+                dev_err(codec->dev, "rate %d not supported\n",
+                        params_rate(params));
+                goto err;
+        }
+        /* set DAI_SR to correct LRCLK frequency */
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0023_PCM_SR_SETUP1,
+                MAX98927_PCM_SR_SET1_SR_MASK,
+                sampling_rate);
+        regmap_update_bits(max98927->regmap,
+                MAX98927_R0024_PCM_SR_SETUP2,
+                MAX98927_PCM_SR_SET2_SR_MASK,
+                sampling_rate << MAX98927_PCM_SR_SET2_SR_SHIFT);
+
+        /* set sampling rate of IV */
+        if (max98927->interleave_mode &&
+            sampling_rate > MAX98927_PCM_SR_SET1_SR_16000)
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0024_PCM_SR_SETUP2,
+                        MAX98927_PCM_SR_SET2_IVADC_SR_MASK,
+                        sampling_rate - 3);
+        else
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R0024_PCM_SR_SETUP2,
+                        MAX98927_PCM_SR_SET2_IVADC_SR_MASK,
+                        sampling_rate);
+        return max98927_set_clock(max98927, params);
+err:
+        return -EINVAL;
+}
+
+#define MAX98927_RATES SNDRV_PCM_RATE_8000_48000
+
+#define MAX98927_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | \
+        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+static int max98927_dai_set_sysclk(struct snd_soc_dai *dai,
+        int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+
+        max98927->sysclk = freq;
+        return 0;
+}
+
+static const struct snd_soc_dai_ops max98927_dai_ops = {
+        .set_sysclk = max98927_dai_set_sysclk,
+        .set_fmt = max98927_dai_set_fmt,
+        .hw_params = max98927_dai_hw_params,
+};
+
+static int max98927_dac_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003A_AMP_EN,
+                        MAX98927_AMP_EN_MASK, 1);
+                /* enable VMON and IMON */
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003E_MEAS_EN,
+                        MAX98927_MEAS_V_EN | MAX98927_MEAS_I_EN,
+                        MAX98927_MEAS_V_EN | MAX98927_MEAS_I_EN);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R00FF_GLOBAL_SHDN,
+                        MAX98927_GLOBAL_EN_MASK, 1);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R00FF_GLOBAL_SHDN,
+                        MAX98927_GLOBAL_EN_MASK, 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003A_AMP_EN,
+                        MAX98927_AMP_EN_MASK, 0);
+                /* disable VMON and IMON */
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R003E_MEAS_EN,
+                        MAX98927_MEAS_V_EN | MAX98927_MEAS_I_EN, 0);
+                break;
+        default:
+                return 0;
+        }
+        return 0;
+}
+
+static const char * const max98927_switch_text[] = {
+        "Left", "Right", "LeftRight"};
+
+static const struct soc_enum dai_sel_enum =
+        SOC_ENUM_SINGLE(MAX98927_R0025_PCM_TO_SPK_MONOMIX_A,
+                MAX98927_PCM_TO_SPK_MONOMIX_CFG_SHIFT,
+                3, max98927_switch_text);
+
+static const struct snd_kcontrol_new max98927_dai_controls =
+        SOC_DAPM_ENUM("DAI Sel", dai_sel_enum);
+
+static const struct snd_soc_dapm_widget max98927_dapm_widgets[] = {
+        SND_SOC_DAPM_AIF_IN("DAI_OUT", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_DAC_E("Amp Enable", "HiFi Playback", MAX98927_R003A_AMP_EN,
+                0, 0, max98927_dac_event,
+                SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_MUX("DAI Sel Mux", SND_SOC_NOPM, 0, 0,
+                &max98927_dai_controls),
+        SND_SOC_DAPM_OUTPUT("BE_OUT"),
+};
+
+static DECLARE_TLV_DB_SCALE(max98927_spk_tlv, 300, 300, 0);
+static DECLARE_TLV_DB_SCALE(max98927_digital_tlv, -1600, 25, 0);
+
+static bool max98927_readable_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case MAX98927_R0001_INT_RAW1 ... MAX98927_R0028_ICC_RX_EN_B:
+        case MAX98927_R002B_ICC_TX_EN_A ... MAX98927_R002C_ICC_TX_EN_B:
+        case MAX98927_R002E_ICC_HIZ_MANUAL_MODE
+                ... MAX98927_R004E_MEAS_ADC_CH2_READ:
+        case MAX98927_R0051_BROWNOUT_STATUS
+                ... MAX98927_R0055_BROWNOUT_LVL_HOLD:
+        case MAX98927_R005A_BROWNOUT_LVL1_THRESH
+                ... MAX98927_R0061_BROWNOUT_AMP1_CLIP_MODE:
+        case MAX98927_R0072_BROWNOUT_LVL1_CUR_LIMIT
+                ... MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ:
+        case MAX98927_R00FF_GLOBAL_SHDN:
+        case MAX98927_R0100_SOFT_RESET:
+        case MAX98927_R01FF_REV_ID:
+                return true;
+        default:
+                return false;
+        }
+};
+
+static bool max98927_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case MAX98927_R0001_INT_RAW1 ... MAX98927_R0009_INT_FLAG3:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const char * const max98927_boost_voltage_text[] = {
+        "6.5V", "6.625V", "6.75V", "6.875V", "7V", "7.125V", "7.25V", "7.375V",
+        "7.5V", "7.625V", "7.75V", "7.875V", "8V", "8.125V", "8.25V", "8.375V",
+        "8.5V", "8.625V", "8.75V", "8.875V", "9V", "9.125V", "9.25V", "9.375V",
+        "9.5V", "9.625V", "9.75V", "9.875V", "10V"
+};
+
+static SOC_ENUM_SINGLE_DECL(max98927_boost_voltage,
+                MAX98927_R0040_BOOST_CTRL0, 0,
+                max98927_boost_voltage_text);
+
+static const char * const max98927_current_limit_text[] = {
+        "1.00A", "1.10A", "1.20A", "1.30A", "1.40A", "1.50A", "1.60A", "1.70A",
+        "1.80A", "1.90A", "2.00A", "2.10A", "2.20A", "2.30A", "2.40A", "2.50A",
+        "2.60A", "2.70A", "2.80A", "2.90A", "3.00A", "3.10A", "3.20A", "3.30A",
+        "3.40A", "3.50A", "3.60A", "3.70A", "3.80A", "3.90A", "4.00A", "4.10A"
+};
+
+static SOC_ENUM_SINGLE_DECL(max98927_current_limit,
+                MAX98927_R0042_BOOST_CTRL1, 1,
+                max98927_current_limit_text);
+
+static const struct snd_kcontrol_new max98927_snd_controls[] = {
+        SOC_SINGLE_TLV("Speaker Volume", MAX98927_R003C_SPK_GAIN,
+                0, 6, 0,
+                max98927_spk_tlv),
+        SOC_SINGLE_TLV("Digital Volume", MAX98927_R0036_AMP_VOL_CTRL,
+                0, (1<<MAX98927_AMP_VOL_WIDTH)-1, 0,
+                max98927_digital_tlv),
+        SOC_SINGLE("Amp DSP Switch", MAX98927_R0052_BROWNOUT_EN,
+                MAX98927_BROWNOUT_DSP_SHIFT, 1, 0),
+        SOC_SINGLE("Ramp Switch", MAX98927_R0037_AMP_DSP_CFG,
+                MAX98927_AMP_DSP_CFG_RMP_SHIFT, 1, 0),
+        SOC_SINGLE("DRE Switch", MAX98927_R0039_DRE_CTRL,
+                MAX98927_DRE_EN_SHIFT, 1, 0),
+        SOC_SINGLE("Volume Location Switch", MAX98927_R0036_AMP_VOL_CTRL,
+                MAX98927_AMP_VOL_SEL_SHIFT, 1, 0),
+        SOC_ENUM("Boost Output Voltage", max98927_boost_voltage),
+        SOC_ENUM("Current Limit", max98927_current_limit),
+};
+
+static const struct snd_soc_dapm_route max98927_audio_map[] = {
+        {"Amp Enable", NULL, "DAI_OUT"},
+        {"DAI Sel Mux", "Left", "Amp Enable"},
+        {"DAI Sel Mux", "Right", "Amp Enable"},
+        {"DAI Sel Mux", "LeftRight", "Amp Enable"},
+        {"BE_OUT", NULL, "DAI Sel Mux"},
+};
+
+static struct snd_soc_dai_driver max98927_dai[] = {
+        {
+                .name = "max98927-aif1",
+                .playback = {
+                        .stream_name = "HiFi Playback",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = MAX98927_RATES,
+                        .formats = MAX98927_FORMATS,
+                },
+                .capture = {
+                        .stream_name = "HiFi Capture",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = MAX98927_RATES,
+                        .formats = MAX98927_FORMATS,
+                },
+                .ops = &max98927_dai_ops,
+        }
+};
+
+static int max98927_probe(struct snd_soc_codec *codec)
+{
+        struct max98927_priv *max98927 = snd_soc_codec_get_drvdata(codec);
+
+        max98927->codec = codec;
+        codec->control_data = max98927->regmap;
+        codec->cache_bypass = 1;
+
+        /* Software Reset */
+        regmap_write(max98927->regmap,
+                MAX98927_R0100_SOFT_RESET, MAX98927_SOFT_RESET);
+
+        /* IV default slot configuration */
+        regmap_write(max98927->regmap,
+                MAX98927_R001C_PCM_TX_HIZ_CTRL_A,
+                0xFF);
+        regmap_write(max98927->regmap,
+                MAX98927_R001D_PCM_TX_HIZ_CTRL_B,
+                0xFF);
+        regmap_write(max98927->regmap,
+                MAX98927_R0025_PCM_TO_SPK_MONOMIX_A,
+                0x80);
+        regmap_write(max98927->regmap,
+                MAX98927_R0026_PCM_TO_SPK_MONOMIX_B,
+                0x1);
+        /* Set inital volume (+13dB) */
+        regmap_write(max98927->regmap,
+                MAX98927_R0036_AMP_VOL_CTRL,
+                0x38);
+        regmap_write(max98927->regmap,
+                MAX98927_R003C_SPK_GAIN,
+                0x05);
+        /* Enable DC blocker */
+        regmap_write(max98927->regmap,
+                MAX98927_R0037_AMP_DSP_CFG,
+                0x03);
+        /* Enable IMON VMON DC blocker */
+        regmap_write(max98927->regmap,
+                MAX98927_R003F_MEAS_DSP_CFG,
+                0xF7);
+        /* Boost Output Voltage & Current limit */
+        regmap_write(max98927->regmap,
+                MAX98927_R0040_BOOST_CTRL0,
+                0x1C);
+        regmap_write(max98927->regmap,
+                MAX98927_R0042_BOOST_CTRL1,
+                0x3E);
+        /* Measurement ADC config */
+        regmap_write(max98927->regmap,
+                MAX98927_R0043_MEAS_ADC_CFG,
+                0x04);
+        regmap_write(max98927->regmap,
+                MAX98927_R0044_MEAS_ADC_BASE_MSB,
+                0x00);
+        regmap_write(max98927->regmap,
+                MAX98927_R0045_MEAS_ADC_BASE_LSB,
+                0x24);
+        /* Brownout Level */
+        regmap_write(max98927->regmap,
+                MAX98927_R007F_BROWNOUT_LVL4_AMP1_CTRL1,
+                0x06);
+        /* Envelope Tracking configuration */
+        regmap_write(max98927->regmap,
+                MAX98927_R0082_ENV_TRACK_VOUT_HEADROOM,
+                0x08);
+        regmap_write(max98927->regmap,
+                MAX98927_R0086_ENV_TRACK_CTRL,
+                0x01);
+        regmap_write(max98927->regmap,
+                MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ,
+                0x10);
+
+        /* voltage, current slot configuration */
+        regmap_write(max98927->regmap,
+                MAX98927_R001E_PCM_TX_CH_SRC_A,
+                (max98927->i_l_slot<<MAX98927_PCM_TX_CH_SRC_A_I_SHIFT|
+                max98927->v_l_slot)&0xFF);
+
+        if (max98927->v_l_slot < 8) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001C_PCM_TX_HIZ_CTRL_A,
+                        1 << max98927->v_l_slot, 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001A_PCM_TX_EN_A,
+                        1 << max98927->v_l_slot,
+                        1 << max98927->v_l_slot);
+        } else {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001D_PCM_TX_HIZ_CTRL_B,
+                        1 << (max98927->v_l_slot - 8), 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001B_PCM_TX_EN_B,
+                        1 << (max98927->v_l_slot - 8),
+                        1 << (max98927->v_l_slot - 8));
+        }
+
+        if (max98927->i_l_slot < 8) {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001C_PCM_TX_HIZ_CTRL_A,
+                        1 << max98927->i_l_slot, 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001A_PCM_TX_EN_A,
+                        1 << max98927->i_l_slot,
+                        1 << max98927->i_l_slot);
+        } else {
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001D_PCM_TX_HIZ_CTRL_B,
+                        1 << (max98927->i_l_slot - 8), 0);
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001B_PCM_TX_EN_B,
+                        1 << (max98927->i_l_slot - 8),
+                        1 << (max98927->i_l_slot - 8));
+        }
+
+        /* Set interleave mode */
+        if (max98927->interleave_mode)
+                regmap_update_bits(max98927->regmap,
+                        MAX98927_R001F_PCM_TX_CH_SRC_B,
+                        MAX98927_PCM_TX_CH_INTERLEAVE_MASK,
+                        MAX98927_PCM_TX_CH_INTERLEAVE_MASK);
+        return 0;
+}
+
+static const struct snd_soc_codec_driver soc_codec_dev_max98927 = {
+        .probe = max98927_probe,
+        .component_driver = {
+                .controls = max98927_snd_controls,
+                .num_controls = ARRAY_SIZE(max98927_snd_controls),
+                .dapm_widgets = max98927_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(max98927_dapm_widgets),
+                .dapm_routes = max98927_audio_map,
+                .num_dapm_routes = ARRAY_SIZE(max98927_audio_map),
+        },
+};
+
+static const struct regmap_config max98927_regmap = {
+        .reg_bits         = 16,
+        .val_bits         = 8,
+        .max_register     = MAX98927_R01FF_REV_ID,
+        .reg_defaults     = max98927_reg,
+        .num_reg_defaults = ARRAY_SIZE(max98927_reg),
+        .readable_reg     = max98927_readable_register,
+        .volatile_reg     = max98927_volatile_reg,
+        .cache_type       = REGCACHE_RBTREE,
+};
+
+static void max98927_slot_config(struct i2c_client *i2c,
+        struct max98927_priv *max98927)
+{
+        int value;
+
+        if (!of_property_read_u32(i2c->dev.of_node,
+                "vmon-slot-no", &value))
+                max98927->v_l_slot = value & 0xF;
+        else
+                max98927->v_l_slot = 0;
+        if (!of_property_read_u32(i2c->dev.of_node,
+                "imon-slot-no", &value))
+                max98927->i_l_slot = value & 0xF;
+        else
+                max98927->i_l_slot = 1;
+}
+
+static int max98927_i2c_probe(struct i2c_client *i2c,
+        const struct i2c_device_id *id)
+{
+
+        int ret = 0, value;
+        int reg = 0;
+        struct max98927_priv *max98927 = NULL;
+
+        max98927 = devm_kzalloc(&i2c->dev,
+                sizeof(*max98927), GFP_KERNEL);
+
+        if (!max98927) {
+                ret = -ENOMEM;
+                return ret;
+        }
+        i2c_set_clientdata(i2c, max98927);
+
+        /* update interleave mode info */
+        if (!of_property_read_u32(i2c->dev.of_node,
+                "interleave_mode", &value)) {
+                if (value > 0)
+                        max98927->interleave_mode = 1;
+                else
+                        max98927->interleave_mode = 0;
+        } else
+                max98927->interleave_mode = 0;
+
+        /* regmap initialization */
+        max98927->regmap
+                = devm_regmap_init_i2c(i2c, &max98927_regmap);
+        if (IS_ERR(max98927->regmap)) {
+                ret = PTR_ERR(max98927->regmap);
+                dev_err(&i2c->dev,
+                        "Failed to allocate regmap: %d\n", ret);
+                return ret;
+        }
+
+        /* Check Revision ID */
+        ret = regmap_read(max98927->regmap,
+                MAX98927_R01FF_REV_ID, &reg);
+        if (ret < 0) {
+                dev_err(&i2c->dev,
+                        "Failed to read: 0x%02X\n", MAX98927_R01FF_REV_ID);
+                return ret;
+        }
+        dev_info(&i2c->dev, "MAX98927 revisionID: 0x%02X\n", reg);
+
+        /* voltage/current slot configuration */
+        max98927_slot_config(i2c, max98927);
+
+        /* codec registeration */
+        ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_max98927,
+                max98927_dai, ARRAY_SIZE(max98927_dai));
+        if (ret < 0)
+                dev_err(&i2c->dev, "Failed to register codec: %d\n", ret);
+
+        return ret;
+}
+
+static int max98927_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct i2c_device_id max98927_i2c_id[] = {
+        { "max98927", 0},
+        { },
+};
+
+MODULE_DEVICE_TABLE(i2c, max98927_i2c_id);
+
+#if defined(CONFIG_OF)
+static const struct of_device_id max98927_of_match[] = {
+        { .compatible = "maxim,max98927", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, max98927_of_match);
+#endif
+
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id max98927_acpi_match[] = {
+        { "MX98927", 0 },
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, max98927_acpi_match);
+#endif
+
+static struct i2c_driver max98927_i2c_driver = {
+        .driver = {
+                .name = "max98927",
+                .of_match_table = of_match_ptr(max98927_of_match),
+                .acpi_match_table = ACPI_PTR(max98927_acpi_match),
+                .pm = NULL,
+        },
+        .probe  = max98927_i2c_probe,
+        .remove = max98927_i2c_remove,
+        .id_table = max98927_i2c_id,
+};
+
+module_i2c_driver(max98927_i2c_driver)
+
+MODULE_DESCRIPTION("ALSA SoC MAX98927 driver");
+MODULE_AUTHOR("Ryan Lee <ryans.lee@maximintegrated.com>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/max98927.h b/sound/soc/codecs/max98927.h
new file mode 100644
index 000000000000..ece6a608cbe1
--- /dev/null
+++ b/sound/soc/codecs/max98927.h
@@ -0,0 +1,272 @@
+/*
+ * max98927.h  --  MAX98927 ALSA Soc Audio driver
+ *
+ * Copyright 2013-15 Maxim Integrated Products
+ * Author: Ryan Lee <ryans.lee@maximintegrated.com>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+#ifndef _MAX98927_H
+#define _MAX98927_H
+
+/* Register Values */
+#define MAX98927_R0001_INT_RAW1 0x0001
+#define MAX98927_R0002_INT_RAW2 0x0002
+#define MAX98927_R0003_INT_RAW3 0x0003
+#define MAX98927_R0004_INT_STATE1 0x0004
+#define MAX98927_R0005_INT_STATE2 0x0005
+#define MAX98927_R0006_INT_STATE3 0x0006
+#define MAX98927_R0007_INT_FLAG1 0x0007
+#define MAX98927_R0008_INT_FLAG2 0x0008
+#define MAX98927_R0009_INT_FLAG3 0x0009
+#define MAX98927_R000A_INT_EN1 0x000A
+#define MAX98927_R000B_INT_EN2 0x000B
+#define MAX98927_R000C_INT_EN3 0x000C
+#define MAX98927_R000D_INT_FLAG_CLR1    0x000D
+#define MAX98927_R000E_INT_FLAG_CLR2    0x000E
+#define MAX98927_R000F_INT_FLAG_CLR3    0x000F
+#define MAX98927_R0010_IRQ_CTRL 0x0010
+#define MAX98927_R0011_CLK_MON 0x0011
+#define MAX98927_R0012_WDOG_CTRL 0x0012
+#define MAX98927_R0013_WDOG_RST 0x0013
+#define MAX98927_R0014_MEAS_ADC_THERM_WARN_THRESH 0x0014
+#define MAX98927_R0015_MEAS_ADC_THERM_SHDN_THRESH 0x0015
+#define MAX98927_R0016_MEAS_ADC_THERM_HYSTERESIS 0x0016
+#define MAX98927_R0017_PIN_CFG 0x0017
+#define MAX98927_R0018_PCM_RX_EN_A 0x0018
+#define MAX98927_R0019_PCM_RX_EN_B 0x0019
+#define MAX98927_R001A_PCM_TX_EN_A 0x001A
+#define MAX98927_R001B_PCM_TX_EN_B 0x001B
+#define MAX98927_R001C_PCM_TX_HIZ_CTRL_A 0x001C
+#define MAX98927_R001D_PCM_TX_HIZ_CTRL_B 0x001D
+#define MAX98927_R001E_PCM_TX_CH_SRC_A 0x001E
+#define MAX98927_R001F_PCM_TX_CH_SRC_B 0x001F
+#define MAX98927_R0020_PCM_MODE_CFG 0x0020
+#define MAX98927_R0021_PCM_MASTER_MODE 0x0021
+#define MAX98927_R0022_PCM_CLK_SETUP 0x0022
+#define MAX98927_R0023_PCM_SR_SETUP1 0x0023
+#define MAX98927_R0024_PCM_SR_SETUP2    0x0024
+#define MAX98927_R0025_PCM_TO_SPK_MONOMIX_A 0x0025
+#define MAX98927_R0026_PCM_TO_SPK_MONOMIX_B 0x0026
+#define MAX98927_R0027_ICC_RX_EN_A 0x0027
+#define MAX98927_R0028_ICC_RX_EN_B 0x0028
+#define MAX98927_R002B_ICC_TX_EN_A 0x002B
+#define MAX98927_R002C_ICC_TX_EN_B 0x002C
+#define MAX98927_R002E_ICC_HIZ_MANUAL_MODE 0x002E
+#define MAX98927_R002F_ICC_TX_HIZ_EN_A 0x002F
+#define MAX98927_R0030_ICC_TX_HIZ_EN_B 0x0030
+#define MAX98927_R0031_ICC_LNK_EN 0x0031
+#define MAX98927_R0032_PDM_TX_EN 0x0032
+#define MAX98927_R0033_PDM_TX_HIZ_CTRL 0x0033
+#define MAX98927_R0034_PDM_TX_CTRL 0x0034
+#define MAX98927_R0035_PDM_RX_CTRL 0x0035
+#define MAX98927_R0036_AMP_VOL_CTRL 0x0036
+#define MAX98927_R0037_AMP_DSP_CFG 0x0037
+#define MAX98927_R0038_TONE_GEN_DC_CFG 0x0038
+#define MAX98927_R0039_DRE_CTRL 0x0039
+#define MAX98927_R003A_AMP_EN 0x003A
+#define MAX98927_R003B_SPK_SRC_SEL 0x003B
+#define MAX98927_R003C_SPK_GAIN 0x003C
+#define MAX98927_R003D_SSM_CFG 0x003D
+#define MAX98927_R003E_MEAS_EN 0x003E
+#define MAX98927_R003F_MEAS_DSP_CFG 0x003F
+#define MAX98927_R0040_BOOST_CTRL0 0x0040
+#define MAX98927_R0041_BOOST_CTRL3 0x0041
+#define MAX98927_R0042_BOOST_CTRL1 0x0042
+#define MAX98927_R0043_MEAS_ADC_CFG 0x0043
+#define MAX98927_R0044_MEAS_ADC_BASE_MSB 0x0044
+#define MAX98927_R0045_MEAS_ADC_BASE_LSB 0x0045
+#define MAX98927_R0046_ADC_CH0_DIVIDE 0x0046
+#define MAX98927_R0047_ADC_CH1_DIVIDE 0x0047
+#define MAX98927_R0048_ADC_CH2_DIVIDE 0x0048
+#define MAX98927_R0049_ADC_CH0_FILT_CFG 0x0049
+#define MAX98927_R004A_ADC_CH1_FILT_CFG 0x004A
+#define MAX98927_R004B_ADC_CH2_FILT_CFG 0x004B
+#define MAX98927_R004C_MEAS_ADC_CH0_READ 0x004C
+#define MAX98927_R004D_MEAS_ADC_CH1_READ 0x004D
+#define MAX98927_R004E_MEAS_ADC_CH2_READ 0x004E
+#define MAX98927_R0051_BROWNOUT_STATUS 0x0051
+#define MAX98927_R0052_BROWNOUT_EN 0x0052
+#define MAX98927_R0053_BROWNOUT_INFINITE_HOLD 0x0053
+#define MAX98927_R0054_BROWNOUT_INFINITE_HOLD_CLR 0x0054
+#define MAX98927_R0055_BROWNOUT_LVL_HOLD 0x0055
+#define MAX98927_R005A_BROWNOUT_LVL1_THRESH 0x005A
+#define MAX98927_R005B_BROWNOUT_LVL2_THRESH 0x005B
+#define MAX98927_R005C_BROWNOUT_LVL3_THRESH 0x005C
+#define MAX98927_R005D_BROWNOUT_LVL4_THRESH 0x005D
+#define MAX98927_R005E_BROWNOUT_THRESH_HYSTERYSIS 0x005E
+#define MAX98927_R005F_BROWNOUT_AMP_LIMITER_ATK_REL 0x005F
+#define MAX98927_R0060_BROWNOUT_AMP_GAIN_ATK_REL 0x0060
+#define MAX98927_R0061_BROWNOUT_AMP1_CLIP_MODE 0x0061
+#define MAX98927_R0072_BROWNOUT_LVL1_CUR_LIMIT 0x0072
+#define MAX98927_R0073_BROWNOUT_LVL1_AMP1_CTRL1 0x0073
+#define MAX98927_R0074_BROWNOUT_LVL1_AMP1_CTRL2 0x0074
+#define MAX98927_R0075_BROWNOUT_LVL1_AMP1_CTRL3 0x0075
+#define MAX98927_R0076_BROWNOUT_LVL2_CUR_LIMIT 0x0076
+#define MAX98927_R0077_BROWNOUT_LVL2_AMP1_CTRL1 0x0077
+#define MAX98927_R0078_BROWNOUT_LVL2_AMP1_CTRL2 0x0078
+#define MAX98927_R0079_BROWNOUT_LVL2_AMP1_CTRL3 0x0079
+#define MAX98927_R007A_BROWNOUT_LVL3_CUR_LIMIT 0x007A
+#define MAX98927_R007B_BROWNOUT_LVL3_AMP1_CTRL1 0x007B
+#define MAX98927_R007C_BROWNOUT_LVL3_AMP1_CTRL2 0x007C
+#define MAX98927_R007D_BROWNOUT_LVL3_AMP1_CTRL3 0x007D
+#define MAX98927_R007E_BROWNOUT_LVL4_CUR_LIMIT 0x007E
+#define MAX98927_R007F_BROWNOUT_LVL4_AMP1_CTRL1 0x007F
+#define MAX98927_R0080_BROWNOUT_LVL4_AMP1_CTRL2 0x0080
+#define MAX98927_R0081_BROWNOUT_LVL4_AMP1_CTRL3 0x0081
+#define MAX98927_R0082_ENV_TRACK_VOUT_HEADROOM 0x0082
+#define MAX98927_R0083_ENV_TRACK_BOOST_VOUT_DELAY 0x0083
+#define MAX98927_R0084_ENV_TRACK_REL_RATE 0x0084
+#define MAX98927_R0085_ENV_TRACK_HOLD_RATE 0x0085
+#define MAX98927_R0086_ENV_TRACK_CTRL 0x0086
+#define MAX98927_R0087_ENV_TRACK_BOOST_VOUT_READ 0x0087
+#define MAX98927_R00FF_GLOBAL_SHDN 0x00FF
+#define MAX98927_R0100_SOFT_RESET 0x0100
+#define MAX98927_R01FF_REV_ID 0x01FF
+
+/* MAX98927_R0018_PCM_RX_EN_A */
+#define MAX98927_PCM_RX_CH0_EN (0x1 << 0)
+#define MAX98927_PCM_RX_CH1_EN (0x1 << 1)
+#define MAX98927_PCM_RX_CH2_EN (0x1 << 2)
+#define MAX98927_PCM_RX_CH3_EN (0x1 << 3)
+#define MAX98927_PCM_RX_CH4_EN (0x1 << 4)
+#define MAX98927_PCM_RX_CH5_EN (0x1 << 5)
+#define MAX98927_PCM_RX_CH6_EN (0x1 << 6)
+#define MAX98927_PCM_RX_CH7_EN (0x1 << 7)
+
+/* MAX98927_R001A_PCM_TX_EN_A */
+#define MAX98927_PCM_TX_CH0_EN (0x1 << 0)
+#define MAX98927_PCM_TX_CH1_EN (0x1 << 1)
+#define MAX98927_PCM_TX_CH2_EN (0x1 << 2)
+#define MAX98927_PCM_TX_CH3_EN (0x1 << 3)
+#define MAX98927_PCM_TX_CH4_EN (0x1 << 4)
+#define MAX98927_PCM_TX_CH5_EN (0x1 << 5)
+#define MAX98927_PCM_TX_CH6_EN (0x1 << 6)
+#define MAX98927_PCM_TX_CH7_EN (0x1 << 7)
+
+/* MAX98927_R001E_PCM_TX_CH_SRC_A */
+#define MAX98927_PCM_TX_CH_SRC_A_V_SHIFT (0)
+#define MAX98927_PCM_TX_CH_SRC_A_I_SHIFT (4)
+
+/* MAX98927_R001F_PCM_TX_CH_SRC_B */
+#define MAX98927_PCM_TX_CH_INTERLEAVE_MASK (0x1 << 5)
+
+/* MAX98927_R0020_PCM_MODE_CFG */
+#define MAX98927_PCM_MODE_CFG_PCM_BCLKEDGE (0x1 << 2)
+#define MAX98927_PCM_MODE_CFG_FORMAT_MASK (0x7 << 3)
+#define MAX98927_PCM_MODE_CFG_FORMAT_SHIFT (3)
+#define MAX98927_PCM_FORMAT_I2S (0x0 << 0)
+#define MAX98927_PCM_FORMAT_LJ (0x1 << 0)
+
+#define MAX98927_PCM_MODE_CFG_CHANSZ_MASK (0x3 << 6)
+#define MAX98927_PCM_MODE_CFG_CHANSZ_16 (0x1 << 6)
+#define MAX98927_PCM_MODE_CFG_CHANSZ_24 (0x2 << 6)
+#define MAX98927_PCM_MODE_CFG_CHANSZ_32 (0x3 << 6)
+
+/* MAX98927_R0021_PCM_MASTER_MODE */
+#define MAX98927_PCM_MASTER_MODE_MASK (0x3 << 0)
+#define MAX98927_PCM_MASTER_MODE_SLAVE (0x0 << 0)
+#define MAX98927_PCM_MASTER_MODE_MASTER (0x3 << 0)
+
+#define MAX98927_PCM_MASTER_MODE_MCLK_MASK (0xF << 2)
+#define MAX98927_PCM_MASTER_MODE_MCLK_RATE_SHIFT (2)
+
+/* MAX98927_R0022_PCM_CLK_SETUP */
+#define MAX98927_PCM_CLK_SETUP_BSEL_MASK (0xF << 0)
+
+/* MAX98927_R0023_PCM_SR_SETUP1 */
+#define MAX98927_PCM_SR_SET1_SR_MASK (0xF << 0)
+
+#define MAX98927_PCM_SR_SET1_SR_8000 (0x0 << 0)
+#define MAX98927_PCM_SR_SET1_SR_11025 (0x1 << 0)
+#define MAX98927_PCM_SR_SET1_SR_12000 (0x2 << 0)
+#define MAX98927_PCM_SR_SET1_SR_16000 (0x3 << 0)
+#define MAX98927_PCM_SR_SET1_SR_22050 (0x4 << 0)
+#define MAX98927_PCM_SR_SET1_SR_24000 (0x5 << 0)
+#define MAX98927_PCM_SR_SET1_SR_32000 (0x6 << 0)
+#define MAX98927_PCM_SR_SET1_SR_44100 (0x7 << 0)
+#define MAX98927_PCM_SR_SET1_SR_48000 (0x8 << 0)
+
+/* MAX98927_R0024_PCM_SR_SETUP2 */
+#define MAX98927_PCM_SR_SET2_SR_MASK (0xF << 4)
+#define MAX98927_PCM_SR_SET2_SR_SHIFT (4)
+#define MAX98927_PCM_SR_SET2_IVADC_SR_MASK (0xf << 0)
+
+/* MAX98927_R0025_PCM_TO_SPK_MONOMIX_A */
+#define MAX98927_PCM_TO_SPK_MONOMIX_CFG_MASK (0x3 << 6)
+#define MAX98927_PCM_TO_SPK_MONOMIX_CFG_SHIFT (6)
+
+/* MAX98927_R0035_PDM_RX_CTRL */
+#define MAX98927_PDM_RX_EN_MASK (0x1 << 0)
+
+/* MAX98927_R0036_AMP_VOL_CTRL */
+#define MAX98927_AMP_VOL_SEL (0x1 << 7)
+#define MAX98927_AMP_VOL_SEL_WIDTH (1)
+#define MAX98927_AMP_VOL_SEL_SHIFT (7)
+#define MAX98927_AMP_VOL_MASK (0x7f << 0)
+#define MAX98927_AMP_VOL_WIDTH (7)
+#define MAX98927_AMP_VOL_SHIFT (0)
+
+/* MAX98927_R0037_AMP_DSP_CFG */
+#define MAX98927_AMP_DSP_CFG_DCBLK_EN (0x1 << 0)
+#define MAX98927_AMP_DSP_CFG_DITH_EN (0x1 << 1)
+#define MAX98927_AMP_DSP_CFG_RMP_BYPASS (0x1 << 4)
+#define MAX98927_AMP_DSP_CFG_DAC_INV (0x1 << 5)
+#define MAX98927_AMP_DSP_CFG_RMP_SHIFT (4)
+
+/* MAX98927_R0039_DRE_CTRL */
+#define MAX98927_DRE_CTRL_DRE_EN        (0x1 << 0)
+#define MAX98927_DRE_EN_SHIFT 0x1
+
+/* MAX98927_R003A_AMP_EN */
+#define MAX98927_AMP_EN_MASK (0x1 << 0)
+
+/* MAX98927_R003B_SPK_SRC_SEL */
+#define MAX98927_SPK_SRC_MASK (0x3 << 0)
+
+/* MAX98927_R003C_SPK_GAIN */
+#define MAX98927_SPK_PCM_GAIN_MASK (0x7 << 0)
+#define MAX98927_SPK_PDM_GAIN_MASK (0x7 << 4)
+#define MAX98927_SPK_GAIN_WIDTH (3)
+
+/* MAX98927_R003E_MEAS_EN */
+#define MAX98927_MEAS_V_EN (0x1 << 0)
+#define MAX98927_MEAS_I_EN (0x1 << 1)
+
+/* MAX98927_R0040_BOOST_CTRL0 */
+#define MAX98927_BOOST_CTRL0_VOUT_MASK (0x1f << 0)
+#define MAX98927_BOOST_CTRL0_PVDD_MASK (0x1 << 7)
+#define MAX98927_BOOST_CTRL0_PVDD_EN_SHIFT (7)
+
+/* MAX98927_R0052_BROWNOUT_EN */
+#define MAX98927_BROWNOUT_BDE_EN (0x1 << 0)
+#define MAX98927_BROWNOUT_AMP_EN (0x1 << 1)
+#define MAX98927_BROWNOUT_DSP_EN (0x1 << 2)
+#define MAX98927_BROWNOUT_DSP_SHIFT (2)
+
+/* MAX98927_R0100_SOFT_RESET */
+#define MAX98927_SOFT_RESET (0x1 << 0)
+
+/* MAX98927_R00FF_GLOBAL_SHDN */
+#define MAX98927_GLOBAL_EN_MASK (0x1 << 0)
+
+struct max98927_priv {
+        struct regmap *regmap;
+        struct snd_soc_codec *codec;
+        struct max98927_pdata *pdata;
+        unsigned int spk_gain;
+        unsigned int sysclk;
+        unsigned int v_l_slot;
+        unsigned int i_l_slot;
+        bool interleave_mode;
+        unsigned int ch_size;
+        unsigned int rate;
+        unsigned int iface;
+        unsigned int master;
+        unsigned int digital_gain;
+};
+#endif
diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c
index 9e8f0f4aa51a..c8bcb1db966d 100644
--- a/sound/soc/codecs/nau8540.c
+++ b/sound/soc/codecs/nau8540.c
@@ -39,147 +39,147 @@
 
 /* scaling for mclk from sysclk_src output */
 static const struct nau8540_fll_attr mclk_src_scaling[] = {
-       { 1, 0x0 },
-       { 2, 0x2 },
-       { 4, 0x3 },
-       { 8, 0x4 },
-       { 16, 0x5 },
-       { 32, 0x6 },
-       { 3, 0x7 },
-       { 6, 0xa },
-       { 12, 0xb },
-       { 24, 0xc },
+        { 1, 0x0 },
+        { 2, 0x2 },
+        { 4, 0x3 },
+        { 8, 0x4 },
+        { 16, 0x5 },
+        { 32, 0x6 },
+        { 3, 0x7 },
+        { 6, 0xa },
+        { 12, 0xb },
+        { 24, 0xc },
 };
 
 /* ratio for input clk freq */
 static const struct nau8540_fll_attr fll_ratio[] = {
-       { 512000, 0x01 },
-       { 256000, 0x02 },
-       { 128000, 0x04 },
-       { 64000, 0x08 },
-       { 32000, 0x10 },
-       { 8000, 0x20 },
-       { 4000, 0x40 },
+        { 512000, 0x01 },
+        { 256000, 0x02 },
+        { 128000, 0x04 },
+        { 64000, 0x08 },
+        { 32000, 0x10 },
+        { 8000, 0x20 },
+        { 4000, 0x40 },
 };
 
 static const struct nau8540_fll_attr fll_pre_scalar[] = {
-       { 1, 0x0 },
-       { 2, 0x1 },
-       { 4, 0x2 },
-       { 8, 0x3 },
+        { 1, 0x0 },
+        { 2, 0x1 },
+        { 4, 0x2 },
+        { 8, 0x3 },
 };
 
 /* over sampling rate */
 static const struct nau8540_osr_attr osr_adc_sel[] = {
-       { 32, 3 },      /* OSR 32, SRC 1/8 */
-       { 64, 2 },      /* OSR 64, SRC 1/4 */
-       { 128, 1 },     /* OSR 128, SRC 1/2 */
-       { 256, 0 },     /* OSR 256, SRC 1 */
+        { 32, 3 },      /* OSR 32, SRC 1/8 */
+        { 64, 2 },      /* OSR 64, SRC 1/4 */
+        { 128, 1 },     /* OSR 128, SRC 1/2 */
+        { 256, 0 },     /* OSR 256, SRC 1 */
 };
 
 static const struct reg_default nau8540_reg_defaults[] = {
-       {NAU8540_REG_POWER_MANAGEMENT, 0x0000},
-       {NAU8540_REG_CLOCK_CTRL, 0x0000},
-       {NAU8540_REG_CLOCK_SRC, 0x0000},
-       {NAU8540_REG_FLL1, 0x0001},
-       {NAU8540_REG_FLL2, 0x3126},
-       {NAU8540_REG_FLL3, 0x0008},
-       {NAU8540_REG_FLL4, 0x0010},
-       {NAU8540_REG_FLL5, 0xC000},
-       {NAU8540_REG_FLL6, 0x6000},
-       {NAU8540_REG_FLL_VCO_RSV, 0xF13C},
-       {NAU8540_REG_PCM_CTRL0, 0x000B},
-       {NAU8540_REG_PCM_CTRL1, 0x3010},
-       {NAU8540_REG_PCM_CTRL2, 0x0800},
-       {NAU8540_REG_PCM_CTRL3, 0x0000},
-       {NAU8540_REG_PCM_CTRL4, 0x000F},
-       {NAU8540_REG_ALC_CONTROL_1, 0x0000},
-       {NAU8540_REG_ALC_CONTROL_2, 0x700B},
-       {NAU8540_REG_ALC_CONTROL_3, 0x0022},
-       {NAU8540_REG_ALC_CONTROL_4, 0x1010},
-       {NAU8540_REG_ALC_CONTROL_5, 0x1010},
-       {NAU8540_REG_NOTCH_FIL1_CH1, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH1, 0x0000},
-       {NAU8540_REG_NOTCH_FIL1_CH2, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH2, 0x0000},
-       {NAU8540_REG_NOTCH_FIL1_CH3, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH3, 0x0000},
-       {NAU8540_REG_NOTCH_FIL1_CH4, 0x0000},
-       {NAU8540_REG_NOTCH_FIL2_CH4, 0x0000},
-       {NAU8540_REG_HPF_FILTER_CH12, 0x0000},
-       {NAU8540_REG_HPF_FILTER_CH34, 0x0000},
-       {NAU8540_REG_ADC_SAMPLE_RATE, 0x0002},
-       {NAU8540_REG_DIGITAL_GAIN_CH1, 0x0400},
-       {NAU8540_REG_DIGITAL_GAIN_CH2, 0x0400},
-       {NAU8540_REG_DIGITAL_GAIN_CH3, 0x0400},
-       {NAU8540_REG_DIGITAL_GAIN_CH4, 0x0400},
-       {NAU8540_REG_DIGITAL_MUX, 0x00E4},
-       {NAU8540_REG_GPIO_CTRL, 0x0000},
-       {NAU8540_REG_MISC_CTRL, 0x0000},
-       {NAU8540_REG_I2C_CTRL, 0xEFFF},
-       {NAU8540_REG_VMID_CTRL, 0x0000},
-       {NAU8540_REG_MUTE, 0x0000},
-       {NAU8540_REG_ANALOG_ADC1, 0x0011},
-       {NAU8540_REG_ANALOG_ADC2, 0x0020},
-       {NAU8540_REG_ANALOG_PWR, 0x0000},
-       {NAU8540_REG_MIC_BIAS, 0x0004},
-       {NAU8540_REG_REFERENCE, 0x0000},
-       {NAU8540_REG_FEPGA1, 0x0000},
-       {NAU8540_REG_FEPGA2, 0x0000},
-       {NAU8540_REG_FEPGA3, 0x0101},
-       {NAU8540_REG_FEPGA4, 0x0101},
-       {NAU8540_REG_PWR, 0x0000},
+        {NAU8540_REG_POWER_MANAGEMENT, 0x0000},
+        {NAU8540_REG_CLOCK_CTRL, 0x0000},
+        {NAU8540_REG_CLOCK_SRC, 0x0000},
+        {NAU8540_REG_FLL1, 0x0001},
+        {NAU8540_REG_FLL2, 0x3126},
+        {NAU8540_REG_FLL3, 0x0008},
+        {NAU8540_REG_FLL4, 0x0010},
+        {NAU8540_REG_FLL5, 0xC000},
+        {NAU8540_REG_FLL6, 0x6000},
+        {NAU8540_REG_FLL_VCO_RSV, 0xF13C},
+        {NAU8540_REG_PCM_CTRL0, 0x000B},
+        {NAU8540_REG_PCM_CTRL1, 0x3010},
+        {NAU8540_REG_PCM_CTRL2, 0x0800},
+        {NAU8540_REG_PCM_CTRL3, 0x0000},
+        {NAU8540_REG_PCM_CTRL4, 0x000F},
+        {NAU8540_REG_ALC_CONTROL_1, 0x0000},
+        {NAU8540_REG_ALC_CONTROL_2, 0x700B},
+        {NAU8540_REG_ALC_CONTROL_3, 0x0022},
+        {NAU8540_REG_ALC_CONTROL_4, 0x1010},
+        {NAU8540_REG_ALC_CONTROL_5, 0x1010},
+        {NAU8540_REG_NOTCH_FIL1_CH1, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH1, 0x0000},
+        {NAU8540_REG_NOTCH_FIL1_CH2, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH2, 0x0000},
+        {NAU8540_REG_NOTCH_FIL1_CH3, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH3, 0x0000},
+        {NAU8540_REG_NOTCH_FIL1_CH4, 0x0000},
+        {NAU8540_REG_NOTCH_FIL2_CH4, 0x0000},
+        {NAU8540_REG_HPF_FILTER_CH12, 0x0000},
+        {NAU8540_REG_HPF_FILTER_CH34, 0x0000},
+        {NAU8540_REG_ADC_SAMPLE_RATE, 0x0002},
+        {NAU8540_REG_DIGITAL_GAIN_CH1, 0x0400},
+        {NAU8540_REG_DIGITAL_GAIN_CH2, 0x0400},
+        {NAU8540_REG_DIGITAL_GAIN_CH3, 0x0400},
+        {NAU8540_REG_DIGITAL_GAIN_CH4, 0x0400},
+        {NAU8540_REG_DIGITAL_MUX, 0x00E4},
+        {NAU8540_REG_GPIO_CTRL, 0x0000},
+        {NAU8540_REG_MISC_CTRL, 0x0000},
+        {NAU8540_REG_I2C_CTRL, 0xEFFF},
+        {NAU8540_REG_VMID_CTRL, 0x0000},
+        {NAU8540_REG_MUTE, 0x0000},
+        {NAU8540_REG_ANALOG_ADC1, 0x0011},
+        {NAU8540_REG_ANALOG_ADC2, 0x0020},
+        {NAU8540_REG_ANALOG_PWR, 0x0000},
+        {NAU8540_REG_MIC_BIAS, 0x0004},
+        {NAU8540_REG_REFERENCE, 0x0000},
+        {NAU8540_REG_FEPGA1, 0x0000},
+        {NAU8540_REG_FEPGA2, 0x0000},
+        {NAU8540_REG_FEPGA3, 0x0101},
+        {NAU8540_REG_FEPGA4, 0x0101},
+        {NAU8540_REG_PWR, 0x0000},
 };
 
 static bool nau8540_readable_reg(struct device *dev, unsigned int reg)
 {
-       switch (reg) {
-       case NAU8540_REG_POWER_MANAGEMENT ... NAU8540_REG_FLL_VCO_RSV:
-       case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
-       case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
-       case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ADC_SAMPLE_RATE:
-       case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
-       case NAU8540_REG_P2P_CH1 ... NAU8540_REG_I2C_CTRL:
-       case NAU8540_REG_I2C_DEVICE_ID:
-       case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
-       case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
-               return true;
-       default:
-               return false;
-       }
+        switch (reg) {
+        case NAU8540_REG_POWER_MANAGEMENT ... NAU8540_REG_FLL_VCO_RSV:
+        case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
+        case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
+        case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ADC_SAMPLE_RATE:
+        case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
+        case NAU8540_REG_P2P_CH1 ... NAU8540_REG_I2C_CTRL:
+        case NAU8540_REG_I2C_DEVICE_ID:
+        case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
+        case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
+                return true;
+        default:
+                return false;
+        }
 
 }
 
 static bool nau8540_writeable_reg(struct device *dev, unsigned int reg)
 {
-       switch (reg) {
-       case NAU8540_REG_SW_RESET ... NAU8540_REG_FLL_VCO_RSV:
-       case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
-       case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
-       case NAU8540_REG_NOTCH_FIL1_CH1 ... NAU8540_REG_ADC_SAMPLE_RATE:
-       case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
-       case NAU8540_REG_GPIO_CTRL ... NAU8540_REG_I2C_CTRL:
-       case NAU8540_REG_RST:
-       case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
-       case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
-               return true;
-       default:
-               return false;
-       }
+        switch (reg) {
+        case NAU8540_REG_SW_RESET ... NAU8540_REG_FLL_VCO_RSV:
+        case NAU8540_REG_PCM_CTRL0 ... NAU8540_REG_PCM_CTRL4:
+        case NAU8540_REG_ALC_CONTROL_1 ... NAU8540_REG_ALC_CONTROL_5:
+        case NAU8540_REG_NOTCH_FIL1_CH1 ... NAU8540_REG_ADC_SAMPLE_RATE:
+        case NAU8540_REG_DIGITAL_GAIN_CH1 ... NAU8540_REG_DIGITAL_MUX:
+        case NAU8540_REG_GPIO_CTRL ... NAU8540_REG_I2C_CTRL:
+        case NAU8540_REG_RST:
+        case NAU8540_REG_VMID_CTRL ... NAU8540_REG_MUTE:
+        case NAU8540_REG_ANALOG_ADC1 ... NAU8540_REG_PWR:
+                return true;
+        default:
+                return false;
+        }
 }
 
 static bool nau8540_volatile_reg(struct device *dev, unsigned int reg)
 {
-       switch (reg) {
-       case NAU8540_REG_SW_RESET:
-       case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ALC_STATUS:
-       case NAU8540_REG_P2P_CH1 ... NAU8540_REG_PEAK_CH4:
-       case NAU8540_REG_I2C_DEVICE_ID:
-       case NAU8540_REG_RST:
-               return true;
-       default:
-               return false;
-       }
+        switch (reg) {
+        case NAU8540_REG_SW_RESET:
+        case NAU8540_REG_ALC_GAIN_CH12 ... NAU8540_REG_ALC_STATUS:
+        case NAU8540_REG_P2P_CH1 ... NAU8540_REG_PEAK_CH4:
+        case NAU8540_REG_I2C_DEVICE_ID:
+        case NAU8540_REG_RST:
+                return true;
+        default:
+                return false;
+        }
 }
 
 
@@ -187,255 +187,255 @@ static const DECLARE_TLV_DB_MINMAX(adc_vol_tlv, -12800, 3600);
 static const DECLARE_TLV_DB_MINMAX(fepga_gain_tlv, -100, 3600);
 
 static const struct snd_kcontrol_new nau8540_snd_controls[] = {
-       SOC_SINGLE_TLV("Mic1 Volume", NAU8540_REG_DIGITAL_GAIN_CH1,
-               0, 0x520, 0, adc_vol_tlv),
-       SOC_SINGLE_TLV("Mic2 Volume", NAU8540_REG_DIGITAL_GAIN_CH2,
-               0, 0x520, 0, adc_vol_tlv),
-       SOC_SINGLE_TLV("Mic3 Volume", NAU8540_REG_DIGITAL_GAIN_CH3,
-               0, 0x520, 0, adc_vol_tlv),
-       SOC_SINGLE_TLV("Mic4 Volume", NAU8540_REG_DIGITAL_GAIN_CH4,
-               0, 0x520, 0, adc_vol_tlv),
-
-       SOC_SINGLE_TLV("Frontend PGA1 Volume", NAU8540_REG_FEPGA3,
-               0, 0x25, 0, fepga_gain_tlv),
-       SOC_SINGLE_TLV("Frontend PGA2 Volume", NAU8540_REG_FEPGA3,
-               8, 0x25, 0, fepga_gain_tlv),
-       SOC_SINGLE_TLV("Frontend PGA3 Volume", NAU8540_REG_FEPGA4,
-               0, 0x25, 0, fepga_gain_tlv),
-       SOC_SINGLE_TLV("Frontend PGA4 Volume", NAU8540_REG_FEPGA4,
-               8, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Mic1 Volume", NAU8540_REG_DIGITAL_GAIN_CH1,
+                0, 0x520, 0, adc_vol_tlv),
+        SOC_SINGLE_TLV("Mic2 Volume", NAU8540_REG_DIGITAL_GAIN_CH2,
+                0, 0x520, 0, adc_vol_tlv),
+        SOC_SINGLE_TLV("Mic3 Volume", NAU8540_REG_DIGITAL_GAIN_CH3,
+                0, 0x520, 0, adc_vol_tlv),
+        SOC_SINGLE_TLV("Mic4 Volume", NAU8540_REG_DIGITAL_GAIN_CH4,
+                0, 0x520, 0, adc_vol_tlv),
+
+        SOC_SINGLE_TLV("Frontend PGA1 Volume", NAU8540_REG_FEPGA3,
+                0, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Frontend PGA2 Volume", NAU8540_REG_FEPGA3,
+                8, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Frontend PGA3 Volume", NAU8540_REG_FEPGA4,
+                0, 0x25, 0, fepga_gain_tlv),
+        SOC_SINGLE_TLV("Frontend PGA4 Volume", NAU8540_REG_FEPGA4,
+                8, 0x25, 0, fepga_gain_tlv),
 };
 
 static const char * const adc_channel[] = {
-       "ADC channel 1", "ADC channel 2", "ADC channel 3", "ADC channel 4"
+        "ADC channel 1", "ADC channel 2", "ADC channel 3", "ADC channel 4"
 };
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch4_enum, NAU8540_REG_DIGITAL_MUX, 6, adc_channel);
+        digital_ch4_enum, NAU8540_REG_DIGITAL_MUX, 6, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch4_mux =
-       SOC_DAPM_ENUM("Digital CH4 Select", digital_ch4_enum);
+        SOC_DAPM_ENUM("Digital CH4 Select", digital_ch4_enum);
 
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch3_enum, NAU8540_REG_DIGITAL_MUX, 4, adc_channel);
+        digital_ch3_enum, NAU8540_REG_DIGITAL_MUX, 4, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch3_mux =
-       SOC_DAPM_ENUM("Digital CH3 Select", digital_ch3_enum);
+        SOC_DAPM_ENUM("Digital CH3 Select", digital_ch3_enum);
 
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch2_enum, NAU8540_REG_DIGITAL_MUX, 2, adc_channel);
+        digital_ch2_enum, NAU8540_REG_DIGITAL_MUX, 2, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch2_mux =
-       SOC_DAPM_ENUM("Digital CH2 Select", digital_ch2_enum);
+        SOC_DAPM_ENUM("Digital CH2 Select", digital_ch2_enum);
 
 static SOC_ENUM_SINGLE_DECL(
-       digital_ch1_enum, NAU8540_REG_DIGITAL_MUX, 0, adc_channel);
+        digital_ch1_enum, NAU8540_REG_DIGITAL_MUX, 0, adc_channel);
 
 static const struct snd_kcontrol_new digital_ch1_mux =
-       SOC_DAPM_ENUM("Digital CH1 Select", digital_ch1_enum);
+        SOC_DAPM_ENUM("Digital CH1 Select", digital_ch1_enum);
 
 static const struct snd_soc_dapm_widget nau8540_dapm_widgets[] = {
-       SND_SOC_DAPM_SUPPLY("MICBIAS2", NAU8540_REG_MIC_BIAS, 11, 0, NULL, 0),
-       SND_SOC_DAPM_SUPPLY("MICBIAS1", NAU8540_REG_MIC_BIAS, 10, 0, NULL, 0),
-
-       SND_SOC_DAPM_INPUT("MIC1"),
-       SND_SOC_DAPM_INPUT("MIC2"),
-       SND_SOC_DAPM_INPUT("MIC3"),
-       SND_SOC_DAPM_INPUT("MIC4"),
-
-       SND_SOC_DAPM_PGA("Frontend PGA1", NAU8540_REG_PWR, 12, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("Frontend PGA2", NAU8540_REG_PWR, 13, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("Frontend PGA3", NAU8540_REG_PWR, 14, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("Frontend PGA4", NAU8540_REG_PWR, 15, 0, NULL, 0),
-
-       SND_SOC_DAPM_ADC("ADC1", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 0, 0),
-       SND_SOC_DAPM_ADC("ADC2", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 1, 0),
-       SND_SOC_DAPM_ADC("ADC3", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 2, 0),
-       SND_SOC_DAPM_ADC("ADC4", NULL,
-               NAU8540_REG_POWER_MANAGEMENT, 3, 0),
-
-       SND_SOC_DAPM_PGA("ADC CH1", NAU8540_REG_ANALOG_PWR, 0, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("ADC CH2", NAU8540_REG_ANALOG_PWR, 1, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("ADC CH3", NAU8540_REG_ANALOG_PWR, 2, 0, NULL, 0),
-       SND_SOC_DAPM_PGA("ADC CH4", NAU8540_REG_ANALOG_PWR, 3, 0, NULL, 0),
-
-       SND_SOC_DAPM_MUX("Digital CH4 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch4_mux),
-       SND_SOC_DAPM_MUX("Digital CH3 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch3_mux),
-       SND_SOC_DAPM_MUX("Digital CH2 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch2_mux),
-       SND_SOC_DAPM_MUX("Digital CH1 Mux",
-               SND_SOC_NOPM, 0, 0, &digital_ch1_mux),
-
-       SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS2", NAU8540_REG_MIC_BIAS, 11, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS1", NAU8540_REG_MIC_BIAS, 10, 0, NULL, 0),
+
+        SND_SOC_DAPM_INPUT("MIC1"),
+        SND_SOC_DAPM_INPUT("MIC2"),
+        SND_SOC_DAPM_INPUT("MIC3"),
+        SND_SOC_DAPM_INPUT("MIC4"),
+
+        SND_SOC_DAPM_PGA("Frontend PGA1", NAU8540_REG_PWR, 12, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Frontend PGA2", NAU8540_REG_PWR, 13, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Frontend PGA3", NAU8540_REG_PWR, 14, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Frontend PGA4", NAU8540_REG_PWR, 15, 0, NULL, 0),
+
+        SND_SOC_DAPM_ADC("ADC1", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 0, 0),
+        SND_SOC_DAPM_ADC("ADC2", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 1, 0),
+        SND_SOC_DAPM_ADC("ADC3", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 2, 0),
+        SND_SOC_DAPM_ADC("ADC4", NULL,
+                NAU8540_REG_POWER_MANAGEMENT, 3, 0),
+
+        SND_SOC_DAPM_PGA("ADC CH1", NAU8540_REG_ANALOG_PWR, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("ADC CH2", NAU8540_REG_ANALOG_PWR, 1, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("ADC CH3", NAU8540_REG_ANALOG_PWR, 2, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("ADC CH4", NAU8540_REG_ANALOG_PWR, 3, 0, NULL, 0),
+
+        SND_SOC_DAPM_MUX("Digital CH4 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch4_mux),
+        SND_SOC_DAPM_MUX("Digital CH3 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch3_mux),
+        SND_SOC_DAPM_MUX("Digital CH2 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch2_mux),
+        SND_SOC_DAPM_MUX("Digital CH1 Mux",
+                SND_SOC_NOPM, 0, 0, &digital_ch1_mux),
+
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
 };
 
 static const struct snd_soc_dapm_route nau8540_dapm_routes[] = {
-       {"Frontend PGA1", NULL, "MIC1"},
-       {"Frontend PGA2", NULL, "MIC2"},
-       {"Frontend PGA3", NULL, "MIC3"},
-       {"Frontend PGA4", NULL, "MIC4"},
-
-       {"ADC1", NULL, "Frontend PGA1"},
-       {"ADC2", NULL, "Frontend PGA2"},
-       {"ADC3", NULL, "Frontend PGA3"},
-       {"ADC4", NULL, "Frontend PGA4"},
-
-       {"ADC CH1", NULL, "ADC1"},
-       {"ADC CH2", NULL, "ADC2"},
-       {"ADC CH3", NULL, "ADC3"},
-       {"ADC CH4", NULL, "ADC4"},
-
-       {"ADC1", NULL, "MICBIAS1"},
-       {"ADC2", NULL, "MICBIAS1"},
-       {"ADC3", NULL, "MICBIAS2"},
-       {"ADC4", NULL, "MICBIAS2"},
-
-       {"Digital CH1 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH1 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH1 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH1 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"Digital CH2 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH2 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH2 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH2 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"Digital CH3 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH3 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH3 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH3 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"Digital CH4 Mux", "ADC channel 1", "ADC CH1"},
-       {"Digital CH4 Mux", "ADC channel 2", "ADC CH2"},
-       {"Digital CH4 Mux", "ADC channel 3", "ADC CH3"},
-       {"Digital CH4 Mux", "ADC channel 4", "ADC CH4"},
-
-       {"AIFTX", NULL, "Digital CH1 Mux"},
-       {"AIFTX", NULL, "Digital CH2 Mux"},
-       {"AIFTX", NULL, "Digital CH3 Mux"},
-       {"AIFTX", NULL, "Digital CH4 Mux"},
+        {"Frontend PGA1", NULL, "MIC1"},
+        {"Frontend PGA2", NULL, "MIC2"},
+        {"Frontend PGA3", NULL, "MIC3"},
+        {"Frontend PGA4", NULL, "MIC4"},
+
+        {"ADC1", NULL, "Frontend PGA1"},
+        {"ADC2", NULL, "Frontend PGA2"},
+        {"ADC3", NULL, "Frontend PGA3"},
+        {"ADC4", NULL, "Frontend PGA4"},
+
+        {"ADC CH1", NULL, "ADC1"},
+        {"ADC CH2", NULL, "ADC2"},
+        {"ADC CH3", NULL, "ADC3"},
+        {"ADC CH4", NULL, "ADC4"},
+
+        {"ADC1", NULL, "MICBIAS1"},
+        {"ADC2", NULL, "MICBIAS1"},
+        {"ADC3", NULL, "MICBIAS2"},
+        {"ADC4", NULL, "MICBIAS2"},
+
+        {"Digital CH1 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH1 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH1 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH1 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"Digital CH2 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH2 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH2 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH2 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"Digital CH3 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH3 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH3 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH3 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"Digital CH4 Mux", "ADC channel 1", "ADC CH1"},
+        {"Digital CH4 Mux", "ADC channel 2", "ADC CH2"},
+        {"Digital CH4 Mux", "ADC channel 3", "ADC CH3"},
+        {"Digital CH4 Mux", "ADC channel 4", "ADC CH4"},
+
+        {"AIFTX", NULL, "Digital CH1 Mux"},
+        {"AIFTX", NULL, "Digital CH2 Mux"},
+        {"AIFTX", NULL, "Digital CH3 Mux"},
+        {"AIFTX", NULL, "Digital CH4 Mux"},
 };
 
 static int nau8540_clock_check(struct nau8540 *nau8540, int rate, int osr)
 {
-       int osrate;
+        int osrate;
 
-       if (osr >= ARRAY_SIZE(osr_adc_sel))
-               return -EINVAL;
-       osrate = osr_adc_sel[osr].osr;
+        if (osr >= ARRAY_SIZE(osr_adc_sel))
+                return -EINVAL;
+        osrate = osr_adc_sel[osr].osr;
 
-       if (rate * osr > CLK_ADC_MAX) {
-               dev_err(nau8540->dev, "exceed the maximum frequency of CLK_ADC\n");
-               return -EINVAL;
-       }
+        if (rate * osr > CLK_ADC_MAX) {
+                dev_err(nau8540->dev, "exceed the maximum frequency of CLK_ADC\n");
+                return -EINVAL;
+        }
 
-       return 0;
+        return 0;
 }
 
 static int nau8540_hw_params(struct snd_pcm_substream *substream,
-       struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
 {
-       struct snd_soc_codec *codec = dai->codec;
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       unsigned int val_len = 0, osr;
-
-       /* CLK_ADC = OSR * FS
-        * ADC clock frequency is defined as Over Sampling Rate (OSR)
-        * multiplied by the audio sample rate (Fs). Note that the OSR and Fs
-        * values must be selected such that the maximum frequency is less
-        * than 6.144 MHz.
-        */
-       regmap_read(nau8540->regmap, NAU8540_REG_ADC_SAMPLE_RATE, &osr);
-       osr &= NAU8540_ADC_OSR_MASK;
-       if (nau8540_clock_check(nau8540, params_rate(params), osr))
-               return -EINVAL;
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-               NAU8540_CLK_ADC_SRC_MASK,
-               osr_adc_sel[osr].clk_src << NAU8540_CLK_ADC_SRC_SFT);
-
-       switch (params_width(params)) {
-       case 16:
-               val_len |= NAU8540_I2S_DL_16;
-               break;
-       case 20:
-               val_len |= NAU8540_I2S_DL_20;
-               break;
-       case 24:
-               val_len |= NAU8540_I2S_DL_24;
-               break;
-       case 32:
-               val_len |= NAU8540_I2S_DL_32;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
-               NAU8540_I2S_DL_MASK, val_len);
-
-       return 0;
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val_len = 0, osr;
+
+        /* CLK_ADC = OSR * FS
+         * ADC clock frequency is defined as Over Sampling Rate (OSR)
+         * multiplied by the audio sample rate (Fs). Note that the OSR and Fs
+         * values must be selected such that the maximum frequency is less
+         * than 6.144 MHz.
+         */
+        regmap_read(nau8540->regmap, NAU8540_REG_ADC_SAMPLE_RATE, &osr);
+        osr &= NAU8540_ADC_OSR_MASK;
+        if (nau8540_clock_check(nau8540, params_rate(params), osr))
+                return -EINVAL;
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                NAU8540_CLK_ADC_SRC_MASK,
+                osr_adc_sel[osr].clk_src << NAU8540_CLK_ADC_SRC_SFT);
+
+        switch (params_width(params)) {
+        case 16:
+                val_len |= NAU8540_I2S_DL_16;
+                break;
+        case 20:
+                val_len |= NAU8540_I2S_DL_20;
+                break;
+        case 24:
+                val_len |= NAU8540_I2S_DL_24;
+                break;
+        case 32:
+                val_len |= NAU8540_I2S_DL_32;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
+                NAU8540_I2S_DL_MASK, val_len);
+
+        return 0;
 }
 
 static int nau8540_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 {
-       struct snd_soc_codec *codec = dai->codec;
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       unsigned int ctrl1_val = 0, ctrl2_val = 0;
-
-       switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
-       case SND_SOC_DAIFMT_CBM_CFM:
-               ctrl2_val |= NAU8540_I2S_MS_MASTER;
-               break;
-       case SND_SOC_DAIFMT_CBS_CFS:
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
-       case SND_SOC_DAIFMT_NB_NF:
-               break;
-       case SND_SOC_DAIFMT_IB_NF:
-               ctrl1_val |= NAU8540_I2S_BP_INV;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
-       case SND_SOC_DAIFMT_I2S:
-               ctrl1_val |= NAU8540_I2S_DF_I2S;
-               break;
-       case SND_SOC_DAIFMT_LEFT_J:
-               ctrl1_val |= NAU8540_I2S_DF_LEFT;
-               break;
-       case SND_SOC_DAIFMT_RIGHT_J:
-               ctrl1_val |= NAU8540_I2S_DF_RIGTH;
-               break;
-       case SND_SOC_DAIFMT_DSP_A:
-               ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
-               break;
-       case SND_SOC_DAIFMT_DSP_B:
-               ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
-               ctrl1_val |= NAU8540_I2S_PCMB_EN;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
-               NAU8540_I2S_DL_MASK | NAU8540_I2S_DF_MASK |
-               NAU8540_I2S_BP_INV | NAU8540_I2S_PCMB_EN, ctrl1_val);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
-               NAU8540_I2S_MS_MASK | NAU8540_I2S_DO12_OE, ctrl2_val);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
-               NAU8540_I2S_DO34_OE, 0);
-
-       return 0;
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        unsigned int ctrl1_val = 0, ctrl2_val = 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                ctrl2_val |= NAU8540_I2S_MS_MASTER;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                ctrl1_val |= NAU8540_I2S_BP_INV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                ctrl1_val |= NAU8540_I2S_DF_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                ctrl1_val |= NAU8540_I2S_DF_LEFT;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                ctrl1_val |= NAU8540_I2S_DF_RIGTH;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                ctrl1_val |= NAU8540_I2S_DF_PCM_AB;
+                ctrl1_val |= NAU8540_I2S_PCMB_EN;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL0,
+                NAU8540_I2S_DL_MASK | NAU8540_I2S_DF_MASK |
+                NAU8540_I2S_BP_INV | NAU8540_I2S_PCMB_EN, ctrl1_val);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
+                NAU8540_I2S_MS_MASK | NAU8540_I2S_DO12_OE, ctrl2_val);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
+                NAU8540_I2S_DO34_OE, 0);
+
+        return 0;
 }
 
 /**
@@ -451,55 +451,55 @@ static int nau8540_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
  * Configures a DAI for TDM operation. Only support 4 slots TDM.
  */
 static int nau8540_set_tdm_slot(struct snd_soc_dai *dai,
-       unsigned int tx_mask, unsigned int rx_mask, int slots, int slot_width)
+        unsigned int tx_mask, unsigned int rx_mask, int slots, int slot_width)
 {
-       struct snd_soc_codec *codec = dai->codec;
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       unsigned int ctrl2_val = 0, ctrl4_val = 0;
-
-       if (slots > 4 || ((tx_mask & 0xf0) && (tx_mask & 0xf)))
-               return -EINVAL;
-
-       ctrl4_val |= (NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN);
-       if (tx_mask & 0xf0) {
-               ctrl2_val = 4 * slot_width;
-               ctrl4_val |= (tx_mask >> 4);
-       } else {
-               ctrl4_val |= tx_mask;
-       }
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL4,
-               NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN |
-               NAU8540_TDM_TX_MASK, ctrl4_val);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
-               NAU8540_I2S_DO12_OE, NAU8540_I2S_DO12_OE);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
-               NAU8540_I2S_DO34_OE | NAU8540_I2S_TSLOT_L_MASK,
-               NAU8540_I2S_DO34_OE | ctrl2_val);
-
-       return 0;
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        unsigned int ctrl2_val = 0, ctrl4_val = 0;
+
+        if (slots > 4 || ((tx_mask & 0xf0) && (tx_mask & 0xf)))
+                return -EINVAL;
+
+        ctrl4_val |= (NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN);
+        if (tx_mask & 0xf0) {
+                ctrl2_val = 4 * slot_width;
+                ctrl4_val |= (tx_mask >> 4);
+        } else {
+                ctrl4_val |= tx_mask;
+        }
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL4,
+                NAU8540_TDM_MODE | NAU8540_TDM_OFFSET_EN |
+                NAU8540_TDM_TX_MASK, ctrl4_val);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL1,
+                NAU8540_I2S_DO12_OE, NAU8540_I2S_DO12_OE);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_PCM_CTRL2,
+                NAU8540_I2S_DO34_OE | NAU8540_I2S_TSLOT_L_MASK,
+                NAU8540_I2S_DO34_OE | ctrl2_val);
+
+        return 0;
 }
 
 
 static const struct snd_soc_dai_ops nau8540_dai_ops = {
-       .hw_params = nau8540_hw_params,
-       .set_fmt = nau8540_set_fmt,
-       .set_tdm_slot = nau8540_set_tdm_slot,
+        .hw_params = nau8540_hw_params,
+        .set_fmt = nau8540_set_fmt,
+        .set_tdm_slot = nau8540_set_tdm_slot,
 };
 
 #define NAU8540_RATES SNDRV_PCM_RATE_8000_48000
 #define NAU8540_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
-        | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
+         | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
 
 static struct snd_soc_dai_driver nau8540_dai = {
-       .name = "nau8540-hifi",
-       .capture = {
-               .stream_name = "Capture",
-               .channels_min = 1,
-               .channels_max = 4,
-               .rates = NAU8540_RATES,
-               .formats = NAU8540_FORMATS,
-       },
-       .ops = &nau8540_dai_ops,
+        .name = "nau8540-hifi",
+        .capture = {
+                .stream_name = "Capture",
+                .channels_min = 1,
+                .channels_max = 4,
+                .rates = NAU8540_RATES,
+                .formats = NAU8540_FORMATS,
+        },
+        .ops = &nau8540_dai_ops,
 };
 
 /**
@@ -513,320 +513,320 @@ static struct snd_soc_dai_driver nau8540_dai = {
  * Returns 0 for success or negative error code.
  */
 static int nau8540_calc_fll_param(unsigned int fll_in,
-       unsigned int fs, struct nau8540_fll *fll_param)
+        unsigned int fs, struct nau8540_fll *fll_param)
 {
-       u64 fvco, fvco_max;
-       unsigned int fref, i, fvco_sel;
-
-       /* Ensure the reference clock frequency (FREF) is <= 13.5MHz by dividing
-        * freq_in by 1, 2, 4, or 8 using FLL pre-scalar.
-        * FREF = freq_in / NAU8540_FLL_REF_DIV_MASK
-        */
-       for (i = 0; i < ARRAY_SIZE(fll_pre_scalar); i++) {
-               fref = fll_in / fll_pre_scalar[i].param;
-               if (fref <= NAU_FREF_MAX)
-                       break;
-       }
-       if (i == ARRAY_SIZE(fll_pre_scalar))
-               return -EINVAL;
-       fll_param->clk_ref_div = fll_pre_scalar[i].val;
-
-       /* Choose the FLL ratio based on FREF */
-       for (i = 0; i < ARRAY_SIZE(fll_ratio); i++) {
-               if (fref >= fll_ratio[i].param)
-                       break;
-       }
-       if (i == ARRAY_SIZE(fll_ratio))
-               return -EINVAL;
-       fll_param->ratio = fll_ratio[i].val;
-
-       /* Calculate the frequency of DCO (FDCO) given freq_out = 256 * Fs.
-        * FDCO must be within the 90MHz - 124MHz or the FFL cannot be
-        * guaranteed across the full range of operation.
-        * FDCO = freq_out * 2 * mclk_src_scaling
-        */
-       fvco_max = 0;
-       fvco_sel = ARRAY_SIZE(mclk_src_scaling);
-       for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
-               fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
-               if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
-                       fvco_max < fvco) {
-                       fvco_max = fvco;
-                       fvco_sel = i;
-               }
-       }
-       if (ARRAY_SIZE(mclk_src_scaling) == fvco_sel)
-               return -EINVAL;
-       fll_param->mclk_src = mclk_src_scaling[fvco_sel].val;
-
-       /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
-        * input based on FDCO, FREF and FLL ratio.
-        */
-       fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
-       fll_param->fll_int = (fvco >> 16) & 0x3FF;
-       fll_param->fll_frac = fvco & 0xFFFF;
-       return 0;
+        u64 fvco, fvco_max;
+        unsigned int fref, i, fvco_sel;
+
+        /* Ensure the reference clock frequency (FREF) is <= 13.5MHz by dividing
+         * freq_in by 1, 2, 4, or 8 using FLL pre-scalar.
+         * FREF = freq_in / NAU8540_FLL_REF_DIV_MASK
+         */
+        for (i = 0; i < ARRAY_SIZE(fll_pre_scalar); i++) {
+                fref = fll_in / fll_pre_scalar[i].param;
+                if (fref <= NAU_FREF_MAX)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_pre_scalar))
+                return -EINVAL;
+        fll_param->clk_ref_div = fll_pre_scalar[i].val;
+
+        /* Choose the FLL ratio based on FREF */
+        for (i = 0; i < ARRAY_SIZE(fll_ratio); i++) {
+                if (fref >= fll_ratio[i].param)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_ratio))
+                return -EINVAL;
+        fll_param->ratio = fll_ratio[i].val;
+
+        /* Calculate the frequency of DCO (FDCO) given freq_out = 256 * Fs.
+         * FDCO must be within the 90MHz - 124MHz or the FFL cannot be
+         * guaranteed across the full range of operation.
+         * FDCO = freq_out * 2 * mclk_src_scaling
+         */
+        fvco_max = 0;
+        fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+        for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+                fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
+                if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+                        fvco_max < fvco) {
+                        fvco_max = fvco;
+                        fvco_sel = i;
+                }
+        }
+        if (ARRAY_SIZE(mclk_src_scaling) == fvco_sel)
+                return -EINVAL;
+        fll_param->mclk_src = mclk_src_scaling[fvco_sel].val;
+
+        /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
+         * input based on FDCO, FREF and FLL ratio.
+         */
+        fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
+        fll_param->fll_int = (fvco >> 16) & 0x3FF;
+        fll_param->fll_frac = fvco & 0xFFFF;
+        return 0;
 }
 
 static void nau8540_fll_apply(struct regmap *regmap,
-       struct nau8540_fll *fll_param)
+        struct nau8540_fll *fll_param)
 {
-       regmap_update_bits(regmap, NAU8540_REG_CLOCK_SRC,
-               NAU8540_CLK_SRC_MASK | NAU8540_CLK_MCLK_SRC_MASK,
-               NAU8540_CLK_SRC_MCLK | fll_param->mclk_src);
-       regmap_update_bits(regmap, NAU8540_REG_FLL1,
-               NAU8540_FLL_RATIO_MASK, fll_param->ratio);
-       /* FLL 16-bit fractional input */
-       regmap_write(regmap, NAU8540_REG_FLL2, fll_param->fll_frac);
-       /* FLL 10-bit integer input */
-       regmap_update_bits(regmap, NAU8540_REG_FLL3,
-               NAU8540_FLL_INTEGER_MASK, fll_param->fll_int);
-       /* FLL pre-scaler */
-       regmap_update_bits(regmap, NAU8540_REG_FLL4,
-               NAU8540_FLL_REF_DIV_MASK,
-               fll_param->clk_ref_div << NAU8540_FLL_REF_DIV_SFT);
-       regmap_update_bits(regmap, NAU8540_REG_FLL5,
-               NAU8540_FLL_CLK_SW_MASK, NAU8540_FLL_CLK_SW_REF);
-       regmap_update_bits(regmap,
-               NAU8540_REG_FLL6, NAU8540_DCO_EN, 0);
-       if (fll_param->fll_frac) {
-               regmap_update_bits(regmap, NAU8540_REG_FLL5,
-                       NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
-                       NAU8540_FLL_FTR_SW_MASK,
-                       NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
-                       NAU8540_FLL_FTR_SW_FILTER);
-               regmap_update_bits(regmap, NAU8540_REG_FLL6,
-                       NAU8540_SDM_EN, NAU8540_SDM_EN);
-       } else {
-               regmap_update_bits(regmap, NAU8540_REG_FLL5,
-                       NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
-                       NAU8540_FLL_FTR_SW_MASK, NAU8540_FLL_FTR_SW_ACCU);
-               regmap_update_bits(regmap,
-                       NAU8540_REG_FLL6, NAU8540_SDM_EN, 0);
-       }
+        regmap_update_bits(regmap, NAU8540_REG_CLOCK_SRC,
+                NAU8540_CLK_SRC_MASK | NAU8540_CLK_MCLK_SRC_MASK,
+                NAU8540_CLK_SRC_MCLK | fll_param->mclk_src);
+        regmap_update_bits(regmap, NAU8540_REG_FLL1,
+                NAU8540_FLL_RATIO_MASK, fll_param->ratio);
+        /* FLL 16-bit fractional input */
+        regmap_write(regmap, NAU8540_REG_FLL2, fll_param->fll_frac);
+        /* FLL 10-bit integer input */
+        regmap_update_bits(regmap, NAU8540_REG_FLL3,
+                NAU8540_FLL_INTEGER_MASK, fll_param->fll_int);
+        /* FLL pre-scaler */
+        regmap_update_bits(regmap, NAU8540_REG_FLL4,
+                NAU8540_FLL_REF_DIV_MASK,
+                fll_param->clk_ref_div << NAU8540_FLL_REF_DIV_SFT);
+        regmap_update_bits(regmap, NAU8540_REG_FLL5,
+                NAU8540_FLL_CLK_SW_MASK, NAU8540_FLL_CLK_SW_REF);
+        regmap_update_bits(regmap,
+                NAU8540_REG_FLL6, NAU8540_DCO_EN, 0);
+        if (fll_param->fll_frac) {
+                regmap_update_bits(regmap, NAU8540_REG_FLL5,
+                        NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
+                        NAU8540_FLL_FTR_SW_MASK,
+                        NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
+                        NAU8540_FLL_FTR_SW_FILTER);
+                regmap_update_bits(regmap, NAU8540_REG_FLL6,
+                        NAU8540_SDM_EN, NAU8540_SDM_EN);
+        } else {
+                regmap_update_bits(regmap, NAU8540_REG_FLL5,
+                        NAU8540_FLL_PDB_DAC_EN | NAU8540_FLL_LOOP_FTR_EN |
+                        NAU8540_FLL_FTR_SW_MASK, NAU8540_FLL_FTR_SW_ACCU);
+                regmap_update_bits(regmap,
+                        NAU8540_REG_FLL6, NAU8540_SDM_EN, 0);
+        }
 }
 
 /* freq_out must be 256*Fs in order to achieve the best performance */
 static int nau8540_set_pll(struct snd_soc_codec *codec, int pll_id, int source,
-               unsigned int freq_in, unsigned int freq_out)
+                unsigned int freq_in, unsigned int freq_out)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-       struct nau8540_fll fll_param;
-       int ret, fs;
-
-       switch (pll_id) {
-       case NAU8540_CLK_FLL_MCLK:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
-                       NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_MCLK);
-               break;
-
-       case NAU8540_CLK_FLL_BLK:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
-                       NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_BLK);
-               break;
-
-       case NAU8540_CLK_FLL_FS:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
-                       NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_FS);
-               break;
-
-       default:
-               dev_err(nau8540->dev, "Invalid clock id (%d)\n", pll_id);
-               return -EINVAL;
-       }
-       dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
-               freq_out, pll_id);
-
-       fs = freq_out / 256;
-       ret = nau8540_calc_fll_param(freq_in, fs, &fll_param);
-       if (ret < 0) {
-               dev_err(nau8540->dev, "Unsupported input clock %d\n", freq_in);
-               return ret;
-       }
-       dev_dbg(nau8540->dev, "mclk_src=%x ratio=%x fll_frac=%x fll_int=%x clk_ref_div=%x\n",
-               fll_param.mclk_src, fll_param.ratio, fll_param.fll_frac,
-               fll_param.fll_int, fll_param.clk_ref_div);
-
-       nau8540_fll_apply(nau8540->regmap, &fll_param);
-       mdelay(2);
-       regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-               NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
-
-       return 0;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        struct nau8540_fll fll_param;
+        int ret, fs;
+
+        switch (pll_id) {
+        case NAU8540_CLK_FLL_MCLK:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
+                        NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_MCLK);
+                break;
+
+        case NAU8540_CLK_FLL_BLK:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
+                        NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_BLK);
+                break;
+
+        case NAU8540_CLK_FLL_FS:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL3,
+                        NAU8540_FLL_CLK_SRC_MASK, NAU8540_FLL_CLK_SRC_FS);
+                break;
+
+        default:
+                dev_err(nau8540->dev, "Invalid clock id (%d)\n", pll_id);
+                return -EINVAL;
+        }
+        dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
+                freq_out, pll_id);
+
+        fs = freq_out / 256;
+        ret = nau8540_calc_fll_param(freq_in, fs, &fll_param);
+        if (ret < 0) {
+                dev_err(nau8540->dev, "Unsupported input clock %d\n", freq_in);
+                return ret;
+        }
+        dev_dbg(nau8540->dev, "mclk_src=%x ratio=%x fll_frac=%x fll_int=%x clk_ref_div=%x\n",
+                fll_param.mclk_src, fll_param.ratio, fll_param.fll_frac,
+                fll_param.fll_int, fll_param.clk_ref_div);
+
+        nau8540_fll_apply(nau8540->regmap, &fll_param);
+        mdelay(2);
+        regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
+
+        return 0;
 }
 
 static int nau8540_set_sysclk(struct snd_soc_codec *codec,
-       int clk_id, int source, unsigned int freq, int dir)
+        int clk_id, int source, unsigned int freq, int dir)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
-
-       switch (clk_id) {
-       case NAU8540_CLK_DIS:
-       case NAU8540_CLK_MCLK:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-                       NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_MCLK);
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
-                       NAU8540_DCO_EN, 0);
-               break;
-
-       case NAU8540_CLK_INTERNAL:
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
-                       NAU8540_DCO_EN, NAU8540_DCO_EN);
-               regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
-                       NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
-               break;
-
-       default:
-               dev_err(nau8540->dev, "Invalid clock id (%d)\n", clk_id);
-               return -EINVAL;
-       }
-
-       dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
-               freq, clk_id);
-
-       return 0;
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+
+        switch (clk_id) {
+        case NAU8540_CLK_DIS:
+        case NAU8540_CLK_MCLK:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                        NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_MCLK);
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
+                        NAU8540_DCO_EN, 0);
+                break;
+
+        case NAU8540_CLK_INTERNAL:
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_FLL6,
+                        NAU8540_DCO_EN, NAU8540_DCO_EN);
+                regmap_update_bits(nau8540->regmap, NAU8540_REG_CLOCK_SRC,
+                        NAU8540_CLK_SRC_MASK, NAU8540_CLK_SRC_VCO);
+                break;
+
+        default:
+                dev_err(nau8540->dev, "Invalid clock id (%d)\n", clk_id);
+                return -EINVAL;
+        }
+
+        dev_dbg(nau8540->dev, "Sysclk is %dHz and clock id is %d\n",
+                freq, clk_id);
+
+        return 0;
 }
 
 static void nau8540_reset_chip(struct regmap *regmap)
 {
-       regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
-       regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
+        regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
+        regmap_write(regmap, NAU8540_REG_SW_RESET, 0x00);
 }
 
 static void nau8540_init_regs(struct nau8540 *nau8540)
 {
-       struct regmap *regmap = nau8540->regmap;
-
-       /* Enable Bias/VMID/VMID Tieoff */
-       regmap_update_bits(regmap, NAU8540_REG_VMID_CTRL,
-               NAU8540_VMID_EN | NAU8540_VMID_SEL_MASK,
-               NAU8540_VMID_EN | (0x2 << NAU8540_VMID_SEL_SFT));
-       regmap_update_bits(regmap, NAU8540_REG_REFERENCE,
-               NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN,
-               NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN);
-       mdelay(2);
-       regmap_update_bits(regmap, NAU8540_REG_MIC_BIAS,
-               NAU8540_PU_PRE, NAU8540_PU_PRE);
-       regmap_update_bits(regmap, NAU8540_REG_CLOCK_CTRL,
-               NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN,
-               NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN);
-       /* ADC OSR selection, CLK_ADC = Fs * OSR */
-       regmap_update_bits(regmap, NAU8540_REG_ADC_SAMPLE_RATE,
-               NAU8540_ADC_OSR_MASK, NAU8540_ADC_OSR_64);
+        struct regmap *regmap = nau8540->regmap;
+
+        /* Enable Bias/VMID/VMID Tieoff */
+        regmap_update_bits(regmap, NAU8540_REG_VMID_CTRL,
+                NAU8540_VMID_EN | NAU8540_VMID_SEL_MASK,
+                NAU8540_VMID_EN | (0x2 << NAU8540_VMID_SEL_SFT));
+        regmap_update_bits(regmap, NAU8540_REG_REFERENCE,
+                NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN,
+                NAU8540_PRECHARGE_DIS | NAU8540_GLOBAL_BIAS_EN);
+        mdelay(2);
+        regmap_update_bits(regmap, NAU8540_REG_MIC_BIAS,
+                NAU8540_PU_PRE, NAU8540_PU_PRE);
+        regmap_update_bits(regmap, NAU8540_REG_CLOCK_CTRL,
+                NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN,
+                NAU8540_CLK_ADC_EN | NAU8540_CLK_I2S_EN);
+        /* ADC OSR selection, CLK_ADC = Fs * OSR */
+        regmap_update_bits(regmap, NAU8540_REG_ADC_SAMPLE_RATE,
+                NAU8540_ADC_OSR_MASK, NAU8540_ADC_OSR_64);
 }
 
 static int __maybe_unused nau8540_suspend(struct snd_soc_codec *codec)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
 
-       regcache_cache_only(nau8540->regmap, true);
-       regcache_mark_dirty(nau8540->regmap);
+        regcache_cache_only(nau8540->regmap, true);
+        regcache_mark_dirty(nau8540->regmap);
 
-       return 0;
+        return 0;
 }
 
 static int __maybe_unused nau8540_resume(struct snd_soc_codec *codec)
 {
-       struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
+        struct nau8540 *nau8540 = snd_soc_codec_get_drvdata(codec);
 
-       regcache_cache_only(nau8540->regmap, false);
-       regcache_sync(nau8540->regmap);
+        regcache_cache_only(nau8540->regmap, false);
+        regcache_sync(nau8540->regmap);
 
-       return 0;
+        return 0;
 }
 
 static struct snd_soc_codec_driver nau8540_codec_driver = {
-       .set_sysclk = nau8540_set_sysclk,
-       .set_pll = nau8540_set_pll,
-       .suspend = nau8540_suspend,
-       .resume = nau8540_resume,
-       .suspend_bias_off = true,
-
-       .component_driver = {
-               .controls = nau8540_snd_controls,
-               .num_controls = ARRAY_SIZE(nau8540_snd_controls),
-               .dapm_widgets = nau8540_dapm_widgets,
-               .num_dapm_widgets = ARRAY_SIZE(nau8540_dapm_widgets),
-               .dapm_routes = nau8540_dapm_routes,
-               .num_dapm_routes = ARRAY_SIZE(nau8540_dapm_routes),
-       },
+        .set_sysclk = nau8540_set_sysclk,
+        .set_pll = nau8540_set_pll,
+        .suspend = nau8540_suspend,
+        .resume = nau8540_resume,
+        .suspend_bias_off = true,
+
+        .component_driver = {
+                .controls = nau8540_snd_controls,
+                .num_controls = ARRAY_SIZE(nau8540_snd_controls),
+                .dapm_widgets = nau8540_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(nau8540_dapm_widgets),
+                .dapm_routes = nau8540_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(nau8540_dapm_routes),
+        },
 };
 
 static const struct regmap_config nau8540_regmap_config = {
-       .val_bits = 16,
-       .reg_bits = 16,
+        .val_bits = 16,
+        .reg_bits = 16,
 
-       .max_register = NAU8540_REG_MAX,
-       .readable_reg = nau8540_readable_reg,
-       .writeable_reg = nau8540_writeable_reg,
-       .volatile_reg = nau8540_volatile_reg,
+        .max_register = NAU8540_REG_MAX,
+        .readable_reg = nau8540_readable_reg,
+        .writeable_reg = nau8540_writeable_reg,
+        .volatile_reg = nau8540_volatile_reg,
 
-       .cache_type = REGCACHE_RBTREE,
-       .reg_defaults = nau8540_reg_defaults,
-       .num_reg_defaults = ARRAY_SIZE(nau8540_reg_defaults),
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = nau8540_reg_defaults,
+        .num_reg_defaults = ARRAY_SIZE(nau8540_reg_defaults),
 };
 
 static int nau8540_i2c_probe(struct i2c_client *i2c,
-       const struct i2c_device_id *id)
+        const struct i2c_device_id *id)
 {
-       struct device *dev = &i2c->dev;
-       struct nau8540 *nau8540 = dev_get_platdata(dev);
-       int ret, value;
-
-       if (!nau8540) {
-               nau8540 = devm_kzalloc(dev, sizeof(*nau8540), GFP_KERNEL);
-               if (!nau8540)
-                       return -ENOMEM;
-       }
-       i2c_set_clientdata(i2c, nau8540);
-
-       nau8540->regmap = devm_regmap_init_i2c(i2c, &nau8540_regmap_config);
-       if (IS_ERR(nau8540->regmap))
-               return PTR_ERR(nau8540->regmap);
-       ret = regmap_read(nau8540->regmap, NAU8540_REG_I2C_DEVICE_ID, &value);
-       if (ret < 0) {
-               dev_err(dev, "Failed to read device id from the NAU85L40: %d\n",
-                       ret);
-               return ret;
-       }
-
-       nau8540->dev = dev;
-       nau8540_reset_chip(nau8540->regmap);
-       nau8540_init_regs(nau8540);
-
-       return snd_soc_register_codec(dev,
-               &nau8540_codec_driver, &nau8540_dai, 1);
+        struct device *dev = &i2c->dev;
+        struct nau8540 *nau8540 = dev_get_platdata(dev);
+        int ret, value;
+
+        if (!nau8540) {
+                nau8540 = devm_kzalloc(dev, sizeof(*nau8540), GFP_KERNEL);
+                if (!nau8540)
+                        return -ENOMEM;
+        }
+        i2c_set_clientdata(i2c, nau8540);
+
+        nau8540->regmap = devm_regmap_init_i2c(i2c, &nau8540_regmap_config);
+        if (IS_ERR(nau8540->regmap))
+                return PTR_ERR(nau8540->regmap);
+        ret = regmap_read(nau8540->regmap, NAU8540_REG_I2C_DEVICE_ID, &value);
+        if (ret < 0) {
+                dev_err(dev, "Failed to read device id from the NAU85L40: %d\n",
+                        ret);
+                return ret;
+        }
+
+        nau8540->dev = dev;
+        nau8540_reset_chip(nau8540->regmap);
+        nau8540_init_regs(nau8540);
+
+        return snd_soc_register_codec(dev,
+                &nau8540_codec_driver, &nau8540_dai, 1);
 }
 
 static int nau8540_i2c_remove(struct i2c_client *client)
 {
-       snd_soc_unregister_codec(&client->dev);
-       return 0;
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
 }
 
 
 static const struct i2c_device_id nau8540_i2c_ids[] = {
-       { "nau8540", 0 },
-       { }
+        { "nau8540", 0 },
+        { }
 };
 MODULE_DEVICE_TABLE(i2c, nau8540_i2c_ids);
 
 #ifdef CONFIG_OF
 static const struct of_device_id nau8540_of_ids[] = {
-       { .compatible = "nuvoton,nau8540", },
-       {}
+        { .compatible = "nuvoton,nau8540", },
+        {}
 };
 MODULE_DEVICE_TABLE(of, nau8540_of_ids);
 #endif
 
 static struct i2c_driver nau8540_i2c_driver = {
-       .driver = {
-               .name = "nau8540",
-               .of_match_table = of_match_ptr(nau8540_of_ids),
-       },
-       .probe = nau8540_i2c_probe,
-       .remove = nau8540_i2c_remove,
-       .id_table = nau8540_i2c_ids,
+        .driver = {
+                .name = "nau8540",
+                .of_match_table = of_match_ptr(nau8540_of_ids),
+        },
+        .probe = nau8540_i2c_probe,
+        .remove = nau8540_i2c_remove,
+        .id_table = nau8540_i2c_ids,
 };
 module_i2c_driver(nau8540_i2c_driver);
 
diff --git a/sound/soc/codecs/nau8540.h b/sound/soc/codecs/nau8540.h
index d06e65188cd5..5db5b224944d 100644
--- a/sound/soc/codecs/nau8540.h
+++ b/sound/soc/codecs/nau8540.h
@@ -12,211 +12,211 @@
 #ifndef __NAU8540_H__
 #define __NAU8540_H__
 
-#define NAU8540_REG_SW_RESET                   0x00
-#define NAU8540_REG_POWER_MANAGEMENT   0x01
-#define NAU8540_REG_CLOCK_CTRL         0x02
-#define NAU8540_REG_CLOCK_SRC                  0x03
-#define NAU8540_REG_FLL1                       0x04
-#define NAU8540_REG_FLL2                       0x05
-#define NAU8540_REG_FLL3                       0x06
-#define NAU8540_REG_FLL4                       0x07
-#define NAU8540_REG_FLL5                       0x08
-#define NAU8540_REG_FLL6                       0x09
-#define NAU8540_REG_FLL_VCO_RSV                0x0A
-#define NAU8540_REG_PCM_CTRL0                  0x10
-#define NAU8540_REG_PCM_CTRL1                  0x11
-#define NAU8540_REG_PCM_CTRL2                  0x12
-#define NAU8540_REG_PCM_CTRL3                  0x13
-#define NAU8540_REG_PCM_CTRL4                  0x14
-#define NAU8540_REG_ALC_CONTROL_1              0x20
-#define NAU8540_REG_ALC_CONTROL_2              0x21
-#define NAU8540_REG_ALC_CONTROL_3              0x22
-#define NAU8540_REG_ALC_CONTROL_4              0x23
-#define NAU8540_REG_ALC_CONTROL_5              0x24
-#define NAU8540_REG_ALC_GAIN_CH12              0x2D
-#define NAU8540_REG_ALC_GAIN_CH34              0x2E
-#define NAU8540_REG_ALC_STATUS         0x2F
-#define NAU8540_REG_NOTCH_FIL1_CH1             0x30
-#define NAU8540_REG_NOTCH_FIL2_CH1             0x31
-#define NAU8540_REG_NOTCH_FIL1_CH2             0x32
-#define NAU8540_REG_NOTCH_FIL2_CH2             0x33
-#define NAU8540_REG_NOTCH_FIL1_CH3             0x34
-#define NAU8540_REG_NOTCH_FIL2_CH3             0x35
-#define NAU8540_REG_NOTCH_FIL1_CH4             0x36
-#define NAU8540_REG_NOTCH_FIL2_CH4             0x37
-#define NAU8540_REG_HPF_FILTER_CH12            0x38
-#define NAU8540_REG_HPF_FILTER_CH34            0x39
-#define NAU8540_REG_ADC_SAMPLE_RATE            0x3A
-#define NAU8540_REG_DIGITAL_GAIN_CH1           0x40
-#define NAU8540_REG_DIGITAL_GAIN_CH2           0x41
-#define NAU8540_REG_DIGITAL_GAIN_CH3           0x42
-#define NAU8540_REG_DIGITAL_GAIN_CH4           0x43
-#define NAU8540_REG_DIGITAL_MUX                0x44
-#define NAU8540_REG_P2P_CH1                    0x48
-#define NAU8540_REG_P2P_CH2                    0x49
-#define NAU8540_REG_P2P_CH3                    0x4A
-#define NAU8540_REG_P2P_CH4                    0x4B
-#define NAU8540_REG_PEAK_CH1                   0x4C
-#define NAU8540_REG_PEAK_CH2                   0x4D
-#define NAU8540_REG_PEAK_CH3                   0x4E
-#define NAU8540_REG_PEAK_CH4                   0x4F
-#define NAU8540_REG_GPIO_CTRL                  0x50
-#define NAU8540_REG_MISC_CTRL                  0x51
-#define NAU8540_REG_I2C_CTRL                   0x52
-#define NAU8540_REG_I2C_DEVICE_ID              0x58
-#define NAU8540_REG_RST                        0x5A
-#define NAU8540_REG_VMID_CTRL                  0x60
-#define NAU8540_REG_MUTE                       0x61
-#define NAU8540_REG_ANALOG_ADC1                0x64
-#define NAU8540_REG_ANALOG_ADC2                0x65
-#define NAU8540_REG_ANALOG_PWR         0x66
-#define NAU8540_REG_MIC_BIAS                   0x67
-#define NAU8540_REG_REFERENCE                  0x68
-#define NAU8540_REG_FEPGA1                     0x69
-#define NAU8540_REG_FEPGA2                     0x6A
-#define NAU8540_REG_FEPGA3                     0x6B
-#define NAU8540_REG_FEPGA4                     0x6C
-#define NAU8540_REG_PWR                        0x6D
-#define NAU8540_REG_MAX                        NAU8540_REG_PWR
+#define NAU8540_REG_SW_RESET                    0x00
+#define NAU8540_REG_POWER_MANAGEMENT    0x01
+#define NAU8540_REG_CLOCK_CTRL          0x02
+#define NAU8540_REG_CLOCK_SRC                   0x03
+#define NAU8540_REG_FLL1                        0x04
+#define NAU8540_REG_FLL2                        0x05
+#define NAU8540_REG_FLL3                        0x06
+#define NAU8540_REG_FLL4                        0x07
+#define NAU8540_REG_FLL5                        0x08
+#define NAU8540_REG_FLL6                        0x09
+#define NAU8540_REG_FLL_VCO_RSV         0x0A
+#define NAU8540_REG_PCM_CTRL0                   0x10
+#define NAU8540_REG_PCM_CTRL1                   0x11
+#define NAU8540_REG_PCM_CTRL2                   0x12
+#define NAU8540_REG_PCM_CTRL3                   0x13
+#define NAU8540_REG_PCM_CTRL4                   0x14
+#define NAU8540_REG_ALC_CONTROL_1               0x20
+#define NAU8540_REG_ALC_CONTROL_2               0x21
+#define NAU8540_REG_ALC_CONTROL_3               0x22
+#define NAU8540_REG_ALC_CONTROL_4               0x23
+#define NAU8540_REG_ALC_CONTROL_5               0x24
+#define NAU8540_REG_ALC_GAIN_CH12               0x2D
+#define NAU8540_REG_ALC_GAIN_CH34               0x2E
+#define NAU8540_REG_ALC_STATUS          0x2F
+#define NAU8540_REG_NOTCH_FIL1_CH1              0x30
+#define NAU8540_REG_NOTCH_FIL2_CH1              0x31
+#define NAU8540_REG_NOTCH_FIL1_CH2              0x32
+#define NAU8540_REG_NOTCH_FIL2_CH2              0x33
+#define NAU8540_REG_NOTCH_FIL1_CH3              0x34
+#define NAU8540_REG_NOTCH_FIL2_CH3              0x35
+#define NAU8540_REG_NOTCH_FIL1_CH4              0x36
+#define NAU8540_REG_NOTCH_FIL2_CH4              0x37
+#define NAU8540_REG_HPF_FILTER_CH12             0x38
+#define NAU8540_REG_HPF_FILTER_CH34             0x39
+#define NAU8540_REG_ADC_SAMPLE_RATE             0x3A
+#define NAU8540_REG_DIGITAL_GAIN_CH1            0x40
+#define NAU8540_REG_DIGITAL_GAIN_CH2            0x41
+#define NAU8540_REG_DIGITAL_GAIN_CH3            0x42
+#define NAU8540_REG_DIGITAL_GAIN_CH4            0x43
+#define NAU8540_REG_DIGITAL_MUX         0x44
+#define NAU8540_REG_P2P_CH1                     0x48
+#define NAU8540_REG_P2P_CH2                     0x49
+#define NAU8540_REG_P2P_CH3                     0x4A
+#define NAU8540_REG_P2P_CH4                     0x4B
+#define NAU8540_REG_PEAK_CH1                    0x4C
+#define NAU8540_REG_PEAK_CH2                    0x4D
+#define NAU8540_REG_PEAK_CH3                    0x4E
+#define NAU8540_REG_PEAK_CH4                    0x4F
+#define NAU8540_REG_GPIO_CTRL                   0x50
+#define NAU8540_REG_MISC_CTRL                   0x51
+#define NAU8540_REG_I2C_CTRL                    0x52
+#define NAU8540_REG_I2C_DEVICE_ID               0x58
+#define NAU8540_REG_RST                 0x5A
+#define NAU8540_REG_VMID_CTRL                   0x60
+#define NAU8540_REG_MUTE                        0x61
+#define NAU8540_REG_ANALOG_ADC1         0x64
+#define NAU8540_REG_ANALOG_ADC2         0x65
+#define NAU8540_REG_ANALOG_PWR          0x66
+#define NAU8540_REG_MIC_BIAS                    0x67
+#define NAU8540_REG_REFERENCE                   0x68
+#define NAU8540_REG_FEPGA1                      0x69
+#define NAU8540_REG_FEPGA2                      0x6A
+#define NAU8540_REG_FEPGA3                      0x6B
+#define NAU8540_REG_FEPGA4                      0x6C
+#define NAU8540_REG_PWR                 0x6D
+#define NAU8540_REG_MAX                 NAU8540_REG_PWR
 
 
 /* POWER_MANAGEMENT (0x01) */
-#define NAU8540_ADC4_EN                (0x1 << 3)
-#define NAU8540_ADC3_EN                (0x1 << 2)
-#define NAU8540_ADC2_EN                (0x1 << 1)
-#define NAU8540_ADC1_EN                0x1
+#define NAU8540_ADC4_EN         (0x1 << 3)
+#define NAU8540_ADC3_EN         (0x1 << 2)
+#define NAU8540_ADC2_EN         (0x1 << 1)
+#define NAU8540_ADC1_EN         0x1
 
 /* CLOCK_CTRL (0x02) */
-#define NAU8540_CLK_ADC_EN             (0x1 << 15)
-#define NAU8540_CLK_I2S_EN             (0x1 << 1)
+#define NAU8540_CLK_ADC_EN              (0x1 << 15)
+#define NAU8540_CLK_I2S_EN              (0x1 << 1)
 
 /* CLOCK_SRC (0x03) */
-#define NAU8540_CLK_SRC_SFT            15
-#define NAU8540_CLK_SRC_MASK           (1 << NAU8540_CLK_SRC_SFT)
-#define NAU8540_CLK_SRC_VCO            (1 << NAU8540_CLK_SRC_SFT)
-#define NAU8540_CLK_SRC_MCLK           (0 << NAU8540_CLK_SRC_SFT)
-#define NAU8540_CLK_ADC_SRC_SFT        6
-#define NAU8540_CLK_ADC_SRC_MASK       (0x3 << NAU8540_CLK_ADC_SRC_SFT)
-#define NAU8540_CLK_MCLK_SRC_MASK      0xf
+#define NAU8540_CLK_SRC_SFT             15
+#define NAU8540_CLK_SRC_MASK            (1 << NAU8540_CLK_SRC_SFT)
+#define NAU8540_CLK_SRC_VCO             (1 << NAU8540_CLK_SRC_SFT)
+#define NAU8540_CLK_SRC_MCLK            (0 << NAU8540_CLK_SRC_SFT)
+#define NAU8540_CLK_ADC_SRC_SFT 6
+#define NAU8540_CLK_ADC_SRC_MASK        (0x3 << NAU8540_CLK_ADC_SRC_SFT)
+#define NAU8540_CLK_MCLK_SRC_MASK       0xf
 
 /* FLL1 (0x04) */
-#define NAU8540_FLL_RATIO_MASK 0x7f
+#define NAU8540_FLL_RATIO_MASK  0x7f
 
 /* FLL3 (0x06) */
-#define NAU8540_FLL_CLK_SRC_SFT        10
-#define NAU8540_FLL_CLK_SRC_MASK       (0x3 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_CLK_SRC_MCLK       (0 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_CLK_SRC_BLK        (0x2 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_CLK_SRC_FS         (0x3 << NAU8540_FLL_CLK_SRC_SFT)
-#define NAU8540_FLL_INTEGER_MASK       0x3ff
+#define NAU8540_FLL_CLK_SRC_SFT 10
+#define NAU8540_FLL_CLK_SRC_MASK        (0x3 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_CLK_SRC_MCLK        (0 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_CLK_SRC_BLK (0x2 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_CLK_SRC_FS          (0x3 << NAU8540_FLL_CLK_SRC_SFT)
+#define NAU8540_FLL_INTEGER_MASK        0x3ff
 
 /* FLL4 (0x07) */
-#define NAU8540_FLL_REF_DIV_SFT        10
-#define NAU8540_FLL_REF_DIV_MASK       (0x3 << NAU8540_FLL_REF_DIV_SFT)
+#define NAU8540_FLL_REF_DIV_SFT 10
+#define NAU8540_FLL_REF_DIV_MASK        (0x3 << NAU8540_FLL_REF_DIV_SFT)
 
 /* FLL5 (0x08) */
-#define NAU8540_FLL_PDB_DAC_EN (0x1 << 15)
-#define NAU8540_FLL_LOOP_FTR_EN        (0x1 << 14)
-#define NAU8540_FLL_CLK_SW_MASK        (0x1 << 13)
-#define NAU8540_FLL_CLK_SW_N2          (0x1 << 13)
-#define NAU8540_FLL_CLK_SW_REF (0x0 << 13)
-#define NAU8540_FLL_FTR_SW_MASK        (0x1 << 12)
-#define NAU8540_FLL_FTR_SW_ACCU        (0x1 << 12)
-#define NAU8540_FLL_FTR_SW_FILTER      (0x0 << 12)
+#define NAU8540_FLL_PDB_DAC_EN  (0x1 << 15)
+#define NAU8540_FLL_LOOP_FTR_EN (0x1 << 14)
+#define NAU8540_FLL_CLK_SW_MASK (0x1 << 13)
+#define NAU8540_FLL_CLK_SW_N2           (0x1 << 13)
+#define NAU8540_FLL_CLK_SW_REF  (0x0 << 13)
+#define NAU8540_FLL_FTR_SW_MASK (0x1 << 12)
+#define NAU8540_FLL_FTR_SW_ACCU (0x1 << 12)
+#define NAU8540_FLL_FTR_SW_FILTER       (0x0 << 12)
 
 /* FLL6 (0x9) */
-#define NAU8540_DCO_EN                 (0x1 << 15)
-#define NAU8540_SDM_EN                 (0x1 << 14)
+#define NAU8540_DCO_EN                  (0x1 << 15)
+#define NAU8540_SDM_EN                  (0x1 << 14)
 
 /* PCM_CTRL0 (0x10) */
-#define NAU8540_I2S_BP_SFT             7
-#define NAU8540_I2S_BP_INV             (0x1 << NAU8540_I2S_BP_SFT)
-#define NAU8540_I2S_PCMB_SFT           6
-#define NAU8540_I2S_PCMB_EN            (0x1 << NAU8540_I2S_PCMB_SFT)
-#define NAU8540_I2S_DL_SFT             2
-#define NAU8540_I2S_DL_MASK            (0x3 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_16              (0 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_20              (0x1 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_24              (0x2 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DL_32              (0x3 << NAU8540_I2S_DL_SFT)
-#define NAU8540_I2S_DF_MASK            0x3
-#define NAU8540_I2S_DF_RIGTH           0
-#define NAU8540_I2S_DF_LEFT            0x1
-#define NAU8540_I2S_DF_I2S             0x2
-#define NAU8540_I2S_DF_PCM_AB          0x3
+#define NAU8540_I2S_BP_SFT              7
+#define NAU8540_I2S_BP_INV              (0x1 << NAU8540_I2S_BP_SFT)
+#define NAU8540_I2S_PCMB_SFT            6
+#define NAU8540_I2S_PCMB_EN             (0x1 << NAU8540_I2S_PCMB_SFT)
+#define NAU8540_I2S_DL_SFT              2
+#define NAU8540_I2S_DL_MASK             (0x3 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_16               (0 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_20               (0x1 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_24               (0x2 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DL_32               (0x3 << NAU8540_I2S_DL_SFT)
+#define NAU8540_I2S_DF_MASK             0x3
+#define NAU8540_I2S_DF_RIGTH            0
+#define NAU8540_I2S_DF_LEFT             0x1
+#define NAU8540_I2S_DF_I2S              0x2
+#define NAU8540_I2S_DF_PCM_AB           0x3
 
 /* PCM_CTRL1 (0x11) */
-#define NAU8540_I2S_LRC_DIV_SFT        12
-#define NAU8540_I2S_LRC_DIV_MASK       (0x3 << NAU8540_I2S_LRC_DIV_SFT)
-#define NAU8540_I2S_DO12_OE            (0x1 << 4)
-#define NAU8540_I2S_MS_SFT             3
-#define NAU8540_I2S_MS_MASK            (0x1 << NAU8540_I2S_MS_SFT)
-#define NAU8540_I2S_MS_MASTER          (0x1 << NAU8540_I2S_MS_SFT)
-#define NAU8540_I2S_MS_SLAVE           (0x0 << NAU8540_I2S_MS_SFT)
-#define NAU8540_I2S_BLK_DIV_MASK       0x7
+#define NAU8540_I2S_LRC_DIV_SFT 12
+#define NAU8540_I2S_LRC_DIV_MASK        (0x3 << NAU8540_I2S_LRC_DIV_SFT)
+#define NAU8540_I2S_DO12_OE             (0x1 << 4)
+#define NAU8540_I2S_MS_SFT              3
+#define NAU8540_I2S_MS_MASK             (0x1 << NAU8540_I2S_MS_SFT)
+#define NAU8540_I2S_MS_MASTER           (0x1 << NAU8540_I2S_MS_SFT)
+#define NAU8540_I2S_MS_SLAVE            (0x0 << NAU8540_I2S_MS_SFT)
+#define NAU8540_I2S_BLK_DIV_MASK        0x7
 
 /* PCM_CTRL1 (0x12) */
-#define NAU8540_I2S_DO34_OE            (0x1 << 11)
-#define NAU8540_I2S_TSLOT_L_MASK       0x3ff
+#define NAU8540_I2S_DO34_OE             (0x1 << 11)
+#define NAU8540_I2S_TSLOT_L_MASK        0x3ff
 
 /* PCM_CTRL4 (0x14) */
-#define NAU8540_TDM_MODE               (0x1 << 15)
-#define NAU8540_TDM_OFFSET_EN          (0x1 << 14)
-#define NAU8540_TDM_TX_MASK            0xf
+#define NAU8540_TDM_MODE                (0x1 << 15)
+#define NAU8540_TDM_OFFSET_EN           (0x1 << 14)
+#define NAU8540_TDM_TX_MASK             0xf
 
 /* ADC_SAMPLE_RATE (0x3A) */
-#define NAU8540_ADC_OSR_MASK           0x3
-#define NAU8540_ADC_OSR_256            0x3
-#define NAU8540_ADC_OSR_128            0x2
-#define NAU8540_ADC_OSR_64             0x1
-#define NAU8540_ADC_OSR_32             0x0
+#define NAU8540_ADC_OSR_MASK            0x3
+#define NAU8540_ADC_OSR_256             0x3
+#define NAU8540_ADC_OSR_128             0x2
+#define NAU8540_ADC_OSR_64              0x1
+#define NAU8540_ADC_OSR_32              0x0
 
 /* VMID_CTRL (0x60) */
-#define NAU8540_VMID_EN                (1 << 6)
-#define NAU8540_VMID_SEL_SFT           4
-#define NAU8540_VMID_SEL_MASK          (0x3 << NAU8540_VMID_SEL_SFT)
+#define NAU8540_VMID_EN         (1 << 6)
+#define NAU8540_VMID_SEL_SFT            4
+#define NAU8540_VMID_SEL_MASK           (0x3 << NAU8540_VMID_SEL_SFT)
 
 /* MIC_BIAS (0x67) */
-#define NAU8540_PU_PRE                 (0x1 << 8)
+#define NAU8540_PU_PRE                  (0x1 << 8)
 
 /* REFERENCE (0x68) */
-#define NAU8540_PRECHARGE_DIS          (0x1 << 13)
-#define NAU8540_GLOBAL_BIAS_EN (0x1 << 12)
+#define NAU8540_PRECHARGE_DIS           (0x1 << 13)
+#define NAU8540_GLOBAL_BIAS_EN  (0x1 << 12)
 
 
 /* System Clock Source */
 enum {
-       NAU8540_CLK_DIS,
-       NAU8540_CLK_MCLK,
-       NAU8540_CLK_INTERNAL,
-       NAU8540_CLK_FLL_MCLK,
-       NAU8540_CLK_FLL_BLK,
-       NAU8540_CLK_FLL_FS,
+        NAU8540_CLK_DIS,
+        NAU8540_CLK_MCLK,
+        NAU8540_CLK_INTERNAL,
+        NAU8540_CLK_FLL_MCLK,
+        NAU8540_CLK_FLL_BLK,
+        NAU8540_CLK_FLL_FS,
 };
 
 struct nau8540 {
-       struct device *dev;
-       struct regmap *regmap;
+        struct device *dev;
+        struct regmap *regmap;
 };
 
 struct nau8540_fll {
-       int mclk_src;
-       int ratio;
-       int fll_frac;
-       int fll_int;
-       int clk_ref_div;
+        int mclk_src;
+        int ratio;
+        int fll_frac;
+        int fll_int;
+        int clk_ref_div;
 };
 
 struct nau8540_fll_attr {
-       unsigned int param;
-       unsigned int val;
+        unsigned int param;
+        unsigned int val;
 };
 
 /* over sampling rate */
 struct nau8540_osr_attr {
-       unsigned int osr;
-       unsigned int clk_src;
+        unsigned int osr;
+        unsigned int clk_src;
 };
 
 
-#endif /* __NAU8540_H__ */
+#endif  /* __NAU8540_H__ */
diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
new file mode 100644
index 000000000000..cca974d26136
--- /dev/null
+++ b/sound/soc/codecs/nau8824.c
@@ -0,0 +1,1831 @@
+/*
+ * NAU88L24 ALSA SoC audio driver
+ *
+ * Copyright 2016 Nuvoton Technology Corp.
+ * Author: John Hsu <KCHSU0@nuvoton.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <linux/clk.h>
+#include <linux/acpi.h>
+#include <linux/math64.h>
+#include <linux/semaphore.h>
+
+#include <sound/initval.h>
+#include <sound/tlv.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/jack.h>
+
+#include "nau8824.h"
+
+
+static int nau8824_config_sysclk(struct nau8824 *nau8824,
+        int clk_id, unsigned int freq);
+static bool nau8824_is_jack_inserted(struct nau8824 *nau8824);
+
+/* the ADC threshold of headset */
+#define DMIC_CLK 3072000
+
+/* the ADC threshold of headset */
+#define HEADSET_SARADC_THD 0x80
+
+/* the parameter threshold of FLL */
+#define NAU_FREF_MAX 13500000
+#define NAU_FVCO_MAX 124000000
+#define NAU_FVCO_MIN 90000000
+
+/* scaling for mclk from sysclk_src output */
+static const struct nau8824_fll_attr mclk_src_scaling[] = {
+        { 1, 0x0 },
+        { 2, 0x2 },
+        { 4, 0x3 },
+        { 8, 0x4 },
+        { 16, 0x5 },
+        { 32, 0x6 },
+        { 3, 0x7 },
+        { 6, 0xa },
+        { 12, 0xb },
+        { 24, 0xc },
+};
+
+/* ratio for input clk freq */
+static const struct nau8824_fll_attr fll_ratio[] = {
+        { 512000, 0x01 },
+        { 256000, 0x02 },
+        { 128000, 0x04 },
+        { 64000, 0x08 },
+        { 32000, 0x10 },
+        { 8000, 0x20 },
+        { 4000, 0x40 },
+};
+
+static const struct nau8824_fll_attr fll_pre_scalar[] = {
+        { 1, 0x0 },
+        { 2, 0x1 },
+        { 4, 0x2 },
+        { 8, 0x3 },
+};
+
+/* the maximum frequency of CLK_ADC and CLK_DAC */
+#define CLK_DA_AD_MAX 6144000
+
+/* over sampling rate */
+static const struct nau8824_osr_attr osr_dac_sel[] = {
+        { 64, 2 },      /* OSR 64, SRC 1/4 */
+        { 256, 0 },     /* OSR 256, SRC 1 */
+        { 128, 1 },     /* OSR 128, SRC 1/2 */
+        { 0, 0 },
+        { 32, 3 },      /* OSR 32, SRC 1/8 */
+};
+
+static const struct nau8824_osr_attr osr_adc_sel[] = {
+        { 32, 3 },      /* OSR 32, SRC 1/8 */
+        { 64, 2 },      /* OSR 64, SRC 1/4 */
+        { 128, 1 },     /* OSR 128, SRC 1/2 */
+        { 256, 0 },     /* OSR 256, SRC 1 */
+};
+
+static const struct reg_default nau8824_reg_defaults[] = {
+        { NAU8824_REG_ENA_CTRL, 0x0000 },
+        { NAU8824_REG_CLK_GATING_ENA, 0x0000 },
+        { NAU8824_REG_CLK_DIVIDER, 0x0000 },
+        { NAU8824_REG_FLL1, 0x0000 },
+        { NAU8824_REG_FLL2, 0x3126 },
+        { NAU8824_REG_FLL3, 0x0008 },
+        { NAU8824_REG_FLL4, 0x0010 },
+        { NAU8824_REG_FLL5, 0xC000 },
+        { NAU8824_REG_FLL6, 0x6000 },
+        { NAU8824_REG_FLL_VCO_RSV, 0xF13C },
+        { NAU8824_REG_JACK_DET_CTRL, 0x0000 },
+        { NAU8824_REG_INTERRUPT_SETTING_1, 0x0000 },
+        { NAU8824_REG_IRQ, 0x0000 },
+        { NAU8824_REG_CLEAR_INT_REG, 0x0000 },
+        { NAU8824_REG_INTERRUPT_SETTING, 0x1000 },
+        { NAU8824_REG_SAR_ADC, 0x0015 },
+        { NAU8824_REG_VDET_COEFFICIENT, 0x0110 },
+        { NAU8824_REG_VDET_THRESHOLD_1, 0x0000 },
+        { NAU8824_REG_VDET_THRESHOLD_2, 0x0000 },
+        { NAU8824_REG_VDET_THRESHOLD_3, 0x0000 },
+        { NAU8824_REG_VDET_THRESHOLD_4, 0x0000 },
+        { NAU8824_REG_GPIO_SEL, 0x0000 },
+        { NAU8824_REG_PORT0_I2S_PCM_CTRL_1, 0x000B },
+        { NAU8824_REG_PORT0_I2S_PCM_CTRL_2, 0x0010 },
+        { NAU8824_REG_PORT0_LEFT_TIME_SLOT, 0x0000 },
+        { NAU8824_REG_PORT0_RIGHT_TIME_SLOT, 0x0000 },
+        { NAU8824_REG_TDM_CTRL, 0x0000 },
+        { NAU8824_REG_ADC_HPF_FILTER, 0x0000 },
+        { NAU8824_REG_ADC_FILTER_CTRL, 0x0002 },
+        { NAU8824_REG_DAC_FILTER_CTRL_1, 0x0000 },
+        { NAU8824_REG_DAC_FILTER_CTRL_2, 0x0000 },
+        { NAU8824_REG_NOTCH_FILTER_1, 0x0000 },
+        { NAU8824_REG_NOTCH_FILTER_2, 0x0000 },
+        { NAU8824_REG_EQ1_LOW, 0x112C },
+        { NAU8824_REG_EQ2_EQ3, 0x2C2C },
+        { NAU8824_REG_EQ4_EQ5, 0x2C2C },
+        { NAU8824_REG_ADC_CH0_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_CH1_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_CH2_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_CH3_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_DAC_MUTE_CTRL, 0x0000 },
+        { NAU8824_REG_DAC_CH0_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_DAC_CH1_DGAIN_CTRL, 0x0100 },
+        { NAU8824_REG_ADC_TO_DAC_ST, 0x0000 },
+        { NAU8824_REG_DRC_KNEE_IP12_ADC_CH01, 0x1486 },
+        { NAU8824_REG_DRC_KNEE_IP34_ADC_CH01, 0x0F12 },
+        { NAU8824_REG_DRC_SLOPE_ADC_CH01, 0x25FF },
+        { NAU8824_REG_DRC_ATKDCY_ADC_CH01, 0x3457 },
+        { NAU8824_REG_DRC_KNEE_IP12_ADC_CH23, 0x1486 },
+        { NAU8824_REG_DRC_KNEE_IP34_ADC_CH23, 0x0F12 },
+        { NAU8824_REG_DRC_SLOPE_ADC_CH23, 0x25FF },
+        { NAU8824_REG_DRC_ATKDCY_ADC_CH23, 0x3457 },
+        { NAU8824_REG_DRC_GAINL_ADC0, 0x0200 },
+        { NAU8824_REG_DRC_GAINL_ADC1, 0x0200 },
+        { NAU8824_REG_DRC_GAINL_ADC2, 0x0200 },
+        { NAU8824_REG_DRC_GAINL_ADC3, 0x0200 },
+        { NAU8824_REG_DRC_KNEE_IP12_DAC, 0x1486 },
+        { NAU8824_REG_DRC_KNEE_IP34_DAC, 0x0F12 },
+        { NAU8824_REG_DRC_SLOPE_DAC, 0x25F9 },
+        { NAU8824_REG_DRC_ATKDCY_DAC, 0x3457 },
+        { NAU8824_REG_DRC_GAIN_DAC_CH0, 0x0200 },
+        { NAU8824_REG_DRC_GAIN_DAC_CH1, 0x0200 },
+        { NAU8824_REG_MODE, 0x0000 },
+        { NAU8824_REG_MODE1, 0x0000 },
+        { NAU8824_REG_MODE2, 0x0000 },
+        { NAU8824_REG_CLASSG, 0x0000 },
+        { NAU8824_REG_OTP_EFUSE, 0x0000 },
+        { NAU8824_REG_OTPDOUT_1, 0x0000 },
+        { NAU8824_REG_OTPDOUT_2, 0x0000 },
+        { NAU8824_REG_MISC_CTRL, 0x0000 },
+        { NAU8824_REG_I2C_TIMEOUT, 0xEFFF },
+        { NAU8824_REG_TEST_MODE, 0x0000 },
+        { NAU8824_REG_I2C_DEVICE_ID, 0x1AF1 },
+        { NAU8824_REG_SAR_ADC_DATA_OUT, 0x00FF },
+        { NAU8824_REG_BIAS_ADJ, 0x0000 },
+        { NAU8824_REG_PGA_GAIN, 0x0000 },
+        { NAU8824_REG_TRIM_SETTINGS, 0x0000 },
+        { NAU8824_REG_ANALOG_CONTROL_1, 0x0000 },
+        { NAU8824_REG_ANALOG_CONTROL_2, 0x0000 },
+        { NAU8824_REG_ENABLE_LO, 0x0000 },
+        { NAU8824_REG_GAIN_LO, 0x0000 },
+        { NAU8824_REG_CLASSD_GAIN_1, 0x0000 },
+        { NAU8824_REG_CLASSD_GAIN_2, 0x0000 },
+        { NAU8824_REG_ANALOG_ADC_1, 0x0011 },
+        { NAU8824_REG_ANALOG_ADC_2, 0x0020 },
+        { NAU8824_REG_RDAC, 0x0008 },
+        { NAU8824_REG_MIC_BIAS, 0x0006 },
+        { NAU8824_REG_HS_VOLUME_CONTROL, 0x0000 },
+        { NAU8824_REG_BOOST, 0x0000 },
+        { NAU8824_REG_FEPGA, 0x0000 },
+        { NAU8824_REG_FEPGA_II, 0x0000 },
+        { NAU8824_REG_FEPGA_SE, 0x0000 },
+        { NAU8824_REG_FEPGA_ATTENUATION, 0x0000 },
+        { NAU8824_REG_ATT_PORT0, 0x0000 },
+        { NAU8824_REG_ATT_PORT1, 0x0000 },
+        { NAU8824_REG_POWER_UP_CONTROL, 0x0000 },
+        { NAU8824_REG_CHARGE_PUMP_CONTROL, 0x0300 },
+        { NAU8824_REG_CHARGE_PUMP_INPUT, 0x0013 },
+};
+
+static int nau8824_sema_acquire(struct nau8824 *nau8824, long timeout)
+{
+        int ret;
+
+        if (timeout) {
+                ret = down_timeout(&nau8824->jd_sem, timeout);
+                if (ret < 0)
+                        dev_warn(nau8824->dev, "Acquire semaphone timeout\n");
+        } else {
+                ret = down_interruptible(&nau8824->jd_sem);
+                if (ret < 0)
+                        dev_warn(nau8824->dev, "Acquire semaphone fail\n");
+        }
+
+        return ret;
+}
+
+static inline void nau8824_sema_release(struct nau8824 *nau8824)
+{
+        up(&nau8824->jd_sem);
+}
+
+static bool nau8824_readable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8824_REG_ENA_CTRL ... NAU8824_REG_FLL_VCO_RSV:
+        case NAU8824_REG_JACK_DET_CTRL:
+        case NAU8824_REG_INTERRUPT_SETTING_1:
+        case NAU8824_REG_IRQ:
+        case NAU8824_REG_CLEAR_INT_REG ... NAU8824_REG_VDET_THRESHOLD_4:
+        case NAU8824_REG_GPIO_SEL:
+        case NAU8824_REG_PORT0_I2S_PCM_CTRL_1 ... NAU8824_REG_TDM_CTRL:
+        case NAU8824_REG_ADC_HPF_FILTER ... NAU8824_REG_EQ4_EQ5:
+        case NAU8824_REG_ADC_CH0_DGAIN_CTRL ... NAU8824_REG_ADC_TO_DAC_ST:
+        case NAU8824_REG_DRC_KNEE_IP12_ADC_CH01 ... NAU8824_REG_DRC_GAINL_ADC3:
+        case NAU8824_REG_DRC_KNEE_IP12_DAC ... NAU8824_REG_DRC_GAIN_DAC_CH1:
+        case NAU8824_REG_CLASSG ... NAU8824_REG_OTP_EFUSE:
+        case NAU8824_REG_OTPDOUT_1 ... NAU8824_REG_OTPDOUT_2:
+        case NAU8824_REG_I2C_TIMEOUT:
+        case NAU8824_REG_I2C_DEVICE_ID ... NAU8824_REG_SAR_ADC_DATA_OUT:
+        case NAU8824_REG_BIAS_ADJ ... NAU8824_REG_CLASSD_GAIN_2:
+        case NAU8824_REG_ANALOG_ADC_1 ... NAU8824_REG_ATT_PORT1:
+        case NAU8824_REG_POWER_UP_CONTROL ... NAU8824_REG_CHARGE_PUMP_INPUT:
+                return true;
+        default:
+                return false;
+        }
+
+}
+
+static bool nau8824_writeable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8824_REG_RESET ... NAU8824_REG_FLL_VCO_RSV:
+        case NAU8824_REG_JACK_DET_CTRL:
+        case NAU8824_REG_INTERRUPT_SETTING_1:
+        case NAU8824_REG_CLEAR_INT_REG ... NAU8824_REG_VDET_THRESHOLD_4:
+        case NAU8824_REG_GPIO_SEL:
+        case NAU8824_REG_PORT0_I2S_PCM_CTRL_1 ... NAU8824_REG_TDM_CTRL:
+        case NAU8824_REG_ADC_HPF_FILTER ... NAU8824_REG_EQ4_EQ5:
+        case NAU8824_REG_ADC_CH0_DGAIN_CTRL ... NAU8824_REG_ADC_TO_DAC_ST:
+        case NAU8824_REG_DRC_KNEE_IP12_ADC_CH01:
+        case NAU8824_REG_DRC_KNEE_IP34_ADC_CH01:
+        case NAU8824_REG_DRC_SLOPE_ADC_CH01:
+        case NAU8824_REG_DRC_ATKDCY_ADC_CH01:
+        case NAU8824_REG_DRC_KNEE_IP12_ADC_CH23:
+        case NAU8824_REG_DRC_KNEE_IP34_ADC_CH23:
+        case NAU8824_REG_DRC_SLOPE_ADC_CH23:
+        case NAU8824_REG_DRC_ATKDCY_ADC_CH23:
+        case NAU8824_REG_DRC_KNEE_IP12_DAC ... NAU8824_REG_DRC_ATKDCY_DAC:
+        case NAU8824_REG_CLASSG ... NAU8824_REG_OTP_EFUSE:
+        case NAU8824_REG_I2C_TIMEOUT:
+        case NAU8824_REG_BIAS_ADJ ... NAU8824_REG_CLASSD_GAIN_2:
+        case NAU8824_REG_ANALOG_ADC_1 ... NAU8824_REG_ATT_PORT1:
+        case NAU8824_REG_POWER_UP_CONTROL ... NAU8824_REG_CHARGE_PUMP_CONTROL:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool nau8824_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8824_REG_RESET:
+        case NAU8824_REG_IRQ ... NAU8824_REG_CLEAR_INT_REG:
+        case NAU8824_REG_DRC_GAINL_ADC0 ... NAU8824_REG_DRC_GAINL_ADC3:
+        case NAU8824_REG_DRC_GAIN_DAC_CH0 ... NAU8824_REG_DRC_GAIN_DAC_CH1:
+        case NAU8824_REG_OTPDOUT_1 ... NAU8824_REG_OTPDOUT_2:
+        case NAU8824_REG_I2C_DEVICE_ID ... NAU8824_REG_SAR_ADC_DATA_OUT:
+        case NAU8824_REG_CHARGE_PUMP_INPUT:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const char * const nau8824_companding[] = {
+        "Off", "NC", "u-law", "A-law" };
+
+static const struct soc_enum nau8824_companding_adc_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_PORT0_I2S_PCM_CTRL_1, 12,
+                ARRAY_SIZE(nau8824_companding), nau8824_companding);
+
+static const struct soc_enum nau8824_companding_dac_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_PORT0_I2S_PCM_CTRL_1, 14,
+                ARRAY_SIZE(nau8824_companding), nau8824_companding);
+
+static const char * const nau8824_adc_decimation[] = {
+        "32", "64", "128", "256" };
+
+static const struct soc_enum nau8824_adc_decimation_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_FILTER_CTRL, 0,
+                ARRAY_SIZE(nau8824_adc_decimation), nau8824_adc_decimation);
+
+static const char * const nau8824_dac_oversampl[] = {
+        "64", "256", "128", "", "32" };
+
+static const struct soc_enum nau8824_dac_oversampl_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_DAC_FILTER_CTRL_1, 0,
+                ARRAY_SIZE(nau8824_dac_oversampl), nau8824_dac_oversampl);
+
+static const char * const nau8824_input_channel[] = {
+        "Input CH0", "Input CH1", "Input CH2", "Input CH3" };
+
+static const struct soc_enum nau8824_adc_ch0_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH0_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const struct soc_enum nau8824_adc_ch1_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH1_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const struct soc_enum nau8824_adc_ch2_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH2_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const struct soc_enum nau8824_adc_ch3_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_ADC_CH3_DGAIN_CTRL, 9,
+                ARRAY_SIZE(nau8824_input_channel), nau8824_input_channel);
+
+static const char * const nau8824_tdm_slot[] = {
+        "Slot 0", "Slot 1", "Slot 2", "Slot 3" };
+
+static const struct soc_enum nau8824_dac_left_sel_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_TDM_CTRL, 6,
+                ARRAY_SIZE(nau8824_tdm_slot), nau8824_tdm_slot);
+
+static const struct soc_enum nau8824_dac_right_sel_enum =
+        SOC_ENUM_SINGLE(NAU8824_REG_TDM_CTRL, 4,
+                ARRAY_SIZE(nau8824_tdm_slot), nau8824_tdm_slot);
+
+static const DECLARE_TLV_DB_MINMAX_MUTE(spk_vol_tlv, 0, 2400);
+static const DECLARE_TLV_DB_MINMAX(hp_vol_tlv, -3000, 0);
+static const DECLARE_TLV_DB_SCALE(mic_vol_tlv, 0, 200, 0);
+static const DECLARE_TLV_DB_SCALE(dmic_vol_tlv, -12800, 50, 0);
+
+static const struct snd_kcontrol_new nau8824_snd_controls[] = {
+        SOC_ENUM("ADC Companding", nau8824_companding_adc_enum),
+        SOC_ENUM("DAC Companding", nau8824_companding_dac_enum),
+
+        SOC_ENUM("ADC Decimation Rate", nau8824_adc_decimation_enum),
+        SOC_ENUM("DAC Oversampling Rate", nau8824_dac_oversampl_enum),
+
+        SOC_SINGLE_TLV("Speaker Right DACR Volume",
+                NAU8824_REG_CLASSD_GAIN_1, 8, 0x1f, 0, spk_vol_tlv),
+        SOC_SINGLE_TLV("Speaker Left DACL Volume",
+                NAU8824_REG_CLASSD_GAIN_2, 0, 0x1f, 0, spk_vol_tlv),
+        SOC_SINGLE_TLV("Speaker Left DACR Volume",
+                NAU8824_REG_CLASSD_GAIN_1, 0, 0x1f, 0, spk_vol_tlv),
+        SOC_SINGLE_TLV("Speaker Right DACL Volume",
+                NAU8824_REG_CLASSD_GAIN_2, 8, 0x1f, 0, spk_vol_tlv),
+
+        SOC_SINGLE_TLV("Headphone Right DACR Volume",
+                NAU8824_REG_ATT_PORT0, 8, 0x1f, 0, hp_vol_tlv),
+        SOC_SINGLE_TLV("Headphone Left DACL Volume",
+                NAU8824_REG_ATT_PORT0, 0, 0x1f, 0, hp_vol_tlv),
+        SOC_SINGLE_TLV("Headphone Right DACL Volume",
+                NAU8824_REG_ATT_PORT1, 8, 0x1f, 0, hp_vol_tlv),
+        SOC_SINGLE_TLV("Headphone Left DACR Volume",
+                NAU8824_REG_ATT_PORT1, 0, 0x1f, 0, hp_vol_tlv),
+
+        SOC_SINGLE_TLV("MIC1 Volume", NAU8824_REG_FEPGA_II,
+                NAU8824_FEPGA_GAINL_SFT, 0x12, 0, mic_vol_tlv),
+        SOC_SINGLE_TLV("MIC2 Volume", NAU8824_REG_FEPGA_II,
+                NAU8824_FEPGA_GAINR_SFT, 0x12, 0, mic_vol_tlv),
+
+        SOC_SINGLE_TLV("DMIC1 Volume", NAU8824_REG_ADC_CH0_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+        SOC_SINGLE_TLV("DMIC2 Volume", NAU8824_REG_ADC_CH1_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+        SOC_SINGLE_TLV("DMIC3 Volume", NAU8824_REG_ADC_CH2_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+        SOC_SINGLE_TLV("DMIC4 Volume", NAU8824_REG_ADC_CH3_DGAIN_CTRL,
+                0, 0x164, 0, dmic_vol_tlv),
+
+        SOC_ENUM("ADC CH0 Select", nau8824_adc_ch0_enum),
+        SOC_ENUM("ADC CH1 Select", nau8824_adc_ch1_enum),
+        SOC_ENUM("ADC CH2 Select", nau8824_adc_ch2_enum),
+        SOC_ENUM("ADC CH3 Select", nau8824_adc_ch3_enum),
+
+        SOC_SINGLE("ADC CH0 TX Switch", NAU8824_REG_TDM_CTRL, 0, 1, 0),
+        SOC_SINGLE("ADC CH1 TX Switch", NAU8824_REG_TDM_CTRL, 1, 1, 0),
+        SOC_SINGLE("ADC CH2 TX Switch", NAU8824_REG_TDM_CTRL, 2, 1, 0),
+        SOC_SINGLE("ADC CH3 TX Switch", NAU8824_REG_TDM_CTRL, 3, 1, 0),
+
+        SOC_ENUM("DACL Channel Source", nau8824_dac_left_sel_enum),
+        SOC_ENUM("DACR Channel Source", nau8824_dac_right_sel_enum),
+
+        SOC_SINGLE("DACL LR Mix", NAU8824_REG_DAC_MUTE_CTRL, 0, 1, 0),
+        SOC_SINGLE("DACR LR Mix", NAU8824_REG_DAC_MUTE_CTRL, 1, 1, 0),
+};
+
+static int nau8824_output_dac_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                /* Disables the TESTDAC to let DAC signal pass through. */
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_ENABLE_LO,
+                        NAU8824_TEST_DAC_EN, 0);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_ENABLE_LO,
+                        NAU8824_TEST_DAC_EN, NAU8824_TEST_DAC_EN);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int nau8824_spk_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_ANALOG_CONTROL_2,
+                        NAU8824_CLASSD_CLAMP_DIS, NAU8824_CLASSD_CLAMP_DIS);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_ANALOG_CONTROL_2,
+                        NAU8824_CLASSD_CLAMP_DIS, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int nau8824_pump_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                /* Prevent startup click by letting charge pump to ramp up */
+                msleep(10);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_CHARGE_PUMP_CONTROL,
+                        NAU8824_JAMNODCLOW, NAU8824_JAMNODCLOW);
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_CHARGE_PUMP_CONTROL,
+                        NAU8824_JAMNODCLOW, 0);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int system_clock_control(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *k, int  event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        if (SND_SOC_DAPM_EVENT_OFF(event)) {
+                /* Set clock source to disable or internal clock before the
+                 * playback or capture end. Codec needs clock for Jack
+                 * detection and button press if jack inserted; otherwise,
+                 * the clock should be closed.
+                 */
+                if (nau8824_is_jack_inserted(nau8824)) {
+                        nau8824_config_sysclk(nau8824,
+                                NAU8824_CLK_INTERNAL, 0);
+                } else {
+                        nau8824_config_sysclk(nau8824, NAU8824_CLK_DIS, 0);
+                }
+        }
+        return 0;
+}
+
+static int dmic_clock_control(struct snd_soc_dapm_widget *w,
+                struct snd_kcontrol *k, int  event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        int src;
+
+        /* The DMIC clock is gotten from system clock (256fs) divided by
+         * DMIC_SRC (1, 2, 4, 8, 16, 32). The clock has to be equal or
+         * less than 3.072 MHz.
+         */
+        for (src = 0; src < 5; src++) {
+                if ((0x1 << (8 - src)) * nau8824->fs <= DMIC_CLK)
+                        break;
+        }
+        dev_dbg(nau8824->dev, "dmic src %d for mclk %d\n", src, nau8824->fs * 256);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_DMIC_SRC_MASK, (src << NAU8824_CLK_DMIC_SRC_SFT));
+
+        return 0;
+}
+
+static const struct snd_kcontrol_new nau8824_adc_ch0_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH0_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_ch1_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH1_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_ch2_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH2_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_ch3_dmic =
+        SOC_DAPM_SINGLE("Switch", NAU8824_REG_ENA_CTRL,
+                NAU8824_ADC_CH3_DMIC_SFT, 1, 0);
+
+static const struct snd_kcontrol_new nau8824_adc_left_mixer[] = {
+        SOC_DAPM_SINGLE("MIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODEL_MIC1_SFT, 1, 0),
+        SOC_DAPM_SINGLE("HSMIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODEL_HSMIC_SFT, 1, 0),
+};
+
+static const struct snd_kcontrol_new nau8824_adc_right_mixer[] = {
+        SOC_DAPM_SINGLE("MIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODER_MIC2_SFT, 1, 0),
+        SOC_DAPM_SINGLE("HSMIC Switch", NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODER_HSMIC_SFT, 1, 0),
+};
+
+static const struct snd_kcontrol_new nau8824_hp_left_mixer[] = {
+        SOC_DAPM_SINGLE("DAC Right Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACR_HPL_EN_SFT, 1, 0),
+        SOC_DAPM_SINGLE("DAC Left Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACL_HPL_EN_SFT, 1, 0),
+};
+
+static const struct snd_kcontrol_new nau8824_hp_right_mixer[] = {
+        SOC_DAPM_SINGLE("DAC Left Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACL_HPR_EN_SFT, 1, 0),
+        SOC_DAPM_SINGLE("DAC Right Switch", NAU8824_REG_ENABLE_LO,
+                NAU8824_DACR_HPR_EN_SFT, 1, 0),
+};
+
+static const char * const nau8824_dac_src[] = { "DACL", "DACR" };
+
+static SOC_ENUM_SINGLE_DECL(
+        nau8824_dacl_enum, NAU8824_REG_DAC_CH0_DGAIN_CTRL,
+        NAU8824_DAC_CH0_SEL_SFT, nau8824_dac_src);
+
+static SOC_ENUM_SINGLE_DECL(
+        nau8824_dacr_enum, NAU8824_REG_DAC_CH1_DGAIN_CTRL,
+        NAU8824_DAC_CH1_SEL_SFT, nau8824_dac_src);
+
+static const struct snd_kcontrol_new nau8824_dacl_mux =
+        SOC_DAPM_ENUM("DACL Source", nau8824_dacl_enum);
+
+static const struct snd_kcontrol_new nau8824_dacr_mux =
+        SOC_DAPM_ENUM("DACR Source", nau8824_dacr_enum);
+
+
+static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("System Clock", SND_SOC_NOPM, 0, 0,
+                        system_clock_control, SND_SOC_DAPM_POST_PMD),
+
+        SND_SOC_DAPM_INPUT("HSMIC1"),
+        SND_SOC_DAPM_INPUT("HSMIC2"),
+        SND_SOC_DAPM_INPUT("MIC1"),
+        SND_SOC_DAPM_INPUT("MIC2"),
+        SND_SOC_DAPM_INPUT("DMIC1"),
+        SND_SOC_DAPM_INPUT("DMIC2"),
+        SND_SOC_DAPM_INPUT("DMIC3"),
+        SND_SOC_DAPM_INPUT("DMIC4"),
+
+        SND_SOC_DAPM_SUPPLY("SAR", NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_ADC_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS", NAU8824_REG_MIC_BIAS,
+                NAU8824_MICBIAS_POWERUP_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DMIC12 Power", NAU8824_REG_BIAS_ADJ,
+                NAU8824_DMIC1_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DMIC34 Power", NAU8824_REG_BIAS_ADJ,
+                NAU8824_DMIC2_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DMIC Clock", SND_SOC_NOPM, 0, 0,
+                dmic_clock_control, SND_SOC_DAPM_POST_PMU),
+
+        SND_SOC_DAPM_SWITCH("DMIC1 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch0_dmic),
+        SND_SOC_DAPM_SWITCH("DMIC2 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch1_dmic),
+        SND_SOC_DAPM_SWITCH("DMIC3 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch2_dmic),
+        SND_SOC_DAPM_SWITCH("DMIC4 Enable", SND_SOC_NOPM,
+                0, 0, &nau8824_adc_ch3_dmic),
+
+        SND_SOC_DAPM_MIXER("Left ADC", NAU8824_REG_POWER_UP_CONTROL,
+                12, 0, nau8824_adc_left_mixer,
+                ARRAY_SIZE(nau8824_adc_left_mixer)),
+        SND_SOC_DAPM_MIXER("Right ADC", NAU8824_REG_POWER_UP_CONTROL,
+                13, 0, nau8824_adc_right_mixer,
+                ARRAY_SIZE(nau8824_adc_right_mixer)),
+
+        SND_SOC_DAPM_ADC("ADCL", NULL, NAU8824_REG_ANALOG_ADC_2,
+                NAU8824_ADCL_EN_SFT, 0),
+        SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+                NAU8824_ADCR_EN_SFT, 0),
+
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
+
+        SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+                NAU8824_DACL_EN_SFT, 0),
+        SND_SOC_DAPM_SUPPLY("DACL Clock", NAU8824_REG_RDAC,
+                NAU8824_DACL_CLK_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_DAC("DACR", NULL, NAU8824_REG_RDAC,
+                NAU8824_DACR_EN_SFT, 0),
+        SND_SOC_DAPM_SUPPLY("DACR Clock", NAU8824_REG_RDAC,
+                NAU8824_DACR_CLK_SFT, 0, NULL, 0),
+
+        SND_SOC_DAPM_MUX("DACL Mux", SND_SOC_NOPM, 0, 0, &nau8824_dacl_mux),
+        SND_SOC_DAPM_MUX("DACR Mux", SND_SOC_NOPM, 0, 0, &nau8824_dacr_mux),
+
+        SND_SOC_DAPM_PGA_S("Output DACL", 0, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                8, 1, nau8824_output_dac_event,
+                SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+        SND_SOC_DAPM_PGA_S("Output DACR", 0, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                9, 1, nau8824_output_dac_event,
+                SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+        SND_SOC_DAPM_PGA_S("ClassD", 0, NAU8824_REG_CLASSD_GAIN_1,
+                NAU8824_CLASSD_EN_SFT, 0, nau8824_spk_event,
+                SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+
+        SND_SOC_DAPM_MIXER("Left Headphone", NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_LDAC_EN_SFT, 0, nau8824_hp_left_mixer,
+                ARRAY_SIZE(nau8824_hp_left_mixer)),
+        SND_SOC_DAPM_MIXER("Right Headphone", NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_RDAC_EN_SFT, 0, nau8824_hp_right_mixer,
+                ARRAY_SIZE(nau8824_hp_right_mixer)),
+        SND_SOC_DAPM_PGA_S("Charge Pump", 1, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                NAU8824_CHARGE_PUMP_EN_SFT, 0, nau8824_pump_event,
+                SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+        SND_SOC_DAPM_PGA("Output Driver L",
+                NAU8824_REG_POWER_UP_CONTROL, 3, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Output Driver R",
+                NAU8824_REG_POWER_UP_CONTROL, 2, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Main Driver L",
+                NAU8824_REG_POWER_UP_CONTROL, 1, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Main Driver R",
+                NAU8824_REG_POWER_UP_CONTROL, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("HP Boost Driver", NAU8824_REG_BOOST,
+                NAU8824_HP_BOOST_DIS_SFT, 1, NULL, 0),
+        SND_SOC_DAPM_PGA("Class G", NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_EN_SFT, 0, NULL, 0),
+
+        SND_SOC_DAPM_OUTPUT("SPKOUTL"),
+        SND_SOC_DAPM_OUTPUT("SPKOUTR"),
+        SND_SOC_DAPM_OUTPUT("HPOL"),
+        SND_SOC_DAPM_OUTPUT("HPOR"),
+};
+
+static const struct snd_soc_dapm_route nau8824_dapm_routes[] = {
+        {"DMIC1 Enable", "Switch", "DMIC1"},
+        {"DMIC2 Enable", "Switch", "DMIC2"},
+        {"DMIC3 Enable", "Switch", "DMIC3"},
+        {"DMIC4 Enable", "Switch", "DMIC4"},
+
+        {"DMIC1", NULL, "DMIC12 Power"},
+        {"DMIC2", NULL, "DMIC12 Power"},
+        {"DMIC3", NULL, "DMIC34 Power"},
+        {"DMIC4", NULL, "DMIC34 Power"},
+        {"DMIC12 Power", NULL, "DMIC Clock"},
+        {"DMIC34 Power", NULL, "DMIC Clock"},
+
+        {"Left ADC", "MIC Switch", "MIC1"},
+        {"Left ADC", "HSMIC Switch", "HSMIC1"},
+        {"Right ADC", "MIC Switch", "MIC2"},
+        {"Right ADC", "HSMIC Switch", "HSMIC2"},
+
+        {"ADCL", NULL, "Left ADC"},
+        {"ADCR", NULL, "Right ADC"},
+
+        {"AIFTX", NULL, "MICBIAS"},
+        {"AIFTX", NULL, "ADCL"},
+        {"AIFTX", NULL, "ADCR"},
+        {"AIFTX", NULL, "DMIC1 Enable"},
+        {"AIFTX", NULL, "DMIC2 Enable"},
+        {"AIFTX", NULL, "DMIC3 Enable"},
+        {"AIFTX", NULL, "DMIC4 Enable"},
+
+        {"AIFTX", NULL, "System Clock"},
+        {"AIFRX", NULL, "System Clock"},
+
+        {"DACL", NULL, "AIFRX"},
+        {"DACL", NULL, "DACL Clock"},
+        {"DACR", NULL, "AIFRX"},
+        {"DACR", NULL, "DACR Clock"},
+
+        {"DACL Mux", "DACL", "DACL"},
+        {"DACL Mux", "DACR", "DACR"},
+        {"DACR Mux", "DACL", "DACL"},
+        {"DACR Mux", "DACR", "DACR"},
+
+        {"Output DACL", NULL, "DACL Mux"},
+        {"Output DACR", NULL, "DACR Mux"},
+
+        {"ClassD", NULL, "Output DACL"},
+        {"ClassD", NULL, "Output DACR"},
+
+        {"Left Headphone", "DAC Left Switch", "Output DACL"},
+        {"Left Headphone", "DAC Right Switch", "Output DACR"},
+        {"Right Headphone", "DAC Left Switch", "Output DACL"},
+        {"Right Headphone", "DAC Right Switch", "Output DACR"},
+
+        {"Charge Pump", NULL, "Left Headphone"},
+        {"Charge Pump", NULL, "Right Headphone"},
+        {"Output Driver L", NULL, "Charge Pump"},
+        {"Output Driver R", NULL, "Charge Pump"},
+        {"Main Driver L", NULL, "Output Driver L"},
+        {"Main Driver R", NULL, "Output Driver R"},
+        {"Class G", NULL, "Main Driver L"},
+        {"Class G", NULL, "Main Driver R"},
+        {"HP Boost Driver", NULL, "Class G"},
+
+        {"SPKOUTL", NULL, "ClassD"},
+        {"SPKOUTR", NULL, "ClassD"},
+        {"HPOL", NULL, "HP Boost Driver"},
+        {"HPOR", NULL, "HP Boost Driver"},
+};
+
+static bool nau8824_is_jack_inserted(struct nau8824 *nau8824)
+{
+        struct snd_soc_jack *jack = nau8824->jack;
+        bool insert = FALSE;
+
+        if (nau8824->irq && jack)
+                insert = jack->status & SND_JACK_HEADPHONE;
+
+        return insert;
+}
+
+static void nau8824_int_status_clear_all(struct regmap *regmap)
+{
+        int active_irq, clear_irq, i;
+
+        /* Reset the intrruption status from rightmost bit if the corres-
+         * ponding irq event occurs.
+         */
+        regmap_read(regmap, NAU8824_REG_IRQ, &active_irq);
+        for (i = 0; i < NAU8824_REG_DATA_LEN; i++) {
+                clear_irq = (0x1 << i);
+                if (active_irq & clear_irq)
+                        regmap_write(regmap,
+                                NAU8824_REG_CLEAR_INT_REG, clear_irq);
+        }
+}
+
+static void nau8824_eject_jack(struct nau8824 *nau8824)
+{
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        struct regmap *regmap = nau8824->regmap;
+
+        /* Clear all interruption status */
+        nau8824_int_status_clear_all(regmap);
+
+        snd_soc_dapm_disable_pin(dapm, "SAR");
+        snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+        snd_soc_dapm_sync(dapm);
+
+        /* Enable the insertion interruption, disable the ejection
+         * interruption, and then bypass de-bounce circuit.
+         */
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING,
+                NAU8824_IRQ_KEY_RELEASE_DIS | NAU8824_IRQ_KEY_SHORT_PRESS_DIS |
+                NAU8824_IRQ_EJECT_DIS | NAU8824_IRQ_INSERT_DIS,
+                NAU8824_IRQ_KEY_RELEASE_DIS | NAU8824_IRQ_KEY_SHORT_PRESS_DIS |
+                NAU8824_IRQ_EJECT_DIS);
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING_1,
+                NAU8824_IRQ_INSERT_EN | NAU8824_IRQ_EJECT_EN,
+                NAU8824_IRQ_INSERT_EN);
+        regmap_update_bits(regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_JD_SLEEP_MODE, NAU8824_JD_SLEEP_MODE);
+
+        /* Close clock for jack type detection at manual mode */
+        nau8824_config_sysclk(nau8824, NAU8824_CLK_DIS, 0);
+}
+
+static void nau8824_jdet_work(struct work_struct *work)
+{
+        struct nau8824 *nau8824 = container_of(
+                work, struct nau8824, jdet_work);
+        struct snd_soc_dapm_context *dapm = nau8824->dapm;
+        struct regmap *regmap = nau8824->regmap;
+        int adc_value, event = 0, event_mask = 0;
+
+        snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+        snd_soc_dapm_force_enable_pin(dapm, "SAR");
+        snd_soc_dapm_sync(dapm);
+
+        msleep(100);
+
+        regmap_read(regmap, NAU8824_REG_SAR_ADC_DATA_OUT, &adc_value);
+        adc_value = adc_value & NAU8824_SAR_ADC_DATA_MASK;
+        dev_dbg(nau8824->dev, "SAR ADC data 0x%02x\n", adc_value);
+        if (adc_value < HEADSET_SARADC_THD) {
+                event |= SND_JACK_HEADPHONE;
+
+                snd_soc_dapm_disable_pin(dapm, "SAR");
+                snd_soc_dapm_disable_pin(dapm, "MICBIAS");
+                snd_soc_dapm_sync(dapm);
+        } else {
+                event |= SND_JACK_HEADSET;
+        }
+        event_mask |= SND_JACK_HEADSET;
+        snd_soc_jack_report(nau8824->jack, event, event_mask);
+
+        nau8824_sema_release(nau8824);
+}
+
+static void nau8824_setup_auto_irq(struct nau8824 *nau8824)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        /* Enable jack ejection, short key press and release interruption. */
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING_1,
+                NAU8824_IRQ_INSERT_EN | NAU8824_IRQ_EJECT_EN,
+                NAU8824_IRQ_EJECT_EN);
+        regmap_update_bits(regmap, NAU8824_REG_INTERRUPT_SETTING,
+                NAU8824_IRQ_EJECT_DIS | NAU8824_IRQ_KEY_RELEASE_DIS |
+                NAU8824_IRQ_KEY_SHORT_PRESS_DIS, 0);
+        /* Enable internal VCO needed for interruptions */
+        nau8824_config_sysclk(nau8824, NAU8824_CLK_INTERNAL, 0);
+        regmap_update_bits(regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_JD_SLEEP_MODE, 0);
+}
+
+static int nau8824_button_decode(int value)
+{
+        int buttons = 0;
+
+        /* The chip supports up to 8 buttons, but ALSA defines
+         * only 6 buttons.
+         */
+        if (value & BIT(0))
+                buttons |= SND_JACK_BTN_0;
+        if (value & BIT(1))
+                buttons |= SND_JACK_BTN_1;
+        if (value & BIT(2))
+                buttons |= SND_JACK_BTN_2;
+        if (value & BIT(3))
+                buttons |= SND_JACK_BTN_3;
+        if (value & BIT(4))
+                buttons |= SND_JACK_BTN_4;
+        if (value & BIT(5))
+                buttons |= SND_JACK_BTN_5;
+
+        return buttons;
+}
+
+#define NAU8824_BUTTONS (SND_JACK_BTN_0 | SND_JACK_BTN_1 | \
+                SND_JACK_BTN_2 | SND_JACK_BTN_3)
+
+static irqreturn_t nau8824_interrupt(int irq, void *data)
+{
+        struct nau8824 *nau8824 = (struct nau8824 *)data;
+        struct regmap *regmap = nau8824->regmap;
+        int active_irq, clear_irq = 0, event = 0, event_mask = 0;
+
+        if (regmap_read(regmap, NAU8824_REG_IRQ, &active_irq)) {
+                dev_err(nau8824->dev, "failed to read irq status\n");
+                return IRQ_NONE;
+        }
+        dev_dbg(nau8824->dev, "IRQ %x\n", active_irq);
+
+        if (active_irq & NAU8824_JACK_EJECTION_DETECTED) {
+                nau8824_eject_jack(nau8824);
+                event_mask |= SND_JACK_HEADSET;
+                clear_irq = NAU8824_JACK_EJECTION_DETECTED;
+                /* release semaphore held after resume,
+                 * and cancel jack detection
+                 */
+                nau8824_sema_release(nau8824);
+                cancel_work_sync(&nau8824->jdet_work);
+        } else if (active_irq & NAU8824_KEY_SHORT_PRESS_IRQ) {
+                int key_status, button_pressed;
+
+                regmap_read(regmap, NAU8824_REG_CLEAR_INT_REG,
+                        &key_status);
+
+                /* lower 8 bits of the register are for pressed keys */
+                button_pressed = nau8824_button_decode(key_status);
+
+                event |= button_pressed;
+                dev_dbg(nau8824->dev, "button %x pressed\n", event);
+                event_mask |= NAU8824_BUTTONS;
+                clear_irq = NAU8824_KEY_SHORT_PRESS_IRQ;
+        } else if (active_irq & NAU8824_KEY_RELEASE_IRQ) {
+                event_mask = NAU8824_BUTTONS;
+                clear_irq = NAU8824_KEY_RELEASE_IRQ;
+        } else if (active_irq & NAU8824_JACK_INSERTION_DETECTED) {
+                /* Turn off insertion interruption at manual mode */
+                regmap_update_bits(regmap,
+                        NAU8824_REG_INTERRUPT_SETTING,
+                        NAU8824_IRQ_INSERT_DIS,
+                        NAU8824_IRQ_INSERT_DIS);
+                regmap_update_bits(regmap,
+                        NAU8824_REG_INTERRUPT_SETTING_1,
+                        NAU8824_IRQ_INSERT_EN, 0);
+                /* detect microphone and jack type */
+                cancel_work_sync(&nau8824->jdet_work);
+                schedule_work(&nau8824->jdet_work);
+
+                /* Enable interruption for jack type detection at audo
+                 * mode which can detect microphone and jack type.
+                 */
+                nau8824_setup_auto_irq(nau8824);
+        }
+
+        if (!clear_irq)
+                clear_irq = active_irq;
+        /* clears the rightmost interruption */
+        regmap_write(regmap, NAU8824_REG_CLEAR_INT_REG, clear_irq);
+
+        if (event_mask)
+                snd_soc_jack_report(nau8824->jack, event, event_mask);
+
+        return IRQ_HANDLED;
+}
+
+static int nau8824_clock_check(struct nau8824 *nau8824,
+        int stream, int rate, int osr)
+{
+        int osrate;
+
+        if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                if (osr >= ARRAY_SIZE(osr_dac_sel))
+                        return -EINVAL;
+                osrate = osr_dac_sel[osr].osr;
+        } else {
+                if (osr >= ARRAY_SIZE(osr_adc_sel))
+                        return -EINVAL;
+                osrate = osr_adc_sel[osr].osr;
+        }
+
+        if (!osrate || rate * osr > CLK_DA_AD_MAX) {
+                dev_err(nau8824->dev, "exceed the maximum frequency of CLK_ADC or CLK_DAC\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int nau8824_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val_len = 0, osr, ctrl_val, bclk_fs, bclk_div;
+
+        nau8824_sema_acquire(nau8824, HZ);
+
+        /* CLK_DAC or CLK_ADC = OSR * FS
+         * DAC or ADC clock frequency is defined as Over Sampling Rate (OSR)
+         * multiplied by the audio sample rate (Fs). Note that the OSR and Fs
+         * values must be selected such that the maximum frequency is less
+         * than 6.144 MHz.
+         */
+        nau8824->fs = params_rate(params);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+                regmap_read(nau8824->regmap,
+                        NAU8824_REG_DAC_FILTER_CTRL_1, &osr);
+                osr &= NAU8824_DAC_OVERSAMPLE_MASK;
+                if (nau8824_clock_check(nau8824, substream->stream,
+                        nau8824->fs, osr))
+                        return -EINVAL;
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_DAC_SRC_MASK,
+                        osr_dac_sel[osr].clk_src << NAU8824_CLK_DAC_SRC_SFT);
+        } else {
+                regmap_read(nau8824->regmap,
+                        NAU8824_REG_ADC_FILTER_CTRL, &osr);
+                osr &= NAU8824_ADC_SYNC_DOWN_MASK;
+                if (nau8824_clock_check(nau8824, substream->stream,
+                        nau8824->fs, osr))
+                        return -EINVAL;
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_ADC_SRC_MASK,
+                        osr_adc_sel[osr].clk_src << NAU8824_CLK_ADC_SRC_SFT);
+        }
+
+        /* make BCLK and LRC divde configuration if the codec as master. */
+        regmap_read(nau8824->regmap,
+                NAU8824_REG_PORT0_I2S_PCM_CTRL_2, &ctrl_val);
+        if (ctrl_val & NAU8824_I2S_MS_MASTER) {
+                /* get the bclk and fs ratio */
+                bclk_fs = snd_soc_params_to_bclk(params) / nau8824->fs;
+                if (bclk_fs <= 32)
+                        bclk_div = 0x3;
+                else if (bclk_fs <= 64)
+                        bclk_div = 0x2;
+                else if (bclk_fs <= 128)
+                        bclk_div = 0x1;
+                else if (bclk_fs <= 256)
+                        bclk_div = 0;
+                else
+                        return -EINVAL;
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
+                        NAU8824_I2S_LRC_DIV_MASK | NAU8824_I2S_BLK_DIV_MASK,
+                        (bclk_div << NAU8824_I2S_LRC_DIV_SFT) | bclk_div);
+        }
+
+        switch (params_width(params)) {
+        case 16:
+                val_len |= NAU8824_I2S_DL_16;
+                break;
+        case 20:
+                val_len |= NAU8824_I2S_DL_20;
+                break;
+        case 24:
+                val_len |= NAU8824_I2S_DL_24;
+                break;
+        case 32:
+                val_len |= NAU8824_I2S_DL_32;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+                NAU8824_I2S_DL_MASK, val_len);
+
+        nau8824_sema_release(nau8824);
+
+        return 0;
+}
+
+static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        unsigned int ctrl1_val = 0, ctrl2_val = 0;
+
+        nau8824_sema_acquire(nau8824, HZ);
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                ctrl2_val |= NAU8824_I2S_MS_MASTER;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                ctrl1_val |= NAU8824_I2S_BP_INV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                ctrl1_val |= NAU8824_I2S_DF_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                ctrl1_val |= NAU8824_I2S_DF_LEFT;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                ctrl1_val |= NAU8824_I2S_DF_RIGTH;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                ctrl1_val |= NAU8824_I2S_DF_PCM_AB;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                ctrl1_val |= NAU8824_I2S_DF_PCM_AB;
+                ctrl1_val |= NAU8824_I2S_PCMB_EN;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+                NAU8824_I2S_DF_MASK | NAU8824_I2S_BP_MASK |
+                NAU8824_I2S_PCMB_EN, ctrl1_val);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
+                NAU8824_I2S_MS_MASK, ctrl2_val);
+
+        nau8824_sema_release(nau8824);
+
+        return 0;
+}
+
+/**
+ * nau8824_calc_fll_param - Calculate FLL parameters.
+ * @fll_in: external clock provided to codec.
+ * @fs: sampling rate.
+ * @fll_param: Pointer to structure of FLL parameters.
+ *
+ * Calculate FLL parameters to configure codec.
+ *
+ * Returns 0 for success or negative error code.
+ */
+static int nau8824_calc_fll_param(unsigned int fll_in,
+        unsigned int fs, struct nau8824_fll *fll_param)
+{
+        u64 fvco, fvco_max;
+        unsigned int fref, i, fvco_sel;
+
+        /* Ensure the reference clock frequency (FREF) is <= 13.5MHz by dividing
+         * freq_in by 1, 2, 4, or 8 using FLL pre-scalar.
+         * FREF = freq_in / NAU8824_FLL_REF_DIV_MASK
+         */
+        for (i = 0; i < ARRAY_SIZE(fll_pre_scalar); i++) {
+                fref = fll_in / fll_pre_scalar[i].param;
+                if (fref <= NAU_FREF_MAX)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_pre_scalar))
+                return -EINVAL;
+        fll_param->clk_ref_div = fll_pre_scalar[i].val;
+
+        /* Choose the FLL ratio based on FREF */
+        for (i = 0; i < ARRAY_SIZE(fll_ratio); i++) {
+                if (fref >= fll_ratio[i].param)
+                        break;
+        }
+        if (i == ARRAY_SIZE(fll_ratio))
+                return -EINVAL;
+        fll_param->ratio = fll_ratio[i].val;
+
+        /* Calculate the frequency of DCO (FDCO) given freq_out = 256 * Fs.
+         * FDCO must be within the 90MHz - 124MHz or the FFL cannot be
+         * guaranteed across the full range of operation.
+         * FDCO = freq_out * 2 * mclk_src_scaling
+         */
+        fvco_max = 0;
+        fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+        for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+                fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
+                if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+                        fvco_max < fvco) {
+                        fvco_max = fvco;
+                        fvco_sel = i;
+                }
+        }
+        if (ARRAY_SIZE(mclk_src_scaling) == fvco_sel)
+                return -EINVAL;
+        fll_param->mclk_src = mclk_src_scaling[fvco_sel].val;
+
+        /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
+         * input based on FDCO, FREF and FLL ratio.
+         */
+        fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
+        fll_param->fll_int = (fvco >> 16) & 0x3FF;
+        fll_param->fll_frac = fvco & 0xFFFF;
+        return 0;
+}
+
+static void nau8824_fll_apply(struct regmap *regmap,
+        struct nau8824_fll *fll_param)
+{
+        regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_SRC_MASK | NAU8824_CLK_MCLK_SRC_MASK,
+                NAU8824_CLK_SRC_MCLK | fll_param->mclk_src);
+        regmap_update_bits(regmap, NAU8824_REG_FLL1,
+                NAU8824_FLL_RATIO_MASK, fll_param->ratio);
+        /* FLL 16-bit fractional input */
+        regmap_write(regmap, NAU8824_REG_FLL2, fll_param->fll_frac);
+        /* FLL 10-bit integer input */
+        regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                NAU8824_FLL_INTEGER_MASK, fll_param->fll_int);
+        /* FLL pre-scaler */
+        regmap_update_bits(regmap, NAU8824_REG_FLL4,
+                NAU8824_FLL_REF_DIV_MASK,
+                fll_param->clk_ref_div << NAU8824_FLL_REF_DIV_SFT);
+        /* select divided VCO input */
+        regmap_update_bits(regmap, NAU8824_REG_FLL5,
+                NAU8824_FLL_CLK_SW_MASK, NAU8824_FLL_CLK_SW_REF);
+        /* Disable free-running mode */
+        regmap_update_bits(regmap,
+                NAU8824_REG_FLL6, NAU8824_DCO_EN, 0);
+        if (fll_param->fll_frac) {
+                regmap_update_bits(regmap, NAU8824_REG_FLL5,
+                        NAU8824_FLL_PDB_DAC_EN | NAU8824_FLL_LOOP_FTR_EN |
+                        NAU8824_FLL_FTR_SW_MASK,
+                        NAU8824_FLL_PDB_DAC_EN | NAU8824_FLL_LOOP_FTR_EN |
+                        NAU8824_FLL_FTR_SW_FILTER);
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_SDM_EN, NAU8824_SDM_EN);
+        } else {
+                regmap_update_bits(regmap, NAU8824_REG_FLL5,
+                        NAU8824_FLL_PDB_DAC_EN | NAU8824_FLL_LOOP_FTR_EN |
+                        NAU8824_FLL_FTR_SW_MASK, NAU8824_FLL_FTR_SW_ACCU);
+                regmap_update_bits(regmap,
+                        NAU8824_REG_FLL6, NAU8824_SDM_EN, 0);
+        }
+}
+
+/* freq_out must be 256*Fs in order to achieve the best performance */
+static int nau8824_set_pll(struct snd_soc_codec *codec, int pll_id, int source,
+                unsigned int freq_in, unsigned int freq_out)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        struct nau8824_fll fll_param;
+        int ret, fs;
+
+        fs = freq_out / 256;
+        ret = nau8824_calc_fll_param(freq_in, fs, &fll_param);
+        if (ret < 0) {
+                dev_err(nau8824->dev, "Unsupported input clock %d\n", freq_in);
+                return ret;
+        }
+        dev_dbg(nau8824->dev, "mclk_src=%x ratio=%x fll_frac=%x fll_int=%x clk_ref_div=%x\n",
+                fll_param.mclk_src, fll_param.ratio, fll_param.fll_frac,
+                fll_param.fll_int, fll_param.clk_ref_div);
+
+        nau8824_fll_apply(nau8824->regmap, &fll_param);
+        mdelay(2);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_VCO);
+
+        return 0;
+}
+
+static int nau8824_config_sysclk(struct nau8824 *nau8824,
+        int clk_id, unsigned int freq)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        switch (clk_id) {
+        case NAU8824_CLK_DIS:
+                regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_MCLK);
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_DCO_EN, 0);
+                break;
+
+        case NAU8824_CLK_MCLK:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_MCLK);
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_DCO_EN, 0);
+                nau8824_sema_release(nau8824);
+                break;
+
+        case NAU8824_CLK_INTERNAL:
+                regmap_update_bits(regmap, NAU8824_REG_FLL6,
+                        NAU8824_DCO_EN, NAU8824_DCO_EN);
+                regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                        NAU8824_CLK_SRC_MASK, NAU8824_CLK_SRC_VCO);
+                break;
+
+        case NAU8824_CLK_FLL_MCLK:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                        NAU8824_FLL_CLK_SRC_MASK, NAU8824_FLL_CLK_SRC_MCLK);
+                nau8824_sema_release(nau8824);
+                break;
+
+        case NAU8824_CLK_FLL_BLK:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                        NAU8824_FLL_CLK_SRC_MASK, NAU8824_FLL_CLK_SRC_BLK);
+                nau8824_sema_release(nau8824);
+                break;
+
+        case NAU8824_CLK_FLL_FS:
+                nau8824_sema_acquire(nau8824, HZ);
+                regmap_update_bits(regmap, NAU8824_REG_FLL3,
+                        NAU8824_FLL_CLK_SRC_MASK, NAU8824_FLL_CLK_SRC_FS);
+                nau8824_sema_release(nau8824);
+                break;
+
+        default:
+                dev_err(nau8824->dev, "Invalid clock id (%d)\n", clk_id);
+                return -EINVAL;
+        }
+
+        dev_dbg(nau8824->dev, "Sysclk is %dHz and clock id is %d\n", freq,
+                clk_id);
+
+        return 0;
+}
+
+static int nau8824_set_sysclk(struct snd_soc_codec *codec,
+        int clk_id, int source, unsigned int freq, int dir)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        return nau8824_config_sysclk(nau8824, clk_id, freq);
+}
+
+static void nau8824_resume_setup(struct nau8824 *nau8824)
+{
+        nau8824_config_sysclk(nau8824, NAU8824_CLK_DIS, 0);
+        if (nau8824->irq) {
+                /* Clear all interruption status */
+                nau8824_int_status_clear_all(nau8824->regmap);
+                /* Enable jack detection at sleep mode, insertion detection,
+                 * and ejection detection.
+                 */
+                regmap_update_bits(nau8824->regmap, NAU8824_REG_ENA_CTRL,
+                        NAU8824_JD_SLEEP_MODE, NAU8824_JD_SLEEP_MODE);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING_1,
+                        NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN,
+                        NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING,
+                        NAU8824_IRQ_EJECT_DIS | NAU8824_IRQ_INSERT_DIS, 0);
+        }
+}
+
+static int nau8824_set_bias_level(struct snd_soc_codec *codec,
+        enum snd_soc_bias_level level)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        switch (level) {
+        case SND_SOC_BIAS_ON:
+                break;
+
+        case SND_SOC_BIAS_PREPARE:
+                break;
+
+        case SND_SOC_BIAS_STANDBY:
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
+                        /* Setup codec configuration after resume */
+                        nau8824_resume_setup(nau8824);
+                }
+                break;
+
+        case SND_SOC_BIAS_OFF:
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING, 0x3ff, 0x3ff);
+                regmap_update_bits(nau8824->regmap,
+                        NAU8824_REG_INTERRUPT_SETTING_1,
+                        NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN, 0);
+                break;
+        }
+
+        return 0;
+}
+
+static int nau8824_codec_probe(struct snd_soc_codec *codec)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+
+        nau8824->dapm = dapm;
+
+        return 0;
+}
+
+static int __maybe_unused nau8824_suspend(struct snd_soc_codec *codec)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        if (nau8824->irq) {
+                disable_irq(nau8824->irq);
+                snd_soc_codec_force_bias_level(codec, SND_SOC_BIAS_OFF);
+        }
+        regcache_cache_only(nau8824->regmap, true);
+        regcache_mark_dirty(nau8824->regmap);
+
+        return 0;
+}
+
+static int __maybe_unused nau8824_resume(struct snd_soc_codec *codec)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+
+        regcache_cache_only(nau8824->regmap, false);
+        regcache_sync(nau8824->regmap);
+        if (nau8824->irq) {
+                /* Hold semaphore to postpone playback happening
+                 * until jack detection done.
+                 */
+                nau8824_sema_acquire(nau8824, 0);
+                enable_irq(nau8824->irq);
+        }
+
+        return 0;
+}
+
+static struct snd_soc_codec_driver nau8824_codec_driver = {
+        .probe = nau8824_codec_probe,
+        .set_sysclk = nau8824_set_sysclk,
+        .set_pll = nau8824_set_pll,
+        .set_bias_level = nau8824_set_bias_level,
+        .suspend = nau8824_suspend,
+        .resume = nau8824_resume,
+        .suspend_bias_off = true,
+
+        .component_driver = {
+                .controls = nau8824_snd_controls,
+                .num_controls = ARRAY_SIZE(nau8824_snd_controls),
+                .dapm_widgets = nau8824_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(nau8824_dapm_widgets),
+                .dapm_routes = nau8824_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(nau8824_dapm_routes),
+        },
+};
+
+static const struct snd_soc_dai_ops nau8824_dai_ops = {
+        .hw_params = nau8824_hw_params,
+        .set_fmt = nau8824_set_fmt,
+};
+
+#define NAU8824_RATES SNDRV_PCM_RATE_8000_192000
+#define NAU8824_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE \
+         | SNDRV_PCM_FMTBIT_S24_3LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+static struct snd_soc_dai_driver nau8824_dai = {
+        .name = NAU8824_CODEC_DAI,
+        .playback = {
+                .stream_name     = "Playback",
+                .channels_min    = 1,
+                .channels_max    = 2,
+                .rates           = NAU8824_RATES,
+                .formats         = NAU8824_FORMATS,
+        },
+        .capture = {
+                .stream_name     = "Capture",
+                .channels_min    = 1,
+                .channels_max    = 2,
+                .rates           = NAU8824_RATES,
+                .formats         = NAU8824_FORMATS,
+        },
+        .ops = &nau8824_dai_ops,
+};
+
+static const struct regmap_config nau8824_regmap_config = {
+        .val_bits = NAU8824_REG_ADDR_LEN,
+        .reg_bits = NAU8824_REG_DATA_LEN,
+
+        .max_register = NAU8824_REG_MAX,
+        .readable_reg = nau8824_readable_reg,
+        .writeable_reg = nau8824_writeable_reg,
+        .volatile_reg = nau8824_volatile_reg,
+
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = nau8824_reg_defaults,
+        .num_reg_defaults = ARRAY_SIZE(nau8824_reg_defaults),
+};
+
+/**
+ * nau8824_enable_jack_detect - Specify a jack for event reporting
+ *
+ * @component:  component to register the jack with
+ * @jack: jack to use to report headset and button events on
+ *
+ * After this function has been called the headset insert/remove and button
+ * events will be routed to the given jack.  Jack can be null to stop
+ * reporting.
+ */
+int nau8824_enable_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *jack)
+{
+        struct nau8824 *nau8824 = snd_soc_codec_get_drvdata(codec);
+        int ret;
+
+        nau8824->jack = jack;
+        /* Initiate jack detection work queue */
+        INIT_WORK(&nau8824->jdet_work, nau8824_jdet_work);
+        ret = devm_request_threaded_irq(nau8824->dev, nau8824->irq, NULL,
+                nau8824_interrupt, IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+                "nau8824", nau8824);
+        if (ret) {
+                dev_err(nau8824->dev, "Cannot request irq %d (%d)\n",
+                        nau8824->irq, ret);
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nau8824_enable_jack_detect);
+
+static void nau8824_reset_chip(struct regmap *regmap)
+{
+        regmap_write(regmap, NAU8824_REG_RESET, 0x00);
+        regmap_write(regmap, NAU8824_REG_RESET, 0x00);
+}
+
+static void nau8824_setup_buttons(struct nau8824 *nau8824)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        regmap_update_bits(regmap, NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_TRACKING_GAIN_MASK,
+                nau8824->sar_voltage << NAU8824_SAR_TRACKING_GAIN_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_COMPARE_TIME_MASK,
+                nau8824->sar_compare_time << NAU8824_SAR_COMPARE_TIME_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_SAR_ADC,
+                NAU8824_SAR_SAMPLING_TIME_MASK,
+                nau8824->sar_sampling_time << NAU8824_SAR_SAMPLING_TIME_SFT);
+
+        regmap_update_bits(regmap, NAU8824_REG_VDET_COEFFICIENT,
+                NAU8824_LEVELS_NR_MASK,
+                (nau8824->sar_threshold_num - 1) << NAU8824_LEVELS_NR_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_VDET_COEFFICIENT,
+                NAU8824_HYSTERESIS_MASK,
+                nau8824->sar_hysteresis << NAU8824_HYSTERESIS_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_VDET_COEFFICIENT,
+                NAU8824_SHORTKEY_DEBOUNCE_MASK,
+                nau8824->key_debounce << NAU8824_SHORTKEY_DEBOUNCE_SFT);
+
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_1,
+                (nau8824->sar_threshold[0] << 8) | nau8824->sar_threshold[1]);
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_2,
+                (nau8824->sar_threshold[2] << 8) | nau8824->sar_threshold[3]);
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_3,
+                (nau8824->sar_threshold[4] << 8) | nau8824->sar_threshold[5]);
+        regmap_write(regmap, NAU8824_REG_VDET_THRESHOLD_4,
+                (nau8824->sar_threshold[6] << 8) | nau8824->sar_threshold[7]);
+}
+
+static void nau8824_init_regs(struct nau8824 *nau8824)
+{
+        struct regmap *regmap = nau8824->regmap;
+
+        /* Enable Bias/VMID/VMID Tieoff */
+        regmap_update_bits(regmap, NAU8824_REG_BIAS_ADJ,
+                NAU8824_VMID | NAU8824_VMID_SEL_MASK, NAU8824_VMID |
+                (nau8824->vref_impedance << NAU8824_VMID_SEL_SFT));
+        regmap_update_bits(regmap, NAU8824_REG_BOOST,
+                NAU8824_GLOBAL_BIAS_EN, NAU8824_GLOBAL_BIAS_EN);
+        mdelay(2);
+        regmap_update_bits(regmap, NAU8824_REG_MIC_BIAS,
+                NAU8824_MICBIAS_VOLTAGE_MASK, nau8824->micbias_voltage);
+        /* Disable Boost Driver, Automatic Short circuit protection enable */
+        regmap_update_bits(regmap, NAU8824_REG_BOOST,
+                NAU8824_PRECHARGE_DIS | NAU8824_HP_BOOST_DIS |
+                NAU8824_HP_BOOST_G_DIS | NAU8824_SHORT_SHUTDOWN_EN,
+                NAU8824_PRECHARGE_DIS | NAU8824_HP_BOOST_DIS |
+                NAU8824_HP_BOOST_G_DIS | NAU8824_SHORT_SHUTDOWN_EN);
+        /* Scaling for ADC and DAC clock */
+        regmap_update_bits(regmap, NAU8824_REG_CLK_DIVIDER,
+                NAU8824_CLK_ADC_SRC_MASK | NAU8824_CLK_DAC_SRC_MASK,
+                (0x1 << NAU8824_CLK_ADC_SRC_SFT) |
+                (0x1 << NAU8824_CLK_DAC_SRC_SFT));
+        regmap_update_bits(regmap, NAU8824_REG_DAC_MUTE_CTRL,
+                NAU8824_DAC_ZC_EN, NAU8824_DAC_ZC_EN);
+        regmap_update_bits(regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_DAC_CH1_EN | NAU8824_DAC_CH0_EN |
+                NAU8824_ADC_CH0_EN | NAU8824_ADC_CH1_EN |
+                NAU8824_ADC_CH2_EN | NAU8824_ADC_CH3_EN,
+                NAU8824_DAC_CH1_EN | NAU8824_DAC_CH0_EN |
+                NAU8824_ADC_CH0_EN | NAU8824_ADC_CH1_EN |
+                NAU8824_ADC_CH2_EN | NAU8824_ADC_CH3_EN);
+        regmap_update_bits(regmap, NAU8824_REG_CLK_GATING_ENA,
+                NAU8824_CLK_ADC_CH23_EN | NAU8824_CLK_ADC_CH01_EN |
+                NAU8824_CLK_DAC_CH1_EN | NAU8824_CLK_DAC_CH0_EN |
+                NAU8824_CLK_I2S_EN | NAU8824_CLK_GAIN_EN |
+                NAU8824_CLK_SAR_EN | NAU8824_CLK_DMIC_CH23_EN,
+                NAU8824_CLK_ADC_CH23_EN | NAU8824_CLK_ADC_CH01_EN |
+                NAU8824_CLK_DAC_CH1_EN | NAU8824_CLK_DAC_CH0_EN |
+                NAU8824_CLK_I2S_EN | NAU8824_CLK_GAIN_EN |
+                NAU8824_CLK_SAR_EN | NAU8824_CLK_DMIC_CH23_EN);
+        /* Class G timer 64ms */
+        regmap_update_bits(regmap, NAU8824_REG_CLASSG,
+                NAU8824_CLASSG_TIMER_MASK,
+                0x20 << NAU8824_CLASSG_TIMER_SFT);
+        regmap_update_bits(regmap, NAU8824_REG_TRIM_SETTINGS,
+                NAU8824_DRV_CURR_INC, NAU8824_DRV_CURR_INC);
+        /* Disable DACR/L power */
+        regmap_update_bits(regmap, NAU8824_REG_CHARGE_PUMP_CONTROL,
+                NAU8824_SPKR_PULL_DOWN | NAU8824_SPKL_PULL_DOWN |
+                NAU8824_POWER_DOWN_DACR | NAU8824_POWER_DOWN_DACL,
+                NAU8824_SPKR_PULL_DOWN | NAU8824_SPKL_PULL_DOWN |
+                NAU8824_POWER_DOWN_DACR | NAU8824_POWER_DOWN_DACL);
+        /* Enable TESTDAC. This sets the analog DAC inputs to a '0' input
+         * signal to avoid any glitches due to power up transients in both
+         * the analog and digital DAC circuit.
+         */
+        regmap_update_bits(regmap, NAU8824_REG_ENABLE_LO,
+                NAU8824_TEST_DAC_EN, NAU8824_TEST_DAC_EN);
+        /* Config L/R channel */
+        regmap_update_bits(regmap, NAU8824_REG_DAC_CH0_DGAIN_CTRL,
+                NAU8824_DAC_CH0_SEL_MASK, NAU8824_DAC_CH0_SEL_I2S0);
+        regmap_update_bits(regmap, NAU8824_REG_DAC_CH1_DGAIN_CTRL,
+                NAU8824_DAC_CH1_SEL_MASK, NAU8824_DAC_CH1_SEL_I2S1);
+        regmap_update_bits(regmap, NAU8824_REG_ENABLE_LO,
+                NAU8824_DACR_HPR_EN | NAU8824_DACL_HPL_EN,
+                NAU8824_DACR_HPR_EN | NAU8824_DACL_HPL_EN);
+        /* Default oversampling/decimations settings are unusable
+         * (audible hiss). Set it to something better.
+         */
+        regmap_update_bits(regmap, NAU8824_REG_ADC_FILTER_CTRL,
+                NAU8824_ADC_SYNC_DOWN_MASK, NAU8824_ADC_SYNC_DOWN_64);
+        regmap_update_bits(regmap, NAU8824_REG_DAC_FILTER_CTRL_1,
+                NAU8824_DAC_CICCLP_OFF | NAU8824_DAC_OVERSAMPLE_MASK,
+                NAU8824_DAC_CICCLP_OFF | NAU8824_DAC_OVERSAMPLE_64);
+        /* DAC clock delay 2ns, VREF */
+        regmap_update_bits(regmap, NAU8824_REG_RDAC,
+                NAU8824_RDAC_CLK_DELAY_MASK | NAU8824_RDAC_VREF_MASK,
+                (0x2 << NAU8824_RDAC_CLK_DELAY_SFT) |
+                (0x3 << NAU8824_RDAC_VREF_SFT));
+        /* PGA input mode selection */
+        regmap_update_bits(regmap, NAU8824_REG_FEPGA,
+                NAU8824_FEPGA_MODEL_SHORT_EN | NAU8824_FEPGA_MODER_SHORT_EN,
+                NAU8824_FEPGA_MODEL_SHORT_EN | NAU8824_FEPGA_MODER_SHORT_EN);
+        /* Digital microphone control */
+        regmap_update_bits(regmap, NAU8824_REG_ANALOG_CONTROL_1,
+                NAU8824_DMIC_CLK_DRV_STRG | NAU8824_DMIC_CLK_SLEW_FAST,
+                NAU8824_DMIC_CLK_DRV_STRG | NAU8824_DMIC_CLK_SLEW_FAST);
+        regmap_update_bits(regmap, NAU8824_REG_JACK_DET_CTRL,
+                NAU8824_JACK_LOGIC,
+                /* jkdet_polarity - 1  is for active-low */
+                nau8824->jkdet_polarity ? 0 : NAU8824_JACK_LOGIC);
+        regmap_update_bits(regmap,
+                NAU8824_REG_JACK_DET_CTRL, NAU8824_JACK_EJECT_DT_MASK,
+                (nau8824->jack_eject_debounce << NAU8824_JACK_EJECT_DT_SFT));
+        if (nau8824->sar_threshold_num)
+                nau8824_setup_buttons(nau8824);
+}
+
+static int nau8824_setup_irq(struct nau8824 *nau8824)
+{
+        /* Disable interruption before codec initiation done */
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_ENA_CTRL,
+                NAU8824_JD_SLEEP_MODE, NAU8824_JD_SLEEP_MODE);
+        regmap_update_bits(nau8824->regmap,
+                NAU8824_REG_INTERRUPT_SETTING, 0x3ff, 0x3ff);
+        regmap_update_bits(nau8824->regmap, NAU8824_REG_INTERRUPT_SETTING_1,
+                NAU8824_IRQ_EJECT_EN | NAU8824_IRQ_INSERT_EN, 0);
+
+        return 0;
+}
+
+static void nau8824_print_device_properties(struct nau8824 *nau8824)
+{
+        struct device *dev = nau8824->dev;
+        int i;
+
+        dev_dbg(dev, "jkdet-polarity:       %d\n", nau8824->jkdet_polarity);
+        dev_dbg(dev, "micbias-voltage:      %d\n", nau8824->micbias_voltage);
+        dev_dbg(dev, "vref-impedance:       %d\n", nau8824->vref_impedance);
+
+        dev_dbg(dev, "sar-threshold-num:    %d\n", nau8824->sar_threshold_num);
+        for (i = 0; i < nau8824->sar_threshold_num; i++)
+                dev_dbg(dev, "sar-threshold[%d]=%x\n", i,
+                                nau8824->sar_threshold[i]);
+
+        dev_dbg(dev, "sar-hysteresis:       %d\n", nau8824->sar_hysteresis);
+        dev_dbg(dev, "sar-voltage:          %d\n", nau8824->sar_voltage);
+        dev_dbg(dev, "sar-compare-time:     %d\n", nau8824->sar_compare_time);
+        dev_dbg(dev, "sar-sampling-time:    %d\n", nau8824->sar_sampling_time);
+        dev_dbg(dev, "short-key-debounce:   %d\n", nau8824->key_debounce);
+        dev_dbg(dev, "jack-eject-debounce:  %d\n",
+                        nau8824->jack_eject_debounce);
+}
+
+static int nau8824_read_device_properties(struct device *dev,
+        struct nau8824 *nau8824) {
+        int ret;
+
+        ret = device_property_read_u32(dev, "nuvoton,jkdet-polarity",
+                &nau8824->jkdet_polarity);
+        if (ret)
+                nau8824->jkdet_polarity = 1;
+        ret = device_property_read_u32(dev, "nuvoton,micbias-voltage",
+                &nau8824->micbias_voltage);
+        if (ret)
+                nau8824->micbias_voltage = 6;
+        ret = device_property_read_u32(dev, "nuvoton,vref-impedance",
+                &nau8824->vref_impedance);
+        if (ret)
+                nau8824->vref_impedance = 2;
+        ret = device_property_read_u32(dev, "nuvoton,sar-threshold-num",
+                &nau8824->sar_threshold_num);
+        if (ret)
+                nau8824->sar_threshold_num = 4;
+        ret = device_property_read_u32_array(dev, "nuvoton,sar-threshold",
+                nau8824->sar_threshold, nau8824->sar_threshold_num);
+        if (ret) {
+                nau8824->sar_threshold[0] = 0x0a;
+                nau8824->sar_threshold[1] = 0x14;
+                nau8824->sar_threshold[2] = 0x26;
+                nau8824->sar_threshold[3] = 0x73;
+        }
+        ret = device_property_read_u32(dev, "nuvoton,sar-hysteresis",
+                &nau8824->sar_hysteresis);
+        if (ret)
+                nau8824->sar_hysteresis = 0;
+        ret = device_property_read_u32(dev, "nuvoton,sar-voltage",
+                &nau8824->sar_voltage);
+        if (ret)
+                nau8824->sar_voltage = 6;
+        ret = device_property_read_u32(dev, "nuvoton,sar-compare-time",
+                &nau8824->sar_compare_time);
+        if (ret)
+                nau8824->sar_compare_time = 1;
+        ret = device_property_read_u32(dev, "nuvoton,sar-sampling-time",
+                &nau8824->sar_sampling_time);
+        if (ret)
+                nau8824->sar_sampling_time = 1;
+        ret = device_property_read_u32(dev, "nuvoton,short-key-debounce",
+                &nau8824->key_debounce);
+        if (ret)
+                nau8824->key_debounce = 0;
+        ret = device_property_read_u32(dev, "nuvoton,jack-eject-debounce",
+                &nau8824->jack_eject_debounce);
+        if (ret)
+                nau8824->jack_eject_debounce = 1;
+
+        return 0;
+}
+
+static int nau8824_i2c_probe(struct i2c_client *i2c,
+        const struct i2c_device_id *id)
+{
+        struct device *dev = &i2c->dev;
+        struct nau8824 *nau8824 = dev_get_platdata(dev);
+        int ret, value;
+
+        if (!nau8824) {
+                nau8824 = devm_kzalloc(dev, sizeof(*nau8824), GFP_KERNEL);
+                if (!nau8824)
+                        return -ENOMEM;
+                ret = nau8824_read_device_properties(dev, nau8824);
+                if (ret)
+                        return ret;
+        }
+        i2c_set_clientdata(i2c, nau8824);
+
+        nau8824->regmap = devm_regmap_init_i2c(i2c, &nau8824_regmap_config);
+        if (IS_ERR(nau8824->regmap))
+                return PTR_ERR(nau8824->regmap);
+        nau8824->dev = dev;
+        nau8824->irq = i2c->irq;
+        sema_init(&nau8824->jd_sem, 1);
+
+        nau8824_print_device_properties(nau8824);
+
+        ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value);
+        if (ret < 0) {
+                dev_err(dev, "Failed to read device id from the NAU8824: %d\n",
+                        ret);
+                return ret;
+        }
+        nau8824_reset_chip(nau8824->regmap);
+        nau8824_init_regs(nau8824);
+
+        if (i2c->irq)
+                nau8824_setup_irq(nau8824);
+
+        return snd_soc_register_codec(dev,
+                &nau8824_codec_driver, &nau8824_dai, 1);
+}
+
+
+static int nau8824_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+        return 0;
+}
+
+static const struct i2c_device_id nau8824_i2c_ids[] = {
+        { "nau8824", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, nau8824_i2c_ids);
+
+#ifdef CONFIG_OF
+static const struct of_device_id nau8824_of_ids[] = {
+        { .compatible = "nuvoton,nau8824", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, nau8824_of_ids);
+#endif
+
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id nau8824_acpi_match[] = {
+        { "10508824", 0 },
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, nau8824_acpi_match);
+#endif
+
+static struct i2c_driver nau8824_i2c_driver = {
+        .driver = {
+                .name = "nau8824",
+                .of_match_table = of_match_ptr(nau8824_of_ids),
+                .acpi_match_table = ACPI_PTR(nau8824_acpi_match),
+        },
+        .probe = nau8824_i2c_probe,
+        .remove = nau8824_i2c_remove,
+        .id_table = nau8824_i2c_ids,
+};
+module_i2c_driver(nau8824_i2c_driver);
+
+
+MODULE_DESCRIPTION("ASoC NAU88L24 driver");
+MODULE_AUTHOR("John Hsu <KCHSU0@nuvoton.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/nau8824.h b/sound/soc/codecs/nau8824.h
new file mode 100644
index 000000000000..87ac9a382aed
--- /dev/null
+++ b/sound/soc/codecs/nau8824.h
@@ -0,0 +1,466 @@
+/*
+ * NAU88L24 ALSA SoC audio driver
+ *
+ * Copyright 2016 Nuvoton Technology Corp.
+ * Author: John Hsu <KCHSU0@nuvoton.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __NAU8824_H__
+#define __NAU8824_H__
+
+#define NAU8824_REG_RESET                       0x00
+#define NAU8824_REG_ENA_CTRL                    0x01
+#define NAU8824_REG_CLK_GATING_ENA              0x02
+#define NAU8824_REG_CLK_DIVIDER         0x03
+#define NAU8824_REG_FLL1                        0x04
+#define NAU8824_REG_FLL2                        0x05
+#define NAU8824_REG_FLL3                        0x06
+#define NAU8824_REG_FLL4                        0x07
+#define NAU8824_REG_FLL5                        0x08
+#define NAU8824_REG_FLL6                        0x09
+#define NAU8824_REG_FLL_VCO_RSV         0x0A
+#define NAU8824_REG_JACK_DET_CTRL               0x0D
+#define NAU8824_REG_INTERRUPT_SETTING_1 0x0F
+#define NAU8824_REG_IRQ                 0x10
+#define NAU8824_REG_CLEAR_INT_REG               0x11
+#define NAU8824_REG_INTERRUPT_SETTING   0x12
+#define NAU8824_REG_SAR_ADC                     0x13
+#define NAU8824_REG_VDET_COEFFICIENT            0x14
+#define NAU8824_REG_VDET_THRESHOLD_1    0x15
+#define NAU8824_REG_VDET_THRESHOLD_2    0x16
+#define NAU8824_REG_VDET_THRESHOLD_3    0x17
+#define NAU8824_REG_VDET_THRESHOLD_4    0x18
+#define NAU8824_REG_GPIO_SEL                    0x1A
+#define NAU8824_REG_PORT0_I2S_PCM_CTRL_1        0x1C
+#define NAU8824_REG_PORT0_I2S_PCM_CTRL_2        0x1D
+#define NAU8824_REG_PORT0_LEFT_TIME_SLOT        0x1E
+#define NAU8824_REG_PORT0_RIGHT_TIME_SLOT       0x1F
+#define NAU8824_REG_TDM_CTRL                    0x20
+#define NAU8824_REG_ADC_HPF_FILTER              0x23
+#define NAU8824_REG_ADC_FILTER_CTRL             0x24
+#define NAU8824_REG_DAC_FILTER_CTRL_1   0x25
+#define NAU8824_REG_DAC_FILTER_CTRL_2   0x26
+#define NAU8824_REG_NOTCH_FILTER_1              0x27
+#define NAU8824_REG_NOTCH_FILTER_2              0x28
+#define NAU8824_REG_EQ1_LOW                     0x29
+#define NAU8824_REG_EQ2_EQ3                     0x2A
+#define NAU8824_REG_EQ4_EQ5                     0x2B
+#define NAU8824_REG_ADC_CH0_DGAIN_CTRL  0x2D
+#define NAU8824_REG_ADC_CH1_DGAIN_CTRL  0x2E
+#define NAU8824_REG_ADC_CH2_DGAIN_CTRL  0x2F
+#define NAU8824_REG_ADC_CH3_DGAIN_CTRL  0x30
+#define NAU8824_REG_DAC_MUTE_CTRL               0x31
+#define NAU8824_REG_DAC_CH0_DGAIN_CTRL  0x32
+#define NAU8824_REG_DAC_CH1_DGAIN_CTRL  0x33
+#define NAU8824_REG_ADC_TO_DAC_ST               0x34
+#define NAU8824_REG_DRC_KNEE_IP12_ADC_CH01      0x38
+#define NAU8824_REG_DRC_KNEE_IP34_ADC_CH01      0x39
+#define NAU8824_REG_DRC_SLOPE_ADC_CH01  0x3A
+#define NAU8824_REG_DRC_ATKDCY_ADC_CH01 0x3B
+#define NAU8824_REG_DRC_KNEE_IP12_ADC_CH23      0x3C
+#define NAU8824_REG_DRC_KNEE_IP34_ADC_CH23      0x3D
+#define NAU8824_REG_DRC_SLOPE_ADC_CH23  0x3E
+#define NAU8824_REG_DRC_ATKDCY_ADC_CH23 0x3F
+#define NAU8824_REG_DRC_GAINL_ADC0              0x40
+#define NAU8824_REG_DRC_GAINL_ADC1              0x41
+#define NAU8824_REG_DRC_GAINL_ADC2              0x42
+#define NAU8824_REG_DRC_GAINL_ADC3              0x43
+#define NAU8824_REG_DRC_KNEE_IP12_DAC   0x45
+#define NAU8824_REG_DRC_KNEE_IP34_DAC   0x46
+#define NAU8824_REG_DRC_SLOPE_DAC               0x47
+#define NAU8824_REG_DRC_ATKDCY_DAC              0x48
+#define NAU8824_REG_DRC_GAIN_DAC_CH0    0x49
+#define NAU8824_REG_DRC_GAIN_DAC_CH1    0x4A
+#define NAU8824_REG_MODE                        0x4C
+#define NAU8824_REG_MODE1                       0x4D
+#define NAU8824_REG_MODE2                       0x4E
+#define NAU8824_REG_CLASSG                      0x50
+#define NAU8824_REG_OTP_EFUSE                   0x51
+#define NAU8824_REG_OTPDOUT_1           0x53
+#define NAU8824_REG_OTPDOUT_2           0x54
+#define NAU8824_REG_MISC_CTRL                   0x55
+#define NAU8824_REG_I2C_TIMEOUT         0x56
+#define NAU8824_REG_TEST_MODE           0x57
+#define NAU8824_REG_I2C_DEVICE_ID               0x58
+#define NAU8824_REG_SAR_ADC_DATA_OUT    0x59
+#define NAU8824_REG_BIAS_ADJ                    0x66
+#define NAU8824_REG_PGA_GAIN                    0x67
+#define NAU8824_REG_TRIM_SETTINGS               0x68
+#define NAU8824_REG_ANALOG_CONTROL_1    0x69
+#define NAU8824_REG_ANALOG_CONTROL_2    0x6A
+#define NAU8824_REG_ENABLE_LO                   0x6B
+#define NAU8824_REG_GAIN_LO                     0x6C
+#define NAU8824_REG_CLASSD_GAIN_1               0x6D
+#define NAU8824_REG_CLASSD_GAIN_2               0x6E
+#define NAU8824_REG_ANALOG_ADC_1                0x71
+#define NAU8824_REG_ANALOG_ADC_2                0x72
+#define NAU8824_REG_RDAC                        0x73
+#define NAU8824_REG_MIC_BIAS                    0x74
+#define NAU8824_REG_HS_VOLUME_CONTROL   0x75
+#define NAU8824_REG_BOOST                       0x76
+#define NAU8824_REG_FEPGA                       0x77
+#define NAU8824_REG_FEPGA_II                    0x78
+#define NAU8824_REG_FEPGA_SE                    0x79
+#define NAU8824_REG_FEPGA_ATTENUATION   0x7A
+#define NAU8824_REG_ATT_PORT0           0x7B
+#define NAU8824_REG_ATT_PORT1           0x7C
+#define NAU8824_REG_POWER_UP_CONTROL    0x7F
+#define NAU8824_REG_CHARGE_PUMP_CONTROL 0x80
+#define NAU8824_REG_CHARGE_PUMP_INPUT   0x81
+#define NAU8824_REG_MAX                 NAU8824_REG_CHARGE_PUMP_INPUT
+/* 16-bit control register address, and 16-bits control register data */
+#define NAU8824_REG_ADDR_LEN            16
+#define NAU8824_REG_DATA_LEN            16
+
+
+/* ENA_CTRL (0x1) */
+#define NAU8824_DMIC_LCH_EDGE_CH23      (0x1 << 12)
+#define NAU8824_DMIC_LCH_EDGE_CH01      (0x1 << 11)
+#define NAU8824_JD_SLEEP_MODE           (0x1 << 10)
+#define NAU8824_ADC_CH3_DMIC_SFT        9
+#define NAU8824_ADC_CH3_DMIC_EN (0x1 << NAU8824_ADC_CH3_DMIC_SFT)
+#define NAU8824_ADC_CH2_DMIC_SFT        8
+#define NAU8824_ADC_CH2_DMIC_EN (0x1 << NAU8824_ADC_CH2_DMIC_SFT)
+#define NAU8824_ADC_CH1_DMIC_SFT        7
+#define NAU8824_ADC_CH1_DMIC_EN (0x1 << NAU8824_ADC_CH1_DMIC_SFT)
+#define NAU8824_ADC_CH0_DMIC_SFT        6
+#define NAU8824_ADC_CH0_DMIC_EN (0x1 << NAU8824_ADC_CH0_DMIC_SFT)
+#define NAU8824_DAC_CH1_EN              (0x1 << 5)
+#define NAU8824_DAC_CH0_EN              (0x1 << 4)
+#define NAU8824_ADC_CH3_EN              (0x1 << 3)
+#define NAU8824_ADC_CH2_EN              (0x1 << 2)
+#define NAU8824_ADC_CH1_EN              (0x1 << 1)
+#define NAU8824_ADC_CH0_EN              0x1
+
+/* CLK_GATING_ENA (0x02) */
+#define NAU8824_CLK_ADC_CH23_EN (0x1 << 15)
+#define NAU8824_CLK_ADC_CH01_EN (0x1 << 14)
+#define NAU8824_CLK_DAC_CH1_EN  (0x1 << 13)
+#define NAU8824_CLK_DAC_CH0_EN  (0x1 << 12)
+#define NAU8824_CLK_I2S_EN              (0x1 << 7)
+#define NAU8824_CLK_GAIN_EN             (0x1 << 5)
+#define NAU8824_CLK_SAR_EN              (0x1 << 3)
+#define NAU8824_CLK_DMIC_CH23_EN        (0x1 << 1)
+
+/* CLK_DIVIDER (0x3) */
+#define NAU8824_CLK_SRC_SFT             15
+#define NAU8824_CLK_SRC_MASK            (1 << NAU8824_CLK_SRC_SFT)
+#define NAU8824_CLK_SRC_VCO             (1 << NAU8824_CLK_SRC_SFT)
+#define NAU8824_CLK_SRC_MCLK            (0 << NAU8824_CLK_SRC_SFT)
+#define NAU8824_CLK_MCLK_SRC_MASK       (0xf << 0)
+#define NAU8824_CLK_DMIC_SRC_SFT        10
+#define NAU8824_CLK_DMIC_SRC_MASK       (0x7 << NAU8824_CLK_DMIC_SRC_SFT)
+#define NAU8824_CLK_ADC_SRC_SFT 6
+#define NAU8824_CLK_ADC_SRC_MASK        (0x3 << NAU8824_CLK_ADC_SRC_SFT)
+#define NAU8824_CLK_DAC_SRC_SFT 4
+#define NAU8824_CLK_DAC_SRC_MASK        (0x3 << NAU8824_CLK_DAC_SRC_SFT)
+
+/* FLL1 (0x04) */
+#define NAU8824_FLL_RATIO_MASK  (0x7f << 0)
+
+/* FLL3 (0x06) */
+#define NAU8824_FLL_INTEGER_MASK        (0x3ff << 0)
+#define NAU8824_FLL_CLK_SRC_SFT 10
+#define NAU8824_FLL_CLK_SRC_MASK        (0x3 << NAU8824_FLL_CLK_SRC_SFT)
+#define NAU8824_FLL_CLK_SRC_MCLK        (0 << NAU8824_FLL_CLK_SRC_SFT)
+#define NAU8824_FLL_CLK_SRC_BLK (0x2 << NAU8824_FLL_CLK_SRC_SFT)
+#define NAU8824_FLL_CLK_SRC_FS          (0x3 << NAU8824_FLL_CLK_SRC_SFT)
+
+/* FLL4 (0x07) */
+#define NAU8824_FLL_REF_DIV_SFT 10
+#define NAU8824_FLL_REF_DIV_MASK        (0x3 << NAU8824_FLL_REF_DIV_SFT)
+
+/* FLL5 (0x08) */
+#define NAU8824_FLL_PDB_DAC_EN  (0x1 << 15)
+#define NAU8824_FLL_LOOP_FTR_EN (0x1 << 14)
+#define NAU8824_FLL_CLK_SW_MASK (0x1 << 13)
+#define NAU8824_FLL_CLK_SW_N2           (0x1 << 13)
+#define NAU8824_FLL_CLK_SW_REF  (0x0 << 13)
+#define NAU8824_FLL_FTR_SW_MASK (0x1 << 12)
+#define NAU8824_FLL_FTR_SW_ACCU (0x1 << 12)
+#define NAU8824_FLL_FTR_SW_FILTER       (0x0 << 12)
+
+/* FLL6 (0x9) */
+#define NAU8824_DCO_EN                  (0x1 << 15)
+#define NAU8824_SDM_EN                  (0x1 << 14)
+
+/* IRQ (0x10) */
+#define NAU8824_SHORT_CIRCUIT_IRQ               (0x1 << 7)
+#define NAU8824_IMPEDANCE_MEAS_IRQ              (0x1 << 6)
+#define NAU8824_KEY_RELEASE_IRQ         (0x1 << 5)
+#define NAU8824_KEY_LONG_PRESS_IRQ              (0x1 << 4)
+#define NAU8824_KEY_SHORT_PRESS_IRQ             (0x1 << 3)
+#define NAU8824_JACK_EJECTION_DETECTED  (0x1 << 1)
+#define NAU8824_JACK_INSERTION_DETECTED 0x1
+
+/* JACK_DET_CTRL (0x0D) */
+#define NAU8824_JACK_EJECT_DT_SFT       2
+#define NAU8824_JACK_EJECT_DT_MASK (0x3 << NAU8824_JACK_EJECT_DT_SFT)
+#define NAU8824_JACK_LOGIC              0x1
+
+
+/* INTERRUPT_SETTING_1 (0x0F) */
+#define NAU8824_IRQ_EJECT_EN            (0x1 << 9)
+#define NAU8824_IRQ_INSERT_EN           (0x1 << 8)
+
+/* INTERRUPT_SETTING (0x12) */
+#define NAU8824_IRQ_KEY_RELEASE_DIS             (0x1 << 5)
+#define NAU8824_IRQ_KEY_SHORT_PRESS_DIS (0x1 << 3)
+#define NAU8824_IRQ_EJECT_DIS                   (0x1 << 1)
+#define NAU8824_IRQ_INSERT_DIS          0x1
+
+/* SAR_ADC (0x13) */
+#define NAU8824_SAR_ADC_EN_SFT          12
+#define NAU8824_SAR_TRACKING_GAIN_SFT   8
+#define NAU8824_SAR_TRACKING_GAIN_MASK  (0x7 << NAU8824_SAR_TRACKING_GAIN_SFT)
+#define NAU8824_SAR_COMPARE_TIME_SFT    2
+#define NAU8824_SAR_COMPARE_TIME_MASK   (3 << 2)
+#define NAU8824_SAR_SAMPLING_TIME_SFT   0
+#define NAU8824_SAR_SAMPLING_TIME_MASK  (3 << 0)
+
+/* VDET_COEFFICIENT (0x14) */
+#define NAU8824_SHORTKEY_DEBOUNCE_SFT   12
+#define NAU8824_SHORTKEY_DEBOUNCE_MASK  (0x3 << NAU8824_SHORTKEY_DEBOUNCE_SFT)
+#define NAU8824_LEVELS_NR_SFT                   8
+#define NAU8824_LEVELS_NR_MASK          (0x7 << 8)
+#define NAU8824_HYSTERESIS_SFT          0
+#define NAU8824_HYSTERESIS_MASK         0xf
+
+/* PORT0_I2S_PCM_CTRL_1 (0x1C) */
+#define NAU8824_I2S_BP_SFT              7
+#define NAU8824_I2S_BP_MASK             (1 << NAU8824_I2S_BP_SFT)
+#define NAU8824_I2S_BP_INV              (1 << NAU8824_I2S_BP_SFT)
+#define NAU8824_I2S_PCMB_SFT            6
+#define NAU8824_I2S_PCMB_EN             (1 << NAU8824_I2S_PCMB_SFT)
+#define NAU8824_I2S_DL_SFT              2
+#define NAU8824_I2S_DL_MASK             (0x3 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_16               (0 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_20               (1 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_24               (2 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DL_32               (3 << NAU8824_I2S_DL_SFT)
+#define NAU8824_I2S_DF_MASK             0x3
+#define NAU8824_I2S_DF_RIGTH            0
+#define NAU8824_I2S_DF_LEFT             1
+#define NAU8824_I2S_DF_I2S              2
+#define NAU8824_I2S_DF_PCM_AB           3
+
+
+/* PORT0_I2S_PCM_CTRL_2 (0x1D) */
+#define NAU8824_I2S_LRC_DIV_SFT 12
+#define NAU8824_I2S_LRC_DIV_MASK        (0x3 << NAU8824_I2S_LRC_DIV_SFT)
+#define NAU8824_I2S_MS_SFT              3
+#define NAU8824_I2S_MS_MASK             (1 << NAU8824_I2S_MS_SFT)
+#define NAU8824_I2S_MS_MASTER           (1 << NAU8824_I2S_MS_SFT)
+#define NAU8824_I2S_MS_SLAVE            (0 << NAU8824_I2S_MS_SFT)
+#define NAU8824_I2S_BLK_DIV_MASK        0x7
+
+/* ADC_FILTER_CTRL (0x24) */
+#define NAU8824_ADC_SYNC_DOWN_MASK      0x3
+#define NAU8824_ADC_SYNC_DOWN_32        0
+#define NAU8824_ADC_SYNC_DOWN_64        1
+#define NAU8824_ADC_SYNC_DOWN_128       2
+#define NAU8824_ADC_SYNC_DOWN_256       3
+
+/* DAC_FILTER_CTRL_1 (0x25) */
+#define NAU8824_DAC_CICCLP_OFF  (0x1 << 7)
+#define NAU8824_DAC_OVERSAMPLE_MASK     0x7
+#define NAU8824_DAC_OVERSAMPLE_64       0
+#define NAU8824_DAC_OVERSAMPLE_256      1
+#define NAU8824_DAC_OVERSAMPLE_128      2
+#define NAU8824_DAC_OVERSAMPLE_32       4
+
+/* DAC_MUTE_CTRL (0x31) */
+#define NAU8824_DAC_CH01_MIX            0x3
+#define NAU8824_DAC_ZC_EN               (0x1 << 11)
+
+/* DAC_CH0_DGAIN_CTRL (0x32) */
+#define NAU8824_DAC_CH0_SEL_SFT 9
+#define NAU8824_DAC_CH0_SEL_MASK        (0x1 << NAU8824_DAC_CH0_SEL_SFT)
+#define NAU8824_DAC_CH0_SEL_I2S0        (0x0 << NAU8824_DAC_CH0_SEL_SFT)
+#define NAU8824_DAC_CH0_SEL_I2S1        (0x1 << NAU8824_DAC_CH0_SEL_SFT)
+#define NAU8824_DAC_CH0_VOL_MASK        0x1ff
+
+/* DAC_CH1_DGAIN_CTRL (0x33) */
+#define NAU8824_DAC_CH1_SEL_SFT 9
+#define NAU8824_DAC_CH1_SEL_MASK        (0x1 << NAU8824_DAC_CH1_SEL_SFT)
+#define NAU8824_DAC_CH1_SEL_I2S0        (0x0 << NAU8824_DAC_CH1_SEL_SFT)
+#define NAU8824_DAC_CH1_SEL_I2S1        (0x1 << NAU8824_DAC_CH1_SEL_SFT)
+#define NAU8824_DAC_CH1_VOL_MASK        0x1ff
+
+/* CLASSG (0x50) */
+#define NAU8824_CLASSG_TIMER_SFT        8
+#define NAU8824_CLASSG_TIMER_MASK       (0x3f << NAU8824_CLASSG_TIMER_SFT)
+#define NAU8824_CLASSG_LDAC_EN_SFT      2
+#define NAU8824_CLASSG_RDAC_EN_SFT      1
+#define NAU8824_CLASSG_EN_SFT           0
+
+/* SAR_ADC_DATA_OUT (0x59) */
+#define NAU8824_SAR_ADC_DATA_MASK       0xff
+
+/* BIAS_ADJ (0x66) */
+#define NAU8824_VMID                    (1 << 6)
+#define NAU8824_VMID_SEL_SFT            4
+#define NAU8824_VMID_SEL_MASK           (3 << NAU8824_VMID_SEL_SFT)
+#define NAU8824_DMIC2_EN_SFT            3
+#define NAU8824_DMIC1_EN_SFT            2
+
+/* TRIM_SETTINGS (0x68) */
+#define NAU8824_DRV_CURR_INC            (1 << 15)
+
+/* ANALOG_CONTROL_1 (0x69) */
+#define NAU8824_DMIC_CLK_DRV_STRG       (1 << 3)
+#define NAU8824_DMIC_CLK_SLEW_FAST      (0x7)
+
+/* ANALOG_CONTROL_2 (0x6A) */
+#define NAU8824_CLASSD_CLAMP_DIS_SFT    3
+#define NAU8824_CLASSD_CLAMP_DIS        (0x1 << NAU8824_CLASSD_CLAMP_DIS_SFT)
+
+/* ENABLE_LO (0x6B) */
+#define NAU8824_TEST_DAC_SFT            14
+#define NAU8824_TEST_DAC_EN             (0x3 << NAU8824_TEST_DAC_SFT)
+#define NAU8824_DACL_HPR_EN_SFT 3
+#define NAU8824_DACL_HPR_EN             (0x1 << NAU8824_DACL_HPR_EN_SFT)
+#define NAU8824_DACR_HPR_EN_SFT 2
+#define NAU8824_DACR_HPR_EN             (0x1 << NAU8824_DACR_HPR_EN_SFT)
+#define NAU8824_DACR_HPL_EN_SFT 1
+#define NAU8824_DACR_HPL_EN             (0x1 << NAU8824_DACR_HPL_EN_SFT)
+#define NAU8824_DACL_HPL_EN_SFT 0
+#define NAU8824_DACL_HPL_EN             0x1
+
+/* CLASSD_GAIN_1 (0x6D) */
+#define NAU8824_CLASSD_GAIN_1R_SFT      8
+#define NAU8824_CLASSD_GAIN_1R_MASK     (0x1f << NAU8824_CLASSD_GAIN_1R_SFT)
+#define NAU8824_CLASSD_EN_SFT           7
+#define NAU8824_CLASSD_EN               (0x1 << NAU8824_CLASSD_EN_SFT)
+#define NAU8824_CLASSD_GAIN_1L_MASK     0x1f
+
+/* CLASSD_GAIN_2 (0x6E) */
+#define NAU8824_CLASSD_GAIN_2R_SFT      8
+#define NAU8824_CLASSD_GAIN_2R_MASK     (0x1f << NAU8824_CLASSD_GAIN_1R_SFT)
+#define NAU8824_CLASSD_EN_SFT           7
+#define NAU8824_CLASSD_EN               (0x1 << NAU8824_CLASSD_EN_SFT)
+#define NAU8824_CLASSD_GAIN_2L_MASK     0x1f
+
+/* ANALOG_ADC_2 (0x72) */
+#define NAU8824_ADCR_EN_SFT             7
+#define NAU8824_ADCL_EN_SFT             6
+
+/* RDAC (0x73) */
+#define NAU8824_DACR_EN_SFT             13
+#define NAU8824_DACL_EN_SFT             12
+#define NAU8824_DACR_CLK_SFT            9
+#define NAU8824_DACL_CLK_SFT            8
+#define NAU8824_RDAC_CLK_DELAY_SFT      4
+#define NAU8824_RDAC_CLK_DELAY_MASK     (0x7 << NAU8824_RDAC_CLK_DELAY_SFT)
+#define NAU8824_RDAC_VREF_SFT           2
+#define NAU8824_RDAC_VREF_MASK  (0x3 << NAU8824_RDAC_VREF_SFT)
+
+/* MIC_BIAS (0x74) */
+#define NAU8824_MICBIAS_JKSLV           (1 << 14)
+#define NAU8824_MICBIAS_JKR2            (1 << 12)
+#define NAU8824_MICBIAS_POWERUP_SFT     8
+#define NAU8824_MICBIAS_VOLTAGE_SFT     0
+#define NAU8824_MICBIAS_VOLTAGE_MASK    0x7
+
+/* BOOST (0x76) */
+#define NAU8824_PRECHARGE_DIS                   (0x1 << 13)
+#define NAU8824_GLOBAL_BIAS_EN          (0x1 << 12)
+#define NAU8824_HP_BOOST_DIS_SFT                9
+#define NAU8824_HP_BOOST_DIS            (0x1 << NAU8824_HP_BOOST_DIS_SFT)
+#define NAU8824_HP_BOOST_G_DIS_SFT              8
+#define NAU8824_HP_BOOST_G_DIS          (0x1 << NAU8824_HP_BOOST_G_DIS_SFT)
+#define NAU8824_SHORT_SHUTDOWN_DIG_EN   (1 << 7)
+#define NAU8824_SHORT_SHUTDOWN_EN               (1 << 6)
+
+/* FEPGA (0x77) */
+#define NAU8824_FEPGA_MODER_SHORT_SFT   7
+#define NAU8824_FEPGA_MODER_SHORT_EN    (0x1 << NAU8824_FEPGA_MODER_SHORT_SFT)
+#define NAU8824_FEPGA_MODER_MIC2_SFT            5
+#define NAU8824_FEPGA_MODER_MIC2_EN     (0x1 << NAU8824_FEPGA_MODER_MIC2_SFT)
+#define NAU8824_FEPGA_MODER_HSMIC_SFT   4
+#define NAU8824_FEPGA_MODER_HSMIC_EN    (0x1 << NAU8824_FEPGA_MODER_HSMIC_SFT)
+#define NAU8824_FEPGA_MODEL_SHORT_SFT   3
+#define NAU8824_FEPGA_MODEL_SHORT_EN    (0x1 << NAU8824_FEPGA_MODEL_SHORT_SFT)
+#define NAU8824_FEPGA_MODEL_MIC1_SFT            1
+#define NAU8824_FEPGA_MODEL_MIC1_EN     (0x1 << NAU8824_FEPGA_MODEL_MIC1_SFT)
+#define NAU8824_FEPGA_MODEL_HSMIC_SFT   0
+#define NAU8824_FEPGA_MODEL_HSMIC_EN    (0x1 << NAU8824_FEPGA_MODEL_HSMIC_SFT)
+
+/* FEPGA_II (0x78) */
+#define NAU8824_FEPGA_GAINR_SFT 5
+#define NAU8824_FEPGA_GAINR_MASK        (0x1f << NAU8824_FEPGA_GAINR_SFT)
+#define NAU8824_FEPGA_GAINL_SFT 0
+#define NAU8824_FEPGA_GAINL_MASK        0x1f
+
+/* CHARGE_PUMP_CONTROL (0x80) */
+#define NAU8824_JAMNODCLOW              (0x1 << 15)
+#define NAU8824_SPKR_PULL_DOWN  (0x1 << 13)
+#define NAU8824_SPKL_PULL_DOWN  (0x1 << 12)
+#define NAU8824_POWER_DOWN_DACR (0x1 << 9)
+#define NAU8824_POWER_DOWN_DACL (0x1 << 8)
+#define NAU8824_CHARGE_PUMP_EN_SFT      5
+#define NAU8824_CHARGE_PUMP_EN  (0x1 << NAU8824_CHARGE_PUMP_EN_SFT)
+
+
+#define NAU8824_CODEC_DAI "nau8824-hifi"
+
+/* System Clock Source */
+enum {
+        NAU8824_CLK_DIS,
+        NAU8824_CLK_MCLK,
+        NAU8824_CLK_INTERNAL,
+        NAU8824_CLK_FLL_MCLK,
+        NAU8824_CLK_FLL_BLK,
+        NAU8824_CLK_FLL_FS,
+};
+
+struct nau8824 {
+        struct device *dev;
+        struct regmap *regmap;
+        struct snd_soc_dapm_context *dapm;
+        struct snd_soc_jack *jack;
+        struct work_struct jdet_work;
+        struct semaphore jd_sem;
+        int fs;
+        int irq;
+        int micbias_voltage;
+        int vref_impedance;
+        int jkdet_polarity;
+        int sar_threshold_num;
+        int sar_threshold[8];
+        int sar_hysteresis;
+        int sar_voltage;
+        int sar_compare_time;
+        int sar_sampling_time;
+        int key_debounce;
+        int jack_eject_debounce;
+};
+
+struct nau8824_fll {
+        int mclk_src;
+        int ratio;
+        int fll_frac;
+        int fll_int;
+        int clk_ref_div;
+};
+
+struct nau8824_fll_attr {
+        unsigned int param;
+        unsigned int val;
+};
+
+struct nau8824_osr_attr {
+        unsigned int osr;
+        unsigned int clk_src;
+};
+
+
+int nau8824_enable_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *jack);
+
+#endif                          /* _NAU8824_H */
+
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index b281a46d769d..f91221b1ddf0 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -1084,13 +1084,28 @@ static int rt5514_parse_dt(struct rt5514_priv *rt5514, struct device *dev)
         return 0;
 }
 
+static __maybe_unused int rt5514_i2c_resume(struct device *dev)
+{
+        struct rt5514_priv *rt5514 = dev_get_drvdata(dev);
+        unsigned int val;
+
+        /*
+         * Add a bogus read to avoid rt5514's confusion after s2r in case it
+         * saw glitches on the i2c lines and thought the other side sent a
+         * start bit.
+         */
+        regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
+
+        return 0;
+}
+
 static int rt5514_i2c_probe(struct i2c_client *i2c,
                     const struct i2c_device_id *id)
 {
         struct rt5514_platform_data *pdata = dev_get_platdata(&i2c->dev);
         struct rt5514_priv *rt5514;
         int ret;
-        unsigned int val;
+        unsigned int val = ~0;
 
         rt5514 = devm_kzalloc(&i2c->dev, sizeof(struct rt5514_priv),
                                 GFP_KERNEL);
@@ -1120,8 +1135,16 @@ static int rt5514_i2c_probe(struct i2c_client *i2c,
                 return ret;
         }
 
-        regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
-        if (val != RT5514_DEVICE_ID) {
+        /*
+         * The rt5514 can get confused if the i2c lines glitch together, as
+         * can happen at bootup as regulators are turned off and on.  If it's
+         * in this glitched state the first i2c read will fail, so we'll give
+         * it one change to retry.
+         */
+        ret = regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
+        if (ret || val != RT5514_DEVICE_ID)
+                ret = regmap_read(rt5514->regmap, RT5514_VENDOR_ID2, &val);
+        if (ret || val != RT5514_DEVICE_ID) {
                 dev_err(&i2c->dev,
                         "Device with ID register %x is not rt5514\n", val);
                 return -ENODEV;
@@ -1149,10 +1172,15 @@ static int rt5514_i2c_remove(struct i2c_client *i2c)
         return 0;
 }
 
-struct i2c_driver rt5514_i2c_driver = {
+static const struct dev_pm_ops rt5514_i2_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(NULL, rt5514_i2c_resume)
+};
+
+static struct i2c_driver rt5514_i2c_driver = {
         .driver = {
                 .name = "rt5514",
                 .of_match_table = of_match_ptr(rt5514_of_match),
+                .pm = &rt5514_i2_pm_ops,
         },
         .probe = rt5514_i2c_probe,
         .remove   = rt5514_i2c_remove,
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index e149f3ce5401..87844a45886a 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3542,6 +3542,15 @@ static const struct i2c_device_id rt5645_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, rt5645_i2c_id);
 
+#ifdef CONFIG_OF
+static const struct of_device_id rt5645_of_match[] = {
+        { .compatible = "realtek,rt5645", },
+        { .compatible = "realtek,rt5650", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, rt5645_of_match);
+#endif
+
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id rt5645_acpi_match[] = {
         { "10EC5645", 0 },
@@ -3912,6 +3921,7 @@ static void rt5645_i2c_shutdown(struct i2c_client *i2c)
 static struct i2c_driver rt5645_i2c_driver = {
         .driver = {
                 .name = "rt5645",
+                .of_match_table = of_match_ptr(rt5645_of_match),
                 .acpi_match_table = ACPI_PTR(rt5645_acpi_match),
         },
         .probe = rt5645_i2c_probe,
diff --git a/sound/soc/codecs/rt5665.c b/sound/soc/codecs/rt5665.c
index 324461e985b3..8cd22307f5b6 100644
--- a/sound/soc/codecs/rt5665.c
+++ b/sound/soc/codecs/rt5665.c
@@ -1139,7 +1139,8 @@ static void rt5665_enable_push_button_irq(struct snd_soc_codec *codec,
         bool enable)
 {
         if (enable) {
-                snd_soc_write(codec, RT5665_4BTN_IL_CMD_1, 0x000b);
+                snd_soc_write(codec, RT5665_4BTN_IL_CMD_1, 0x0003);
+                snd_soc_update_bits(codec, RT5665_SAR_IL_CMD_9, 0x1, 0x1);
                 snd_soc_write(codec, RT5665_IL_CMD_1, 0x0048);
                 snd_soc_update_bits(codec, RT5665_4BTN_IL_CMD_2,
                                 RT5665_4BTN_IL_MASK | RT5665_4BTN_IL_RST_MASK,
@@ -1192,10 +1193,13 @@ static int rt5665_headset_detect(struct snd_soc_codec *codec, int jack_insert)
                 }
 
                 regmap_update_bits(rt5665->regmap, RT5665_EJD_CTRL_1,
-                        0x180, 0x180);
+                        0x1a0, 0x120);
                 regmap_write(rt5665->regmap, RT5665_EJD_CTRL_3, 0x3424);
+                regmap_write(rt5665->regmap, RT5665_IL_CMD_1, 0x0048);
                 regmap_write(rt5665->regmap, RT5665_SAR_IL_CMD_1, 0xa291);
 
+                usleep_range(10000, 15000);
+
                 rt5665->sar_adc_value = snd_soc_read(rt5665->codec,
                         RT5665_SAR_IL_CMD_4) & 0x7ff;
 
@@ -1241,7 +1245,7 @@ static irqreturn_t rt5665_irq(int irq, void *data)
 static void rt5665_jd_check_handler(struct work_struct *work)
 {
         struct rt5665_priv *rt5665 = container_of(work, struct rt5665_priv,
-                calibrate_work.work);
+                jd_check_work.work);
 
         if (snd_soc_read(rt5665->codec, RT5665_AJD1_CTRL) & 0x0010) {
                 /* jack out */
@@ -1256,8 +1260,8 @@ static void rt5665_jd_check_handler(struct work_struct *work)
         }
 }
 
-int rt5665_set_jack_detect(struct snd_soc_codec *codec,
-        struct snd_soc_jack *hs_jack)
+static int rt5665_set_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *hs_jack, void *data)
 {
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
 
@@ -1284,7 +1288,6 @@ int rt5665_set_jack_detect(struct snd_soc_codec *codec,
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(rt5665_set_jack_detect);
 
 static void rt5665_jack_detect_handler(struct work_struct *work)
 {
@@ -2252,7 +2255,7 @@ static const char * const rt5665_if2_1_adc_in_src[] = {
 
 static const SOC_ENUM_SINGLE_DECL(
         rt5665_if2_1_adc_in_enum, RT5665_DIG_INF2_DATA,
-        RT5665_IF3_ADC_IN_SFT, rt5665_if2_1_adc_in_src);
+        RT5665_IF2_1_ADC_IN_SFT, rt5665_if2_1_adc_in_src);
 
 static const struct snd_kcontrol_new rt5665_if2_1_adc_in_mux =
         SOC_DAPM_ENUM("IF2_1 ADC IN Source", rt5665_if2_1_adc_in_enum);
@@ -2600,6 +2603,55 @@ static int rt5655_set_verf(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
+static int rt5665_i2s_pin_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        unsigned int val1, val2, mask1, mask2 = 0;
+
+        switch (w->shift) {
+        case RT5665_PWR_I2S2_1_BIT:
+                mask1 = RT5665_GP2_PIN_MASK | RT5665_GP3_PIN_MASK |
+                        RT5665_GP4_PIN_MASK | RT5665_GP5_PIN_MASK;
+                val1 = RT5665_GP2_PIN_BCLK2 | RT5665_GP3_PIN_LRCK2 |
+                        RT5665_GP4_PIN_DACDAT2_1 | RT5665_GP5_PIN_ADCDAT2_1;
+                break;
+        case RT5665_PWR_I2S2_2_BIT:
+                mask1 = RT5665_GP2_PIN_MASK | RT5665_GP3_PIN_MASK |
+                        RT5665_GP8_PIN_MASK;
+                val1 = RT5665_GP2_PIN_BCLK2 | RT5665_GP3_PIN_LRCK2 |
+                        RT5665_GP8_PIN_DACDAT2_2;
+                mask2 = RT5665_GP9_PIN_MASK;
+                val2 = RT5665_GP9_PIN_ADCDAT2_2;
+                break;
+        case RT5665_PWR_I2S3_BIT:
+                mask1 = RT5665_GP6_PIN_MASK | RT5665_GP7_PIN_MASK |
+                        RT5665_GP8_PIN_MASK;
+                val1 = RT5665_GP6_PIN_BCLK3 | RT5665_GP7_PIN_LRCK3 |
+                        RT5665_GP8_PIN_DACDAT3;
+                mask2 = RT5665_GP9_PIN_MASK;
+                val2 = RT5665_GP9_PIN_ADCDAT3;
+                break;
+        }
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1, mask1, val1);
+                if (mask2)
+                        snd_soc_update_bits(codec, RT5665_GPIO_CTRL_2,
+                                            mask2, val2);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                snd_soc_update_bits(codec, RT5665_GPIO_CTRL_1, mask1, 0);
+                if (mask2)
+                        snd_soc_update_bits(codec, RT5665_GPIO_CTRL_2,
+                                            mask2, 0);
+                break;
+        default:
+                return 0;
+        }
+
+        return 0;
+}
 
 static const struct snd_soc_dapm_widget rt5665_dapm_widgets[] = {
         SND_SOC_DAPM_SUPPLY("LDO2", RT5665_PWR_ANLG_3, RT5665_PWR_LDO2_BIT, 0,
@@ -2852,11 +2904,14 @@ static const struct snd_soc_dapm_widget rt5665_dapm_widgets[] = {
         SND_SOC_DAPM_SUPPLY("I2S1_2", RT5665_PWR_DIG_1, RT5665_PWR_I2S1_2_BIT,
                 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY("I2S2_1", RT5665_PWR_DIG_1, RT5665_PWR_I2S2_1_BIT,
-                0, NULL, 0),
+                0, rt5665_i2s_pin_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMD),
         SND_SOC_DAPM_SUPPLY("I2S2_2", RT5665_PWR_DIG_1, RT5665_PWR_I2S2_2_BIT,
-                0, NULL, 0),
+                0, rt5665_i2s_pin_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMD),
         SND_SOC_DAPM_SUPPLY("I2S3", RT5665_PWR_DIG_1, RT5665_PWR_I2S3_BIT,
-                0, NULL, 0),
+                0, rt5665_i2s_pin_event, SND_SOC_DAPM_PRE_PMU |
+                SND_SOC_DAPM_POST_PMD),
         SND_SOC_DAPM_PGA("IF1 DAC1", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("IF1 DAC2", SND_SOC_NOPM, 0, 0, NULL, 0),
         SND_SOC_DAPM_PGA("IF1 DAC3", SND_SOC_NOPM, 0, 0, NULL, 0),
@@ -3178,6 +3233,9 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
         {"DAC Mono Right Filter", NULL, "DAC Mono R ASRC", is_using_asrc},
         {"DAC Stereo1 Filter", NULL, "DAC STO1 ASRC", is_using_asrc},
         {"DAC Stereo2 Filter", NULL, "DAC STO2 ASRC", is_using_asrc},
+        {"I2S1 ASRC", NULL, "CLKDET"},
+        {"I2S2 ASRC", NULL, "CLKDET"},
+        {"I2S3 ASRC", NULL, "CLKDET"},
 
         /*Vref*/
         {"Mic Det Power", NULL, "Vref2"},
@@ -3912,6 +3970,7 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
         {"Mono MIX", "MONOVOL Switch", "MONOVOL"},
         {"Mono Amp", NULL, "Mono MIX"},
         {"Mono Amp", NULL, "Vref2"},
+        {"Mono Amp", NULL, "Vref3"},
         {"Mono Amp", NULL, "CLKDET SYS"},
         {"Mono Amp", NULL, "CLKDET MONO"},
         {"Mono Playback", "Switch", "Mono Amp"},
@@ -3959,12 +4018,68 @@ static const struct snd_soc_dapm_route rt5665_dapm_routes[] = {
         {"PDMR", NULL, "PDM R Playback"},
 };
 
+static int rt5665_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
+                        unsigned int rx_mask, int slots, int slot_width)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        unsigned int val = 0;
+
+        if (rx_mask || tx_mask)
+                val |= RT5665_I2S1_MODE_TDM;
+
+        switch (slots) {
+        case 4:
+                val |= RT5665_TDM_IN_CH_4;
+                val |= RT5665_TDM_OUT_CH_4;
+                break;
+        case 6:
+                val |= RT5665_TDM_IN_CH_6;
+                val |= RT5665_TDM_OUT_CH_6;
+                break;
+        case 8:
+                val |= RT5665_TDM_IN_CH_8;
+                val |= RT5665_TDM_OUT_CH_8;
+                break;
+        case 2:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (slot_width) {
+        case 20:
+                val |= RT5665_TDM_IN_LEN_20;
+                val |= RT5665_TDM_OUT_LEN_20;
+                break;
+        case 24:
+                val |= RT5665_TDM_IN_LEN_24;
+                val |= RT5665_TDM_OUT_LEN_24;
+                break;
+        case 32:
+                val |= RT5665_TDM_IN_LEN_32;
+                val |= RT5665_TDM_OUT_LEN_32;
+                break;
+        case 16:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, RT5665_TDM_CTRL_1,
+                RT5665_I2S1_MODE_MASK | RT5665_TDM_IN_CH_MASK |
+                RT5665_TDM_OUT_CH_MASK | RT5665_TDM_IN_LEN_MASK |
+                RT5665_TDM_OUT_LEN_MASK, val);
+
+        return 0;
+}
+
+
 static int rt5665_hw_params(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
 {
         struct snd_soc_codec *codec = dai->codec;
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val_len = 0, val_clk, mask_clk, val_bits = 0x0100;
+        unsigned int val_len = 0, val_clk, reg_clk, mask_clk, val_bits = 0x0100;
         int pre_div, frame_size;
 
         rt5665->lrck[dai->id] = params_rate(params);
@@ -4005,6 +4120,10 @@ static int rt5665_hw_params(struct snd_pcm_substream *substream,
         switch (dai->id) {
         case RT5665_AIF1_1:
         case RT5665_AIF1_2:
+                if (params_channels(params) > 2)
+                        rt5665_set_tdm_slot(dai, 0xf, 0xf,
+                                params_channels(params), params_width(params));
+                reg_clk = RT5665_ADDA_CLK_1;
                 mask_clk = RT5665_I2S_PD1_MASK;
                 val_clk = pre_div << RT5665_I2S_PD1_SFT;
                 snd_soc_update_bits(codec, RT5665_I2S1_SDP,
@@ -4012,12 +4131,14 @@ static int rt5665_hw_params(struct snd_pcm_substream *substream,
                 break;
         case RT5665_AIF2_1:
         case RT5665_AIF2_2:
+                reg_clk = RT5665_ADDA_CLK_2;
                 mask_clk = RT5665_I2S_PD2_MASK;
                 val_clk = pre_div << RT5665_I2S_PD2_SFT;
                 snd_soc_update_bits(codec, RT5665_I2S2_SDP,
                         RT5665_I2S_DL_MASK, val_len);
                 break;
         case RT5665_AIF3:
+                reg_clk = RT5665_ADDA_CLK_2;
                 mask_clk = RT5665_I2S_PD3_MASK;
                 val_clk = pre_div << RT5665_I2S_PD3_SFT;
                 snd_soc_update_bits(codec, RT5665_I2S3_SDP,
@@ -4028,7 +4149,7 @@ static int rt5665_hw_params(struct snd_pcm_substream *substream,
                 return -EINVAL;
         }
 
-        snd_soc_update_bits(codec, RT5665_ADDA_CLK_1, mask_clk, val_clk);
+        snd_soc_update_bits(codec, reg_clk, mask_clk, val_clk);
         snd_soc_update_bits(codec, RT5665_STO1_DAC_SIL_DET, 0x3700, val_bits);
 
         switch (rt5665->lrck[dai->id]) {
@@ -4121,10 +4242,9 @@ static int rt5665_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         return 0;
 }
 
-static int rt5665_set_dai_sysclk(struct snd_soc_dai *dai,
-                int clk_id, unsigned int freq, int dir)
+static int rt5665_set_codec_sysclk(struct snd_soc_codec *codec, int clk_id,
+                                   int source, unsigned int freq, int dir)
 {
-        struct snd_soc_codec *codec = dai->codec;
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
         unsigned int reg_val = 0;
 
@@ -4150,20 +4270,20 @@ static int rt5665_set_dai_sysclk(struct snd_soc_dai *dai,
         rt5665->sysclk = freq;
         rt5665->sysclk_src = clk_id;
 
-        dev_dbg(dai->dev, "Sysclk is %dHz and clock id is %d\n", freq, clk_id);
+        dev_dbg(codec->dev, "Sysclk is %dHz and clock id is %d\n", freq, clk_id);
 
         return 0;
 }
 
-static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
-                        unsigned int freq_in, unsigned int freq_out)
+static int rt5665_set_codec_pll(struct snd_soc_codec *codec, int pll_id,
+                                int source, unsigned int freq_in,
+                                unsigned int freq_out)
 {
-        struct snd_soc_codec *codec = dai->codec;
         struct rt5665_priv *rt5665 = snd_soc_codec_get_drvdata(codec);
         struct rl6231_pll_code pll_code;
         int ret;
 
-        if (Source == rt5665->pll_src && freq_in == rt5665->pll_in &&
+        if (source == rt5665->pll_src && freq_in == rt5665->pll_in &&
             freq_out == rt5665->pll_out)
                 return 0;
 
@@ -4177,7 +4297,7 @@ static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
                 return 0;
         }
 
-        switch (Source) {
+        switch (source) {
         case RT5665_PLL1_S_MCLK:
                 snd_soc_update_bits(codec, RT5665_GLB_CLK,
                         RT5665_PLL1_SRC_MASK, RT5665_PLL1_SRC_MCLK);
@@ -4195,7 +4315,7 @@ static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
                                 RT5665_PLL1_SRC_MASK, RT5665_PLL1_SRC_BCLK3);
                 break;
         default:
-                dev_err(codec->dev, "Unknown PLL Source %d\n", Source);
+                dev_err(codec->dev, "Unknown PLL Source %d\n", source);
                 return -EINVAL;
         }
 
@@ -4217,62 +4337,7 @@ static int rt5665_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int Source,
 
         rt5665->pll_in = freq_in;
         rt5665->pll_out = freq_out;
-        rt5665->pll_src = Source;
-
-        return 0;
-}
-
-static int rt5665_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
-                        unsigned int rx_mask, int slots, int slot_width)
-{
-        struct snd_soc_codec *codec = dai->codec;
-        unsigned int val = 0;
-
-        if (rx_mask || tx_mask)
-                val |= RT5665_I2S1_MODE_TDM;
-
-        switch (slots) {
-        case 4:
-                val |= RT5665_TDM_IN_CH_4;
-                val |= RT5665_TDM_OUT_CH_4;
-                break;
-        case 6:
-                val |= RT5665_TDM_IN_CH_6;
-                val |= RT5665_TDM_OUT_CH_6;
-                break;
-        case 8:
-                val |= RT5665_TDM_IN_CH_8;
-                val |= RT5665_TDM_OUT_CH_8;
-                break;
-        case 2:
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        switch (slot_width) {
-        case 20:
-                val |= RT5665_TDM_IN_LEN_20;
-                val |= RT5665_TDM_OUT_LEN_20;
-                break;
-        case 24:
-                val |= RT5665_TDM_IN_LEN_24;
-                val |= RT5665_TDM_OUT_LEN_24;
-                break;
-        case 32:
-                val |= RT5665_TDM_IN_LEN_32;
-                val |= RT5665_TDM_OUT_LEN_32;
-                break;
-        case 16:
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        snd_soc_update_bits(codec, RT5665_TDM_CTRL_1,
-                RT5665_I2S1_MODE_MASK | RT5665_TDM_IN_CH_MASK |
-                RT5665_TDM_OUT_CH_MASK | RT5665_TDM_IN_LEN_MASK |
-                RT5665_TDM_OUT_LEN_MASK, val);
+        rt5665->pll_src = source;
 
         return 0;
 }
@@ -4389,9 +4454,7 @@ static int rt5665_resume(struct snd_soc_codec *codec)
 static const struct snd_soc_dai_ops rt5665_aif_dai_ops = {
         .hw_params = rt5665_hw_params,
         .set_fmt = rt5665_set_dai_fmt,
-        .set_sysclk = rt5665_set_dai_sysclk,
         .set_tdm_slot = rt5665_set_tdm_slot,
-        .set_pll = rt5665_set_dai_pll,
         .set_bclk_ratio = rt5665_set_bclk_ratio,
 };
 
@@ -4500,7 +4563,10 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5665 = {
                 .num_dapm_widgets = ARRAY_SIZE(rt5665_dapm_widgets),
                 .dapm_routes = rt5665_dapm_routes,
                 .num_dapm_routes = ARRAY_SIZE(rt5665_dapm_routes),
-        }
+        },
+        .set_sysclk = rt5665_set_codec_sysclk,
+        .set_pll = rt5665_set_codec_pll,
+        .set_jack = rt5665_set_jack_detect,
 };
 
 
@@ -4779,7 +4845,7 @@ static int rt5665_i2c_probe(struct i2c_client *i2c,
 
         regmap_write(rt5665->regmap, RT5665_HP_LOGIC_CTRL_2, 0x0002);
         regmap_update_bits(rt5665->regmap, RT5665_EJD_CTRL_1,
-                0xf000 | RT5665_VREF_POW_MASK, 0xd000 | RT5665_VREF_POW_REG);
+                0xf000 | RT5665_VREF_POW_MASK, 0xe000 | RT5665_VREF_POW_REG);
         /* Work around for pow_pump */
         regmap_update_bits(rt5665->regmap, RT5665_STO1_DAC_SIL_DET,
                 RT5665_DEB_STO_DAC_MASK, RT5665_DEB_80_MS);
@@ -4798,7 +4864,7 @@ static int rt5665_i2c_probe(struct i2c_client *i2c,
         /* Enhance performance*/
         regmap_update_bits(rt5665->regmap, RT5665_PWR_ANLG_1,
                 RT5665_HP_DRIVER_MASK | RT5665_LDO1_DVO_MASK,
-                RT5665_HP_DRIVER_5X | RT5665_LDO1_DVO_09);
+                RT5665_HP_DRIVER_5X | RT5665_LDO1_DVO_12);
 
         INIT_DELAYED_WORK(&rt5665->jack_detect_work,
                                 rt5665_jack_detect_handler);
diff --git a/sound/soc/codecs/rt5665.h b/sound/soc/codecs/rt5665.h
index 12f7080a0d3c..1db5c6a62a8e 100644
--- a/sound/soc/codecs/rt5665.h
+++ b/sound/soc/codecs/rt5665.h
@@ -1106,7 +1106,7 @@
 #define RT5665_HP_DRIVER_MASK                   (0x3 << 2)
 #define RT5665_HP_DRIVER_1X                     (0x0 << 2)
 #define RT5665_HP_DRIVER_3X                     (0x1 << 2)
-#define RT5665_HP_DRIVER_5X                     (0x2 << 2)
+#define RT5665_HP_DRIVER_5X                     (0x3 << 2)
 #define RT5665_LDO1_DVO_MASK                    (0x3)
 #define RT5665_LDO1_DVO_09                      (0x0)
 #define RT5665_LDO1_DVO_10                      (0x1)
@@ -1984,7 +1984,5 @@ enum {
 
 int rt5665_sel_asrc_clk_src(struct snd_soc_codec *codec,
                 unsigned int filter_mask, unsigned int clk_src);
-int rt5665_set_jack_detect(struct snd_soc_codec *codec,
-        struct snd_soc_jack *hs_jack);
 
 #endif /* __RT5665_H__ */
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index 17d20b99f041..e27c5a4a0a15 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -2835,6 +2835,27 @@ static const struct dmi_system_id dmi_platform_intel_braswell[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Wyse 3040"),
                 },
         },
+        {
+                .ident = "Lenovo Thinkpad Tablet 10",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 10"),
+                },
+        },
+        {
+                .ident = "Lenovo Thinkpad Tablet 10",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Tablet B"),
+                },
+        },
+        {
+                .ident = "Lenovo Thinkpad Tablet 10",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Miix 2 10"),
+                },
+        },
         {}
 };
 
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index abc802a5a479..65ac4518ad06 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -5035,6 +5035,12 @@ static const struct i2c_device_id rt5677_i2c_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id);
 
+static const struct of_device_id rt5677_of_match[] = {
+        { .compatible = "realtek,rt5677", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, rt5677_of_match);
+
 static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false };
 static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false };
 static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false };
@@ -5294,6 +5300,7 @@ static int rt5677_i2c_remove(struct i2c_client *i2c)
 static struct i2c_driver rt5677_i2c_driver = {
         .driver = {
                 .name = "rt5677",
+                .of_match_table = rt5677_of_match,
         },
         .probe = rt5677_i2c_probe,
         .remove   = rt5677_i2c_remove,
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index d151224ffcca..20695b691aff 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -112,17 +112,22 @@
 #define ADSP1_CLK_SEL_SHIFT                    0  /* CLK_SEL_ENA */
 #define ADSP1_CLK_SEL_WIDTH                    3  /* CLK_SEL_ENA */
 
-#define ADSP2_CONTROL        0x0
-#define ADSP2_CLOCKING       0x1
-#define ADSP2_STATUS1        0x4
-#define ADSP2_WDMA_CONFIG_1 0x30
-#define ADSP2_WDMA_CONFIG_2 0x31
-#define ADSP2_RDMA_CONFIG_1 0x34
-
-#define ADSP2_SCRATCH0        0x40
-#define ADSP2_SCRATCH1        0x41
-#define ADSP2_SCRATCH2        0x42
-#define ADSP2_SCRATCH3        0x43
+#define ADSP2_CONTROL                     0x0
+#define ADSP2_CLOCKING                    0x1
+#define ADSP2V2_CLOCKING                  0x2
+#define ADSP2_STATUS1                     0x4
+#define ADSP2_WDMA_CONFIG_1               0x30
+#define ADSP2_WDMA_CONFIG_2               0x31
+#define ADSP2V2_WDMA_CONFIG_2             0x32
+#define ADSP2_RDMA_CONFIG_1               0x34
+
+#define ADSP2_SCRATCH0                    0x40
+#define ADSP2_SCRATCH1                    0x41
+#define ADSP2_SCRATCH2                    0x42
+#define ADSP2_SCRATCH3                    0x43
+
+#define ADSP2V2_SCRATCH0_1                0x40
+#define ADSP2V2_SCRATCH2_3                0x42
 
 /*
  * ADSP2 Control
@@ -153,6 +158,17 @@
 #define ADSP2_CLK_SEL_WIDTH                    3  /* CLK_SEL_ENA */
 
 /*
+ * ADSP2V2 clocking
+ */
+#define ADSP2V2_CLK_SEL_MASK             0x70000  /* CLK_SEL_ENA */
+#define ADSP2V2_CLK_SEL_SHIFT                 16  /* CLK_SEL_ENA */
+#define ADSP2V2_CLK_SEL_WIDTH                  3  /* CLK_SEL_ENA */
+
+#define ADSP2V2_RATE_MASK                 0x7800  /* DSP_RATE */
+#define ADSP2V2_RATE_SHIFT                    11  /* DSP_RATE */
+#define ADSP2V2_RATE_WIDTH                     4  /* DSP_RATE */
+
+/*
  * ADSP2 Status 1
  */
 #define ADSP2_RAM_RDY                     0x0001
@@ -160,6 +176,37 @@
 #define ADSP2_RAM_RDY_SHIFT                    0
 #define ADSP2_RAM_RDY_WIDTH                    1
 
+/*
+ * ADSP2 Lock support
+ */
+#define ADSP2_LOCK_CODE_0                    0x5555
+#define ADSP2_LOCK_CODE_1                    0xAAAA
+
+#define ADSP2_WATCHDOG                       0x0A
+#define ADSP2_BUS_ERR_ADDR                   0x52
+#define ADSP2_REGION_LOCK_STATUS             0x64
+#define ADSP2_LOCK_REGION_1_LOCK_REGION_0    0x66
+#define ADSP2_LOCK_REGION_3_LOCK_REGION_2    0x68
+#define ADSP2_LOCK_REGION_5_LOCK_REGION_4    0x6A
+#define ADSP2_LOCK_REGION_7_LOCK_REGION_6    0x6C
+#define ADSP2_LOCK_REGION_9_LOCK_REGION_8    0x6E
+#define ADSP2_LOCK_REGION_CTRL               0x7A
+#define ADSP2_PMEM_ERR_ADDR_XMEM_ERR_ADDR    0x7C
+
+#define ADSP2_REGION_LOCK_ERR_MASK           0x8000
+#define ADSP2_SLAVE_ERR_MASK                 0x4000
+#define ADSP2_WDT_TIMEOUT_STS_MASK           0x2000
+#define ADSP2_CTRL_ERR_PAUSE_ENA             0x0002
+#define ADSP2_CTRL_ERR_EINT                  0x0001
+
+#define ADSP2_BUS_ERR_ADDR_MASK              0x00FFFFFF
+#define ADSP2_XMEM_ERR_ADDR_MASK             0x0000FFFF
+#define ADSP2_PMEM_ERR_ADDR_MASK             0x7FFF0000
+#define ADSP2_PMEM_ERR_ADDR_SHIFT            16
+#define ADSP2_WDT_ENA_MASK                   0xFFFFFFFD
+
+#define ADSP2_LOCK_REGION_SHIFT              16
+
 #define ADSP_MAX_STD_CTRL_SIZE               512
 
 #define WM_ADSP_ACKED_CTL_TIMEOUT_MS         100
@@ -683,6 +730,9 @@ static const struct soc_enum wm_adsp_fw_enum[] = {
         SOC_ENUM_SINGLE(0, 1, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
         SOC_ENUM_SINGLE(0, 2, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
         SOC_ENUM_SINGLE(0, 3, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
+        SOC_ENUM_SINGLE(0, 4, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
+        SOC_ENUM_SINGLE(0, 5, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
+        SOC_ENUM_SINGLE(0, 6, ARRAY_SIZE(wm_adsp_fw_text), wm_adsp_fw_text),
 };
 
 const struct snd_kcontrol_new wm_adsp_fw_controls[] = {
@@ -694,6 +744,12 @@ const struct snd_kcontrol_new wm_adsp_fw_controls[] = {
                      wm_adsp_fw_get, wm_adsp_fw_put),
         SOC_ENUM_EXT("DSP4 Firmware", wm_adsp_fw_enum[3],
                      wm_adsp_fw_get, wm_adsp_fw_put),
+        SOC_ENUM_EXT("DSP5 Firmware", wm_adsp_fw_enum[4],
+                     wm_adsp_fw_get, wm_adsp_fw_put),
+        SOC_ENUM_EXT("DSP6 Firmware", wm_adsp_fw_enum[5],
+                     wm_adsp_fw_get, wm_adsp_fw_put),
+        SOC_ENUM_EXT("DSP7 Firmware", wm_adsp_fw_enum[6],
+                     wm_adsp_fw_get, wm_adsp_fw_put),
 };
 EXPORT_SYMBOL_GPL(wm_adsp_fw_controls);
 
@@ -750,6 +806,29 @@ static void wm_adsp2_show_fw_status(struct wm_adsp *dsp)
                  be16_to_cpu(scratch[3]));
 }
 
+static void wm_adsp2v2_show_fw_status(struct wm_adsp *dsp)
+{
+        u32 scratch[2];
+        int ret;
+
+        ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
+                              scratch, sizeof(scratch));
+
+        if (ret) {
+                adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
+                return;
+        }
+
+        scratch[0] = be32_to_cpu(scratch[0]);
+        scratch[1] = be32_to_cpu(scratch[1]);
+
+        adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
+                 scratch[0] & 0xFFFF,
+                 scratch[0] >> 16,
+                 scratch[1] & 0xFFFF,
+                 scratch[1] >> 16);
+}
+
 static inline struct wm_coeff_ctl *bytes_ext_to_ctl(struct soc_bytes_ext *ext)
 {
         return container_of(ext, struct wm_coeff_ctl, bytes_ext);
@@ -899,7 +978,10 @@ static int wm_coeff_put(struct snd_kcontrol *kctl,
 
         mutex_lock(&ctl->dsp->pwr_lock);
 
-        memcpy(ctl->cache, p, ctl->len);
+        if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+                ret = -EPERM;
+        else
+                memcpy(ctl->cache, p, ctl->len);
 
         ctl->set = 1;
         if (ctl->enabled && ctl->dsp->running)
@@ -926,6 +1008,8 @@ static int wm_coeff_tlv_put(struct snd_kcontrol *kctl,
                 ctl->set = 1;
                 if (ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_write_control(ctl, ctl->cache, size);
+                else if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
+                        ret = -EPERM;
         }
 
         mutex_unlock(&ctl->dsp->pwr_lock);
@@ -947,7 +1031,7 @@ static int wm_coeff_put_acked(struct snd_kcontrol *kctl,
 
         mutex_lock(&ctl->dsp->pwr_lock);
 
-        if (ctl->enabled)
+        if (ctl->enabled && ctl->dsp->running)
                 ret = wm_coeff_write_acked_control(ctl, val);
         else
                 ret = -EPERM;
@@ -2430,10 +2514,17 @@ static int wm_adsp2_ena(struct wm_adsp *dsp)
         unsigned int val;
         int ret, count;
 
-        ret = regmap_update_bits_async(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                       ADSP2_SYS_ENA, ADSP2_SYS_ENA);
-        if (ret != 0)
-                return ret;
+        switch (dsp->rev) {
+        case 0:
+                ret = regmap_update_bits_async(dsp->regmap,
+                                               dsp->base + ADSP2_CONTROL,
+                                               ADSP2_SYS_ENA, ADSP2_SYS_ENA);
+                if (ret != 0)
+                        return ret;
+                break;
+        default:
+                break;
+        }
 
         /* Wait for the RAM to start, should be near instantaneous */
         for (count = 0; count < 10; ++count) {
@@ -2492,11 +2583,17 @@ static void wm_adsp2_boot_work(struct work_struct *work)
         if (ret != 0)
                 goto err_ena;
 
-        /* Turn DSP back off until we are ready to run */
-        ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                 ADSP2_SYS_ENA, 0);
-        if (ret != 0)
-                goto err_ena;
+        switch (dsp->rev) {
+        case 0:
+                /* Turn DSP back off until we are ready to run */
+                ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                         ADSP2_SYS_ENA, 0);
+                if (ret != 0)
+                        goto err_ena;
+                break;
+        default:
+                break;
+        }
 
         dsp->booted = true;
 
@@ -2518,12 +2615,21 @@ static void wm_adsp2_set_dspclk(struct wm_adsp *dsp, unsigned int freq)
 {
         int ret;
 
-        ret = regmap_update_bits_async(dsp->regmap,
-                                       dsp->base + ADSP2_CLOCKING,
-                                       ADSP2_CLK_SEL_MASK,
-                                       freq << ADSP2_CLK_SEL_SHIFT);
-        if (ret != 0)
-                adsp_err(dsp, "Failed to set clock rate: %d\n", ret);
+        switch (dsp->rev) {
+        case 0:
+                ret = regmap_update_bits_async(dsp->regmap,
+                                               dsp->base + ADSP2_CLOCKING,
+                                               ADSP2_CLK_SEL_MASK,
+                                               freq << ADSP2_CLK_SEL_SHIFT);
+                if (ret) {
+                        adsp_err(dsp, "Failed to set clock rate: %d\n", ret);
+                        return;
+                }
+                break;
+        default:
+                /* clock is handled by parent codec driver */
+                break;
+        }
 }
 
 int wm_adsp2_preloader_get(struct snd_kcontrol *kcontrol,
@@ -2563,6 +2669,18 @@ int wm_adsp2_preloader_put(struct snd_kcontrol *kcontrol,
 }
 EXPORT_SYMBOL_GPL(wm_adsp2_preloader_put);
 
+static void wm_adsp_stop_watchdog(struct wm_adsp *dsp)
+{
+        switch (dsp->rev) {
+        case 0:
+        case 1:
+                return;
+        default:
+                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_WATCHDOG,
+                                   ADSP2_WDT_ENA_MASK, 0);
+        }
+}
+
 int wm_adsp2_early_event(struct snd_soc_dapm_widget *w,
                          struct snd_kcontrol *kcontrol, int event,
                          unsigned int freq)
@@ -2635,6 +2753,8 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 if (ret != 0)
                         goto err;
 
+                wm_adsp2_lock(dsp, dsp->lock_regions);
+
                 ret = regmap_update_bits(dsp->regmap,
                                          dsp->base + ADSP2_CONTROL,
                                          ADSP2_CORE_ENA | ADSP2_START,
@@ -2658,23 +2778,49 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 /* Tell the firmware to cleanup */
                 wm_adsp_signal_event_controls(dsp, WM_ADSP_FW_EVENT_SHUTDOWN);
 
+                wm_adsp_stop_watchdog(dsp);
+
                 /* Log firmware state, it can be useful for analysis */
-                wm_adsp2_show_fw_status(dsp);
+                switch (dsp->rev) {
+                case 0:
+                        wm_adsp2_show_fw_status(dsp);
+                        break;
+                default:
+                        wm_adsp2v2_show_fw_status(dsp);
+                        break;
+                }
 
                 mutex_lock(&dsp->pwr_lock);
 
                 dsp->running = false;
 
-                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                regmap_update_bits(dsp->regmap,
+                                   dsp->base + ADSP2_CONTROL,
                                    ADSP2_CORE_ENA | ADSP2_START, 0);
 
                 /* Make sure DMAs are quiesced */
-                regmap_write(dsp->regmap, dsp->base + ADSP2_RDMA_CONFIG_1, 0);
-                regmap_write(dsp->regmap, dsp->base + ADSP2_WDMA_CONFIG_1, 0);
-                regmap_write(dsp->regmap, dsp->base + ADSP2_WDMA_CONFIG_2, 0);
-
-                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                   ADSP2_SYS_ENA, 0);
+                switch (dsp->rev) {
+                case 0:
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_RDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_WDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_WDMA_CONFIG_2, 0);
+
+                        regmap_update_bits(dsp->regmap,
+                                           dsp->base + ADSP2_CONTROL,
+                                           ADSP2_SYS_ENA, 0);
+                        break;
+                default:
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_RDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2_WDMA_CONFIG_1, 0);
+                        regmap_write(dsp->regmap,
+                                     dsp->base + ADSP2V2_WDMA_CONFIG_2, 0);
+                        break;
+                }
 
                 if (wm_adsp_fw[dsp->fw].num_caps != 0)
                         wm_adsp_buffer_free(dsp);
@@ -2727,15 +2873,22 @@ int wm_adsp2_init(struct wm_adsp *dsp)
 {
         int ret;
 
-        /*
-         * Disable the DSP memory by default when in reset for a small
-         * power saving.
-         */
-        ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
-                                 ADSP2_MEM_ENA, 0);
-        if (ret != 0) {
-                adsp_err(dsp, "Failed to clear memory retention: %d\n", ret);
-                return ret;
+        switch (dsp->rev) {
+        case 0:
+                /*
+                 * Disable the DSP memory by default when in reset for a small
+                 * power saving.
+                 */
+                ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                         ADSP2_MEM_ENA, 0);
+                if (ret) {
+                        adsp_err(dsp,
+                                 "Failed to clear memory retention: %d\n", ret);
+                        return ret;
+                }
+                break;
+        default:
+                break;
         }
 
         INIT_LIST_HEAD(&dsp->alg_regions);
@@ -3518,4 +3671,94 @@ int wm_adsp_compr_copy(struct snd_compr_stream *stream, char __user *buf,
 }
 EXPORT_SYMBOL_GPL(wm_adsp_compr_copy);
 
+int wm_adsp2_lock(struct wm_adsp *dsp, unsigned int lock_regions)
+{
+        struct regmap *regmap = dsp->regmap;
+        unsigned int code0, code1, lock_reg;
+
+        if (!(lock_regions & WM_ADSP2_REGION_ALL))
+                return 0;
+
+        lock_regions &= WM_ADSP2_REGION_ALL;
+        lock_reg = dsp->base + ADSP2_LOCK_REGION_1_LOCK_REGION_0;
+
+        while (lock_regions) {
+                code0 = code1 = 0;
+                if (lock_regions & BIT(0)) {
+                        code0 = ADSP2_LOCK_CODE_0;
+                        code1 = ADSP2_LOCK_CODE_1;
+                }
+                if (lock_regions & BIT(1)) {
+                        code0 |= ADSP2_LOCK_CODE_0 << ADSP2_LOCK_REGION_SHIFT;
+                        code1 |= ADSP2_LOCK_CODE_1 << ADSP2_LOCK_REGION_SHIFT;
+                }
+                regmap_write(regmap, lock_reg, code0);
+                regmap_write(regmap, lock_reg, code1);
+                lock_regions >>= 2;
+                lock_reg += 2;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(wm_adsp2_lock);
+
+irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+{
+        unsigned int val;
+        struct regmap *regmap = dsp->regmap;
+        int ret = 0;
+
+        ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+        if (ret) {
+                adsp_err(dsp,
+                        "Failed to read Region Lock Ctrl register: %d\n", ret);
+                return IRQ_HANDLED;
+        }
+
+        if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+                adsp_err(dsp, "watchdog timeout error\n");
+                wm_adsp_stop_watchdog(dsp);
+        }
+
+        if (val & (ADSP2_SLAVE_ERR_MASK | ADSP2_REGION_LOCK_ERR_MASK)) {
+                if (val & ADSP2_SLAVE_ERR_MASK)
+                        adsp_err(dsp, "bus error: slave error\n");
+                else
+                        adsp_err(dsp, "bus error: region lock error\n");
+
+                ret = regmap_read(regmap, dsp->base + ADSP2_BUS_ERR_ADDR, &val);
+                if (ret) {
+                        adsp_err(dsp,
+                                 "Failed to read Bus Err Addr register: %d\n",
+                                 ret);
+                        return IRQ_HANDLED;
+                }
+
+                adsp_err(dsp, "bus error address = 0x%x\n",
+                         val & ADSP2_BUS_ERR_ADDR_MASK);
+
+                ret = regmap_read(regmap,
+                                  dsp->base + ADSP2_PMEM_ERR_ADDR_XMEM_ERR_ADDR,
+                                  &val);
+                if (ret) {
+                        adsp_err(dsp,
+                                 "Failed to read Pmem Xmem Err Addr register: %d\n",
+                                 ret);
+                        return IRQ_HANDLED;
+                }
+
+                adsp_err(dsp, "xmem error address = 0x%x\n",
+                         val & ADSP2_XMEM_ERR_ADDR_MASK);
+                adsp_err(dsp, "pmem error address = 0x%x\n",
+                         (val & ADSP2_PMEM_ERR_ADDR_MASK) >>
+                         ADSP2_PMEM_ERR_ADDR_SHIFT);
+        }
+
+        regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+                           ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
+        return IRQ_HANDLED;
+}
+EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+
 MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/wm_adsp.h b/sound/soc/codecs/wm_adsp.h
index 3706b11053a3..41cc11c19b83 100644
--- a/sound/soc/codecs/wm_adsp.h
+++ b/sound/soc/codecs/wm_adsp.h
@@ -23,6 +23,23 @@
 #define WM_ADSP_COMPR_OK                 0
 #define WM_ADSP_COMPR_VOICE_TRIGGER      1
 
+#define WM_ADSP2_REGION_0 BIT(0)
+#define WM_ADSP2_REGION_1 BIT(1)
+#define WM_ADSP2_REGION_2 BIT(2)
+#define WM_ADSP2_REGION_3 BIT(3)
+#define WM_ADSP2_REGION_4 BIT(4)
+#define WM_ADSP2_REGION_5 BIT(5)
+#define WM_ADSP2_REGION_6 BIT(6)
+#define WM_ADSP2_REGION_7 BIT(7)
+#define WM_ADSP2_REGION_8 BIT(8)
+#define WM_ADSP2_REGION_9 BIT(9)
+#define WM_ADSP2_REGION_1_9 (WM_ADSP2_REGION_1 | \
+                WM_ADSP2_REGION_2 | WM_ADSP2_REGION_3 | \
+                WM_ADSP2_REGION_4 | WM_ADSP2_REGION_5 | \
+                WM_ADSP2_REGION_6 | WM_ADSP2_REGION_7 | \
+                WM_ADSP2_REGION_8 | WM_ADSP2_REGION_9)
+#define WM_ADSP2_REGION_ALL (WM_ADSP2_REGION_0 | WM_ADSP2_REGION_1_9)
+
 struct wm_adsp_region {
         int type;
         unsigned int base;
@@ -40,6 +57,7 @@ struct wm_adsp_compr_buf;
 
 struct wm_adsp {
         const char *part;
+        int rev;
         int num;
         int type;
         struct device *dev;
@@ -75,6 +93,8 @@ struct wm_adsp {
 
         struct mutex pwr_lock;
 
+        unsigned int lock_regions;
+
 #ifdef CONFIG_DEBUG_FS
         struct dentry *debugfs_root;
         char *wmfw_file_name;
@@ -113,6 +133,10 @@ int wm_adsp1_event(struct snd_soc_dapm_widget *w,
 int wm_adsp2_early_event(struct snd_soc_dapm_widget *w,
                          struct snd_kcontrol *kcontrol, int event,
                          unsigned int freq);
+
+int wm_adsp2_lock(struct wm_adsp *adsp, unsigned int regions);
+irqreturn_t wm_adsp2_bus_error(struct wm_adsp *adsp);
+
 int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                    struct snd_kcontrol *kcontrol, int event);
 
diff --git a/sound/soc/dwc/Kconfig b/sound/soc/dwc/Kconfig
index c297efe43861..c6fd95fa5ca6 100644
--- a/sound/soc/dwc/Kconfig
+++ b/sound/soc/dwc/Kconfig
@@ -8,10 +8,10 @@ config SND_DESIGNWARE_I2S
          maximum of 8 channels each for play and record.
 
 config SND_DESIGNWARE_PCM
-        tristate "PCM PIO extension for I2S driver"
+        bool "PCM PIO extension for I2S driver"
         depends on SND_DESIGNWARE_I2S
         help
-         Say Y, M or N if you want to add a custom ALSA extension that registers
+         Say Y or N if you want to add a custom ALSA extension that registers
          a PCM and uses PIO to transfer data.
 
          This functionality is specially suited for I2S devices that don't have
diff --git a/sound/soc/dwc/Makefile b/sound/soc/dwc/Makefile
index 38f1ca31c5fa..3e24c0ff95fb 100644
--- a/sound/soc/dwc/Makefile
+++ b/sound/soc/dwc/Makefile
@@ -1,5 +1,5 @@
 # SYNOPSYS Platform Support
 obj-$(CONFIG_SND_DESIGNWARE_I2S) += designware_i2s.o
-ifdef CONFIG_SND_DESIGNWARE_PCM
-obj-$(CONFIG_SND_DESIGNWARE_I2S) += designware_pcm.o
-endif
+
+designware_i2s-y := dwc-i2s.o
+designware_i2s-$(CONFIG_SND_DESIGNWARE_PCM) += dwc-pcm.o
diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/dwc-i2s.c
index 9c46e4112026..9c46e4112026 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/dwc-i2s.c
diff --git a/sound/soc/dwc/designware_pcm.c b/sound/soc/dwc/dwc-pcm.c
index 459ec861e6b6..406fd867117b 100644
--- a/sound/soc/dwc/designware_pcm.c
+++ b/sound/soc/dwc/dwc-pcm.c
@@ -129,13 +129,11 @@ void dw_pcm_push_tx(struct dw_i2s_dev *dev)
 {
         dw_pcm_transfer(dev, true);
 }
-EXPORT_SYMBOL_GPL(dw_pcm_push_tx);
 
 void dw_pcm_pop_rx(struct dw_i2s_dev *dev)
 {
         dw_pcm_transfer(dev, false);
 }
-EXPORT_SYMBOL_GPL(dw_pcm_pop_rx);
 
 static int dw_pcm_open(struct snd_pcm_substream *substream)
 {
@@ -281,4 +279,3 @@ int dw_pcm_register(struct platform_device *pdev)
 {
         return devm_snd_soc_register_platform(&pdev->dev, &dw_pcm_platform);
 }
-EXPORT_SYMBOL_GPL(dw_pcm_register);
diff --git a/sound/soc/fsl/eukrea-tlv320.c b/sound/soc/fsl/eukrea-tlv320.c
index 883087f2b092..84ef6385736c 100644
--- a/sound/soc/fsl/eukrea-tlv320.c
+++ b/sound/soc/fsl/eukrea-tlv320.c
@@ -64,7 +64,7 @@ static int eukrea_tlv320_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops eukrea_tlv320_snd_ops = {
+static const struct snd_soc_ops eukrea_tlv320_snd_ops = {
         .hw_params      = eukrea_tlv320_hw_params,
 };
 
diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
index dc30d780f874..282d841840b1 100644
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -76,7 +76,7 @@ static int fsl_asrc_dma_prepare_and_submit(struct snd_pcm_substream *substream)
                         pair->dma_chan[!dir], runtime->dma_addr,
                         snd_pcm_lib_buffer_bytes(substream),
                         snd_pcm_lib_period_bytes(substream),
-                        dir == OUT ? DMA_TO_DEVICE : DMA_FROM_DEVICE, flags);
+                        dir == OUT ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM, flags);
         if (!pair->desc[!dir]) {
                 dev_err(dev, "failed to prepare slave DMA for Front-End\n");
                 return -ENOMEM;
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 38bfd46f4ad8..809a069d490b 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -19,7 +19,6 @@
 #include "fsl_esai.h"
 #include "imx-pcm.h"
 
-#define FSL_ESAI_RATES          SNDRV_PCM_RATE_8000_192000
 #define FSL_ESAI_FORMATS        (SNDRV_PCM_FMTBIT_S8 | \
                                 SNDRV_PCM_FMTBIT_S16_LE | \
                                 SNDRV_PCM_FMTBIT_S20_3LE | \
@@ -647,14 +646,14 @@ static struct snd_soc_dai_driver fsl_esai_dai = {
                 .stream_name = "CPU-Playback",
                 .channels_min = 1,
                 .channels_max = 12,
-                .rates = FSL_ESAI_RATES,
+                .rates = SNDRV_PCM_RATE_8000_192000,
                 .formats = FSL_ESAI_FORMATS,
         },
         .capture = {
                 .stream_name = "CPU-Capture",
                 .channels_min = 1,
                 .channels_max = 8,
-                .rates = FSL_ESAI_RATES,
+                .rates = SNDRV_PCM_RATE_8000_192000,
                 .formats = FSL_ESAI_FORMATS,
         },
         .ops = &fsl_esai_dai_ops,
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index fde08660b63b..173cb8496641 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -35,6 +35,7 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/clk.h>
+#include <linux/ctype.h>
 #include <linux/device.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
@@ -55,16 +56,6 @@
 #include "imx-pcm.h"
 
 /**
- * FSLSSI_I2S_RATES: sample rates supported by the I2S
- *
- * This driver currently only supports the SSI running in I2S slave mode,
- * which means the codec determines the sample rate.  Therefore, we tell
- * ALSA that we support all rates and let the codec driver decide what rates
- * are really supported.
- */
-#define FSLSSI_I2S_RATES SNDRV_PCM_RATE_CONTINUOUS
-
-/**
  * FSLSSI_I2S_FORMATS: audio formats supported by the SSI
  *
  * The SSI has a limitation in that the samples must be in the same byte
@@ -1212,14 +1203,14 @@ static struct snd_soc_dai_driver fsl_ssi_dai_template = {
                 .stream_name = "CPU-Playback",
                 .channels_min = 1,
                 .channels_max = 32,
-                .rates = FSLSSI_I2S_RATES,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
                 .formats = FSLSSI_I2S_FORMATS,
         },
         .capture = {
                 .stream_name = "CPU-Capture",
                 .channels_min = 1,
                 .channels_max = 32,
-                .rates = FSLSSI_I2S_RATES,
+                .rates = SNDRV_PCM_RATE_CONTINUOUS,
                 .formats = FSLSSI_I2S_FORMATS,
         },
         .ops = &fsl_ssi_dai_ops,
@@ -1325,14 +1316,10 @@ static struct snd_ac97_bus_ops fsl_ssi_ac97_ops = {
  */
 static void make_lowercase(char *s)
 {
-        char *p = s;
-        char c;
-
-        while ((c = *p)) {
-                if ((c >= 'A') && (c <= 'Z'))
-                        *p = c + ('a' - 'A');
-                p++;
-        }
+        if (!s)
+                return;
+        for (; *s; s++)
+                *s = tolower(*s);
 }
 
 static int fsl_ssi_imx_probe(struct platform_device *pdev,
diff --git a/sound/soc/fsl/imx-mc13783.c b/sound/soc/fsl/imx-mc13783.c
index bb0459018b45..9d19b808f634 100644
--- a/sound/soc/fsl/imx-mc13783.c
+++ b/sound/soc/fsl/imx-mc13783.c
@@ -48,7 +48,7 @@ static int imx_mc13783_hifi_hw_params(struct snd_pcm_substream *substream,
         return snd_soc_dai_set_tdm_slot(cpu_dai, 0x3, 0x3, 2, 16);
 }
 
-static struct snd_soc_ops imx_mc13783_hifi_ops = {
+static const struct snd_soc_ops imx_mc13783_hifi_ops = {
         .hw_params = imx_mc13783_hifi_hw_params,
 };
 
diff --git a/sound/soc/fsl/imx-pcm-dma.c b/sound/soc/fsl/imx-pcm-dma.c
index f3d3d1ffa84e..314814ddd2b0 100644
--- a/sound/soc/fsl/imx-pcm-dma.c
+++ b/sound/soc/fsl/imx-pcm-dma.c
@@ -33,48 +33,20 @@ static bool filter(struct dma_chan *chan, void *param)
         return true;
 }
 
-static const struct snd_pcm_hardware imx_pcm_hardware = {
-        .info = SNDRV_PCM_INFO_INTERLEAVED |
-                SNDRV_PCM_INFO_BLOCK_TRANSFER |
-                SNDRV_PCM_INFO_MMAP |
-                SNDRV_PCM_INFO_MMAP_VALID |
-                SNDRV_PCM_INFO_PAUSE |
-                SNDRV_PCM_INFO_RESUME,
-        .buffer_bytes_max = IMX_DEFAULT_DMABUF_SIZE,
-        .period_bytes_min = 128,
-        .period_bytes_max = 65535, /* Limited by SDMA engine */
-        .periods_min = 2,
-        .periods_max = 255,
-        .fifo_size = 0,
-};
-
 static const struct snd_dmaengine_pcm_config imx_dmaengine_pcm_config = {
-        .pcm_hardware = &imx_pcm_hardware,
         .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
         .compat_filter_fn = filter,
-        .prealloc_buffer_size = IMX_DEFAULT_DMABUF_SIZE,
 };
 
 int imx_pcm_dma_init(struct platform_device *pdev, size_t size)
 {
         struct snd_dmaengine_pcm_config *config;
-        struct snd_pcm_hardware *pcm_hardware;
 
         config = devm_kzalloc(&pdev->dev,
                         sizeof(struct snd_dmaengine_pcm_config), GFP_KERNEL);
         if (!config)
                 return -ENOMEM;
         *config = imx_dmaengine_pcm_config;
-        if (size)
-                config->prealloc_buffer_size = size;
-
-        pcm_hardware = devm_kzalloc(&pdev->dev,
-                        sizeof(struct snd_pcm_hardware), GFP_KERNEL);
-        *pcm_hardware = imx_pcm_hardware;
-        if (size)
-                pcm_hardware->buffer_bytes_max = size;
-
-        config->pcm_hardware = pcm_hardware;
 
         return devm_snd_dmaengine_pcm_register(&pdev->dev,
                 config,
diff --git a/sound/soc/fsl/imx-pcm-fiq.c b/sound/soc/fsl/imx-pcm-fiq.c
index dac6688540dc..92410f7ca1fa 100644
--- a/sound/soc/fsl/imx-pcm-fiq.c
+++ b/sound/soc/fsl/imx-pcm-fiq.c
@@ -282,7 +282,7 @@ static int imx_pcm_new(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static int ssi_irq = 0;
+static int ssi_irq;
 
 static int imx_pcm_fiq_new(struct snd_soc_pcm_runtime *rtd)
 {
diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
index 1b60958e2080..206b898e554c 100644
--- a/sound/soc/fsl/imx-wm8962.c
+++ b/sound/soc/fsl/imx-wm8962.c
@@ -33,14 +33,14 @@ struct imx_wm8962_data {
         struct snd_soc_card card;
         char codec_dai_name[DAI_NAME_SIZE];
         char platform_name[DAI_NAME_SIZE];
-        struct clk *codec_clk;
         unsigned int clk_frequency;
 };
 
 struct imx_priv {
         struct platform_device *pdev;
+        int sample_rate;
+        snd_pcm_format_t sample_format;
 };
-static struct imx_priv card_priv;
 
 static const struct snd_soc_dapm_widget imx_wm8962_dapm_widgets[] = {
         SND_SOC_DAPM_HP("Headphone Jack", NULL),
@@ -49,14 +49,14 @@ static const struct snd_soc_dapm_widget imx_wm8962_dapm_widgets[] = {
         SND_SOC_DAPM_MIC("DMIC", NULL),
 };
 
-static int sample_rate = 44100;
-static snd_pcm_format_t sample_format = SNDRV_PCM_FORMAT_S16_LE;
-
 static int imx_hifi_hw_params(struct snd_pcm_substream *substream,
                 struct snd_pcm_hw_params *params)
 {
-        sample_rate = params_rate(params);
-        sample_format = params_format(params);
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct imx_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+
+        priv->sample_rate = params_rate(params);
+        priv->sample_format = params_format(params);
 
         return 0;
 }
@@ -71,7 +71,7 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
 {
         struct snd_soc_pcm_runtime *rtd;
         struct snd_soc_dai *codec_dai;
-        struct imx_priv *priv = &card_priv;
+        struct imx_priv *priv = snd_soc_card_get_drvdata(card);
         struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         unsigned int pll_out;
@@ -85,10 +85,10 @@ static int imx_wm8962_set_bias_level(struct snd_soc_card *card,
         switch (level) {
         case SND_SOC_BIAS_PREPARE:
                 if (dapm->bias_level == SND_SOC_BIAS_STANDBY) {
-                        if (sample_format == SNDRV_PCM_FORMAT_S24_LE)
-                                pll_out = sample_rate * 384;
+                        if (priv->sample_format == SNDRV_PCM_FORMAT_S24_LE)
+                                pll_out = priv->sample_rate * 384;
                         else
-                                pll_out = sample_rate * 256;
+                                pll_out = priv->sample_rate * 256;
 
                         ret = snd_soc_dai_set_pll(codec_dai, WM8962_FLL,
                                         WM8962_FLL_MCLK, data->clk_frequency,
@@ -140,7 +140,7 @@ static int imx_wm8962_late_probe(struct snd_soc_card *card)
 {
         struct snd_soc_pcm_runtime *rtd;
         struct snd_soc_dai *codec_dai;
-        struct imx_priv *priv = &card_priv;
+        struct imx_priv *priv = snd_soc_card_get_drvdata(card);
         struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
         struct device *dev = &priv->pdev->dev;
         int ret;
@@ -160,13 +160,20 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         struct device_node *np = pdev->dev.of_node;
         struct device_node *ssi_np, *codec_np;
         struct platform_device *ssi_pdev;
-        struct imx_priv *priv = &card_priv;
         struct i2c_client *codec_dev;
         struct imx_wm8962_data *data;
+        struct imx_priv *priv;
+        struct clk *codec_clk;
         int int_port, ext_port;
         int ret;
 
+        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
         priv->pdev = pdev;
+        priv->sample_rate = 44100;
+        priv->sample_format = SNDRV_PCM_FORMAT_S16_LE;
 
         ret = of_property_read_u32(np, "mux-int-port", &int_port);
         if (ret) {
@@ -231,19 +238,15 @@ static int imx_wm8962_probe(struct platform_device *pdev)
                 goto fail;
         }
 
-        data->codec_clk = devm_clk_get(&codec_dev->dev, NULL);
-        if (IS_ERR(data->codec_clk)) {
-                ret = PTR_ERR(data->codec_clk);
+        codec_clk = clk_get(&codec_dev->dev, NULL);
+        if (IS_ERR(codec_clk)) {
+                ret = PTR_ERR(codec_clk);
                 dev_err(&codec_dev->dev, "failed to get codec clk: %d\n", ret);
                 goto fail;
         }
 
-        data->clk_frequency = clk_get_rate(data->codec_clk);
-        ret = clk_prepare_enable(data->codec_clk);
-        if (ret) {
-                dev_err(&codec_dev->dev, "failed to enable codec clk: %d\n", ret);
-                goto fail;
-        }
+        data->clk_frequency = clk_get_rate(codec_clk);
+        clk_put(codec_clk);
 
         data->dai.name = "HiFi";
         data->dai.stream_name = "HiFi";
@@ -258,10 +261,10 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         data->card.dev = &pdev->dev;
         ret = snd_soc_of_parse_card_name(&data->card, "model");
         if (ret)
-                goto clk_fail;
+                goto fail;
         ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing");
         if (ret)
-                goto clk_fail;
+                goto fail;
         data->card.num_links = 1;
         data->card.owner = THIS_MODULE;
         data->card.dai_link = &data->dai;
@@ -277,16 +280,9 @@ static int imx_wm8962_probe(struct platform_device *pdev)
         ret = devm_snd_soc_register_card(&pdev->dev, &data->card);
         if (ret) {
                 dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret);
-                goto clk_fail;
+                goto fail;
         }
 
-        of_node_put(ssi_np);
-        of_node_put(codec_np);
-
-        return 0;
-
-clk_fail:
-        clk_disable_unprepare(data->codec_clk);
 fail:
         of_node_put(ssi_np);
         of_node_put(codec_np);
@@ -294,17 +290,6 @@ fail:
         return ret;
 }
 
-static int imx_wm8962_remove(struct platform_device *pdev)
-{
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
-        struct imx_wm8962_data *data = snd_soc_card_get_drvdata(card);
-
-        if (!IS_ERR(data->codec_clk))
-                clk_disable_unprepare(data->codec_clk);
-
-        return 0;
-}
-
 static const struct of_device_id imx_wm8962_dt_ids[] = {
         { .compatible = "fsl,imx-audio-wm8962", },
         { /* sentinel */ }
@@ -318,7 +303,6 @@ static struct platform_driver imx_wm8962_driver = {
                 .of_match_table = imx_wm8962_dt_ids,
         },
         .probe = imx_wm8962_probe,
-        .remove = imx_wm8962_remove,
 };
 module_platform_driver(imx_wm8962_driver);
 
diff --git a/sound/soc/fsl/mpc8610_hpcd.c b/sound/soc/fsl/mpc8610_hpcd.c
index ddf49f30b23f..a639b52c16f6 100644
--- a/sound/soc/fsl/mpc8610_hpcd.c
+++ b/sound/soc/fsl/mpc8610_hpcd.c
@@ -174,7 +174,7 @@ static int mpc8610_hpcd_machine_remove(struct snd_soc_card *card)
 /**
  * mpc8610_hpcd_ops: ASoC machine driver operations
  */
-static struct snd_soc_ops mpc8610_hpcd_ops = {
+static const struct snd_soc_ops mpc8610_hpcd_ops = {
         .startup = mpc8610_hpcd_startup,
 };
 
diff --git a/sound/soc/fsl/mx27vis-aic32x4.c b/sound/soc/fsl/mx27vis-aic32x4.c
index 198eeb3f3f7a..d7ec3d20065c 100644
--- a/sound/soc/fsl/mx27vis-aic32x4.c
+++ b/sound/soc/fsl/mx27vis-aic32x4.c
@@ -73,7 +73,7 @@ static int mx27vis_aic32x4_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mx27vis_aic32x4_snd_ops = {
+static const struct snd_soc_ops mx27vis_aic32x4_snd_ops = {
         .hw_params      = mx27vis_aic32x4_hw_params,
 };
 
diff --git a/sound/soc/fsl/p1022_ds.c b/sound/soc/fsl/p1022_ds.c
index a1f780ecadf5..41c623c55c16 100644
--- a/sound/soc/fsl/p1022_ds.c
+++ b/sound/soc/fsl/p1022_ds.c
@@ -184,7 +184,7 @@ static int p1022_ds_machine_remove(struct snd_soc_card *card)
 /**
  * p1022_ds_ops: ASoC machine driver operations
  */
-static struct snd_soc_ops p1022_ds_ops = {
+static const struct snd_soc_ops p1022_ds_ops = {
         .startup = p1022_ds_startup,
 };
 
diff --git a/sound/soc/fsl/p1022_rdk.c b/sound/soc/fsl/p1022_rdk.c
index d4d88a8cb9c0..4afbdd610bfa 100644
--- a/sound/soc/fsl/p1022_rdk.c
+++ b/sound/soc/fsl/p1022_rdk.c
@@ -188,7 +188,7 @@ static int p1022_rdk_machine_remove(struct snd_soc_card *card)
 /**
  * p1022_rdk_ops: ASoC machine driver operations
  */
-static struct snd_soc_ops p1022_rdk_ops = {
+static const struct snd_soc_ops p1022_rdk_ops = {
         .startup = p1022_rdk_startup,
 };
 
diff --git a/sound/soc/fsl/phycore-ac97.c b/sound/soc/fsl/phycore-ac97.c
index ae403c29688f..66fb6c4614d2 100644
--- a/sound/soc/fsl/phycore-ac97.c
+++ b/sound/soc/fsl/phycore-ac97.c
@@ -23,7 +23,7 @@
 
 static struct snd_soc_card imx_phycore;
 
-static struct snd_soc_ops imx_phycore_hifi_ops = {
+static const struct snd_soc_ops imx_phycore_hifi_ops = {
 };
 
 static struct snd_soc_dai_link imx_phycore_dai_ac97[] = {
diff --git a/sound/soc/fsl/wm1133-ev1.c b/sound/soc/fsl/wm1133-ev1.c
index b454972dce35..cdaf16367b47 100644
--- a/sound/soc/fsl/wm1133-ev1.c
+++ b/sound/soc/fsl/wm1133-ev1.c
@@ -139,7 +139,7 @@ static int wm1133_ev1_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops wm1133_ev1_ops = {
+static const struct snd_soc_ops wm1133_ev1_ops = {
         .hw_params = wm1133_ev1_hw_params,
 };
 
diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
index 4924575d2e95..343b291fc372 100644
--- a/sound/soc/generic/simple-card-utils.c
+++ b/sound/soc/generic/simple-card-utils.c
@@ -115,6 +115,7 @@ int asoc_simple_card_parse_clk(struct device *dev,
         clk = devm_get_clk_from_child(dev, node, NULL);
         if (!IS_ERR(clk)) {
                 simple_dai->sysclk = clk_get_rate(clk);
+                simple_dai->clk = clk;
         } else if (!of_property_read_u32(node, "system-clock-frequency", &val)) {
                 simple_dai->sysclk = val;
         } else {
diff --git a/sound/soc/hisilicon/Kconfig b/sound/soc/hisilicon/Kconfig
new file mode 100644
index 000000000000..4356d5a1d338
--- /dev/null
+++ b/sound/soc/hisilicon/Kconfig
@@ -0,0 +1,5 @@
+config SND_I2S_HI6210_I2S
+        tristate "Hisilicon I2S controller"
+        select SND_SOC_GENERIC_DMAENGINE_PCM
+        help
+          Hisilicon I2S
diff --git a/sound/soc/hisilicon/Makefile b/sound/soc/hisilicon/Makefile
new file mode 100644
index 000000000000..e8095e2af91a
--- /dev/null
+++ b/sound/soc/hisilicon/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_SND_I2S_HI6210_I2S) += hi6210-i2s.o
diff --git a/sound/soc/hisilicon/hi6210-i2s.c b/sound/soc/hisilicon/hi6210-i2s.c
new file mode 100644
index 000000000000..45163e5202f5
--- /dev/null
+++ b/sound/soc/hisilicon/hi6210-i2s.c
@@ -0,0 +1,618 @@
+/*
+ * linux/sound/soc/m8m/hi6210_i2s.c - I2S IP driver
+ *
+ * Copyright (C) 2015 Linaro, Ltd
+ * Author: Andy Green <andy.green@linaro.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * This driver only deals with S2 interface (BT)
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/jiffies.h>
+#include <linux/io.h>
+#include <linux/gpio.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/dmaengine_pcm.h>
+#include <sound/initval.h>
+#include <sound/soc.h>
+#include <linux/interrupt.h>
+#include <linux/reset.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/mfd/syscon.h>
+#include <linux/reset-controller.h>
+#include <linux/clk.h>
+
+#include "hi6210-i2s.h"
+
+struct hi6210_i2s {
+        struct device *dev;
+        struct reset_control *rc;
+        struct clk *clk[8];
+        int clocks;
+        struct snd_soc_dai_driver dai;
+        void __iomem *base;
+        struct regmap *sysctrl;
+        phys_addr_t base_phys;
+        struct snd_dmaengine_dai_dma_data dma_data[2];
+        int clk_rate;
+        spinlock_t lock;
+        int rate;
+        int format;
+        u8 bits;
+        u8 channels;
+        u8 id;
+        u8 channel_length;
+        u8 use;
+        u32 master:1;
+        u32 status:1;
+};
+
+#define SC_PERIPH_CLKEN1        0x210
+#define SC_PERIPH_CLKDIS1       0x214
+
+#define SC_PERIPH_CLKEN3        0x230
+#define SC_PERIPH_CLKDIS3       0x234
+
+#define SC_PERIPH_CLKEN12       0x270
+#define SC_PERIPH_CLKDIS12      0x274
+
+#define SC_PERIPH_RSTEN1        0x310
+#define SC_PERIPH_RSTDIS1       0x314
+#define SC_PERIPH_RSTSTAT1      0x318
+
+#define SC_PERIPH_RSTEN2        0x320
+#define SC_PERIPH_RSTDIS2       0x324
+#define SC_PERIPH_RSTSTAT2      0x328
+
+#define SOC_PMCTRL_BBPPLLALIAS  0x48
+
+enum {
+        CLK_DACODEC,
+        CLK_I2S_BASE,
+};
+
+static inline void hi6210_write_reg(struct hi6210_i2s *i2s, int reg, u32 val)
+{
+        writel(val, i2s->base + reg);
+}
+
+static inline u32 hi6210_read_reg(struct hi6210_i2s *i2s, int reg)
+{
+        return readl(i2s->base + reg);
+}
+
+int hi6210_i2s_startup(struct snd_pcm_substream *substream,
+                     struct snd_soc_dai *cpu_dai)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        int ret, n;
+        u32 val;
+
+        /* deassert reset on ABB */
+        regmap_read(i2s->sysctrl, SC_PERIPH_RSTSTAT2, &val);
+        if (val & BIT(4))
+                regmap_write(i2s->sysctrl, SC_PERIPH_RSTDIS2, BIT(4));
+
+        for (n = 0; n < i2s->clocks; n++) {
+                ret = clk_prepare_enable(i2s->clk[n]);
+                if (ret) {
+                        while (n--)
+                                clk_disable_unprepare(i2s->clk[n]);
+                        return ret;
+                }
+        }
+
+        ret = clk_set_rate(i2s->clk[CLK_I2S_BASE], 49152000);
+        if (ret) {
+                dev_err(i2s->dev, "%s: setting 49.152MHz base rate failed %d\n",
+                        __func__, ret);
+                return ret;
+        }
+
+        /* enable clock before frequency division */
+        regmap_write(i2s->sysctrl, SC_PERIPH_CLKEN12, BIT(9));
+
+        /* enable codec working clock / == "codec bus clock" */
+        regmap_write(i2s->sysctrl, SC_PERIPH_CLKEN1, BIT(5));
+
+        /* deassert reset on codec / interface clock / working clock */
+        regmap_write(i2s->sysctrl, SC_PERIPH_RSTEN1, BIT(5));
+        regmap_write(i2s->sysctrl, SC_PERIPH_RSTDIS1, BIT(5));
+
+        /* not interested in i2s irqs */
+        val = hi6210_read_reg(i2s, HII2S_CODEC_IRQ_MASK);
+        val |= 0x3f;
+        hi6210_write_reg(i2s, HII2S_CODEC_IRQ_MASK, val);
+
+
+        /* reset the stereo downlink fifo */
+        val = hi6210_read_reg(i2s, HII2S_APB_AFIFO_CFG_1);
+        val |= (BIT(5) | BIT(4));
+        hi6210_write_reg(i2s, HII2S_APB_AFIFO_CFG_1, val);
+
+        val = hi6210_read_reg(i2s, HII2S_APB_AFIFO_CFG_1);
+        val &= ~(BIT(5) | BIT(4));
+        hi6210_write_reg(i2s, HII2S_APB_AFIFO_CFG_1, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_SW_RST_N);
+        val &= ~(HII2S_SW_RST_N__ST_DL_WORDLEN_MASK <<
+                        HII2S_SW_RST_N__ST_DL_WORDLEN_SHIFT);
+        val |= (HII2S_BITS_16 << HII2S_SW_RST_N__ST_DL_WORDLEN_SHIFT);
+        hi6210_write_reg(i2s, HII2S_SW_RST_N, val);
+
+        val = hi6210_read_reg(i2s, HII2S_MISC_CFG);
+        /* mux 11/12 = APB not i2s */
+        val &= ~HII2S_MISC_CFG__ST_DL_TEST_SEL;
+        /* BT R ch  0 = mixer op of DACR ch */
+        val &= ~HII2S_MISC_CFG__S2_DOUT_RIGHT_SEL;
+        val &= ~HII2S_MISC_CFG__S2_DOUT_TEST_SEL;
+
+        val |= HII2S_MISC_CFG__S2_DOUT_RIGHT_SEL;
+        /* BT L ch = 1 = mux 7 = "mixer output of DACL */
+        val |= HII2S_MISC_CFG__S2_DOUT_TEST_SEL;
+        hi6210_write_reg(i2s, HII2S_MISC_CFG, val);
+
+        val = hi6210_read_reg(i2s, HII2S_SW_RST_N);
+        val |= HII2S_SW_RST_N__SW_RST_N;
+        hi6210_write_reg(i2s, HII2S_SW_RST_N, val);
+
+        return 0;
+}
+void hi6210_i2s_shutdown(struct snd_pcm_substream *substream,
+                       struct snd_soc_dai *cpu_dai)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        int n;
+
+        for (n = 0; n < i2s->clocks; n++)
+                clk_disable_unprepare(i2s->clk[n]);
+
+        regmap_write(i2s->sysctrl, SC_PERIPH_RSTEN1, BIT(5));
+}
+
+static void hi6210_i2s_txctrl(struct snd_soc_dai *cpu_dai, int on)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        u32 val;
+
+        spin_lock(&i2s->lock);
+        if (on) {
+                /* enable S2 TX */
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_IF_TX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        } else {
+                /* disable S2 TX */
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_IF_TX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        }
+        spin_unlock(&i2s->lock);
+}
+
+static void hi6210_i2s_rxctrl(struct snd_soc_dai *cpu_dai, int on)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        u32 val;
+
+        spin_lock(&i2s->lock);
+        if (on) {
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_IF_RX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        } else {
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_IF_RX_EN;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+        }
+        spin_unlock(&i2s->lock);
+}
+
+static int hi6210_i2s_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+
+        /*
+         * We don't actually set the hardware until the hw_params
+         * call, but we need to validate the user input here.
+         */
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+        case SND_SOC_DAIFMT_LEFT_J:
+        case SND_SOC_DAIFMT_RIGHT_J:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        i2s->format = fmt;
+        i2s->master = (i2s->format & SND_SOC_DAIFMT_MASTER_MASK) ==
+                      SND_SOC_DAIFMT_CBS_CFS;
+
+        return 0;
+}
+
+static int hi6210_i2s_hw_params(struct snd_pcm_substream *substream,
+                            struct snd_pcm_hw_params *params,
+                            struct snd_soc_dai *cpu_dai)
+{
+        struct hi6210_i2s *i2s = dev_get_drvdata(cpu_dai->dev);
+        u32 bits = 0, rate = 0, signed_data = 0, fmt = 0;
+        u32 val;
+        struct snd_dmaengine_dai_dma_data *dma_data;
+
+        switch (params_format(params)) {
+        case SNDRV_PCM_FORMAT_U16_LE:
+                signed_data = HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT;
+                /* fallthru */
+        case SNDRV_PCM_FORMAT_S16_LE:
+                bits = HII2S_BITS_16;
+                break;
+        case SNDRV_PCM_FORMAT_U24_LE:
+                signed_data = HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT;
+                /* fallthru */
+        case SNDRV_PCM_FORMAT_S24_LE:
+                bits = HII2S_BITS_24;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Bad format\n");
+                return -EINVAL;
+        }
+
+
+        switch (params_rate(params)) {
+        case 8000:
+                rate = HII2S_FS_RATE_8KHZ;
+                break;
+        case 16000:
+                rate = HII2S_FS_RATE_16KHZ;
+                break;
+        case 32000:
+                rate = HII2S_FS_RATE_32KHZ;
+                break;
+        case 48000:
+                rate = HII2S_FS_RATE_48KHZ;
+                break;
+        case 96000:
+                rate = HII2S_FS_RATE_96KHZ;
+                break;
+        case 192000:
+                rate = HII2S_FS_RATE_192KHZ;
+                break;
+        default:
+                dev_err(cpu_dai->dev, "Bad rate: %d\n", params_rate(params));
+                return -EINVAL;
+        }
+
+        if (!(params_channels(params))) {
+                dev_err(cpu_dai->dev, "Bad channels\n");
+                return -EINVAL;
+        }
+
+        dma_data = snd_soc_dai_get_dma_data(cpu_dai, substream);
+
+        switch (bits) {
+        case HII2S_BITS_24:
+                i2s->bits = 32;
+                dma_data->addr_width = 3;
+                break;
+        default:
+                i2s->bits = 16;
+                dma_data->addr_width = 2;
+                break;
+        }
+        i2s->rate = params_rate(params);
+        i2s->channels = params_channels(params);
+        i2s->channel_length = i2s->channels * i2s->bits;
+
+        val = hi6210_read_reg(i2s, HII2S_ST_DL_FIFO_TH_CFG);
+        val &= ~((HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_SHIFT) |
+                (HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_SHIFT) |
+                (HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_SHIFT) |
+                (HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_MASK <<
+                        HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_SHIFT));
+        val |= ((16 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_SHIFT) |
+                (30 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_SHIFT) |
+                (16 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_SHIFT) |
+                (30 << HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_SHIFT));
+        hi6210_write_reg(i2s, HII2S_ST_DL_FIFO_TH_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_IF_CLK_EN_CFG);
+        val |= (BIT(19) | BIT(18) | BIT(17) |
+                HII2S_IF_CLK_EN_CFG__S2_IF_CLK_EN |
+                HII2S_IF_CLK_EN_CFG__S2_OL_MIXER_EN |
+                HII2S_IF_CLK_EN_CFG__S2_OL_SRC_EN |
+                HII2S_IF_CLK_EN_CFG__ST_DL_R_EN |
+                HII2S_IF_CLK_EN_CFG__ST_DL_L_EN);
+        hi6210_write_reg(i2s, HII2S_IF_CLK_EN_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_DIG_FILTER_CLK_EN_CFG);
+        val &= ~(HII2S_DIG_FILTER_CLK_EN_CFG__DACR_SDM_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACR_HBF2I_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACR_AGC_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACL_SDM_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACL_HBF2I_EN |
+                 HII2S_DIG_FILTER_CLK_EN_CFG__DACL_AGC_EN);
+        val |= (HII2S_DIG_FILTER_CLK_EN_CFG__DACR_MIXER_EN |
+                HII2S_DIG_FILTER_CLK_EN_CFG__DACL_MIXER_EN);
+        hi6210_write_reg(i2s, HII2S_DIG_FILTER_CLK_EN_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_DIG_FILTER_MODULE_CFG);
+        val &= ~(HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN2_MUTE |
+                 HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN2_MUTE);
+        hi6210_write_reg(i2s, HII2S_DIG_FILTER_MODULE_CFG, val);
+
+        val = hi6210_read_reg(i2s, HII2S_MUX_TOP_MODULE_CFG);
+        val &= ~(HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN1_MUTE |
+                 HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN2_MUTE |
+                 HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN1_MUTE |
+                 HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN2_MUTE);
+        hi6210_write_reg(i2s, HII2S_MUX_TOP_MODULE_CFG, val);
+
+
+        switch (i2s->format & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                i2s->master = false;
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_MST_SLV;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                i2s->master = true;
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_MST_SLV;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        default:
+                WARN_ONCE(1, "Invalid i2s->fmt MASTER_MASK. This shouldn't happen\n");
+                return -EINVAL;
+        }
+
+        switch (i2s->format & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                fmt = HII2S_FORMAT_I2S;
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                fmt = HII2S_FORMAT_LEFT_JUST;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                fmt = HII2S_FORMAT_RIGHT_JUST;
+                break;
+        default:
+                WARN_ONCE(1, "Invalid i2s->fmt FORMAT_MASK. This shouldn't happen\n");
+                return -EINVAL;
+        }
+
+        val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+        val &= ~(HII2S_I2S_CFG__S2_FUNC_MODE_MASK <<
+                        HII2S_I2S_CFG__S2_FUNC_MODE_SHIFT);
+        val |= fmt << HII2S_I2S_CFG__S2_FUNC_MODE_SHIFT;
+        hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+
+
+        val = hi6210_read_reg(i2s, HII2S_CLK_SEL);
+        val &= ~(HII2S_CLK_SEL__I2S_BT_FM_SEL | /* BT gets the I2S */
+                        HII2S_CLK_SEL__EXT_12_288MHZ_SEL);
+        hi6210_write_reg(i2s, HII2S_CLK_SEL, val);
+
+        dma_data->maxburst = 2;
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                dma_data->addr = i2s->base_phys + HII2S_ST_DL_CHANNEL;
+        else
+                dma_data->addr = i2s->base_phys + HII2S_STEREO_UPLINK_CHANNEL;
+
+        switch (i2s->channels) {
+        case 1:
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val |= HII2S_I2S_CFG__S2_FRAME_MODE;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        default:
+                val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+                val &= ~HII2S_I2S_CFG__S2_FRAME_MODE;
+                hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+                break;
+        }
+
+        /* clear loopback, set signed type and word length */
+        val = hi6210_read_reg(i2s, HII2S_I2S_CFG);
+        val &= ~HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT;
+        val &= ~(HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_MASK <<
+                        HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_SHIFT);
+        val &= ~(HII2S_I2S_CFG__S2_DIRECT_LOOP_MASK <<
+                        HII2S_I2S_CFG__S2_DIRECT_LOOP_SHIFT);
+        val |= signed_data;
+        val |= (bits << HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_SHIFT);
+        hi6210_write_reg(i2s, HII2S_I2S_CFG, val);
+
+
+        if (!i2s->master)
+                return 0;
+
+        /* set DAC and related units to correct rate */
+        val = hi6210_read_reg(i2s, HII2S_FS_CFG);
+        val &= ~(HII2S_FS_CFG__FS_S2_MASK << HII2S_FS_CFG__FS_S2_SHIFT);
+        val &= ~(HII2S_FS_CFG__FS_DACLR_MASK << HII2S_FS_CFG__FS_DACLR_SHIFT);
+        val &= ~(HII2S_FS_CFG__FS_ST_DL_R_MASK <<
+                                        HII2S_FS_CFG__FS_ST_DL_R_SHIFT);
+        val &= ~(HII2S_FS_CFG__FS_ST_DL_L_MASK <<
+                                        HII2S_FS_CFG__FS_ST_DL_L_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_S2_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_DACLR_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_ST_DL_R_SHIFT);
+        val |= (rate << HII2S_FS_CFG__FS_ST_DL_L_SHIFT);
+        hi6210_write_reg(i2s, HII2S_FS_CFG, val);
+
+        return 0;
+}
+
+static int hi6210_i2s_trigger(struct snd_pcm_substream *substream, int cmd,
+                          struct snd_soc_dai *cpu_dai)
+{
+        pr_debug("%s\n", __func__);
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+                        hi6210_i2s_rxctrl(cpu_dai, 1);
+                else
+                        hi6210_i2s_txctrl(cpu_dai, 1);
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+                        hi6210_i2s_rxctrl(cpu_dai, 0);
+                else
+                        hi6210_i2s_txctrl(cpu_dai, 0);
+                break;
+        default:
+                dev_err(cpu_dai->dev, "uknown cmd\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static int hi6210_i2s_dai_probe(struct snd_soc_dai *dai)
+{
+        struct hi6210_i2s *i2s = snd_soc_dai_get_drvdata(dai);
+
+        snd_soc_dai_init_dma_data(dai,
+                                  &i2s->dma_data[SNDRV_PCM_STREAM_PLAYBACK],
+                                  &i2s->dma_data[SNDRV_PCM_STREAM_CAPTURE]);
+
+        return 0;
+}
+
+
+static struct snd_soc_dai_ops hi6210_i2s_dai_ops = {
+        .trigger        = hi6210_i2s_trigger,
+        .hw_params      = hi6210_i2s_hw_params,
+        .set_fmt        = hi6210_i2s_set_fmt,
+        .startup        = hi6210_i2s_startup,
+        .shutdown       = hi6210_i2s_shutdown,
+};
+
+struct snd_soc_dai_driver hi6210_i2s_dai_init = {
+        .probe          = hi6210_i2s_dai_probe,
+        .playback = {
+                .channels_min = 2,
+                .channels_max = 2,
+                .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                           SNDRV_PCM_FMTBIT_U16_LE,
+                .rates = SNDRV_PCM_RATE_48000,
+        },
+        .capture = {
+                .channels_min = 2,
+                .channels_max = 2,
+                .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                           SNDRV_PCM_FMTBIT_U16_LE,
+                .rates = SNDRV_PCM_RATE_48000,
+        },
+        .ops = &hi6210_i2s_dai_ops,
+};
+
+static const struct snd_soc_component_driver hi6210_i2s_i2s_comp = {
+        .name = "hi6210_i2s-i2s",
+};
+
+static int hi6210_i2s_probe(struct platform_device *pdev)
+{
+        struct device_node *node = pdev->dev.of_node;
+        struct device *dev = &pdev->dev;
+        struct hi6210_i2s *i2s;
+        struct resource *res;
+        int ret;
+
+        i2s = devm_kzalloc(&pdev->dev, sizeof(*i2s), GFP_KERNEL);
+        if (!i2s)
+                return -ENOMEM;
+
+        i2s->dev = dev;
+        spin_lock_init(&i2s->lock);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        i2s->base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(i2s->base))
+                return PTR_ERR(i2s->base);
+
+        i2s->base_phys = (phys_addr_t)res->start;
+        i2s->dai = hi6210_i2s_dai_init;
+
+        dev_set_drvdata(&pdev->dev, i2s);
+
+        i2s->sysctrl = syscon_regmap_lookup_by_phandle(node,
+                                                "hisilicon,sysctrl-syscon");
+        if (IS_ERR(i2s->sysctrl))
+                return PTR_ERR(i2s->sysctrl);
+
+        i2s->clk[CLK_DACODEC] = devm_clk_get(&pdev->dev, "dacodec");
+        if (IS_ERR_OR_NULL(i2s->clk[CLK_DACODEC]))
+                return PTR_ERR(i2s->clk[CLK_DACODEC]);
+        i2s->clocks++;
+
+        i2s->clk[CLK_I2S_BASE] = devm_clk_get(&pdev->dev, "i2s-base");
+        if (IS_ERR_OR_NULL(i2s->clk[CLK_I2S_BASE]))
+                return PTR_ERR(i2s->clk[CLK_I2S_BASE]);
+        i2s->clocks++;
+
+        ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
+        if (ret)
+                return ret;
+
+        ret = devm_snd_soc_register_component(&pdev->dev, &hi6210_i2s_i2s_comp,
+                                         &i2s->dai, 1);
+        return ret;
+}
+
+static const struct of_device_id hi6210_i2s_dt_ids[] = {
+        { .compatible = "hisilicon,hi6210-i2s" },
+        { /* sentinel */ }
+};
+
+MODULE_DEVICE_TABLE(of, hi6210_i2s_dt_ids);
+
+static struct platform_driver hi6210_i2s_driver = {
+        .probe = hi6210_i2s_probe,
+        .driver = {
+                .name = "hi6210_i2s",
+                .of_match_table = hi6210_i2s_dt_ids,
+        },
+};
+
+module_platform_driver(hi6210_i2s_driver);
+
+MODULE_DESCRIPTION("Hisilicon HI6210 I2S driver");
+MODULE_AUTHOR("Andy Green <andy.green@linaro.org>");
+MODULE_LICENSE("GPL");
diff --git a/sound/soc/hisilicon/hi6210-i2s.h b/sound/soc/hisilicon/hi6210-i2s.h
new file mode 100644
index 000000000000..85cecc4939a0
--- /dev/null
+++ b/sound/soc/hisilicon/hi6210-i2s.h
@@ -0,0 +1,276 @@
+/*
+ * linux/sound/soc/hisilicon/hi6210-i2s.h
+ *
+ * Copyright (C) 2015 Linaro, Ltd
+ * Author: Andy Green <andy.green@linaro.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Note at least on 6220, S2 == BT, S1 == Digital FM Radio IF
+ */
+
+#ifndef _HI6210_I2S_H
+#define _HI6210_I2S_H
+
+#define HII2S_SW_RST_N                          0
+
+#define HII2S_SW_RST_N__STEREO_UPLINK_WORDLEN_SHIFT                     28
+#define HII2S_SW_RST_N__STEREO_UPLINK_WORDLEN_MASK                      3
+#define HII2S_SW_RST_N__THIRDMD_UPLINK_WORDLEN_SHIFT                    26
+#define HII2S_SW_RST_N__THIRDMD_UPLINK_WORDLEN_MASK                     3
+#define HII2S_SW_RST_N__VOICE_UPLINK_WORDLEN_SHIFT                      24
+#define HII2S_SW_RST_N__VOICE_UPLINK_WORDLEN_MASK                       3
+#define HII2S_SW_RST_N__ST_DL_WORDLEN_SHIFT                             20
+#define HII2S_SW_RST_N__ST_DL_WORDLEN_MASK                              3
+#define HII2S_SW_RST_N__THIRDMD_DLINK_WORDLEN_SHIFT                     18
+#define HII2S_SW_RST_N__THIRDMD_DLINK_WORDLEN_MASK                      3
+#define HII2S_SW_RST_N__VOICE_DLINK_WORDLEN_SHIFT                       16
+#define HII2S_SW_RST_N__VOICE_DLINK_WORDLEN_MASK                        3
+
+#define HII2S_SW_RST_N__SW_RST_N                                        BIT(0)
+
+enum hi6210_bits {
+        HII2S_BITS_16,
+        HII2S_BITS_18,
+        HII2S_BITS_20,
+        HII2S_BITS_24,
+};
+
+
+#define HII2S_IF_CLK_EN_CFG                     4
+
+#define HII2S_IF_CLK_EN_CFG__THIRDMD_UPLINK_EN                          BIT(25)
+#define HII2S_IF_CLK_EN_CFG__THIRDMD_DLINK_EN                           BIT(24)
+#define HII2S_IF_CLK_EN_CFG__S3_IF_CLK_EN                               BIT(20)
+#define HII2S_IF_CLK_EN_CFG__S2_IF_CLK_EN                               BIT(16)
+#define HII2S_IF_CLK_EN_CFG__S2_OL_MIXER_EN                             BIT(15)
+#define HII2S_IF_CLK_EN_CFG__S2_OL_SRC_EN                               BIT(14)
+#define HII2S_IF_CLK_EN_CFG__S2_IR_PGA_EN                               BIT(13)
+#define HII2S_IF_CLK_EN_CFG__S2_IL_PGA_EN                               BIT(12)
+#define HII2S_IF_CLK_EN_CFG__S1_IR_PGA_EN                               BIT(10)
+#define HII2S_IF_CLK_EN_CFG__S1_IL_PGA_EN                               BIT(9)
+#define HII2S_IF_CLK_EN_CFG__S1_IF_CLK_EN                               BIT(8)
+#define HII2S_IF_CLK_EN_CFG__VOICE_DLINK_SRC_EN                         BIT(7)
+#define HII2S_IF_CLK_EN_CFG__VOICE_DLINK_EN                             BIT(6)
+#define HII2S_IF_CLK_EN_CFG__ST_DL_R_EN                                 BIT(5)
+#define HII2S_IF_CLK_EN_CFG__ST_DL_L_EN                                 BIT(4)
+#define HII2S_IF_CLK_EN_CFG__VOICE_UPLINK_R_EN                          BIT(3)
+#define HII2S_IF_CLK_EN_CFG__VOICE_UPLINK_L_EN                          BIT(2)
+#define HII2S_IF_CLK_EN_CFG__STEREO_UPLINK_R_EN                         BIT(1)
+#define HII2S_IF_CLK_EN_CFG__STEREO_UPLINK_L_EN                         BIT(0)
+
+#define HII2S_DIG_FILTER_CLK_EN_CFG             8
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_SDM_EN                        BIT(30)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_HBF2I_EN                      BIT(28)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_MIXER_EN                      BIT(25)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACR_AGC_EN                        BIT(24)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_SDM_EN                        BIT(22)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_HBF2I_EN                      BIT(20)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_MIXER_EN                      BIT(17)
+#define HII2S_DIG_FILTER_CLK_EN_CFG__DACL_AGC_EN                        BIT(16)
+
+#define HII2S_FS_CFG                            0xc
+
+#define HII2S_FS_CFG__FS_S2_SHIFT                                       28
+#define HII2S_FS_CFG__FS_S2_MASK                                        7
+#define HII2S_FS_CFG__FS_S1_SHIFT                                       24
+#define HII2S_FS_CFG__FS_S1_MASK                                        7
+#define HII2S_FS_CFG__FS_ADCLR_SHIFT                                    20
+#define HII2S_FS_CFG__FS_ADCLR_MASK                                     7
+#define HII2S_FS_CFG__FS_DACLR_SHIFT                                    16
+#define HII2S_FS_CFG__FS_DACLR_MASK                                     7
+#define HII2S_FS_CFG__FS_ST_DL_R_SHIFT                                  8
+#define HII2S_FS_CFG__FS_ST_DL_R_MASK                                   7
+#define HII2S_FS_CFG__FS_ST_DL_L_SHIFT                                  4
+#define HII2S_FS_CFG__FS_ST_DL_L_MASK                                   7
+#define HII2S_FS_CFG__FS_VOICE_DLINK_SHIFT                              0
+#define HII2S_FS_CFG__FS_VOICE_DLINK_MASK                               7
+
+enum hi6210_i2s_rates {
+        HII2S_FS_RATE_8KHZ = 0,
+        HII2S_FS_RATE_16KHZ = 1,
+        HII2S_FS_RATE_32KHZ = 2,
+        HII2S_FS_RATE_48KHZ = 4,
+        HII2S_FS_RATE_96KHZ = 5,
+        HII2S_FS_RATE_192KHZ = 6,
+};
+
+#define HII2S_I2S_CFG                           0x10
+
+#define HII2S_I2S_CFG__S2_IF_TX_EN                                      BIT(31)
+#define HII2S_I2S_CFG__S2_IF_RX_EN                                      BIT(30)
+#define HII2S_I2S_CFG__S2_FRAME_MODE                                    BIT(29)
+#define HII2S_I2S_CFG__S2_MST_SLV                                       BIT(28)
+#define HII2S_I2S_CFG__S2_LRCK_MODE                                     BIT(27)
+#define HII2S_I2S_CFG__S2_CHNNL_MODE                                    BIT(26)
+#define HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_SHIFT                     24
+#define HII2S_I2S_CFG__S2_CODEC_IO_WORDLENGTH_MASK                      3
+#define HII2S_I2S_CFG__S2_DIRECT_LOOP_SHIFT                             22
+#define HII2S_I2S_CFG__S2_DIRECT_LOOP_MASK                              3
+#define HII2S_I2S_CFG__S2_TX_CLK_SEL                                    BIT(21)
+#define HII2S_I2S_CFG__S2_RX_CLK_SEL                                    BIT(20)
+#define HII2S_I2S_CFG__S2_CODEC_DATA_FORMAT                             BIT(19)
+#define HII2S_I2S_CFG__S2_FUNC_MODE_SHIFT                               16
+#define HII2S_I2S_CFG__S2_FUNC_MODE_MASK                                7
+#define HII2S_I2S_CFG__S1_IF_TX_EN                                      BIT(15)
+#define HII2S_I2S_CFG__S1_IF_RX_EN                                      BIT(14)
+#define HII2S_I2S_CFG__S1_FRAME_MODE                                    BIT(13)
+#define HII2S_I2S_CFG__S1_MST_SLV                                       BIT(12)
+#define HII2S_I2S_CFG__S1_LRCK_MODE                                     BIT(11)
+#define HII2S_I2S_CFG__S1_CHNNL_MODE                                    BIT(10)
+#define HII2S_I2S_CFG__S1_CODEC_IO_WORDLENGTH_SHIFT                     8
+#define HII2S_I2S_CFG__S1_CODEC_IO_WORDLENGTH_MASK                      3
+#define HII2S_I2S_CFG__S1_DIRECT_LOOP_SHIFT                             6
+#define HII2S_I2S_CFG__S1_DIRECT_LOOP_MASK                              3
+#define HII2S_I2S_CFG__S1_TX_CLK_SEL                                    BIT(5)
+#define HII2S_I2S_CFG__S1_RX_CLK_SEL                                    BIT(4)
+#define HII2S_I2S_CFG__S1_CODEC_DATA_FORMAT                             BIT(3)
+#define HII2S_I2S_CFG__S1_FUNC_MODE_SHIFT                               0
+#define HII2S_I2S_CFG__S1_FUNC_MODE_MASK                                7
+
+enum hi6210_i2s_formats {
+        HII2S_FORMAT_I2S,
+        HII2S_FORMAT_PCM_STD,
+        HII2S_FORMAT_PCM_USER,
+        HII2S_FORMAT_LEFT_JUST,
+        HII2S_FORMAT_RIGHT_JUST,
+};
+
+#define HII2S_DIG_FILTER_MODULE_CFG             0x14
+
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_GAIN_SHIFT              28
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_GAIN_MASK               3
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN4_MUTE                BIT(27)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN3_MUTE                BIT(26)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN2_MUTE                BIT(25)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACR_MIXER_IN1_MUTE                BIT(24)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_GAIN_SHIFT              20
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_GAIN_MASK               3
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN4_MUTE                BIT(19)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN3_MUTE                BIT(18)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN2_MUTE                BIT(17)
+#define HII2S_DIG_FILTER_MODULE_CFG__DACL_MIXER_IN1_MUTE                BIT(16)
+#define HII2S_DIG_FILTER_MODULE_CFG__SW_DACR_SDM_DITHER                 BIT(9)
+#define HII2S_DIG_FILTER_MODULE_CFG__SW_DACL_SDM_DITHER                 BIT(8)
+#define HII2S_DIG_FILTER_MODULE_CFG__LM_CODEC_DAC2ADC_SHIFT             4
+#define HII2S_DIG_FILTER_MODULE_CFG__LM_CODEC_DAC2ADC_MASK              7
+#define HII2S_DIG_FILTER_MODULE_CFG__RM_CODEC_DAC2ADC_SHIFT             0
+#define HII2S_DIG_FILTER_MODULE_CFG__RM_CODEC_DAC2ADC_MASK              7
+
+enum hi6210_gains {
+        HII2S_GAIN_100PC,
+        HII2S_GAIN_50PC,
+        HII2S_GAIN_25PC,
+};
+
+#define HII2S_MUX_TOP_MODULE_CFG                0x18
+
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_GAIN_SHIFT          14
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_GAIN_MASK           3
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN2_MUTE            BIT(13)
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_MIXER_IN1_MUTE            BIT(12)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_GAIN_SHIFT                10
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_GAIN_MASK                 3
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN2_MUTE                  BIT(9)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_MIXER_IN1_MUTE                  BIT(8)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_SRC_RDY                         BIT(6)
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_SRC_MODE_SHIFT                  4
+#define HII2S_MUX_TOP_MODULE_CFG__S2_OL_SRC_MODE_MASK                   3
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_SRC_RDY                   BIT(3)
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_SRC_MODE_SHIFT            0
+#define HII2S_MUX_TOP_MODULE_CFG__VOICE_DLINK_SRC_MODE_MASK             7
+
+enum hi6210_s2_src_mode {
+        HII2S_S2_SRC_MODE_3,
+        HII2S_S2_SRC_MODE_12,
+        HII2S_S2_SRC_MODE_6,
+        HII2S_S2_SRC_MODE_2,
+};
+
+enum hi6210_voice_dlink_src_mode {
+        HII2S_VOICE_DL_SRC_MODE_12 = 1,
+        HII2S_VOICE_DL_SRC_MODE_6,
+        HII2S_VOICE_DL_SRC_MODE_2,
+        HII2S_VOICE_DL_SRC_MODE_3,
+};
+
+#define HII2S_ADC_PGA_CFG                       0x1c
+#define HII2S_S1_INPUT_PGA_CFG                  0x20
+#define HII2S_S2_INPUT_PGA_CFG                  0x24
+#define HII2S_ST_DL_PGA_CFG                     0x28
+#define HII2S_VOICE_SIDETONE_DLINK_PGA_CFG      0x2c
+#define HII2S_APB_AFIFO_CFG_1                   0x30
+#define HII2S_APB_AFIFO_CFG_2                   0x34
+#define HII2S_ST_DL_FIFO_TH_CFG                 0x38
+
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_SHIFT                   24
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AEMPTY_MASK                    0x1f
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_SHIFT                    16
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_R_AFULL_MASK                     0x1f
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_SHIFT                   8
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AEMPTY_MASK                    0x1f
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_SHIFT                    0
+#define HII2S_ST_DL_FIFO_TH_CFG__ST_DL_L_AFULL_MASK                     0x1f
+
+#define HII2S_STEREO_UPLINK_FIFO_TH_CFG         0x3c
+#define HII2S_VOICE_UPLINK_FIFO_TH_CFG          0x40
+#define HII2S_CODEC_IRQ_MASK                    0x44
+#define HII2S_CODEC_IRQ                         0x48
+#define HII2S_DACL_AGC_CFG_1                    0x4c
+#define HII2S_DACL_AGC_CFG_2                    0x50
+#define HII2S_DACR_AGC_CFG_1                    0x54
+#define HII2S_DACR_AGC_CFG_2                    0x58
+#define HII2S_DMIC_SIF_CFG                      0x5c
+#define HII2S_MISC_CFG                          0x60
+
+#define HII2S_MISC_CFG__THIRDMD_DLINK_TEST_SEL                          BIT(17)
+#define HII2S_MISC_CFG__THIRDMD_DLINK_DIN_SEL                           BIT(16)
+#define HII2S_MISC_CFG__S3_DOUT_RIGHT_SEL                               BIT(14)
+#define HII2S_MISC_CFG__S3_DOUT_LEFT_SEL                                BIT(13)
+#define HII2S_MISC_CFG__S3_DIN_TEST_SEL                                 BIT(12)
+#define HII2S_MISC_CFG__VOICE_DLINK_SRC_UP_DOUT_VLD_SEL                 BIT(8)
+#define HII2S_MISC_CFG__VOICE_DLINK_TEST_SEL                            BIT(7)
+#define HII2S_MISC_CFG__VOICE_DLINK_DIN_SEL                             BIT(6)
+#define HII2S_MISC_CFG__ST_DL_TEST_SEL                                  BIT(4)
+#define HII2S_MISC_CFG__S2_DOUT_RIGHT_SEL                               BIT(3)
+#define HII2S_MISC_CFG__S2_DOUT_TEST_SEL                                BIT(2)
+#define HII2S_MISC_CFG__S1_DOUT_TEST_SEL                                BIT(1)
+#define HII2S_MISC_CFG__S2_DOUT_LEFT_SEL                                BIT(0)
+
+#define HII2S_S2_SRC_CFG                        0x64
+#define HII2S_MEM_CFG                           0x68
+#define HII2S_THIRDMD_PCM_PGA_CFG               0x6c
+#define HII2S_THIRD_MODEM_FIFO_TH               0x70
+#define HII2S_S3_ANTI_FREQ_JITTER_TX_INC_CNT    0x74
+#define HII2S_S3_ANTI_FREQ_JITTER_TX_DEC_CNT    0x78
+#define HII2S_S3_ANTI_FREQ_JITTER_RX_INC_CNT    0x7c
+#define HII2S_S3_ANTI_FREQ_JITTER_RX_DEC_CNT    0x80
+#define HII2S_ANTI_FREQ_JITTER_EN               0x84
+#define HII2S_CLK_SEL                           0x88
+
+/* 0 = BT owns the i2s */
+#define HII2S_CLK_SEL__I2S_BT_FM_SEL                                    BIT(0)
+/* 0 = internal source, 1 = ext */
+#define HII2S_CLK_SEL__EXT_12_288MHZ_SEL                                BIT(1)
+
+
+#define HII2S_THIRDMD_DLINK_CHANNEL             0xe8
+#define HII2S_THIRDMD_ULINK_CHANNEL             0xec
+#define HII2S_VOICE_DLINK_CHANNEL               0xf0
+
+/* shovel data in here for playback */
+#define HII2S_ST_DL_CHANNEL                     0xf4
+#define HII2S_STEREO_UPLINK_CHANNEL             0xf8
+#define HII2S_VOICE_UPLINK_CHANNEL              0xfc
+
+#endif/* _HI6210_I2S_H */
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index 526855ad479e..67968ef3bbda 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -202,6 +202,30 @@ config SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH
           platforms with MAX98090 audio codec it also can support TI jack chip as aux device.
           If unsure select "N".
 
+config SND_SOC_INTEL_BYT_CHT_DA7213_MACH
+        tristate "ASoC Audio driver for Intel Baytrail & Cherrytrail with DA7212/7213 codec"
+        depends on X86_INTEL_LPSS && I2C && ACPI
+        select SND_SOC_DA7213
+        select SND_SST_ATOM_HIFI2_PLATFORM
+        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
+        help
+          This adds support for ASoC machine driver for Intel(R) Baytrail & CherryTrail
+          platforms with DA7212/7213 audio codec.
+          If unsure select "N".
+
+config SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH
+        tristate "ASoC Audio driver for Intel Baytrail & Cherrytrail platform with no codec (MinnowBoard MAX, Up)"
+        depends on X86_INTEL_LPSS && I2C && ACPI
+        select SND_SST_ATOM_HIFI2_PLATFORM
+        select SND_SST_IPC_ACPI
+        select SND_SOC_INTEL_SST_MATCH if ACPI
+        help
+          This adds support for ASoC machine driver for the MinnowBoard Max or
+          Up boards and provides access to I2S signals on the Low-Speed
+          connector
+          If unsure select "N".
+
 config SND_SOC_INTEL_SKYLAKE
         tristate
         select SND_HDA_EXT_CORE
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index 747c0f393d2d..dd250b8b26f2 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -420,7 +420,21 @@ static const struct dmi_system_id byt_table[] = {
                 .callback = byt_thinkpad10_quirk_cb,
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "20C3001VHH"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 10"),
+                },
+        },
+        {
+                .callback = byt_thinkpad10_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Tablet B"),
+                },
+        },
+        {
+                .callback = byt_thinkpad10_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Miix 2 10"),
                 },
         },
         { }
@@ -480,12 +494,23 @@ static struct sst_acpi_mach sst_acpi_bytcr[] = {
                                                 &byt_rvp_platform_data },
         {"10EC5651", "bytcr_rt5651", "intel/fw_sst_0f28.bin", "bytcr_rt5651", NULL,
                                                 &byt_rvp_platform_data },
+        {"DLGS7212", "bytcht_da7213", "intel/fw_sst_0f28.bin", "bytcht_da7213", NULL,
+                                                &byt_rvp_platform_data },
+        {"DLGS7213", "bytcht_da7213", "intel/fw_sst_0f28.bin", "bytcht_da7213", NULL,
+                                                &byt_rvp_platform_data },
         /* some Baytrail platforms rely on RT5645, use CHT machine driver */
         {"10EC5645", "cht-bsw-rt5645", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
                                                 &byt_rvp_platform_data },
         {"10EC5648", "cht-bsw-rt5645", "intel/fw_sst_0f28.bin", "cht-bsw", NULL,
                                                 &byt_rvp_platform_data },
-
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH)
+        /*
+         * This is always last in the table so that it is selected only when
+         * enabled explicitly and there is no codec-related information in SSDT
+         */
+        {"80860F28", "bytcht_nocodec", "intel/fw_sst_0f28.bin", "bytcht_nocodec", NULL,
+                                                &byt_rvp_platform_data },
+#endif
         {},
 };
 
@@ -504,6 +529,10 @@ static struct sst_acpi_mach sst_acpi_chv[] = {
 
         {"193C9890", "cht-bsw-max98090", "intel/fw_sst_22a8.bin", "cht-bsw", NULL,
                                                 &chv_platform_data },
+        {"DLGS7212", "bytcht_da7213", "intel/fw_sst_22a8.bin", "bytcht_da7213", NULL,
+                                                &chv_platform_data },
+        {"DLGS7213", "bytcht_da7213", "intel/fw_sst_22a8.bin", "bytcht_da7213", NULL,
+                                                &chv_platform_data },
         /* some CHT-T platforms rely on RT5640, use Baytrail machine driver */
         {"10EC5640", "bytcr_rt5640", "intel/fw_sst_22a8.bin", "bytcr_rt5640", cht_quirk,
                                                 &chv_platform_data },
@@ -512,6 +541,14 @@ static struct sst_acpi_mach sst_acpi_chv[] = {
         /* some CHT-T platforms rely on RT5651, use Baytrail machine driver */
         {"10EC5651", "bytcr_rt5651", "intel/fw_sst_22a8.bin", "bytcr_rt5651", NULL,
                                                 &chv_platform_data },
+#if IS_ENABLED(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH)
+        /*
+         * This is always last in the table so that it is selected only when
+         * enabled explicitly and there is no codec-related information in SSDT
+         */
+        {"808622A8", "bytcht_nocodec", "intel/fw_sst_22a8.bin", "bytcht_nocodec", NULL,
+                                                &chv_platform_data },
+#endif
         {},
 };
 
diff --git a/sound/soc/intel/atom/sst/sst_ipc.c b/sound/soc/intel/atom/sst/sst_ipc.c
index 14c2d9d18180..20b01e02ed8f 100644
--- a/sound/soc/intel/atom/sst/sst_ipc.c
+++ b/sound/soc/intel/atom/sst/sst_ipc.c
@@ -236,7 +236,9 @@ static void process_fw_init(struct intel_sst_drv *sst_drv_ctx,
                 retval = init->result;
                 goto ret;
         }
-        dev_info(sst_drv_ctx->dev, "FW Version %02x.%02x.%02x.%02x\n",
+        if (memcmp(&sst_drv_ctx->fw_version, &init->fw_version,
+                   sizeof(init->fw_version)))
+                dev_info(sst_drv_ctx->dev, "FW Version %02x.%02x.%02x.%02x\n",
                         init->fw_version.type, init->fw_version.major,
                         init->fw_version.minor, init->fw_version.build);
         dev_dbg(sst_drv_ctx->dev, "Build date %s Time %s\n",
diff --git a/sound/soc/intel/boards/Makefile b/sound/soc/intel/boards/Makefile
index 5639f10774e6..56896e09445d 100644
--- a/sound/soc/intel/boards/Makefile
+++ b/sound/soc/intel/boards/Makefile
@@ -10,6 +10,8 @@ snd-soc-sst-bytcr-rt5651-objs := bytcr_rt5651.o
 snd-soc-sst-cht-bsw-rt5672-objs := cht_bsw_rt5672.o
 snd-soc-sst-cht-bsw-rt5645-objs := cht_bsw_rt5645.o
 snd-soc-sst-cht-bsw-max98090_ti-objs := cht_bsw_max98090_ti.o
+snd-soc-sst-byt-cht-da7213-objs := bytcht_da7213.o
+snd-soc-sst-byt-cht-nocodec-objs := bytcht_nocodec.o
 snd-soc-skl_rt286-objs := skl_rt286.o
 snd-skl_nau88l25_max98357a-objs := skl_nau88l25_max98357a.o
 snd-soc-skl_nau88l25_ssm4567-objs := skl_nau88l25_ssm4567.o
@@ -26,6 +28,8 @@ obj-$(CONFIG_SND_SOC_INTEL_BYTCR_RT5651_MACH) += snd-soc-sst-bytcr-rt5651.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH) += snd-soc-sst-cht-bsw-rt5672.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5645_MACH) += snd-soc-sst-cht-bsw-rt5645.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_MAX98090_TI_MACH) += snd-soc-sst-cht-bsw-max98090_ti.o
+obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_DA7213_MACH) += snd-soc-sst-byt-cht-da7213.o
+obj-$(CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH) += snd-soc-sst-byt-cht-nocodec.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_RT286_MACH) += snd-soc-skl_rt286.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_NAU88L25_MAX98357A_MACH) += snd-skl_nau88l25_max98357a.o
 obj-$(CONFIG_SND_SOC_INTEL_SKL_NAU88L25_SSM4567_MACH) += snd-soc-skl_nau88l25_ssm4567.o
diff --git a/sound/soc/intel/boards/bdw-rt5677.c b/sound/soc/intel/boards/bdw-rt5677.c
index 53c6b4cbb1e1..14d9693c1641 100644
--- a/sound/soc/intel/boards/bdw-rt5677.c
+++ b/sound/soc/intel/boards/bdw-rt5677.c
@@ -193,13 +193,12 @@ static int bdw_rt5677_init(struct snd_soc_pcm_runtime *rtd)
                         RT5677_CLK_SEL_I2S1_ASRC);
 
         /* Request rt5677 GPIO for headphone amp control */
-        bdw_rt5677->gpio_hp_en = devm_gpiod_get_index(codec->dev,
-                        "headphone-enable", 0, 0);
+        bdw_rt5677->gpio_hp_en = devm_gpiod_get(codec->dev, "headphone-enable",
+                                                GPIOD_OUT_LOW);
         if (IS_ERR(bdw_rt5677->gpio_hp_en)) {
                 dev_err(codec->dev, "Can't find HP_AMP_SHDN_L gpio\n");
                 return PTR_ERR(bdw_rt5677->gpio_hp_en);
         }
-        gpiod_direction_output(bdw_rt5677->gpio_hp_en, 0);
 
         /* Create and initialize headphone jack */
         if (!snd_soc_card_jack_new(rtd->card, "Headphone Jack",
diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
index faf865bb1765..6dcbbcefc25b 100644
--- a/sound/soc/intel/boards/broadwell.c
+++ b/sound/soc/intel/boards/broadwell.c
@@ -269,9 +269,6 @@ static struct snd_soc_card broadwell_rt286 = {
 static int broadwell_audio_probe(struct platform_device *pdev)
 {
         broadwell_rt286.dev = &pdev->dev;
-
-        snd_soc_set_dmi_name(&broadwell_rt286, NULL);
-
         return devm_snd_soc_register_card(&pdev->dev, &broadwell_rt286);
 }
 
diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
index 2cda06cde4d1..3a8c4d954a91 100644
--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -55,6 +55,54 @@ enum {
         BXT_DPCM_AUDIO_HDMI3_PB,
 };
 
+static inline struct snd_soc_dai *bxt_get_codec_dai(struct snd_soc_card *card)
+{
+        struct snd_soc_pcm_runtime *rtd;
+
+        list_for_each_entry(rtd, &card->rtd_list, list) {
+
+                if (!strncmp(rtd->codec_dai->name, BXT_DIALOG_CODEC_DAI,
+                             strlen(BXT_DIALOG_CODEC_DAI)))
+                        return rtd->codec_dai;
+        }
+
+        return NULL;
+}
+
+static int platform_clock_control(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *k, int  event)
+{
+        int ret = 0;
+        struct snd_soc_dapm_context *dapm = w->dapm;
+        struct snd_soc_card *card = dapm->card;
+        struct snd_soc_dai *codec_dai;
+
+        codec_dai = bxt_get_codec_dai(card);
+        if (!codec_dai) {
+                dev_err(card->dev, "Codec dai not found; Unable to set/unset codec pll\n");
+                return -EIO;
+        }
+
+        if (SND_SOC_DAPM_EVENT_OFF(event)) {
+                ret = snd_soc_dai_set_pll(codec_dai, 0,
+                        DA7219_SYSCLK_MCLK, 0, 0);
+                if (ret)
+                        dev_err(card->dev, "failed to stop PLL: %d\n", ret);
+        } else if(SND_SOC_DAPM_EVENT_ON(event)) {
+                ret = snd_soc_dai_set_sysclk(codec_dai,
+                        DA7219_CLKSRC_MCLK, 19200000, SND_SOC_CLOCK_IN);
+                if (ret)
+                        dev_err(card->dev, "can't set codec sysclk configuration\n");
+
+                ret = snd_soc_dai_set_pll(codec_dai, 0,
+                        DA7219_SYSCLK_PLL_SRM, 0, DA7219_PLL_FREQ_OUT_98304);
+                if (ret)
+                        dev_err(card->dev, "failed to start PLL: %d\n", ret);
+        }
+
+        return ret;
+}
+
 static const struct snd_kcontrol_new broxton_controls[] = {
         SOC_DAPM_PIN_SWITCH("Headphone Jack"),
         SOC_DAPM_PIN_SWITCH("Headset Mic"),
@@ -69,6 +117,8 @@ static const struct snd_soc_dapm_widget broxton_widgets[] = {
         SND_SOC_DAPM_SPK("HDMI1", NULL),
         SND_SOC_DAPM_SPK("HDMI2", NULL),
         SND_SOC_DAPM_SPK("HDMI3", NULL),
+        SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
+                        platform_clock_control, SND_SOC_DAPM_POST_PMD|SND_SOC_DAPM_PRE_PMU),
 };
 
 static const struct snd_soc_dapm_route broxton_map[] = {
@@ -109,6 +159,9 @@ static const struct snd_soc_dapm_route broxton_map[] = {
         /* DMIC */
         {"dmic01_hifi", NULL, "DMIC01 Rx"},
         {"DMIC01 Rx", NULL, "DMIC AIF"},
+
+        { "Headphone Jack", NULL, "Platform Clock" },
+        { "Headset Mic", NULL, "Platform Clock" },
 };
 
 static int broxton_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
@@ -243,49 +296,6 @@ static const struct snd_soc_ops broxton_da7219_fe_ops = {
         .startup = bxt_fe_startup,
 };
 
-static int broxton_da7219_hw_params(struct snd_pcm_substream *substream,
-                                struct snd_pcm_hw_params *params)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        int ret;
-
-        ret = snd_soc_dai_set_sysclk(codec_dai,
-                        DA7219_CLKSRC_MCLK, 19200000, SND_SOC_CLOCK_IN);
-        if (ret < 0)
-                dev_err(codec_dai->dev, "can't set codec sysclk configuration\n");
-
-        ret = snd_soc_dai_set_pll(codec_dai, 0,
-                        DA7219_SYSCLK_PLL_SRM, 0, DA7219_PLL_FREQ_OUT_98304);
-        if (ret < 0) {
-                dev_err(codec_dai->dev, "failed to start PLL: %d\n", ret);
-                return -EIO;
-        }
-
-        return ret;
-}
-
-static int broxton_da7219_hw_free(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        int ret;
-
-        ret = snd_soc_dai_set_pll(codec_dai, 0,
-                        DA7219_SYSCLK_MCLK, 0, 0);
-        if (ret < 0) {
-                dev_err(codec_dai->dev, "failed to stop PLL: %d\n", ret);
-                return -EIO;
-        }
-
-        return ret;
-}
-
-static const struct snd_soc_ops broxton_da7219_ops = {
-        .hw_params = broxton_da7219_hw_params,
-        .hw_free = broxton_da7219_hw_free,
-};
-
 static int broxton_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
                         struct snd_pcm_hw_params *params)
 {
@@ -467,7 +477,6 @@ static struct snd_soc_dai_link broxton_dais[] = {
                         SND_SOC_DAIFMT_CBS_CFS,
                 .ignore_pmdown_time = 1,
                 .be_hw_params_fixup = broxton_ssp_fixup,
-                .ops = &broxton_da7219_ops,
                 .dpcm_playback = 1,
                 .dpcm_capture = 1,
         },
diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
index 176c080a9818..1a68d043c803 100644
--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -274,12 +274,15 @@ static int bxt_fe_startup(struct snd_pcm_substream *substream)
          * on this platform for PCM device we support:
          *      48Khz
          *      stereo
+         *      16-bit audio
          */
 
         runtime->hw.channels_max = 2;
         snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
                                 &constraints_channels);
 
+        runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+        snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
         snd_pcm_hw_constraint_list(runtime, 0,
                                 SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
 
diff --git a/sound/soc/intel/boards/bytcht_da7213.c b/sound/soc/intel/boards/bytcht_da7213.c
new file mode 100644
index 000000000000..18873e23f404
--- /dev/null
+++ b/sound/soc/intel/boards/bytcht_da7213.c
@@ -0,0 +1,283 @@
+/*
+ *  bytcht-da7213.c - ASoc Machine driver for Intel Baytrail and
+ *             Cherrytrail-based platforms, with Dialog DA7213 codec
+ *
+ *  Copyright (C) 2017 Intel Corporation
+ *  Author: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+#include <linux/module.h>
+#include <linux/acpi.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <asm/platform_sst_audio.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../../codecs/da7213.h"
+#include "../atom/sst-atom-controls.h"
+#include "../common/sst-acpi.h"
+
+static const struct snd_kcontrol_new controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone Jack"),
+        SOC_DAPM_PIN_SWITCH("Headset Mic"),
+        SOC_DAPM_PIN_SWITCH("Mic"),
+        SOC_DAPM_PIN_SWITCH("Aux In"),
+};
+
+static const struct snd_soc_dapm_widget dapm_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone Jack", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_MIC("Mic", NULL),
+        SND_SOC_DAPM_LINE("Aux In", NULL),
+};
+
+static const struct snd_soc_dapm_route audio_map[] = {
+        {"Headphone Jack", NULL, "HPL"},
+        {"Headphone Jack", NULL, "HPR"},
+
+        {"AUXL", NULL, "Aux In"},
+        {"AUXR", NULL, "Aux In"},
+
+        /* Assume Mic1 is linked to Headset and Mic2 to on-board mic */
+        {"MIC1", NULL, "Headset Mic"},
+        {"MIC2", NULL, "Mic"},
+
+        /* SOC-codec link */
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx"},
+        {"codec_in1", NULL, "ssp2 Rx"},
+
+        {"Playback", NULL, "ssp2 Tx"},
+        {"ssp2 Rx", NULL, "Capture"},
+};
+
+static int codec_fixup(struct snd_soc_pcm_runtime *rtd,
+                       struct snd_pcm_hw_params *params)
+{
+        int ret;
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+
+        /* The DSP will convert the FE rate to 48k, stereo, 24bits */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+
+        /* set SSP2 to 24-bit */
+        params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+
+        /*
+         * Default mode for SSP configuration is TDM 4 slot, override config
+         * with explicit setting to I2S 2ch 24-bit. The word length is set with
+         * dai_set_tdm_slot() since there is no other API exposed
+         */
+        ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                  SND_SOC_DAIFMT_I2S     |
+                                  SND_SOC_DAIFMT_NB_NF   |
+                                  SND_SOC_DAIFMT_CBS_CFS);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int aif1_startup(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_hw_constraint_single(substream->runtime,
+                        SNDRV_PCM_HW_PARAM_RATE, 48000);
+}
+
+static int aif1_hw_params(struct snd_pcm_substream *substream,
+                          struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        ret = snd_soc_dai_set_sysclk(codec_dai, DA7213_CLKSRC_MCLK,
+                                     19200000, SND_SOC_CLOCK_IN);
+        if (ret < 0)
+                dev_err(codec_dai->dev, "can't set codec sysclk configuration\n");
+
+        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                        DA7213_SYSCLK_PLL_SRM, 0, DA7213_PLL_FREQ_OUT_98304000);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "failed to start PLL: %d\n", ret);
+                return -EIO;
+        }
+
+        return ret;
+}
+
+static int aif1_hw_free(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                  DA7213_SYSCLK_MCLK, 0, 0);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "failed to stop PLL: %d\n", ret);
+                return -EIO;
+        }
+
+        return ret;
+}
+
+static const struct snd_soc_ops aif1_ops = {
+        .startup = aif1_startup,
+};
+
+static const struct snd_soc_ops ssp2_ops = {
+        .hw_params = aif1_hw_params,
+        .hw_free = aif1_hw_free,
+
+};
+
+static struct snd_soc_dai_link dailink[] = {
+        [MERR_DPCM_AUDIO] = {
+                .name = "Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "media-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_DEEP_BUFFER] = {
+                .name = "Deep-Buffer Audio Port",
+                .stream_name = "Deep-Buffer Audio",
+                .cpu_dai_name = "deepbuffer-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_COMPR] = {
+                .name = "Compressed Port",
+                .stream_name = "Compress",
+                .cpu_dai_name = "compress-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+        },
+        /* CODEC<->CODEC link */
+        /* back ends */
+        {
+                .name = "SSP2-Codec",
+                .id = 1,
+                .cpu_dai_name = "ssp2-port",
+                .platform_name = "sst-mfld-platform",
+                .no_pcm = 1,
+                .codec_dai_name = "da7213-hifi",
+                .codec_name = "i2c-DLGS7213:00",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+                                                | SND_SOC_DAIFMT_CBS_CFS,
+                .be_hw_params_fixup = codec_fixup,
+                .nonatomic = true,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &ssp2_ops,
+        },
+};
+
+/* SoC card */
+static struct snd_soc_card bytcht_da7213_card = {
+        .name = "bytcht-da7213",
+        .owner = THIS_MODULE,
+        .dai_link = dailink,
+        .num_links = ARRAY_SIZE(dailink),
+        .controls = controls,
+        .num_controls = ARRAY_SIZE(controls),
+        .dapm_widgets = dapm_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(dapm_widgets),
+        .dapm_routes = audio_map,
+        .num_dapm_routes = ARRAY_SIZE(audio_map),
+};
+
+static char codec_name[16]; /* i2c-<HID>:00 with HID being 8 chars */
+
+static int bytcht_da7213_probe(struct platform_device *pdev)
+{
+        int ret_val = 0;
+        int i;
+        struct snd_soc_card *card;
+        struct sst_acpi_mach *mach;
+        const char *i2c_name = NULL;
+        int dai_index = 0;
+
+        mach = (&pdev->dev)->platform_data;
+        card = &bytcht_da7213_card;
+        card->dev = &pdev->dev;
+
+        /* fix index of codec dai */
+        dai_index = MERR_DPCM_COMPR + 1;
+        for (i = 0; i < ARRAY_SIZE(dailink); i++) {
+                if (!strcmp(dailink[i].codec_name, "i2c-DLGS7213:00")) {
+                        dai_index = i;
+                        break;
+                }
+        }
+
+        /* fixup codec name based on HID */
+        i2c_name = sst_acpi_find_name_from_hid(mach->id);
+        if (i2c_name != NULL) {
+                snprintf(codec_name, sizeof(codec_name),
+                        "%s%s", "i2c-", i2c_name);
+                dailink[dai_index].codec_name = codec_name;
+        }
+
+        ret_val = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret_val) {
+                dev_err(&pdev->dev,
+                        "snd_soc_register_card failed %d\n", ret_val);
+                return ret_val;
+        }
+        platform_set_drvdata(pdev, card);
+        return ret_val;
+}
+
+static struct platform_driver bytcht_da7213_driver = {
+        .driver = {
+                .name = "bytcht_da7213",
+        },
+        .probe = bytcht_da7213_probe,
+};
+module_platform_driver(bytcht_da7213_driver);
+
+MODULE_DESCRIPTION("ASoC Intel(R) Baytrail/Cherrytrail+DA7213 Machine driver");
+MODULE_AUTHOR("Pierre-Louis Bossart");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bytcht_da7213");
diff --git a/sound/soc/intel/boards/bytcht_nocodec.c b/sound/soc/intel/boards/bytcht_nocodec.c
new file mode 100644
index 000000000000..89853eeaaf9d
--- /dev/null
+++ b/sound/soc/intel/boards/bytcht_nocodec.c
@@ -0,0 +1,208 @@
+/*
+ *  bytcht_nocodec.c - ASoc Machine driver for MinnowBoard Max and Up
+ *  to make I2S signals observable on the Low-Speed connector. Audio codec
+ *  is not managed by ASoC/DAPM
+ *
+ *  Copyright (C) 2015-2017 Intel Corp
+ *
+ *  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful, but
+ *  WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+
+#include <linux/module.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "../atom/sst-atom-controls.h"
+
+static const struct snd_soc_dapm_widget widgets[] = {
+        SND_SOC_DAPM_MIC("Mic", NULL),
+        SND_SOC_DAPM_SPK("Speaker", NULL),
+};
+
+static const struct snd_kcontrol_new controls[] = {
+        SOC_DAPM_PIN_SWITCH("Mic"),
+        SOC_DAPM_PIN_SWITCH("Speaker"),
+};
+
+static const struct snd_soc_dapm_route audio_map[] = {
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx"},
+        {"codec_in1", NULL, "ssp2 Rx"},
+
+        {"ssp2 Rx", NULL, "Mic"},
+        {"Speaker", NULL, "ssp2 Tx"},
+};
+
+static int codec_fixup(struct snd_soc_pcm_runtime *rtd,
+                            struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+        int ret;
+
+        /* The DSP will convert the FE rate to 48k, stereo, 24bits */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+
+        /* set SSP2 to 24-bit */
+        params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+
+        /*
+         * Default mode for SSP configuration is TDM 4 slot, override config
+         * with explicit setting to I2S 2ch 24-bit. The word length is set with
+         * dai_set_tdm_slot() since there is no other API exposed
+         */
+        ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                  SND_SOC_DAIFMT_I2S     |
+                                  SND_SOC_DAIFMT_NB_NF   |
+                                  SND_SOC_DAIFMT_CBS_CFS);
+
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static unsigned int rates_48000[] = {
+        48000,
+};
+
+static struct snd_pcm_hw_constraint_list constraints_48000 = {
+        .count = ARRAY_SIZE(rates_48000),
+        .list  = rates_48000,
+};
+
+static int aif1_startup(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                        SNDRV_PCM_HW_PARAM_RATE,
+                        &constraints_48000);
+}
+
+static struct snd_soc_ops aif1_ops = {
+        .startup = aif1_startup,
+};
+
+static struct snd_soc_dai_link dais[] = {
+        [MERR_DPCM_AUDIO] = {
+                .name = "Audio Port",
+                .stream_name = "Audio",
+                .cpu_dai_name = "media-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .ignore_suspend = 1,
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_DEEP_BUFFER] = {
+                .name = "Deep-Buffer Audio Port",
+                .stream_name = "Deep-Buffer Audio",
+                .cpu_dai_name = "deepbuffer-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+                .ignore_suspend = 1,
+                .nonatomic = true,
+                .dynamic = 1,
+                .dpcm_playback = 1,
+                .ops = &aif1_ops,
+        },
+        [MERR_DPCM_COMPR] = {
+                .name = "Compressed Port",
+                .stream_name = "Compress",
+                .cpu_dai_name = "compress-cpu-dai",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .platform_name = "sst-mfld-platform",
+        },
+        /* CODEC<->CODEC link */
+        /* back ends */
+        {
+                .name = "SSP2-LowSpeed Connector",
+                .id = 1,
+                .cpu_dai_name = "ssp2-port",
+                .platform_name = "sst-mfld-platform",
+                .no_pcm = 1,
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .codec_name = "snd-soc-dummy",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
+                                                | SND_SOC_DAIFMT_CBS_CFS,
+                .be_hw_params_fixup = codec_fixup,
+                .ignore_suspend = 1,
+                .nonatomic = true,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+        },
+};
+
+/* SoC card */
+static struct snd_soc_card bytcht_nocodec_card = {
+        .name = "bytcht-nocodec",
+        .owner = THIS_MODULE,
+        .dai_link = dais,
+        .num_links = ARRAY_SIZE(dais),
+        .dapm_widgets = widgets,
+        .num_dapm_widgets = ARRAY_SIZE(widgets),
+        .dapm_routes = audio_map,
+        .num_dapm_routes = ARRAY_SIZE(audio_map),
+        .controls = controls,
+        .num_controls = ARRAY_SIZE(controls),
+        .fully_routed = true,
+};
+
+static int snd_bytcht_nocodec_mc_probe(struct platform_device *pdev)
+{
+        int ret_val = 0;
+
+        /* register the soc card */
+        bytcht_nocodec_card.dev = &pdev->dev;
+
+        ret_val = devm_snd_soc_register_card(&pdev->dev, &bytcht_nocodec_card);
+
+        if (ret_val) {
+                dev_err(&pdev->dev, "devm_snd_soc_register_card failed %d\n",
+                        ret_val);
+                return ret_val;
+        }
+        platform_set_drvdata(pdev, &bytcht_nocodec_card);
+        return ret_val;
+}
+
+static struct platform_driver snd_bytcht_nocodec_mc_driver = {
+        .driver = {
+                .name = "bytcht_nocodec",
+        },
+        .probe = snd_bytcht_nocodec_mc_probe,
+};
+module_platform_driver(snd_bytcht_nocodec_mc_driver);
+
+MODULE_DESCRIPTION("ASoC Intel(R) Baytrail/Cherrytrail Nocodec Machine driver");
+MODULE_AUTHOR("Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bytcht_nocodec");
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 5c7219fb3aa8..4a76b099a508 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -19,6 +19,7 @@
 
 #include <linux/init.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/platform_device.h>
 #include <linux/acpi.h>
 #include <linux/device.h>
@@ -56,35 +57,88 @@ enum {
 struct byt_rt5640_private {
         struct clk *mclk;
 };
+static bool is_bytcr;
 
 static unsigned long byt_rt5640_quirk = BYT_RT5640_MCLK_EN;
+static unsigned int quirk_override;
+module_param_named(quirk, quirk_override, uint, 0444);
+MODULE_PARM_DESC(quirk, "Board-specific quirk override");
 
 static void log_quirks(struct device *dev)
 {
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_DMIC1_MAP)
-                dev_info(dev, "quirk DMIC1_MAP enabled");
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_DMIC2_MAP)
-                dev_info(dev, "quirk DMIC2_MAP enabled");
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_IN1_MAP)
-                dev_info(dev, "quirk IN1_MAP enabled");
-        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_IN3_MAP)
-                dev_info(dev, "quirk IN3_MAP enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_DMIC_EN)
-                dev_info(dev, "quirk DMIC enabled");
+        int map;
+        bool has_dmic = false;
+        bool has_mclk = false;
+        bool has_ssp0 = false;
+        bool has_ssp0_aif1 = false;
+        bool has_ssp0_aif2 = false;
+        bool has_ssp2_aif2 = false;
+
+        map = BYT_RT5640_MAP(byt_rt5640_quirk);
+        switch (map) {
+        case BYT_RT5640_DMIC1_MAP:
+                dev_info(dev, "quirk DMIC1_MAP enabled\n");
+                has_dmic = true;
+                break;
+        case BYT_RT5640_DMIC2_MAP:
+                dev_info(dev, "quirk DMIC2_MAP enabled\n");
+                has_dmic = true;
+                break;
+        case BYT_RT5640_IN1_MAP:
+                dev_info(dev, "quirk IN1_MAP enabled\n");
+                break;
+        case BYT_RT5640_IN3_MAP:
+                dev_info(dev, "quirk IN3_MAP enabled\n");
+                break;
+        default:
+                dev_err(dev, "quirk map 0x%x is not supported, microphone input will not work\n", map);
+                break;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_DMIC_EN) {
+                if (has_dmic)
+                        dev_info(dev, "quirk DMIC enabled\n");
+                else
+                        dev_err(dev, "quirk DMIC enabled but no DMIC input set, will be ignored\n");
+        }
         if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER)
-                dev_info(dev, "quirk MONO_SPEAKER enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC)
-                dev_info(dev, "quirk DIFF_MIC enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2)
-                dev_info(dev, "quirk SSP2_AIF2 enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1)
-                dev_info(dev, "quirk SSP0_AIF1 enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)
-                dev_info(dev, "quirk SSP0_AIF2 enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN)
-                dev_info(dev, "quirk MCLK_EN enabled");
-        if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ)
-                dev_info(dev, "quirk MCLK_25MHZ enabled");
+                dev_info(dev, "quirk MONO_SPEAKER enabled\n");
+        if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC) {
+                if (!has_dmic)
+                        dev_info(dev, "quirk DIFF_MIC enabled\n");
+                else
+                        dev_info(dev, "quirk DIFF_MIC enabled but DMIC input selected, will be ignored\n");
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) {
+                dev_info(dev, "quirk SSP0_AIF1 enabled\n");
+                has_ssp0 = true;
+                has_ssp0_aif1 = true;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2) {
+                dev_info(dev, "quirk SSP0_AIF2 enabled\n");
+                has_ssp0 = true;
+                has_ssp0_aif2 = true;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2) {
+                dev_info(dev, "quirk SSP2_AIF2 enabled\n");
+                has_ssp2_aif2 = true;
+        }
+        if (is_bytcr && !has_ssp0)
+                dev_err(dev, "Invalid routing, bytcr detected but no SSP0-based quirk, audio cannot work with SSP2 on bytcr\n");
+        if (has_ssp0_aif1 && has_ssp0_aif2)
+                dev_err(dev, "Invalid routing, SSP0 cannot be connected to both AIF1 and AIF2\n");
+        if (has_ssp0 && has_ssp2_aif2)
+                dev_err(dev, "Invalid routing, cannot have both SSP0 and SSP2 connected to codec\n");
+
+        if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN) {
+                dev_info(dev, "quirk MCLK_EN enabled\n");
+                has_mclk = true;
+        }
+        if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ) {
+                if (has_mclk)
+                        dev_info(dev, "quirk MCLK_25MHZ enabled\n");
+                else
+                        dev_err(dev, "quirk MCLK_25MHZ enabled but quirk MCLK not selected, will be ignored\n");
+        }
 }
 
 
@@ -128,7 +182,7 @@ static int platform_clock_control(struct snd_soc_dapm_widget *w,
                         ret = clk_prepare_enable(priv->mclk);
                         if (ret < 0) {
                                 dev_err(card->dev,
-                                        "could not configure MCLK state");
+                                        "could not configure MCLK state\n");
                                 return ret;
                         }
                 }
@@ -621,7 +675,7 @@ static struct snd_soc_dai_link byt_rt5640_dais[] = {
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .codec_name = "snd-soc-dummy",
                 .platform_name = "sst-mfld-platform",
-                .ignore_suspend = 1,
+                .nonatomic = true,
                 .dynamic = 1,
                 .dpcm_playback = 1,
                 .dpcm_capture = 1,
@@ -634,7 +688,6 @@ static struct snd_soc_dai_link byt_rt5640_dais[] = {
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .codec_name = "snd-soc-dummy",
                 .platform_name = "sst-mfld-platform",
-                .ignore_suspend = 1,
                 .nonatomic = true,
                 .dynamic = 1,
                 .dpcm_playback = 1,
@@ -661,6 +714,7 @@ static struct snd_soc_dai_link byt_rt5640_dais[] = {
                                                 | SND_SOC_DAIFMT_CBS_CFS,
                 .be_hw_params_fixup = byt_rt5640_codec_fixup,
                 .ignore_suspend = 1,
+                .nonatomic = true,
                 .dpcm_playback = 1,
                 .dpcm_capture = 1,
                 .init = byt_rt5640_init,
@@ -710,8 +764,8 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
         int i;
         int dai_index;
         struct byt_rt5640_private *priv;
-        bool is_bytcr = false;
 
+        is_bytcr = false;
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_ATOMIC);
         if (!priv)
                 return -ENOMEM;
@@ -806,6 +860,11 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 
         /* check quirks before creating card */
         dmi_check_system(byt_rt5640_quirk_table);
+        if (quirk_override) {
+                dev_info(&pdev->dev, "Overriding quirk 0x%x => 0x%x\n",
+                         (unsigned int)byt_rt5640_quirk, quirk_override);
+                byt_rt5640_quirk = quirk_override;
+        }
         log_quirks(&pdev->dev);
 
         if ((byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2) ||
diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 3186f015939f..8164bec63bf1 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -235,7 +235,6 @@ static struct snd_soc_dai_link byt_rt5651_dais[] = {
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .codec_name = "snd-soc-dummy",
                 .platform_name = "sst-mfld-platform",
-                .ignore_suspend = 1,
                 .nonatomic = true,
                 .dynamic = 1,
                 .dpcm_playback = 1,
@@ -249,7 +248,6 @@ static struct snd_soc_dai_link byt_rt5651_dais[] = {
                 .codec_dai_name = "snd-soc-dummy-dai",
                 .codec_name = "snd-soc-dummy",
                 .platform_name = "sst-mfld-platform",
-                .ignore_suspend = 1,
                 .nonatomic = true,
                 .dynamic = 1,
                 .dpcm_playback = 1,
diff --git a/sound/soc/intel/haswell/sst-haswell-ipc.c b/sound/soc/intel/haswell/sst-haswell-ipc.c
index a3459d1682a6..d33bdaf92c57 100644
--- a/sound/soc/intel/haswell/sst-haswell-ipc.c
+++ b/sound/soc/intel/haswell/sst-haswell-ipc.c
@@ -2000,10 +2000,8 @@ int sst_hsw_module_set_param(struct sst_hsw *hsw,
         u32 param_size, char *param)
 {
         int ret;
-        unsigned char *data = NULL;
         u32 header = 0;
         u32 payload_size = 0, transfer_parameter_size = 0;
-        dma_addr_t dma_addr = 0;
         struct sst_hsw_transfer_parameter *parameter;
         struct device *dev = hsw->dev;
 
@@ -2047,10 +2045,6 @@ int sst_hsw_module_set_param(struct sst_hsw *hsw,
 
         kfree(parameter);
 
-        if (data)
-                dma_free_coherent(hsw->dsp->dma_dev,
-                        param_size, (void *)data, dma_addr);
-
         return ret;
 }
 
diff --git a/sound/soc/intel/skylake/bxt-sst.c b/sound/soc/intel/skylake/bxt-sst.c
index 15a063a403cc..f5e7dbb1ba39 100644
--- a/sound/soc/intel/skylake/bxt-sst.c
+++ b/sound/soc/intel/skylake/bxt-sst.c
@@ -25,7 +25,8 @@
 #include "skl-sst-ipc.h"
 
 #define BXT_BASEFW_TIMEOUT      3000
-#define BXT_INIT_TIMEOUT        500
+#define BXT_INIT_TIMEOUT        300
+#define BXT_ROM_INIT_TIMEOUT    70
 #define BXT_IPC_PURGE_FW        0x01004000
 
 #define BXT_ROM_INIT            0x5
@@ -45,6 +46,8 @@
 /* Delay before scheduling D0i3 entry */
 #define BXT_D0I3_DELAY 5000
 
+#define BXT_FW_ROM_INIT_RETRY 3
+
 static unsigned int bxt_get_errorcode(struct sst_dsp *ctx)
 {
          return sst_dsp_shim_read(ctx, BXT_ADSP_ERROR_CODE);
@@ -55,29 +58,15 @@ bxt_load_library(struct sst_dsp *ctx, struct skl_lib_info *linfo, int lib_count)
 {
         struct snd_dma_buffer dmab;
         struct skl_sst *skl = ctx->thread_context;
-        const struct firmware *fw = NULL;
         struct firmware stripped_fw;
         int ret = 0, i, dma_id, stream_tag;
 
         /* library indices start from 1 to N. 0 represents base FW */
         for (i = 1; i < lib_count; i++) {
-                ret = request_firmware(&fw, linfo[i].name, ctx->dev);
-                if (ret < 0) {
-                        dev_err(ctx->dev, "Request lib %s failed:%d\n",
-                                        linfo[i].name, ret);
-                        return ret;
-                }
-
-                if (skl->is_first_boot) {
-                        ret = snd_skl_parse_uuids(ctx, fw,
+                ret = skl_prepare_lib_load(skl, &skl->lib_info[i], &stripped_fw,
                                         BXT_ADSP_FW_BIN_HDR_OFFSET, i);
-                        if (ret < 0)
-                                goto load_library_failed;
-                }
-
-                stripped_fw.data = fw->data;
-                stripped_fw.size = fw->size;
-                skl_dsp_strip_extended_manifest(&stripped_fw);
+                if (ret < 0)
+                        goto load_library_failed;
 
                 stream_tag = ctx->dsp_ops.prepare(ctx->dev, 0x40,
                                         stripped_fw.size, &dmab);
@@ -92,21 +81,19 @@ bxt_load_library(struct sst_dsp *ctx, struct skl_lib_info *linfo, int lib_count)
                 memcpy(dmab.area, stripped_fw.data, stripped_fw.size);
 
                 ctx->dsp_ops.trigger(ctx->dev, true, stream_tag);
-                ret = skl_sst_ipc_load_library(&skl->ipc, dma_id, i);
+                ret = skl_sst_ipc_load_library(&skl->ipc, dma_id, i, true);
                 if (ret < 0)
                         dev_err(ctx->dev, "IPC Load Lib for %s fail: %d\n",
                                         linfo[i].name, ret);
 
                 ctx->dsp_ops.trigger(ctx->dev, false, stream_tag);
                 ctx->dsp_ops.cleanup(ctx->dev, &dmab, stream_tag);
-                release_firmware(fw);
-                fw = NULL;
         }
 
         return ret;
 
 load_library_failed:
-        release_firmware(fw);
+        skl_release_library(linfo, lib_count);
         return ret;
 }
 
@@ -156,7 +143,7 @@ static int sst_bxt_prepare_fw(struct sst_dsp *ctx,
                                         SKL_ADSP_REG_HIPCIE_DONE,
                                         BXT_INIT_TIMEOUT, "HIPCIE Done");
         if (ret < 0) {
-                dev_err(ctx->dev, "Timout for Purge Request%d\n", ret);
+                dev_err(ctx->dev, "Timeout for Purge Request%d\n", ret);
                 goto base_fw_load_failed;
         }
 
@@ -173,7 +160,7 @@ static int sst_bxt_prepare_fw(struct sst_dsp *ctx,
 
         /* Step 7: Wait for ROM init */
         ret = sst_dsp_register_poll(ctx, BXT_ADSP_FW_STATUS, SKL_FW_STS_MASK,
-                        SKL_FW_INIT, BXT_INIT_TIMEOUT, "ROM Load");
+                        SKL_FW_INIT, BXT_ROM_INIT_TIMEOUT, "ROM Load");
         if (ret < 0) {
                 dev_err(ctx->dev, "Timeout for ROM init, ret:%d\n", ret);
                 goto base_fw_load_failed;
@@ -206,18 +193,16 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
 {
         struct firmware stripped_fw;
         struct skl_sst *skl = ctx->thread_context;
-        int ret;
+        int ret, i;
 
-        ret = request_firmware(&ctx->fw, ctx->fw_name, ctx->dev);
-        if (ret < 0) {
-                dev_err(ctx->dev, "Request firmware failed %d\n", ret);
-                goto sst_load_base_firmware_failed;
+        if (ctx->fw == NULL) {
+                ret = request_firmware(&ctx->fw, ctx->fw_name, ctx->dev);
+                if (ret < 0) {
+                        dev_err(ctx->dev, "Request firmware failed %d\n", ret);
+                        return ret;
+                }
         }
 
-        /* check for extended manifest */
-        if (ctx->fw == NULL)
-                goto sst_load_base_firmware_failed;
-
         /* prase uuids on first boot */
         if (skl->is_first_boot) {
                 ret = snd_skl_parse_uuids(ctx, ctx->fw, BXT_ADSP_FW_BIN_HDR_OFFSET, 0);
@@ -229,18 +214,20 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
         stripped_fw.size = ctx->fw->size;
         skl_dsp_strip_extended_manifest(&stripped_fw);
 
-        ret = sst_bxt_prepare_fw(ctx, stripped_fw.data, stripped_fw.size);
-        /* Retry Enabling core and ROM load. Retry seemed to help */
-        if (ret < 0) {
+
+        for (i = 0; i < BXT_FW_ROM_INIT_RETRY; i++) {
                 ret = sst_bxt_prepare_fw(ctx, stripped_fw.data, stripped_fw.size);
-                if (ret < 0) {
-                        dev_err(ctx->dev, "Error code=0x%x: FW status=0x%x\n",
+                if (ret == 0)
+                        break;
+        }
+
+        if (ret < 0) {
+                dev_err(ctx->dev, "Error code=0x%x: FW status=0x%x\n",
                         sst_dsp_shim_read(ctx, BXT_ADSP_ERROR_CODE),
                         sst_dsp_shim_read(ctx, BXT_ADSP_FW_STATUS));
 
-                        dev_err(ctx->dev, "Core En/ROM load fail:%d\n", ret);
-                        goto sst_load_base_firmware_failed;
-                }
+                dev_err(ctx->dev, "Core En/ROM load fail:%d\n", ret);
+                goto sst_load_base_firmware_failed;
         }
 
         ret = sst_transfer_fw_host_dma(ctx);
@@ -265,8 +252,11 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
                 }
         }
 
+        return ret;
+
 sst_load_base_firmware_failed:
         release_firmware(ctx->fw);
+        ctx->fw = NULL;
         return ret;
 }
 
@@ -428,6 +418,7 @@ static int bxt_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
                                 return ret;
                         }
                 }
+                skl->cores.state[core_id] = SKL_DSP_RUNNING;
                 return ret;
         }
 
@@ -514,11 +505,22 @@ static int bxt_set_dsp_D3(struct sst_dsp *ctx, unsigned int core_id)
 
         ret = skl_ipc_set_dx(&skl->ipc, BXT_INSTANCE_ID,
                                 BXT_BASE_FW_MODULE_ID, &dx);
-        if (ret < 0)
+        if (ret < 0) {
                 dev_err(ctx->dev,
                 "Failed to set DSP to D3:core id = %d;Continue reset\n",
                 core_id);
+                /*
+                 * In case of D3 failure, re-download the firmware, so set
+                 * fw_loaded to false.
+                 */
+                skl->fw_loaded = false;
+        }
 
+        if (core_id == SKL_DSP_CORE0_ID) {
+                /* disable Interrupt */
+                skl_ipc_op_int_disable(ctx);
+                skl_ipc_int_disable(ctx);
+        }
         ret = skl_dsp_disable_core(ctx, core_mask);
         if (ret < 0) {
                 dev_err(ctx->dev, "Failed to disable core %d\n", ret);
@@ -560,23 +562,14 @@ int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         struct sst_dsp *sst;
         int ret;
 
-        skl = devm_kzalloc(dev, sizeof(*skl), GFP_KERNEL);
-        if (skl == NULL)
-                return -ENOMEM;
-
-        skl->dev = dev;
-        skl_dev.thread_context = skl;
-        INIT_LIST_HEAD(&skl->uuid_list);
-
-        skl->dsp = skl_dsp_ctx_init(dev, &skl_dev, irq);
-        if (!skl->dsp) {
-                dev_err(skl->dev, "skl_dsp_ctx_init failed\n");
-                return -ENODEV;
+        ret = skl_sst_ctx_init(dev, irq, fw_name, dsp_ops, dsp, &skl_dev);
+        if (ret < 0) {
+                dev_err(dev, "%s: no device\n", __func__);
+                return ret;
         }
 
+        skl = *dsp;
         sst = skl->dsp;
-        sst->fw_name = fw_name;
-        sst->dsp_ops = dsp_ops;
         sst->fw_ops = bxt_fw_ops;
         sst->addr.lpe = mmio_base;
         sst->addr.shim = mmio_base;
@@ -584,24 +577,15 @@ int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         sst_dsp_mailbox_init(sst, (BXT_ADSP_SRAM0_BASE + SKL_ADSP_W0_STAT_SZ),
                         SKL_ADSP_W0_UP_SZ, BXT_ADSP_SRAM1_BASE, SKL_ADSP_W1_SZ);
 
-        INIT_LIST_HEAD(&sst->module_list);
-        ret = skl_ipc_init(dev, skl);
-        if (ret)
-                return ret;
-
         /* set the D0i3 check */
         skl->ipc.ops.check_dsp_lp_on = skl_ipc_check_D0i0;
 
         skl->cores.count = 2;
         skl->boot_complete = false;
         init_waitqueue_head(&skl->boot_wait);
-        skl->is_first_boot = true;
         INIT_DELAYED_WORK(&skl->d0i3.work, bxt_set_dsp_D0i3);
         skl->d0i3.state = SKL_DSP_D0I3_NONE;
 
-        if (dsp)
-                *dsp = skl;
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(bxt_sst_dsp_init);
@@ -635,6 +619,10 @@ EXPORT_SYMBOL_GPL(bxt_sst_init_fw);
 
 void bxt_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx)
 {
+
+        skl_release_library(ctx->lib_info, ctx->lib_count);
+        if (ctx->dsp->fw)
+                release_firmware(ctx->dsp->fw);
         skl_freeup_uuid_list(ctx);
         skl_ipc_free(&ctx->ipc);
         ctx->dsp->cl_dev.ops.cl_cleanup_controller(ctx->dsp);
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index e66870474f10..ab1adc0c9cc3 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -58,7 +58,7 @@ static int skl_free_dma_buf(struct device *dev, struct snd_dma_buffer *dmab)
 #define NOTIFICATION_MASK 0xf
 
 /* disable notfication for underruns/overruns from firmware module */
-static void skl_dsp_enable_notification(struct skl_sst *ctx, bool enable)
+void skl_dsp_enable_notification(struct skl_sst *ctx, bool enable)
 {
         struct notification_mask mask;
         struct skl_ipc_large_config_msg msg = {0};
@@ -209,7 +209,7 @@ static const struct skl_dsp_ops dsp_ops[] = {
         {
                 .id = 0x9d71,
                 .loader_ops = skl_get_loader_ops,
-                .init = skl_sst_dsp_init,
+                .init = kbl_sst_dsp_init,
                 .init_fw = skl_sst_init_fw,
                 .cleanup = skl_sst_dsp_cleanup
         },
@@ -274,6 +274,7 @@ int skl_init_dsp(struct skl *skl)
         if (ret < 0)
                 return ret;
 
+        skl->skl_sst->dsp_ops = ops;
         dev_dbg(bus->dev, "dsp registration status=%d\n", ret);
 
         return ret;
@@ -284,16 +285,11 @@ int skl_free_dsp(struct skl *skl)
         struct hdac_ext_bus *ebus = &skl->ebus;
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         struct skl_sst *ctx = skl->skl_sst;
-        const struct skl_dsp_ops *ops;
 
         /* disable  ppcap interrupt */
         snd_hdac_ext_bus_ppcap_int_enable(&skl->ebus, false);
 
-        ops = skl_get_dsp_ops(skl->pci->device);
-        if (!ops)
-                return -EIO;
-
-        ops->cleanup(bus->dev, ctx);
+        ctx->dsp_ops->cleanup(bus->dev, ctx);
 
         if (ctx->dsp->addr.lpe)
                 iounmap(ctx->dsp->addr.lpe);
@@ -866,7 +862,7 @@ static void skl_clear_module_state(struct skl_module_pin *mpin, int max,
         }
 
         if (!found)
-                mcfg->m_state = SKL_MODULE_UNINIT;
+                mcfg->m_state = SKL_MODULE_INIT_DONE;
         return;
 }
 
@@ -1098,7 +1094,7 @@ int skl_delete_pipe(struct skl_sst *ctx, struct skl_pipe *pipe)
         dev_dbg(ctx->dev, "%s: pipe = %d\n", __func__, pipe->ppl_id);
 
         /* If pipe is started, do stop the pipe in FW. */
-        if (pipe->state > SKL_PIPE_STARTED) {
+        if (pipe->state >= SKL_PIPE_STARTED) {
                 ret = skl_set_pipe_state(ctx, pipe, PPL_PAUSED);
                 if (ret < 0) {
                         dev_err(ctx->dev, "Failed to stop pipeline\n");
diff --git a/sound/soc/intel/skylake/skl-nhlt.c b/sound/soc/intel/skylake/skl-nhlt.c
index 7eb9c419dc7f..e3f06672fd6d 100644
--- a/sound/soc/intel/skylake/skl-nhlt.c
+++ b/sound/soc/intel/skylake/skl-nhlt.c
@@ -24,8 +24,6 @@
 static u8 OSC_UUID[16] = {0x6E, 0x88, 0x9F, 0xA6, 0xEB, 0x6C, 0x94, 0x45,
                                 0xA4, 0x1F, 0x7B, 0x5D, 0xCE, 0x24, 0xC5, 0x53};
 
-#define DSDT_NHLT_PATH "\\_SB.PCI0.HDAS"
-
 struct nhlt_acpi_table *skl_nhlt_init(struct device *dev)
 {
         acpi_handle handle;
@@ -33,8 +31,9 @@ struct nhlt_acpi_table *skl_nhlt_init(struct device *dev)
         struct nhlt_resource_desc  *nhlt_ptr = NULL;
         struct nhlt_acpi_table *nhlt_table = NULL;
 
-        if (ACPI_FAILURE(acpi_get_handle(NULL, DSDT_NHLT_PATH, &handle))) {
-                dev_err(dev, "Requested NHLT device not found\n");
+        handle = ACPI_HANDLE(dev);
+        if (!handle) {
+                dev_err(dev, "Didn't find ACPI_HANDLE\n");
                 return NULL;
         }
 
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index e12520e142ff..e91bbcffc856 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -21,6 +21,7 @@
 
 #include <linux/pci.h>
 #include <linux/pm_runtime.h>
+#include <linux/delay.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
 #include "skl.h"
@@ -155,7 +156,7 @@ int skl_pcm_host_dma_prepare(struct device *dev, struct skl_pipe_params *params)
         snd_hdac_ext_stream_decouple(ebus, stream, true);
 
         format_val = snd_hdac_calc_stream_format(params->s_freq,
-                                params->ch, params->format, 32, 0);
+                        params->ch, params->format, params->host_bps, 0);
 
         dev_dbg(dev, "format_val=%d, rate=%d, ch=%d, format=%d\n",
                 format_val, params->s_freq, params->ch, params->format);
@@ -190,8 +191,8 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
 
         stream = stream_to_hdac_ext_stream(hstream);
         snd_hdac_ext_stream_decouple(ebus, stream, true);
-        format_val = snd_hdac_calc_stream_format(params->s_freq,
-                                params->ch, params->format, 24, 0);
+        format_val = snd_hdac_calc_stream_format(params->s_freq, params->ch,
+                                        params->format, params->link_bps, 0);
 
         dev_dbg(dev, "format_val=%d, rate=%d, ch=%d, format=%d\n",
                 format_val, params->s_freq, params->ch, params->format);
@@ -262,23 +263,6 @@ static int skl_pcm_open(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static int skl_be_prepare(struct snd_pcm_substream *substream,
-                struct snd_soc_dai *dai)
-{
-        struct skl *skl = get_skl_ctx(dai->dev);
-        struct skl_sst *ctx = skl->skl_sst;
-        struct skl_module_cfg *mconfig;
-
-        if (dai->playback_widget->power || dai->capture_widget->power)
-                return 0;
-
-        mconfig = skl_tplg_be_get_cpr_module(dai, substream->stream);
-        if (mconfig == NULL)
-                return -EINVAL;
-
-        return skl_dsp_set_dma_control(ctx, mconfig);
-}
-
 static int skl_pcm_prepare(struct snd_pcm_substream *substream,
                 struct snd_soc_dai *dai)
 {
@@ -326,6 +310,11 @@ static int skl_pcm_hw_params(struct snd_pcm_substream *substream,
         p_params.host_dma_id = dma_id;
         p_params.stream = substream->stream;
         p_params.format = params_format(params);
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                p_params.host_bps = dai->driver->playback.sig_bits;
+        else
+                p_params.host_bps = dai->driver->capture.sig_bits;
+
 
         m_cfg = skl_tplg_fe_get_cpr_module(dai, p_params.stream);
         if (m_cfg)
@@ -564,6 +553,11 @@ static int skl_link_hw_params(struct snd_pcm_substream *substream,
         p_params.link_index = link->index;
         p_params.format = params_format(params);
 
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                p_params.link_bps = codec_dai->driver->playback.sig_bits;
+        else
+                p_params.link_bps = codec_dai->driver->capture.sig_bits;
+
         return skl_tplg_be_update_params(dai, &p_params);
 }
 
@@ -649,7 +643,6 @@ static struct snd_soc_dai_ops skl_dmic_dai_ops = {
 
 static struct snd_soc_dai_ops skl_be_ssp_dai_ops = {
         .hw_params = skl_be_hw_params,
-        .prepare = skl_be_prepare,
 };
 
 static struct snd_soc_dai_ops skl_link_dai_ops = {
@@ -670,6 +663,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_8000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE |
                         SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
         .capture = {
                 .stream_name = "System Capture",
@@ -677,6 +671,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -688,6 +683,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_QUAD,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -699,6 +695,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -710,6 +707,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -721,6 +719,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_max = HDA_QUAD,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -736,6 +735,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                         SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
                         SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -751,6 +751,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                         SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
                         SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
 },
 {
@@ -766,6 +767,7 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                         SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE |
                         SNDRV_PCM_FMTBIT_S32_LE,
+                .sig_bits = 32,
         },
 },
 
@@ -949,14 +951,12 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
 
 static int skl_platform_open(struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_runtime *runtime;
         struct snd_soc_pcm_runtime *rtd = substream->private_data;
         struct snd_soc_dai_link *dai_link = rtd->dai_link;
 
         dev_dbg(rtd->cpu_dai->dev, "In %s:%s\n", __func__,
                                         dai_link->cpu_dai_name);
 
-        runtime = substream->runtime;
         snd_soc_set_runtime_hwparams(substream, &azx_pcm_hw);
 
         return 0;
@@ -1062,13 +1062,31 @@ static snd_pcm_uframes_t skl_platform_pcm_pointer
          * HAD space reflects the actual data that is transferred.
          * Use the position buffer for capture, as DPIB write gets
          * completed earlier than the actual data written to the DDR.
+         *
+         * For capture stream following workaround is required to fix the
+         * incorrect position reporting.
+         *
+         * 1. Wait for 20us before reading the DMA position in buffer once
+         * the interrupt is generated for stream completion as update happens
+         * on the HDA frame boundary i.e. 20.833uSec.
+         * 2. Read DPIB register to flush the DMA position value. This dummy
+         * read is required to flush DMA position value.
+         * 3. Read the DMA Position-in-Buffer. This value now will be equal to
+         * or greater than period boundary.
          */
-        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 pos = readl(ebus->bus.remap_addr + AZX_REG_VS_SDXDPIB_XBASE +
                                 (AZX_REG_VS_SDXDPIB_XINTERVAL *
                                 hdac_stream(hstream)->index));
-        else
+        } else {
+                udelay(20);
+                readl(ebus->bus.remap_addr +
+                                AZX_REG_VS_SDXDPIB_XBASE +
+                                (AZX_REG_VS_SDXDPIB_XINTERVAL *
+                                 hdac_stream(hstream)->index));
                 pos = snd_hdac_stream_get_pos_posbuf(hdac_stream(hstream));
+        }
 
         if (pos >= hdac_stream(hstream)->bufsize)
                 pos = 0;
@@ -1165,7 +1183,7 @@ static int skl_pcm_new(struct snd_soc_pcm_runtime *rtd)
                                                 snd_dma_pci_data(skl->pci),
                                                 size, MAX_PREALLOC_SIZE);
                 if (retval) {
-                        dev_err(dai->dev, "dma buffer allocationf fail\n");
+                        dev_err(dai->dev, "dma buffer allocation fail\n");
                         return retval;
                 }
         }
@@ -1173,29 +1191,52 @@ static int skl_pcm_new(struct snd_soc_pcm_runtime *rtd)
         return retval;
 }
 
+static int skl_get_module_info(struct skl *skl, struct skl_module_cfg *mconfig)
+{
+        struct skl_sst *ctx = skl->skl_sst;
+        struct uuid_module *module;
+        uuid_le *uuid_mod;
+
+        uuid_mod = (uuid_le *)mconfig->guid;
+
+        if (list_empty(&ctx->uuid_list)) {
+                dev_err(ctx->dev, "Module list is empty\n");
+                return -EIO;
+        }
+
+        list_for_each_entry(module, &ctx->uuid_list, list) {
+                if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
+                        mconfig->id.module_id = module->id;
+                        mconfig->is_loadable = module->is_loadable;
+                        return 0;
+                }
+        }
+
+        return -EIO;
+}
+
 static int skl_populate_modules(struct skl *skl)
 {
         struct skl_pipeline *p;
         struct skl_pipe_module *m;
         struct snd_soc_dapm_widget *w;
         struct skl_module_cfg *mconfig;
-        int ret;
+        int ret = 0;
 
         list_for_each_entry(p, &skl->ppl_list, node) {
                 list_for_each_entry(m, &p->pipe->w_list, node) {
-
                         w = m->w;
                         mconfig = w->priv;
 
-                        ret = snd_skl_get_module_info(skl->skl_sst, mconfig);
+                        ret = skl_get_module_info(skl, mconfig);
                         if (ret < 0) {
                                 dev_err(skl->skl_sst->dev,
-                                        "query module info failed:%d\n", ret);
-                                goto err;
+                                        "query module info failed\n");
+                                return ret;
                         }
                 }
         }
-err:
+
         return ret;
 }
 
@@ -1232,6 +1273,7 @@ static int skl_platform_soc_probe(struct snd_soc_platform *platform)
                 }
                 skl_populate_modules(skl);
                 skl->skl_sst->update_d0i3c = skl_update_d0i3c;
+                skl_dsp_enable_notification(skl->skl_sst, false);
         }
         pm_runtime_mark_last_busy(platform->dev);
         pm_runtime_put_autosuspend(platform->dev);
@@ -1256,6 +1298,7 @@ int skl_platform_register(struct device *dev)
         struct skl *skl = ebus_to_skl(ebus);
 
         INIT_LIST_HEAD(&skl->ppl_list);
+        INIT_LIST_HEAD(&skl->bind_list);
 
         ret = snd_soc_register_platform(dev, &skl_platform_drv);
         if (ret) {
@@ -1276,6 +1319,17 @@ int skl_platform_register(struct device *dev)
 
 int skl_platform_unregister(struct device *dev)
 {
+        struct hdac_ext_bus *ebus = dev_get_drvdata(dev);
+        struct skl *skl = ebus_to_skl(ebus);
+        struct skl_module_deferred_bind *modules, *tmp;
+
+        if (!list_empty(&skl->bind_list)) {
+                list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
+                        list_del(&modules->node);
+                        kfree(modules);
+                }
+        }
+
         snd_soc_unregister_component(dev);
         snd_soc_unregister_platform(dev);
         return 0;
diff --git a/sound/soc/intel/skylake/skl-sst-cldma.c b/sound/soc/intel/skylake/skl-sst-cldma.c
index c9f6d87381db..d2b1d60fec02 100644
--- a/sound/soc/intel/skylake/skl-sst-cldma.c
+++ b/sound/soc/intel/skylake/skl-sst-cldma.c
@@ -164,7 +164,7 @@ static void skl_cldma_cleanup(struct sst_dsp  *ctx)
         ctx->dsp_ops.free_dma_buf(ctx->dev, &ctx->cl_dev.dmab_bdl);
 }
 
-static int skl_cldma_wait_interruptible(struct sst_dsp *ctx)
+int skl_cldma_wait_interruptible(struct sst_dsp *ctx)
 {
         int ret = 0;
 
@@ -243,9 +243,14 @@ static void skl_cldma_fill_buffer(struct sst_dsp *ctx, unsigned int size,
  * 2. Polling on fw register to identify if data left to transferred doesn't
  *    fill the ring buffer. Caller takes care of polling the required status
  *    register to identify the transfer status.
+ * 3. if wait flag is set, waits for DBL interrupt to copy the next chunk till
+ *    bytes_left is 0.
+ *    if wait flag is not set, doesn't wait for BDL interrupt. after ccopying
+ *    the first chunk return the no of bytes_left to be copied.
  */
 static int
-skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin, u32 total_size)
+skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin,
+                        u32 total_size, bool wait)
 {
         int ret = 0;
         bool start = true;
@@ -272,13 +277,14 @@ skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin, u32 total_size)
                         size = ctx->cl_dev.bufsize;
                         skl_cldma_fill_buffer(ctx, size, curr_pos, true, start);
 
-                        start = false;
-                        ret = skl_cldma_wait_interruptible(ctx);
-                        if (ret < 0) {
-                                skl_cldma_stop(ctx);
-                                return ret;
+                        if (wait) {
+                                start = false;
+                                ret = skl_cldma_wait_interruptible(ctx);
+                                if (ret < 0) {
+                                        skl_cldma_stop(ctx);
+                                        return ret;
+                                }
                         }
-
                 } else {
                         skl_cldma_int_disable(ctx);
 
@@ -298,9 +304,11 @@ skl_cldma_copy_to_buf(struct sst_dsp *ctx, const void *bin, u32 total_size)
                 }
                 bytes_left -= size;
                 curr_pos = curr_pos + size;
+                if (!wait)
+                        return bytes_left;
         }
 
-        return ret;
+        return bytes_left;
 }
 
 void skl_cldma_process_intr(struct sst_dsp *ctx)
diff --git a/sound/soc/intel/skylake/skl-sst-cldma.h b/sound/soc/intel/skylake/skl-sst-cldma.h
index 99e4c86b6358..5b730a1a0ae4 100644
--- a/sound/soc/intel/skylake/skl-sst-cldma.h
+++ b/sound/soc/intel/skylake/skl-sst-cldma.h
@@ -213,7 +213,7 @@ struct skl_cl_dev_ops {
         void (*cl_trigger)(struct sst_dsp  *ctx, bool enable);
         void (*cl_cleanup_controller)(struct sst_dsp  *ctx);
         int (*cl_copy_to_dmabuf)(struct sst_dsp *ctx,
-                        const void *bin, u32 size);
+                        const void *bin, u32 size, bool wait);
         void (*cl_stop_dma)(struct sst_dsp *ctx);
 };
 
diff --git a/sound/soc/intel/skylake/skl-sst-dsp.c b/sound/soc/intel/skylake/skl-sst-dsp.c
index c3deefab65d6..08332723c700 100644
--- a/sound/soc/intel/skylake/skl-sst-dsp.c
+++ b/sound/soc/intel/skylake/skl-sst-dsp.c
@@ -355,12 +355,13 @@ int skl_dsp_get_core(struct sst_dsp *ctx, unsigned int core_id)
                 ret = ctx->fw_ops.set_state_D0(ctx, core_id);
                 if (ret < 0) {
                         dev_err(ctx->dev, "unable to get core%d\n", core_id);
-                        return ret;
+                        goto out;
                 }
         }
 
         skl->cores.usage_count[core_id]++;
 
+out:
         dev_dbg(ctx->dev, "core id %d state %d usage_count %d\n",
                         core_id, skl->cores.state[core_id],
                         skl->cores.usage_count[core_id]);
@@ -379,7 +380,8 @@ int skl_dsp_put_core(struct sst_dsp *ctx, unsigned int core_id)
                 return -EINVAL;
         }
 
-        if (--skl->cores.usage_count[core_id] == 0) {
+        if ((--skl->cores.usage_count[core_id] == 0) &&
+                (skl->cores.state[core_id] != SKL_DSP_RESET)) {
                 ret = ctx->fw_ops.set_state_D3(ctx, core_id);
                 if (ret < 0) {
                         dev_err(ctx->dev, "unable to put core %d: %d\n",
diff --git a/sound/soc/intel/skylake/skl-sst-dsp.h b/sound/soc/intel/skylake/skl-sst-dsp.h
index 849410d0823e..eba20d37ba8c 100644
--- a/sound/soc/intel/skylake/skl-sst-dsp.h
+++ b/sound/soc/intel/skylake/skl-sst-dsp.h
@@ -17,13 +17,15 @@
 #define __SKL_SST_DSP_H__
 
 #include <linux/interrupt.h>
+#include <linux/uuid.h>
+#include <linux/firmware.h>
 #include <sound/memalloc.h>
 #include "skl-sst-cldma.h"
-#include "skl-topology.h"
 
 struct sst_dsp;
 struct skl_sst;
 struct sst_dsp_device;
+struct skl_lib_info;
 
 /* Intel HD Audio General DSP Registers */
 #define SKL_ADSP_GEN_BASE               0x0
@@ -144,7 +146,7 @@ struct skl_dsp_fw_ops {
         int (*load_fw)(struct sst_dsp  *ctx);
         /* FW module parser/loader */
         int (*load_library)(struct sst_dsp *ctx,
-                struct skl_lib_info *linfo, int count);
+                struct skl_lib_info *linfo, int lib_count);
         int (*parse_fw)(struct sst_dsp *ctx);
         int (*set_state_D0)(struct sst_dsp *ctx, unsigned int core_id);
         int (*set_state_D3)(struct sst_dsp *ctx, unsigned int core_id);
@@ -172,6 +174,19 @@ struct skl_dsp_loader_ops {
                                  int stream_tag);
 };
 
+#define MAX_INSTANCE_BUFF 2
+
+struct uuid_module {
+        uuid_le uuid;
+        int id;
+        int is_loadable;
+        int max_instance;
+        u64 pvt_id[MAX_INSTANCE_BUFF];
+        int *instance_id;
+
+        struct list_head list;
+};
+
 struct skl_load_module_info {
         u16 mod_id;
         const struct firmware *fw;
@@ -186,6 +201,7 @@ struct skl_module_table {
 void skl_cldma_process_intr(struct sst_dsp *ctx);
 void skl_cldma_int_disable(struct sst_dsp *ctx);
 int skl_cldma_prepare(struct sst_dsp *ctx);
+int skl_cldma_wait_interruptible(struct sst_dsp *ctx);
 
 void skl_dsp_set_state_locked(struct sst_dsp *ctx, int state);
 struct sst_dsp *skl_dsp_ctx_init(struct device *dev,
@@ -214,6 +230,9 @@ int skl_dsp_boot(struct sst_dsp *ctx);
 int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
                 const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
                 struct skl_sst **dsp);
+int kbl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
+                const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
+                struct skl_sst **dsp);
 int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
                 const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
                 struct skl_sst **dsp);
@@ -222,17 +241,22 @@ int bxt_sst_init_fw(struct device *dev, struct skl_sst *ctx);
 void skl_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx);
 void bxt_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx);
 
-int snd_skl_get_module_info(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig);
 int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
                                 unsigned int offset, int index);
-int skl_get_pvt_id(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig);
-int skl_put_pvt_id(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig);
+int skl_get_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int instance_id);
+int skl_put_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int *pvt_id);
 int skl_get_pvt_instance_id_map(struct skl_sst *ctx,
                                 int module_id, int instance_id);
 void skl_freeup_uuid_list(struct skl_sst *ctx);
 
 int skl_dsp_strip_extended_manifest(struct firmware *fw);
+void skl_dsp_enable_notification(struct skl_sst *ctx, bool enable);
+int skl_sst_ctx_init(struct device *dev, int irq, const char *fw_name,
+                struct skl_dsp_loader_ops dsp_ops, struct skl_sst **dsp,
+                struct sst_dsp_device *skl_dev);
+int skl_prepare_lib_load(struct skl_sst *skl, struct skl_lib_info *linfo,
+                        struct firmware *stripped_fw,
+                        unsigned int hdr_offset, int index);
+void skl_release_library(struct skl_lib_info *linfo, int lib_count);
+
 #endif /*__SKL_SST_DSP_H__*/
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index e1391dfbc9e9..58c525096a7c 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -34,6 +34,11 @@
 #define IPC_GLB_REPLY_STATUS_MASK       ((0x1 << IPC_GLB_REPLY_STATUS_SHIFT) - 1)
 #define IPC_GLB_REPLY_STATUS(x)         ((x) << IPC_GLB_REPLY_STATUS_SHIFT)
 
+#define IPC_GLB_REPLY_TYPE_SHIFT        29
+#define IPC_GLB_REPLY_TYPE_MASK         0x1F
+#define IPC_GLB_REPLY_TYPE(x)           (((x) >> IPC_GLB_REPLY_TYPE_SHIFT) \
+                                        & IPC_GLB_RPLY_TYPE_MASK)
+
 #define IPC_TIMEOUT_MSECS               3000
 
 #define IPC_EMPTY_LIST_SIZE             8
@@ -387,12 +392,27 @@ static int skl_ipc_process_notification(struct sst_generic_ipc *ipc,
         return 0;
 }
 
+static int skl_ipc_set_reply_error_code(u32 reply)
+{
+        switch (reply) {
+        case IPC_GLB_REPLY_OUT_OF_MEMORY:
+                return -ENOMEM;
+
+        case IPC_GLB_REPLY_BUSY:
+                return -EBUSY;
+
+        default:
+                return -EINVAL;
+        }
+}
+
 static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
                 struct skl_ipc_header header)
 {
         struct ipc_message *msg;
         u32 reply = header.primary & IPC_GLB_REPLY_STATUS_MASK;
         u64 *ipc_header = (u64 *)(&header);
+        struct skl_sst *skl = container_of(ipc, struct skl_sst, ipc);
 
         msg = skl_ipc_reply_get_msg(ipc, *ipc_header);
         if (msg == NULL) {
@@ -401,33 +421,39 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
         }
 
         /* first process the header */
-        switch (reply) {
-        case IPC_GLB_REPLY_SUCCESS:
+        if (reply == IPC_GLB_REPLY_SUCCESS) {
                 dev_dbg(ipc->dev, "ipc FW reply %x: success\n", header.primary);
                 /* copy the rx data from the mailbox */
                 sst_dsp_inbox_read(ipc->dsp, msg->rx_data, msg->rx_size);
-                break;
-
-        case IPC_GLB_REPLY_OUT_OF_MEMORY:
-                dev_err(ipc->dev, "ipc fw reply: %x: no memory\n", header.primary);
-                msg->errno = -ENOMEM;
-                break;
-
-        case IPC_GLB_REPLY_BUSY:
-                dev_err(ipc->dev, "ipc fw reply: %x: Busy\n", header.primary);
-                msg->errno = -EBUSY;
-                break;
+                switch (IPC_GLB_NOTIFY_MSG_TYPE(header.primary)) {
+                case IPC_GLB_LOAD_MULTIPLE_MODS:
+                case IPC_GLB_LOAD_LIBRARY:
+                        skl->mod_load_complete = true;
+                        skl->mod_load_status = true;
+                        wake_up(&skl->mod_load_wait);
+                        break;
 
-        default:
-                dev_err(ipc->dev, "Unknown ipc reply: 0x%x\n", reply);
-                msg->errno = -EINVAL;
-                break;
-        }
+                default:
+                        break;
 
-        if (reply != IPC_GLB_REPLY_SUCCESS) {
+                }
+        } else {
+                msg->errno = skl_ipc_set_reply_error_code(reply);
                 dev_err(ipc->dev, "ipc FW reply: reply=%d\n", reply);
                 dev_err(ipc->dev, "FW Error Code: %u\n",
                         ipc->dsp->fw_ops.get_fw_errcode(ipc->dsp));
+                switch (IPC_GLB_NOTIFY_MSG_TYPE(header.primary)) {
+                case IPC_GLB_LOAD_MULTIPLE_MODS:
+                case IPC_GLB_LOAD_LIBRARY:
+                        skl->mod_load_complete = true;
+                        skl->mod_load_status = false;
+                        wake_up(&skl->mod_load_wait);
+                        break;
+
+                default:
+                        break;
+
+                }
         }
 
         list_del(&msg->list);
@@ -811,8 +837,8 @@ int skl_ipc_load_modules(struct sst_generic_ipc *ipc,
         header.primary |= IPC_GLB_TYPE(IPC_GLB_LOAD_MULTIPLE_MODS);
         header.primary |= IPC_LOAD_MODULE_CNT(module_cnt);
 
-        ret = sst_ipc_tx_message_wait(ipc, *ipc_header, data,
-                                (sizeof(u16) * module_cnt), NULL, 0);
+        ret = sst_ipc_tx_message_nowait(ipc, *ipc_header, data,
+                                (sizeof(u16) * module_cnt));
         if (ret < 0)
                 dev_err(ipc->dev, "ipc: load modules failed :%d\n", ret);
 
@@ -947,7 +973,7 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
 EXPORT_SYMBOL_GPL(skl_ipc_get_large_config);
 
 int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
-                                u8 dma_id, u8 table_id)
+                                u8 dma_id, u8 table_id, bool wait)
 {
         struct skl_ipc_header header = {0};
         u64 *ipc_header = (u64 *)(&header);
@@ -959,7 +985,11 @@ int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
         header.primary |= IPC_MOD_INSTANCE_ID(table_id);
         header.primary |= IPC_MOD_ID(dma_id);
 
-        ret = sst_ipc_tx_message_wait(ipc, *ipc_header, NULL, 0, NULL, 0);
+        if (wait)
+                ret = sst_ipc_tx_message_wait(ipc, *ipc_header,
+                                        NULL, 0, NULL, 0);
+        else
+                ret = sst_ipc_tx_message_nowait(ipc, *ipc_header, NULL, 0);
 
         if (ret < 0)
                 dev_err(ipc->dev, "ipc: load lib failed\n");
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.h b/sound/soc/intel/skylake/skl-sst-ipc.h
index 9660ace379ab..e057da2713c6 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.h
+++ b/sound/soc/intel/skylake/skl-sst-ipc.h
@@ -69,6 +69,14 @@ struct skl_d0i3_data {
         struct delayed_work work;
 };
 
+#define SKL_LIB_NAME_LENGTH 128
+#define SKL_MAX_LIB 16
+
+struct skl_lib_info {
+        char name[SKL_LIB_NAME_LENGTH];
+        const struct firmware *fw;
+};
+
 struct skl_sst {
         struct device *dev;
         struct sst_dsp *dsp;
@@ -77,6 +85,11 @@ struct skl_sst {
         wait_queue_head_t boot_wait;
         bool boot_complete;
 
+        /* module load */
+        wait_queue_head_t mod_load_wait;
+        bool mod_load_complete;
+        bool mod_load_status;
+
         /* IPC messaging */
         struct sst_generic_ipc ipc;
 
@@ -105,6 +118,8 @@ struct skl_sst {
         void (*update_d0i3c)(struct device *dev, bool enable);
 
         struct skl_d0i3_data d0i3;
+
+        const struct skl_dsp_ops *dsp_ops;
 };
 
 struct skl_ipc_init_instance_msg {
@@ -182,7 +197,7 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
                 struct skl_ipc_large_config_msg *msg, u32 *param);
 
 int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
-                        u8 dma_id, u8 table_id);
+                        u8 dma_id, u8 table_id, bool wait);
 
 int skl_ipc_set_d0ix(struct sst_generic_ipc *ipc,
                 struct skl_ipc_d0ix_msg *msg);
diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
index ea162fbf68e5..81ee251881b4 100644
--- a/sound/soc/intel/skylake/skl-sst-utils.c
+++ b/sound/soc/intel/skylake/skl-sst-utils.c
@@ -94,19 +94,6 @@ struct adsp_fw_hdr {
         u32 load_offset;
 } __packed;
 
-#define MAX_INSTANCE_BUFF 2
-
-struct uuid_module {
-        uuid_le uuid;
-        int id;
-        int is_loadable;
-        int max_instance;
-        u64 pvt_id[MAX_INSTANCE_BUFF];
-        int *instance_id;
-
-        struct list_head list;
-};
-
 struct skl_ext_manifest_hdr {
         u32 id;
         u32 len;
@@ -115,32 +102,6 @@ struct skl_ext_manifest_hdr {
         u32 entries;
 };
 
-int snd_skl_get_module_info(struct skl_sst *ctx,
-                                struct skl_module_cfg *mconfig)
-{
-        struct uuid_module *module;
-        uuid_le *uuid_mod;
-
-        uuid_mod = (uuid_le *)mconfig->guid;
-
-        if (list_empty(&ctx->uuid_list)) {
-                dev_err(ctx->dev, "Module list is empty\n");
-                return -EINVAL;
-        }
-
-        list_for_each_entry(module, &ctx->uuid_list, list) {
-                if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
-                        mconfig->id.module_id = module->id;
-                        mconfig->is_loadable = module->is_loadable;
-
-                        return 0;
-                }
-        }
-
-        return -EINVAL;
-}
-EXPORT_SYMBOL_GPL(snd_skl_get_module_info);
-
 static int skl_get_pvtid_map(struct uuid_module *module, int instance_id)
 {
         int pvt_id;
@@ -222,21 +183,18 @@ static inline int skl_pvtid_128(struct uuid_module *module)
  * This generates a 128 bit private unique id for a module TYPE so that
  * module instance is unique
  */
-int skl_get_pvt_id(struct skl_sst *ctx, struct skl_module_cfg *mconfig)
+int skl_get_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int instance_id)
 {
         struct uuid_module *module;
-        uuid_le *uuid_mod;
         int pvt_id;
 
-        uuid_mod = (uuid_le *)mconfig->guid;
-
         list_for_each_entry(module, &ctx->uuid_list, list) {
                 if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
 
                         pvt_id = skl_pvtid_128(module);
                         if (pvt_id >= 0) {
-                                module->instance_id[pvt_id] =
-                                                mconfig->id.instance_id;
+                                module->instance_id[pvt_id] = instance_id;
+
                                 return pvt_id;
                         }
                 }
@@ -254,23 +212,21 @@ EXPORT_SYMBOL_GPL(skl_get_pvt_id);
  *
  * This frees a 128 bit private unique id previously generated
  */
-int skl_put_pvt_id(struct skl_sst *ctx, struct skl_module_cfg *mconfig)
+int skl_put_pvt_id(struct skl_sst *ctx, uuid_le *uuid_mod, int *pvt_id)
 {
         int i;
-        uuid_le *uuid_mod;
         struct uuid_module *module;
 
-        uuid_mod = (uuid_le *)mconfig->guid;
         list_for_each_entry(module, &ctx->uuid_list, list) {
                 if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
 
-                        if (mconfig->id.pvt_id != 0)
-                                i = (mconfig->id.pvt_id) / 64;
+                        if (*pvt_id != 0)
+                                i = (*pvt_id) / 64;
                         else
                                 i = 0;
 
-                        module->pvt_id[i] &= ~(1 << (mconfig->id.pvt_id));
-                        mconfig->id.pvt_id = -1;
+                        module->pvt_id[i] &= ~(1 << (*pvt_id));
+                        *pvt_id = -1;
                         return 0;
                 }
         }
@@ -405,3 +361,83 @@ int skl_dsp_strip_extended_manifest(struct firmware *fw)
 
         return 0;
 }
+
+int skl_sst_ctx_init(struct device *dev, int irq, const char *fw_name,
+        struct skl_dsp_loader_ops dsp_ops, struct skl_sst **dsp,
+        struct sst_dsp_device *skl_dev)
+{
+        struct skl_sst *skl;
+        struct sst_dsp *sst;
+        int ret;
+
+        skl = devm_kzalloc(dev, sizeof(*skl), GFP_KERNEL);
+        if (skl == NULL)
+                return -ENOMEM;
+
+        skl->dev = dev;
+        skl_dev->thread_context = skl;
+        INIT_LIST_HEAD(&skl->uuid_list);
+        skl->dsp = skl_dsp_ctx_init(dev, skl_dev, irq);
+        if (!skl->dsp) {
+                dev_err(skl->dev, "%s: no device\n", __func__);
+                return -ENODEV;
+        }
+
+        sst = skl->dsp;
+        sst->fw_name = fw_name;
+        sst->dsp_ops = dsp_ops;
+        init_waitqueue_head(&skl->mod_load_wait);
+        INIT_LIST_HEAD(&sst->module_list);
+        ret = skl_ipc_init(dev, skl);
+        if (ret)
+                return ret;
+
+        skl->is_first_boot = true;
+        if (dsp)
+                *dsp = skl;
+
+        return ret;
+}
+
+int skl_prepare_lib_load(struct skl_sst *skl, struct skl_lib_info *linfo,
+                struct firmware *stripped_fw,
+                unsigned int hdr_offset, int index)
+{
+        int ret;
+        struct sst_dsp *dsp = skl->dsp;
+
+        if (linfo->fw == NULL) {
+                ret = request_firmware(&linfo->fw, linfo->name,
+                                        skl->dev);
+                if (ret < 0) {
+                        dev_err(skl->dev, "Request lib %s failed:%d\n",
+                                linfo->name, ret);
+                        return ret;
+                }
+        }
+
+        if (skl->is_first_boot) {
+                ret = snd_skl_parse_uuids(dsp, linfo->fw, hdr_offset, index);
+                if (ret < 0)
+                        return ret;
+        }
+
+        stripped_fw->data = linfo->fw->data;
+        stripped_fw->size = linfo->fw->size;
+        skl_dsp_strip_extended_manifest(stripped_fw);
+
+        return 0;
+}
+
+void skl_release_library(struct skl_lib_info *linfo, int lib_count)
+{
+        int i;
+
+        /* library indices start from 1 to N. 0 represents base FW */
+        for (i = 1; i < lib_count; i++) {
+                if (linfo[i].fw) {
+                        release_firmware(linfo[i].fw);
+                        linfo[i].fw = NULL;
+                }
+        }
+}
diff --git a/sound/soc/intel/skylake/skl-sst.c b/sound/soc/intel/skylake/skl-sst.c
index b30bd384c8d3..155e456b7a3a 100644
--- a/sound/soc/intel/skylake/skl-sst.c
+++ b/sound/soc/intel/skylake/skl-sst.c
@@ -52,7 +52,8 @@ static int skl_transfer_firmware(struct sst_dsp *ctx,
 {
         int ret = 0;
 
-        ret = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, basefw, base_fw_size);
+        ret = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, basefw, base_fw_size,
+                                                                true);
         if (ret < 0)
                 return ret;
 
@@ -178,6 +179,18 @@ static int skl_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
                         dev_err(ctx->dev, "unable to load firmware\n");
                         return ret;
                 }
+
+                /* load libs as they are also lost on D3 */
+                if (skl->lib_count > 1) {
+                        ret = ctx->fw_ops.load_library(ctx, skl->lib_info,
+                                                        skl->lib_count);
+                        if (ret < 0) {
+                                dev_err(ctx->dev, "reload libs failed: %d\n",
+                                                ret);
+                                return ret;
+                        }
+
+                }
         }
 
         /*
@@ -203,7 +216,7 @@ static int skl_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
 
         skl->cores.state[core_id] = SKL_DSP_RUNNING;
 
-        return ret;
+        return 0;
 }
 
 static int skl_set_dsp_D3(struct sst_dsp *ctx, unsigned int core_id)
@@ -323,27 +336,85 @@ static struct skl_module_table *skl_module_get_from_id(
         return NULL;
 }
 
-static int skl_transfer_module(struct sst_dsp *ctx,
-                        struct skl_load_module_info *module)
+static int skl_transfer_module(struct sst_dsp *ctx, const void *data,
+                        u32 size, u16 mod_id, u8 table_id, bool is_module)
 {
-        int ret;
+        int ret, bytes_left, curr_pos;
         struct skl_sst *skl = ctx->thread_context;
+        skl->mod_load_complete = false;
 
-        ret = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, module->fw->data,
-                                                        module->fw->size);
-        if (ret < 0)
-                return ret;
+        bytes_left = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx, data, size, false);
+        if (bytes_left < 0)
+                return bytes_left;
 
-        ret = skl_ipc_load_modules(&skl->ipc, SKL_NUM_MODULES,
-                                                (void *)&module->mod_id);
-        if (ret < 0)
-                dev_err(ctx->dev, "Failed to Load module: %d\n", ret);
+        /* check is_module flag to load module or library */
+        if (is_module)
+                ret = skl_ipc_load_modules(&skl->ipc, SKL_NUM_MODULES, &mod_id);
+        else
+                ret = skl_sst_ipc_load_library(&skl->ipc, 0, table_id, false);
+
+        if (ret < 0) {
+                dev_err(ctx->dev, "Failed to Load %s with err %d\n",
+                                is_module ? "module" : "lib", ret);
+                goto out;
+        }
+
+        /*
+         * if bytes_left > 0 then wait for BDL complete interrupt and
+         * copy the next chunk till bytes_left is 0. if bytes_left is
+         * is zero, then wait for load module IPC reply
+         */
+        while (bytes_left > 0) {
+                curr_pos = size - bytes_left;
+
+                ret = skl_cldma_wait_interruptible(ctx);
+                if (ret < 0)
+                        goto out;
+
+                bytes_left = ctx->cl_dev.ops.cl_copy_to_dmabuf(ctx,
+                                                        data + curr_pos,
+                                                        bytes_left, false);
+        }
 
+        ret = wait_event_timeout(skl->mod_load_wait, skl->mod_load_complete,
+                                msecs_to_jiffies(SKL_IPC_BOOT_MSECS));
+        if (ret == 0 || !skl->mod_load_status) {
+                dev_err(ctx->dev, "Module Load failed\n");
+                ret = -EIO;
+        }
+
+out:
         ctx->cl_dev.ops.cl_stop_dma(ctx);
 
         return ret;
 }
 
+static int
+kbl_load_library(struct sst_dsp *ctx, struct skl_lib_info *linfo, int lib_count)
+{
+        struct skl_sst *skl = ctx->thread_context;
+        struct firmware stripped_fw;
+        int ret, i;
+
+        /* library indices start from 1 to N. 0 represents base FW */
+        for (i = 1; i < lib_count; i++) {
+                ret = skl_prepare_lib_load(skl, &skl->lib_info[i], &stripped_fw,
+                                        SKL_ADSP_FW_BIN_HDR_OFFSET, i);
+                if (ret < 0)
+                        goto load_library_failed;
+                ret = skl_transfer_module(ctx, stripped_fw.data,
+                                stripped_fw.size, 0, i, false);
+                if (ret < 0)
+                        goto load_library_failed;
+        }
+
+        return 0;
+
+load_library_failed:
+        skl_release_library(linfo, lib_count);
+        return ret;
+}
+
 static int skl_load_module(struct sst_dsp *ctx, u16 mod_id, u8 *guid)
 {
         struct skl_module_table *module_entry = NULL;
@@ -365,7 +436,9 @@ static int skl_load_module(struct sst_dsp *ctx, u16 mod_id, u8 *guid)
         }
 
         if (!module_entry->usage_cnt) {
-                ret = skl_transfer_module(ctx, module_entry->mod_info);
+                ret = skl_transfer_module(ctx, module_entry->mod_info->fw->data,
+                                module_entry->mod_info->fw->size,
+                                mod_id, 0, true);
                 if (ret < 0) {
                         dev_err(ctx->dev, "Failed to Load module\n");
                         return ret;
@@ -388,6 +461,11 @@ static int skl_unload_module(struct sst_dsp *ctx, u16 mod_id)
                 dev_err(ctx->dev, "Module bad usage cnt!:%d\n", usage_cnt);
                 return -EIO;
         }
+
+        /* if module is used by others return, no need to unload */
+        if (usage_cnt > 0)
+                return 0;
+
         ret = skl_ipc_unload_modules(&skl->ipc,
                         SKL_NUM_MODULES, &mod_id);
         if (ret < 0) {
@@ -434,6 +512,16 @@ static struct skl_dsp_fw_ops skl_fw_ops = {
         .unload_mod = skl_unload_module,
 };
 
+static struct skl_dsp_fw_ops kbl_fw_ops = {
+        .set_state_D0 = skl_set_dsp_D0,
+        .set_state_D3 = skl_set_dsp_D3,
+        .load_fw = skl_load_base_firmware,
+        .get_fw_errcode = skl_get_errorcode,
+        .load_library = kbl_load_library,
+        .load_mod = skl_load_module,
+        .unload_mod = skl_unload_module,
+};
+
 static struct sst_ops skl_ops = {
         .irq_handler = skl_dsp_sst_interrupt,
         .write = sst_shim32_write,
@@ -455,45 +543,47 @@ int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         struct sst_dsp *sst;
         int ret;
 
-        skl = devm_kzalloc(dev, sizeof(*skl), GFP_KERNEL);
-        if (skl == NULL)
-                return -ENOMEM;
-
-        skl->dev = dev;
-        skl_dev.thread_context = skl;
-        INIT_LIST_HEAD(&skl->uuid_list);
-
-        skl->dsp = skl_dsp_ctx_init(dev, &skl_dev, irq);
-        if (!skl->dsp) {
-                dev_err(skl->dev, "%s: no device\n", __func__);
-                return -ENODEV;
+        ret = skl_sst_ctx_init(dev, irq, fw_name, dsp_ops, dsp, &skl_dev);
+        if (ret < 0) {
+                dev_err(dev, "%s: no device\n", __func__);
+                return ret;
         }
 
+        skl = *dsp;
         sst = skl->dsp;
-
-        sst->fw_name = fw_name;
         sst->addr.lpe = mmio_base;
         sst->addr.shim = mmio_base;
         sst_dsp_mailbox_init(sst, (SKL_ADSP_SRAM0_BASE + SKL_ADSP_W0_STAT_SZ),
                         SKL_ADSP_W0_UP_SZ, SKL_ADSP_SRAM1_BASE, SKL_ADSP_W1_SZ);
 
-        INIT_LIST_HEAD(&sst->module_list);
-        sst->dsp_ops = dsp_ops;
         sst->fw_ops = skl_fw_ops;
 
-        ret = skl_ipc_init(dev, skl);
-        if (ret)
+        skl->cores.count = 2;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(skl_sst_dsp_init);
+
+int kbl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
+                const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
+                struct skl_sst **dsp)
+{
+        struct sst_dsp *sst;
+        int ret;
+
+        ret = skl_sst_dsp_init(dev, mmio_base, irq, fw_name, dsp_ops, dsp);
+        if (ret < 0) {
+                dev_err(dev, "%s: Init failed %d\n", __func__, ret);
                 return ret;
+        }
 
-        skl->cores.count = 2;
-        skl->is_first_boot = true;
+        sst = (*dsp)->dsp;
+        sst->fw_ops = kbl_fw_ops;
 
-        if (dsp)
-                *dsp = skl;
+        return 0;
 
-        return ret;
 }
-EXPORT_SYMBOL_GPL(skl_sst_dsp_init);
+EXPORT_SYMBOL_GPL(kbl_sst_dsp_init);
 
 int skl_sst_init_fw(struct device *dev, struct skl_sst *ctx)
 {
@@ -507,6 +597,15 @@ int skl_sst_init_fw(struct device *dev, struct skl_sst *ctx)
         }
 
         skl_dsp_init_core_state(sst);
+
+        if (ctx->lib_count > 1) {
+                ret = sst->fw_ops.load_library(sst, ctx->lib_info,
+                                                ctx->lib_count);
+                if (ret < 0) {
+                        dev_err(dev, "Load Library failed : %x\n", ret);
+                        return ret;
+                }
+        }
         ctx->is_first_boot = false;
 
         return 0;
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index ed58b5b3555a..3a99712e44a8 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -299,8 +299,6 @@ static void skl_tplg_update_buffer_size(struct skl_sst *ctx,
 {
         int multiplier = 1;
         struct skl_module_fmt *in_fmt, *out_fmt;
-        int in_rate, out_rate;
-
 
         /* Since fixups is applied to pin 0 only, ibs, obs needs
          * change for pin 0 only
@@ -311,22 +309,12 @@ static void skl_tplg_update_buffer_size(struct skl_sst *ctx,
         if (mcfg->m_type == SKL_MODULE_TYPE_SRCINT)
                 multiplier = 5;
 
-        if (in_fmt->s_freq % 1000)
-                in_rate = (in_fmt->s_freq / 1000) + 1;
-        else
-                in_rate = (in_fmt->s_freq / 1000);
-
-        mcfg->ibs = in_rate * (mcfg->in_fmt->channels) *
-                        (mcfg->in_fmt->bit_depth >> 3) *
+        mcfg->ibs = DIV_ROUND_UP(in_fmt->s_freq, 1000) *
+                        in_fmt->channels * (in_fmt->bit_depth >> 3) *
                         multiplier;
 
-        if (mcfg->out_fmt->s_freq % 1000)
-                out_rate = (mcfg->out_fmt->s_freq / 1000) + 1;
-        else
-                out_rate = (mcfg->out_fmt->s_freq / 1000);
-
-        mcfg->obs = out_rate * (mcfg->out_fmt->channels) *
-                        (mcfg->out_fmt->bit_depth >> 3) *
+        mcfg->obs = DIV_ROUND_UP(out_fmt->s_freq, 1000) *
+                        out_fmt->channels * (out_fmt->bit_depth >> 3) *
                         multiplier;
 }
 
@@ -512,7 +500,7 @@ static int skl_tplg_set_module_init_data(struct snd_soc_dapm_widget *w)
                         if (bc->set_params != SKL_PARAM_INIT)
                                 continue;
 
-                        mconfig->formats_config.caps = (u32 *)&bc->params;
+                        mconfig->formats_config.caps = (u32 *)bc->params;
                         mconfig->formats_config.caps_size = bc->size;
 
                         break;
@@ -551,6 +539,7 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
         int ret = 0;
 
         list_for_each_entry(w_module, &pipe->w_list, node) {
+                uuid_le *uuid_mod;
                 w = w_module->w;
                 mconfig = w->priv;
 
@@ -588,13 +577,15 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
                  * FE/BE params
                  */
                 skl_tplg_update_module_params(w, ctx);
-                mconfig->id.pvt_id = skl_get_pvt_id(ctx, mconfig);
+                uuid_mod = (uuid_le *)mconfig->guid;
+                mconfig->id.pvt_id = skl_get_pvt_id(ctx, uuid_mod,
+                                                mconfig->id.instance_id);
                 if (mconfig->id.pvt_id < 0)
                         return ret;
                 skl_tplg_set_module_init_data(w);
                 ret = skl_init_module(ctx, mconfig);
                 if (ret < 0) {
-                        skl_put_pvt_id(ctx, mconfig);
+                        skl_put_pvt_id(ctx, uuid_mod, &mconfig->id.pvt_id);
                         return ret;
                 }
                 skl_tplg_alloc_pipe_mcps(skl, mconfig);
@@ -614,7 +605,9 @@ static int skl_tplg_unload_pipe_modules(struct skl_sst *ctx,
         struct skl_module_cfg *mconfig = NULL;
 
         list_for_each_entry(w_module, &pipe->w_list, node) {
+                uuid_le *uuid_mod;
                 mconfig  = w_module->w->priv;
+                uuid_mod = (uuid_le *)mconfig->guid;
 
                 if (mconfig->is_loadable && ctx->dsp->fw_ops.unload_mod &&
                         mconfig->m_state > SKL_MODULE_UNINIT) {
@@ -623,7 +616,7 @@ static int skl_tplg_unload_pipe_modules(struct skl_sst *ctx,
                         if (ret < 0)
                                 return -EIO;
                 }
-                skl_put_pvt_id(ctx, mconfig);
+                skl_put_pvt_id(ctx, uuid_mod, &mconfig->id.pvt_id);
         }
 
         /* no modules to unload in this path, so return */
@@ -645,8 +638,9 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
         struct skl_module_cfg *mconfig = w->priv;
         struct skl_pipe_module *w_module;
         struct skl_pipe *s_pipe = mconfig->pipe;
-        struct skl_module_cfg *src_module = NULL, *dst_module;
+        struct skl_module_cfg *src_module = NULL, *dst_module, *module;
         struct skl_sst *ctx = skl->skl_sst;
+        struct skl_module_deferred_bind *modules;
 
         /* check resource available */
         if (!skl_is_pipe_mcps_avail(skl, mconfig))
@@ -687,29 +681,48 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
                 src_module = dst_module;
         }
 
+        /*
+         * When the destination module is initialized, check for these modules
+         * in deferred bind list. If found, bind them.
+         */
+        list_for_each_entry(w_module, &s_pipe->w_list, node) {
+                if (list_empty(&skl->bind_list))
+                        break;
+
+                list_for_each_entry(modules, &skl->bind_list, node) {
+                        module = w_module->w->priv;
+                        if (modules->dst == module)
+                                skl_bind_modules(ctx, modules->src,
+                                                        modules->dst);
+                }
+        }
+
         return 0;
 }
 
-static int skl_fill_sink_instance_id(struct skl_sst *ctx,
-                                struct skl_algo_data *alg_data)
+static int skl_fill_sink_instance_id(struct skl_sst *ctx, u32 *params,
+                                int size, struct skl_module_cfg *mcfg)
 {
-        struct skl_kpb_params *params = (struct skl_kpb_params *)alg_data->params;
-        struct skl_mod_inst_map *inst;
         int i, pvt_id;
 
-        inst = params->map;
+        if (mcfg->m_type == SKL_MODULE_TYPE_KPB) {
+                struct skl_kpb_params *kpb_params =
+                                (struct skl_kpb_params *)params;
+                struct skl_mod_inst_map *inst = kpb_params->map;
 
-        for (i = 0; i < params->num_modules; i++) {
-                pvt_id = skl_get_pvt_instance_id_map(ctx,
-                                        inst->mod_id, inst->inst_id);
-                if (pvt_id < 0)
-                        return -EINVAL;
-                inst->inst_id = pvt_id;
-                inst++;
+                for (i = 0; i < kpb_params->num_modules; i++) {
+                        pvt_id = skl_get_pvt_instance_id_map(ctx, inst->mod_id,
+                                                                inst->inst_id);
+                        if (pvt_id < 0)
+                                return -EINVAL;
+
+                        inst->inst_id = pvt_id;
+                        inst++;
+                }
         }
+
         return 0;
 }
-
 /*
  * Some modules require params to be set after the module is bound to
  * all pins connected.
@@ -726,6 +739,7 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
         struct soc_bytes_ext *sb;
         struct skl_algo_data *bc;
         struct skl_specific_cfg *sp_cfg;
+        u32 *params;
 
         /*
          * check all out/in pins are in bind state.
@@ -758,11 +772,18 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
                         bc = (struct skl_algo_data *)sb->dobj.private;
 
                         if (bc->set_params == SKL_PARAM_BIND) {
-                                if (mconfig->m_type == SKL_MODULE_TYPE_KPB)
-                                        skl_fill_sink_instance_id(ctx, bc);
-                                ret = skl_set_module_params(ctx,
-                                                (u32 *)bc->params, bc->max,
-                                                bc->param_id, mconfig);
+                                params = kzalloc(bc->max, GFP_KERNEL);
+                                if (!params)
+                                        return -ENOMEM;
+
+                                memcpy(params, bc->params, bc->max);
+                                skl_fill_sink_instance_id(ctx, params, bc->max,
+                                                                mconfig);
+
+                                ret = skl_set_module_params(ctx, params,
+                                                bc->max, bc->param_id, mconfig);
+                                kfree(params);
+
                                 if (ret < 0)
                                         return ret;
                         }
@@ -772,6 +793,44 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
+
+static int skl_tplg_module_add_deferred_bind(struct skl *skl,
+        struct skl_module_cfg *src, struct skl_module_cfg *dst)
+{
+        struct skl_module_deferred_bind *m_list, *modules;
+        int i;
+
+        /* only supported for module with static pin connection */
+        for (i = 0; i < dst->max_in_queue; i++) {
+                struct skl_module_pin *pin = &dst->m_in_pin[i];
+
+                if (pin->is_dynamic)
+                        continue;
+
+                if ((pin->id.module_id  == src->id.module_id) &&
+                        (pin->id.instance_id  == src->id.instance_id)) {
+
+                        if (!list_empty(&skl->bind_list)) {
+                                list_for_each_entry(modules, &skl->bind_list, node) {
+                                        if (modules->src == src && modules->dst == dst)
+                                                return 0;
+                                }
+                        }
+
+                        m_list = kzalloc(sizeof(*m_list), GFP_KERNEL);
+                        if (!m_list)
+                                return -ENOMEM;
+
+                        m_list->src = src;
+                        m_list->dst = dst;
+
+                        list_add(&m_list->node, &skl->bind_list);
+                }
+        }
+
+        return 0;
+}
+
 static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
                                 struct skl *skl,
                                 struct snd_soc_dapm_widget *src_w,
@@ -806,6 +865,28 @@ static int skl_tplg_bind_sinks(struct snd_soc_dapm_widget *w,
                         sink = p->sink;
                         sink_mconfig = sink->priv;
 
+                        /*
+                         * Modules other than PGA leaf can be connected
+                         * directly or via switch to a module in another
+                         * pipeline. EX: reference path
+                         * when the path is enabled, the dst module that needs
+                         * to be bound may not be initialized. if the module is
+                         * not initialized, add these modules in the deferred
+                         * bind list and when the dst module is initialised,
+                         * bind this module to the dst_module in deferred list.
+                         */
+                        if (((src_mconfig->m_state == SKL_MODULE_INIT_DONE)
+                                && (sink_mconfig->m_state == SKL_MODULE_UNINIT))) {
+
+                                ret = skl_tplg_module_add_deferred_bind(skl,
+                                                src_mconfig, sink_mconfig);
+
+                                if (ret < 0)
+                                        return ret;
+
+                        }
+
+
                         if (src_mconfig->m_state == SKL_MODULE_UNINIT ||
                                 sink_mconfig->m_state == SKL_MODULE_UNINIT)
                                 continue;
@@ -985,15 +1066,6 @@ static int skl_tplg_mixer_dapm_pre_pmd_event(struct snd_soc_dapm_widget *w,
                         src_mconfig = sink_mconfig->m_in_pin[i].tgt_mcfg;
                         if (!src_mconfig)
                                 continue;
-                        /*
-                         * If path_found == 1, that means pmd for source
-                         * pipe has not occurred, source is connected to
-                         * some other sink. so its responsibility of sink
-                         * to unbind itself from source.
-                         */
-                        ret = skl_stop_pipe(ctx, src_mconfig->pipe);
-                        if (ret < 0)
-                                return ret;
 
                         ret = skl_unbind_modules(ctx,
                                                 src_mconfig, sink_mconfig);
@@ -1019,6 +1091,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
         struct skl_module_cfg *src_module = NULL, *dst_module;
         struct skl_sst *ctx = skl->skl_sst;
         struct skl_pipe *s_pipe = mconfig->pipe;
+        struct skl_module_deferred_bind *modules, *tmp;
 
         if (s_pipe->state == SKL_PIPE_INVALID)
                 return -EINVAL;
@@ -1027,6 +1100,35 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
         skl_tplg_free_pipe_mem(skl, mconfig);
 
         list_for_each_entry(w_module, &s_pipe->w_list, node) {
+                if (list_empty(&skl->bind_list))
+                        break;
+
+                src_module = w_module->w->priv;
+
+                list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
+                        /*
+                         * When the destination module is deleted, Unbind the
+                         * modules from deferred bind list.
+                         */
+                        if (modules->dst == src_module) {
+                                skl_unbind_modules(ctx, modules->src,
+                                                modules->dst);
+                        }
+
+                        /*
+                         * When the source module is deleted, remove this entry
+                         * from the deferred bind list.
+                         */
+                        if (modules->src == src_module) {
+                                list_del(&modules->node);
+                                modules->src = NULL;
+                                modules->dst = NULL;
+                                kfree(modules);
+                        }
+                }
+        }
+
+        list_for_each_entry(w_module, &s_pipe->w_list, node) {
                 dst_module = w_module->w->priv;
 
                 if (mconfig->m_state >= SKL_MODULE_INIT_DONE)
@@ -1042,6 +1144,11 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
 
         skl_delete_pipe(ctx, mconfig->pipe);
 
+        list_for_each_entry(w_module, &s_pipe->w_list, node) {
+                src_module = w_module->w->priv;
+                src_module->m_state = SKL_MODULE_UNINIT;
+        }
+
         return skl_tplg_unload_pipe_modules(ctx, s_pipe);
 }
 
@@ -1083,36 +1190,6 @@ static int skl_tplg_pga_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
 }
 
 /*
- * In modelling, we assume there will be ONLY one mixer in a pipeline.  If
- * mixer is not required then it is treated as static mixer aka vmixer with
- * a hard path to source module
- * So we don't need to check if source is started or not as hard path puts
- * dependency on each other
- */
-static int skl_tplg_vmixer_event(struct snd_soc_dapm_widget *w,
-                                struct snd_kcontrol *k, int event)
-{
-        struct snd_soc_dapm_context *dapm = w->dapm;
-        struct skl *skl = get_skl_ctx(dapm->dev);
-
-        switch (event) {
-        case SND_SOC_DAPM_PRE_PMU:
-                return skl_tplg_mixer_dapm_pre_pmu_event(w, skl);
-
-        case SND_SOC_DAPM_POST_PMU:
-                return skl_tplg_mixer_dapm_post_pmu_event(w, skl);
-
-        case SND_SOC_DAPM_PRE_PMD:
-                return skl_tplg_mixer_dapm_pre_pmd_event(w, skl);
-
-        case SND_SOC_DAPM_POST_PMD:
-                return skl_tplg_mixer_dapm_post_pmd_event(w, skl);
-        }
-
-        return 0;
-}
-
-/*
  * In modelling, we assume there will be ONLY one mixer in a pipeline. If a
  * second one is required that is created as another pipe entity.
  * The mixer is responsible for pipe management and represent a pipeline
@@ -1252,10 +1329,12 @@ static void skl_tplg_fill_dma_id(struct skl_module_cfg *mcfg,
                 case SKL_DEVICE_HDALINK:
                         pipe->p_params->link_dma_id = params->link_dma_id;
                         pipe->p_params->link_index = params->link_index;
+                        pipe->p_params->link_bps = params->link_bps;
                         break;
 
                 case SKL_DEVICE_HDAHOST:
                         pipe->p_params->host_dma_id = params->host_dma_id;
+                        pipe->p_params->host_bps = params->host_bps;
                         break;
 
                 default:
@@ -1578,7 +1657,7 @@ int skl_tplg_be_update_params(struct snd_soc_dai *dai,
 
 static const struct snd_soc_tplg_widget_events skl_tplg_widget_ops[] = {
         {SKL_MIXER_EVENT, skl_tplg_mixer_event},
-        {SKL_VMIXER_EVENT, skl_tplg_vmixer_event},
+        {SKL_VMIXER_EVENT, skl_tplg_mixer_event},
         {SKL_PGA_EVENT, skl_tplg_pga_event},
 };
 
@@ -1632,7 +1711,7 @@ static int skl_tplg_add_pipe(struct device *dev,
         list_for_each_entry(ppl, &skl->ppl_list, node) {
                 if (ppl->pipe->ppl_id == tkn_elem->value) {
                         mconfig->pipe = ppl->pipe;
-                        return EEXIST;
+                        return -EEXIST;
                 }
         }
 
@@ -1924,11 +2003,13 @@ static int skl_tplg_get_token(struct device *dev,
                 ret = skl_tplg_add_pipe(dev,
                                 mconfig, skl, tkn_elem);
 
-                if (ret < 0)
+                if (ret < 0) {
+                        if (ret == -EEXIST) {
+                                is_pipe_exists = 1;
+                                break;
+                        }
                         return is_pipe_exists;
-
-                if (ret == EEXIST)
-                        is_pipe_exists = 1;
+                }
 
                 break;
 
diff --git a/sound/soc/intel/skylake/skl-topology.h b/sound/soc/intel/skylake/skl-topology.h
index fefab0e99a3b..cc64d6bdb4f6 100644
--- a/sound/soc/intel/skylake/skl-topology.h
+++ b/sound/soc/intel/skylake/skl-topology.h
@@ -257,6 +257,8 @@ struct skl_pipe_params {
         snd_pcm_format_t format;
         int link_index;
         int stream;
+        unsigned int host_bps;
+        unsigned int link_bps;
 };
 
 struct skl_pipe {
@@ -334,17 +336,10 @@ struct skl_pipeline {
         struct list_head node;
 };
 
-#define SKL_LIB_NAME_LENGTH 128
-#define SKL_MAX_LIB 16
-
-struct skl_lib_info {
-        char name[SKL_LIB_NAME_LENGTH];
-        const struct firmware *fw;
-};
-
-struct skl_manifest {
-        u32 lib_count;
-        struct skl_lib_info lib[SKL_MAX_LIB];
+struct skl_module_deferred_bind {
+        struct skl_module_cfg *src;
+        struct skl_module_cfg *dst;
+        struct list_head node;
 };
 
 static inline struct skl *get_skl_ctx(struct device *dev)
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 0c57d4eaae3a..6df3b317a476 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -512,7 +512,7 @@ static int probe_codec(struct hdac_ext_bus *ebus, int addr)
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         unsigned int cmd = (addr << 28) | (AC_NODE_ROOT << 20) |
                 (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID;
-        unsigned int res;
+        unsigned int res = -1;
 
         mutex_lock(&bus->cmd_mutex);
         snd_hdac_bus_send_cmd(bus, cmd);
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index bbef77d2b917..5b3fa4b91691 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -77,6 +77,7 @@ struct skl {
 
         struct skl_dsp_resource resource;
         struct list_head ppl_list;
+        struct list_head bind_list;
 
         const char *fw_name;
         char tplg_name[64];
diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig
index 05cf809cf9e1..5c68797f36c4 100644
--- a/sound/soc/mediatek/Kconfig
+++ b/sound/soc/mediatek/Kconfig
@@ -13,7 +13,7 @@ config SND_SOC_MT2701
 
 config SND_SOC_MT2701_CS42448
         tristate "ASoc Audio driver for MT2701 with CS42448 codec"
-        depends on SND_SOC_MT2701
+        depends on SND_SOC_MT2701 && I2C
         select SND_SOC_CS42XX8_I2C
         select SND_SOC_BT_SCO
         help
@@ -22,6 +22,16 @@ config SND_SOC_MT2701_CS42448
           Select Y if you have such device.
           If unsure select "N".
 
+config SND_SOC_MT2701_WM8960
+        tristate "ASoc Audio driver for MT2701 with WM8960 codec"
+        depends on SND_SOC_MT2701 && I2C
+        select SND_SOC_WM8960
+        help
+          This adds ASoC driver for Mediatek MT2701 boards
+          with the WM8960 codecs.
+          Select Y if you have such device.
+          If unsure select "N".
+
 config SND_SOC_MT8173
         tristate "ASoC support for Mediatek MT8173 chip"
         depends on ARCH_MEDIATEK
diff --git a/sound/soc/mediatek/mt2701/Makefile b/sound/soc/mediatek/mt2701/Makefile
index 31c3d04d4942..c91deb6aca21 100644
--- a/sound/soc/mediatek/mt2701/Makefile
+++ b/sound/soc/mediatek/mt2701/Makefile
@@ -17,3 +17,4 @@ obj-$(CONFIG_SND_SOC_MT2701) += snd-soc-mt2701-afe.o
 
 # machine driver
 obj-$(CONFIG_SND_SOC_MT2701_CS42448) += mt2701-cs42448.o
+obj-$(CONFIG_SND_SOC_MT2701_WM8960) += mt2701-wm8960.o
diff --git a/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c b/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
index c7fa3e663463..bc5d4db94de6 100644
--- a/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
+++ b/sound/soc/mediatek/mt2701/mt2701-afe-pcm.c
@@ -604,6 +604,22 @@ static struct snd_soc_dai_ops mt2701_btmrg_ops = {
 static struct snd_soc_dai_driver mt2701_afe_pcm_dais[] = {
         /* FE DAIs: memory intefaces to CPU */
         {
+                .name = "PCMO0",
+                .id = MT2701_MEMIF_DL1,
+                .suspend = mtk_afe_dai_suspend,
+                .resume = mtk_afe_dai_resume,
+                .playback = {
+                        .stream_name = "DL1",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = SNDRV_PCM_RATE_8000_192000,
+                        .formats = (SNDRV_PCM_FMTBIT_S16_LE
+                                | SNDRV_PCM_FMTBIT_S24_LE
+                                | SNDRV_PCM_FMTBIT_S32_LE)
+                },
+                .ops = &mt2701_single_memif_dai_ops,
+        },
+        {
                 .name = "PCM_multi",
                 .id = MT2701_MEMIF_DLM,
                 .suspend = mtk_afe_dai_suspend,
diff --git a/sound/soc/mediatek/mt2701/mt2701-cs42448.c b/sound/soc/mediatek/mt2701/mt2701-cs42448.c
index 1e7e8d43fd8a..aa5b31b121e3 100644
--- a/sound/soc/mediatek/mt2701/mt2701-cs42448.c
+++ b/sound/soc/mediatek/mt2701/mt2701-cs42448.c
@@ -129,7 +129,7 @@ static int mt2701_cs42448_fe_ops_startup(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_soc_ops mt2701_cs42448_48k_fe_ops = {
+static const struct snd_soc_ops mt2701_cs42448_48k_fe_ops = {
         .startup = mt2701_cs42448_fe_ops_startup,
 };
 
diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c
new file mode 100644
index 000000000000..a08ce2323bdc
--- /dev/null
+++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c
@@ -0,0 +1,176 @@
+/*
+ * mt2701-wm8960.c  --  MT2701 WM8960 ALSA SoC machine driver
+ *
+ * Copyright (c) 2017 MediaTek Inc.
+ * Author: Ryder Lee <ryder.lee@mediatek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/module.h>
+#include <sound/soc.h>
+
+#include "mt2701-afe-common.h"
+
+static const struct snd_soc_dapm_widget mt2701_wm8960_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone", NULL),
+        SND_SOC_DAPM_MIC("AMIC", NULL),
+};
+
+static const struct snd_kcontrol_new mt2701_wm8960_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphone"),
+        SOC_DAPM_PIN_SWITCH("AMIC"),
+};
+
+static int mt2701_wm8960_be_ops_hw_params(struct snd_pcm_substream *substream,
+                                          struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+        unsigned int mclk_rate;
+        unsigned int rate = params_rate(params);
+        unsigned int div_mclk_over_bck = rate > 192000 ? 2 : 4;
+        unsigned int div_bck_over_lrck = 64;
+
+        mclk_rate = rate * div_bck_over_lrck * div_mclk_over_bck;
+
+        snd_soc_dai_set_sysclk(cpu_dai, 0, mclk_rate, SND_SOC_CLOCK_OUT);
+        snd_soc_dai_set_sysclk(codec_dai, 0, mclk_rate, SND_SOC_CLOCK_IN);
+
+        return 0;
+}
+
+static struct snd_soc_ops mt2701_wm8960_be_ops = {
+        .hw_params = mt2701_wm8960_be_ops_hw_params
+};
+
+static struct snd_soc_dai_link mt2701_wm8960_dai_links[] = {
+        /* FE */
+        {
+                .name = "wm8960-playback",
+                .stream_name = "wm8960-playback",
+                .cpu_dai_name = "PCMO0",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .trigger = {SND_SOC_DPCM_TRIGGER_POST,
+                            SND_SOC_DPCM_TRIGGER_POST},
+                .dynamic = 1,
+                .dpcm_playback = 1,
+        },
+        {
+                .name = "wm8960-capture",
+                .stream_name = "wm8960-capture",
+                .cpu_dai_name = "PCM0",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .trigger = {SND_SOC_DPCM_TRIGGER_POST,
+                            SND_SOC_DPCM_TRIGGER_POST},
+                .dynamic = 1,
+                .dpcm_capture = 1,
+        },
+        /* BE */
+        {
+                .name = "wm8960-codec",
+                .cpu_dai_name = "I2S0",
+                .no_pcm = 1,
+                .codec_dai_name = "wm8960-hifi",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBS_CFS
+                        | SND_SOC_DAIFMT_GATED,
+                .ops = &mt2701_wm8960_be_ops,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+        },
+};
+
+static struct snd_soc_card mt2701_wm8960_card = {
+        .name = "mt2701-wm8960",
+        .owner = THIS_MODULE,
+        .dai_link = mt2701_wm8960_dai_links,
+        .num_links = ARRAY_SIZE(mt2701_wm8960_dai_links),
+        .controls = mt2701_wm8960_controls,
+        .num_controls = ARRAY_SIZE(mt2701_wm8960_controls),
+        .dapm_widgets = mt2701_wm8960_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(mt2701_wm8960_widgets),
+};
+
+static int mt2701_wm8960_machine_probe(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = &mt2701_wm8960_card;
+        struct device_node *platform_node, *codec_node;
+        int ret, i;
+
+        platform_node = of_parse_phandle(pdev->dev.of_node,
+                                         "mediatek,platform", 0);
+        if (!platform_node) {
+                dev_err(&pdev->dev, "Property 'platform' missing or invalid\n");
+                return -EINVAL;
+        }
+        for (i = 0; i < card->num_links; i++) {
+                if (mt2701_wm8960_dai_links[i].platform_name)
+                        continue;
+                mt2701_wm8960_dai_links[i].platform_of_node = platform_node;
+        }
+
+        card->dev = &pdev->dev;
+
+        codec_node = of_parse_phandle(pdev->dev.of_node,
+                                      "mediatek,audio-codec", 0);
+        if (!codec_node) {
+                dev_err(&pdev->dev,
+                        "Property 'audio-codec' missing or invalid\n");
+                return -EINVAL;
+        }
+        for (i = 0; i < card->num_links; i++) {
+                if (mt2701_wm8960_dai_links[i].codec_name)
+                        continue;
+                mt2701_wm8960_dai_links[i].codec_of_node = codec_node;
+        }
+
+        ret = snd_soc_of_parse_audio_routing(card, "audio-routing");
+        if (ret) {
+                dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret);
+                return ret;
+        }
+
+        ret = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret)
+                dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+                        __func__, ret);
+
+        return ret;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id mt2701_wm8960_machine_dt_match[] = {
+        {.compatible = "mediatek,mt2701-wm8960-machine",},
+        {}
+};
+#endif
+
+static struct platform_driver mt2701_wm8960_machine = {
+        .driver = {
+                .name = "mt2701-wm8960",
+                .owner = THIS_MODULE,
+#ifdef CONFIG_OF
+                .of_match_table = mt2701_wm8960_machine_dt_match,
+#endif
+        },
+        .probe = mt2701_wm8960_machine_probe,
+};
+
+module_platform_driver(mt2701_wm8960_machine);
+
+/* Module information */
+MODULE_DESCRIPTION("MT2701 WM8960 ALSA SoC machine driver");
+MODULE_AUTHOR("Ryder Lee <ryder.lee@mediatek.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("mt2701 wm8960 soc card");
+
diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c
index 46c8e6ae00b4..e0c2b23ec711 100644
--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c
+++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c
@@ -67,7 +67,7 @@ static int mt8173_max98090_hw_params(struct snd_pcm_substream *substream,
                                       SND_SOC_CLOCK_IN);
 }
 
-static struct snd_soc_ops mt8173_max98090_ops = {
+static const struct snd_soc_ops mt8173_max98090_ops = {
         .hw_params = mt8173_max98090_hw_params,
 };
 
diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
index 467f7049a288..5e383eb456a4 100644
--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c
@@ -75,7 +75,7 @@ static int mt8173_rt5650_rt5514_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mt8173_rt5650_rt5514_ops = {
+static const struct snd_soc_ops mt8173_rt5650_rt5514_ops = {
         .hw_params = mt8173_rt5650_rt5514_hw_params,
 };
 
diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
index 1b8b2a778845..fed1f15a39c2 100644
--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c
@@ -79,7 +79,7 @@ static int mt8173_rt5650_rt5676_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mt8173_rt5650_rt5676_ops = {
+static const struct snd_soc_ops mt8173_rt5650_rt5676_ops = {
         .hw_params = mt8173_rt5650_rt5676_hw_params,
 };
 
diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
index ba65f4157a7e..a78470839b65 100644
--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
@@ -105,7 +105,7 @@ static int mt8173_rt5650_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops mt8173_rt5650_ops = {
+static const struct snd_soc_ops mt8173_rt5650_ops = {
         .hw_params = mt8173_rt5650_hw_params,
 };
 
diff --git a/sound/soc/omap/am3517evm.c b/sound/soc/omap/am3517evm.c
index 25a33e9d417a..d5651026ec10 100644
--- a/sound/soc/omap/am3517evm.c
+++ b/sound/soc/omap/am3517evm.c
@@ -49,7 +49,7 @@ static int am3517evm_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static struct snd_soc_ops am3517evm_ops = {
+static const struct snd_soc_ops am3517evm_ops = {
         .hw_params = am3517evm_hw_params,
 };
 
diff --git a/sound/soc/omap/n810.c b/sound/soc/omap/n810.c
index fdecb7043174..71e5f31fa306 100644
--- a/sound/soc/omap/n810.c
+++ b/sound/soc/omap/n810.c
@@ -124,7 +124,7 @@ static int n810_hw_params(struct snd_pcm_substream *substream,
         return err;
 }
 
-static struct snd_soc_ops n810_ops = {
+static const struct snd_soc_ops n810_ops = {
         .startup = n810_startup,
         .hw_params = n810_hw_params,
         .shutdown = n810_shutdown,
diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
index 89fe95e877db..614b18d2f631 100644
--- a/sound/soc/omap/omap-abe-twl6040.c
+++ b/sound/soc/omap/omap-abe-twl6040.c
@@ -70,7 +70,7 @@ static int omap_abe_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static struct snd_soc_ops omap_abe_ops = {
+static const struct snd_soc_ops omap_abe_ops = {
         .hw_params = omap_abe_hw_params,
 };
 
diff --git a/sound/soc/omap/omap-twl4030.c b/sound/soc/omap/omap-twl4030.c
index 743131473056..a24b0dedabb9 100644
--- a/sound/soc/omap/omap-twl4030.c
+++ b/sound/soc/omap/omap-twl4030.c
@@ -73,7 +73,7 @@ static int omap_twl4030_hw_params(struct snd_pcm_substream *substream,
         return snd_soc_runtime_set_dai_fmt(rtd, fmt);
 }
 
-static struct snd_soc_ops omap_twl4030_ops = {
+static const struct snd_soc_ops omap_twl4030_ops = {
         .hw_params = omap_twl4030_hw_params,
 };
 
diff --git a/sound/soc/omap/omap3pandora.c b/sound/soc/omap/omap3pandora.c
index 732e749a1f8e..4e3de712159c 100644
--- a/sound/soc/omap/omap3pandora.c
+++ b/sound/soc/omap/omap3pandora.c
@@ -184,7 +184,7 @@ static int omap3pandora_in_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static struct snd_soc_ops omap3pandora_ops = {
+static const struct snd_soc_ops omap3pandora_ops = {
         .hw_params = omap3pandora_hw_params,
 };
 
diff --git a/sound/soc/omap/osk5912.c b/sound/soc/omap/osk5912.c
index aa4053bf6710..e4096779ca05 100644
--- a/sound/soc/omap/osk5912.c
+++ b/sound/soc/omap/osk5912.c
@@ -68,7 +68,7 @@ static int osk_hw_params(struct snd_pcm_substream *substream,
         return err;
 }
 
-static struct snd_soc_ops osk_ops = {
+static const struct snd_soc_ops osk_ops = {
         .startup = osk_startup,
         .hw_params = osk_hw_params,
         .shutdown = osk_shutdown,
diff --git a/sound/soc/omap/rx51.c b/sound/soc/omap/rx51.c
index a76845748a10..3aeb65feaea1 100644
--- a/sound/soc/omap/rx51.c
+++ b/sound/soc/omap/rx51.c
@@ -123,7 +123,7 @@ static int rx51_hw_params(struct snd_pcm_substream *substream,
                                       SND_SOC_CLOCK_IN);
 }
 
-static struct snd_soc_ops rx51_ops = {
+static const struct snd_soc_ops rx51_ops = {
         .startup = rx51_startup,
         .hw_params = rx51_hw_params,
 };
@@ -433,10 +433,9 @@ static int rx51_soc_probe(struct platform_device *pdev)
         }
 
         pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
-        if (pdata == NULL) {
-                dev_err(card->dev, "failed to create private data\n");
+        if (pdata == NULL)
                 return -ENOMEM;
-        }
+
         snd_soc_card_set_drvdata(card, pdata);
 
         pdata->tvout_selection_gpio = devm_gpiod_get(card->dev,
diff --git a/sound/soc/pxa/brownstone.c b/sound/soc/pxa/brownstone.c
index b6cb9950f05d..9a3f5b799720 100644
--- a/sound/soc/pxa/brownstone.c
+++ b/sound/soc/pxa/brownstone.c
@@ -74,7 +74,7 @@ static int brownstone_wm8994_hw_params(struct snd_pcm_substream *substream,
 }
 
 /* machine stream operations */
-static struct snd_soc_ops brownstone_ops = {
+static const struct snd_soc_ops brownstone_ops = {
         .hw_params = brownstone_wm8994_hw_params,
 };
 
diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
index 311774e9ca46..054e0d65db9d 100644
--- a/sound/soc/pxa/corgi.c
+++ b/sound/soc/pxa/corgi.c
@@ -154,7 +154,7 @@ static int corgi_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops corgi_ops = {
+static const struct snd_soc_ops corgi_ops = {
         .startup = corgi_startup,
         .hw_params = corgi_hw_params,
         .shutdown = corgi_shutdown,
diff --git a/sound/soc/pxa/e750_wm9705.c b/sound/soc/pxa/e750_wm9705.c
index fdcd94adee7c..82bcbbb1841b 100644
--- a/sound/soc/pxa/e750_wm9705.c
+++ b/sound/soc/pxa/e750_wm9705.c
@@ -81,7 +81,7 @@ static struct snd_soc_dai_link e750_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9705-aux",
+                .codec_dai_name = "wm9705-aux",
                 .platform_name = "pxa-pcm-audio",
                 .codec_name = "wm9705-codec",
         },
diff --git a/sound/soc/pxa/e800_wm9712.c b/sound/soc/pxa/e800_wm9712.c
index 2df714f70ec0..1ed8aa2348f1 100644
--- a/sound/soc/pxa/e800_wm9712.c
+++ b/sound/soc/pxa/e800_wm9712.c
@@ -81,7 +81,7 @@ static struct snd_soc_dai_link e800_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9712-aux",
+                .codec_dai_name = "wm9712-aux",
                 .platform_name = "pxa-pcm-audio",
                 .codec_name = "wm9712-codec",
         },
diff --git a/sound/soc/pxa/em-x270.c b/sound/soc/pxa/em-x270.c
index 6f2020f6c8d3..e046770ce70e 100644
--- a/sound/soc/pxa/em-x270.c
+++ b/sound/soc/pxa/em-x270.c
@@ -43,7 +43,7 @@ static struct snd_soc_dai_link em_x270_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9712-aux",
+                .codec_dai_name = "wm9712-aux",
                 .platform_name = "pxa-pcm-audio",
                 .codec_name = "wm9712-codec",
         },
diff --git a/sound/soc/pxa/hx4700.c b/sound/soc/pxa/hx4700.c
index 85483049b916..a9ac881c2e14 100644
--- a/sound/soc/pxa/hx4700.c
+++ b/sound/soc/pxa/hx4700.c
@@ -79,7 +79,7 @@ static int hx4700_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops hx4700_ops = {
+static const struct snd_soc_ops hx4700_ops = {
         .hw_params = hx4700_hw_params,
 };
 
diff --git a/sound/soc/pxa/imote2.c b/sound/soc/pxa/imote2.c
index 9d0e40771ef5..78475376f971 100644
--- a/sound/soc/pxa/imote2.c
+++ b/sound/soc/pxa/imote2.c
@@ -42,7 +42,7 @@ static int imote2_asoc_hw_params(struct snd_pcm_substream *substream,
         return ret;
 }
 
-static struct snd_soc_ops imote2_asoc_ops = {
+static const struct snd_soc_ops imote2_asoc_ops = {
         .hw_params = imote2_asoc_hw_params,
 };
 
diff --git a/sound/soc/pxa/magician.c b/sound/soc/pxa/magician.c
index 2d4d4455fe87..2fc012b06c43 100644
--- a/sound/soc/pxa/magician.c
+++ b/sound/soc/pxa/magician.c
@@ -255,12 +255,12 @@ static int magician_capture_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops magician_capture_ops = {
+static const struct snd_soc_ops magician_capture_ops = {
         .startup = magician_startup,
         .hw_params = magician_capture_hw_params,
 };
 
-static struct snd_soc_ops magician_playback_ops = {
+static const struct snd_soc_ops magician_playback_ops = {
         .startup = magician_startup,
         .hw_params = magician_playback_hw_params,
 };
diff --git a/sound/soc/pxa/mioa701_wm9713.c b/sound/soc/pxa/mioa701_wm9713.c
index 8760a6687885..c4c6fbedc723 100644
--- a/sound/soc/pxa/mioa701_wm9713.c
+++ b/sound/soc/pxa/mioa701_wm9713.c
@@ -157,7 +157,7 @@ static struct snd_soc_dai_link mioa701_dai[] = {
                 .name = "AC97 Aux",
                 .stream_name = "AC97 Aux",
                 .cpu_dai_name = "pxa2xx-ac97-aux",
-                .codec_dai_name ="wm9713-aux",
+                .codec_dai_name = "wm9713-aux",
                 .codec_name = "wm9713-codec",
                 .platform_name = "pxa-pcm-audio",
                 .ops = &mioa701_ops,
diff --git a/sound/soc/pxa/mmp-pcm.c b/sound/soc/pxa/mmp-pcm.c
index 96df9b2d8fc4..5b5f1a442891 100644
--- a/sound/soc/pxa/mmp-pcm.c
+++ b/sound/soc/pxa/mmp-pcm.c
@@ -166,7 +166,6 @@ static void mmp_pcm_free_dma_buffers(struct snd_pcm *pcm)
                 buf->area = NULL;
         }
 
-        return;
 }
 
 static int mmp_pcm_preallocate_dma_buffer(struct snd_pcm_substream *substream,
diff --git a/sound/soc/pxa/mmp-sspa.c b/sound/soc/pxa/mmp-sspa.c
index ca8b23f8c525..9cc35012e6e5 100644
--- a/sound/soc/pxa/mmp-sspa.c
+++ b/sound/soc/pxa/mmp-sspa.c
@@ -119,7 +119,6 @@ static void mmp_sspa_shutdown(struct snd_pcm_substream *substream,
         clk_disable(priv->sspa->clk);
         clk_disable(priv->sysclk);
 
-        return;
 }
 
 /*
diff --git a/sound/soc/pxa/poodle.c b/sound/soc/pxa/poodle.c
index a879aba0691f..b6693f32fc02 100644
--- a/sound/soc/pxa/poodle.c
+++ b/sound/soc/pxa/poodle.c
@@ -129,7 +129,7 @@ static int poodle_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops poodle_ops = {
+static const struct snd_soc_ops poodle_ops = {
         .startup = poodle_startup,
         .hw_params = poodle_hw_params,
         .shutdown = poodle_shutdown,
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index 3cad990dad2c..0291c7cb64eb 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -354,6 +354,7 @@ static int pxa_ssp_set_dai_pll(struct snd_soc_dai *cpu_dai, int pll_id,
                 if (ssp->type == PXA3xx_SSP) {
                         u32 val;
                         u64 tmp = 19968;
+
                         tmp *= 1000000;
                         do_div(tmp, freq_out);
                         val = tmp;
@@ -590,13 +591,13 @@ static int pxa_ssp_hw_params(struct snd_pcm_substream *substream,
 
                 if ((pxa_ssp_get_scr(ssp) == 4) && (width == 16)) {
                         /* This is a special case where the bitclk is 64fs
-                        * and we're not dealing with 2*32 bits of audio
-                        * samples.
-                        *
-                        * The SSP values used for that are all found out by
-                        * trying and failing a lot; some of the registers
-                        * needed for that mode are only available on PXA3xx.
-                        */
+                         * and we're not dealing with 2*32 bits of audio
+                         * samples.
+                         *
+                         * The SSP values used for that are all found out by
+                         * trying and failing a lot; some of the registers
+                         * needed for that mode are only available on PXA3xx.
+                         */
                         if (ssp->type != PXA3xx_SSP)
                                 return -EINVAL;
 
diff --git a/sound/soc/pxa/pxa2xx-ac97.c b/sound/soc/pxa/pxa2xx-ac97.c
index 2e2fb1838ec2..f49bf02e5ec2 100644
--- a/sound/soc/pxa/pxa2xx-ac97.c
+++ b/sound/soc/pxa/pxa2xx-ac97.c
@@ -140,9 +140,8 @@ static int pxa2xx_ac97_mic_startup(struct snd_pcm_substream *substream,
 {
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 return -ENODEV;
-        else
-                snd_soc_dai_set_dma_data(cpu_dai, substream,
-                                         &pxa2xx_ac97_pcm_mic_mono_in);
+        snd_soc_dai_set_dma_data(cpu_dai, substream,
+                                 &pxa2xx_ac97_pcm_mic_mono_in);
 
         return 0;
 }
diff --git a/sound/soc/pxa/pxa2xx-i2s.c b/sound/soc/pxa/pxa2xx-i2s.c
index 0389cf7b4b1e..3fb60baf6eab 100644
--- a/sound/soc/pxa/pxa2xx-i2s.c
+++ b/sound/soc/pxa/pxa2xx-i2s.c
@@ -46,10 +46,10 @@
 #define SACR0_STRF      (1 << 5)        /* FIFO Select for EFWR Special Function */
 #define SACR0_EFWR      (1 << 4)        /* Enable EFWR Function  */
 #define SACR0_RST       (1 << 3)        /* FIFO, i2s Register Reset */
-#define SACR0_BCKD      (1 << 2)        /* Bit Clock Direction */
+#define SACR0_BCKD      (1 << 2)        /* Bit Clock Direction */
 #define SACR0_ENB       (1 << 0)        /* Enable I2S Link */
 #define SACR1_ENLBF     (1 << 5)        /* Enable Loopback */
-#define SACR1_DRPL      (1 << 4)        /* Disable Replaying Function */
+#define SACR1_DRPL      (1 << 4)        /* Disable Replaying Function */
 #define SACR1_DREC      (1 << 3)        /* Disable Recording Function */
 #define SACR1_AMSL      (1 << 0)        /* Specify Alternate Mode */
 
@@ -60,7 +60,7 @@
 #define SASR0_TFS       (1 << 3)        /* Tx FIFO Service Request */
 #define SASR0_BSY       (1 << 2)        /* I2S Busy */
 #define SASR0_RNE       (1 << 1)        /* Rx FIFO Not Empty */
-#define SASR0_TNF       (1 << 0)        /* Tx FIFO Not Empty */
+#define SASR0_TNF       (1 << 0)        /* Tx FIFO Not Empty */
 
 #define SAICR_ROR       (1 << 6)        /* Clear Rx FIFO Overrun Interrupt */
 #define SAICR_TUR       (1 << 5)        /* Clear Tx FIFO Underrun Interrupt */
@@ -119,7 +119,7 @@ static int pxa_i2s_wait(void)
         int i;
 
         /* flush the Rx FIFO */
-        for(i = 0; i < 16; i++)
+        for (i = 0; i < 16; i++)
                 SADR;
         return 0;
 }
diff --git a/sound/soc/pxa/pxa2xx-pcm.c b/sound/soc/pxa/pxa2xx-pcm.c
index 410d48b93031..b51d7a0755d5 100644
--- a/sound/soc/pxa/pxa2xx-pcm.c
+++ b/sound/soc/pxa/pxa2xx-pcm.c
@@ -85,7 +85,7 @@ static int pxa2xx_soc_pcm_new(struct snd_soc_pcm_runtime *rtd)
 }
 
 static struct snd_soc_platform_driver pxa2xx_soc_platform = {
-        .ops    = &pxa2xx_pcm_ops,
+        .ops            = &pxa2xx_pcm_ops,
         .pcm_new        = pxa2xx_soc_pcm_new,
         .pcm_free       = pxa2xx_pcm_free_dma_buffers,
 };
diff --git a/sound/soc/pxa/raumfeld.c b/sound/soc/pxa/raumfeld.c
index 552b763005ed..111a907c4eb9 100644
--- a/sound/soc/pxa/raumfeld.c
+++ b/sound/soc/pxa/raumfeld.c
@@ -132,7 +132,7 @@ static int raumfeld_cs4270_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops raumfeld_cs4270_ops = {
+static const struct snd_soc_ops raumfeld_cs4270_ops = {
         .startup = raumfeld_cs4270_startup,
         .shutdown = raumfeld_cs4270_shutdown,
         .hw_params = raumfeld_cs4270_hw_params,
@@ -228,14 +228,12 @@ static struct snd_soc_ops raumfeld_ak4104_ops = {
         .codec_name     = "spi0.0",                     \
 }
 
-static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] =
-{
+static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] = {
         DAI_LINK_CS4270,
         DAI_LINK_AK4104,
 };
 
-static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] =
-{
+static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] = {
         DAI_LINK_CS4270,
 };
 
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index 07d77cddac60..1671da648e95 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -156,7 +156,7 @@ static int spitz_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops spitz_ops = {
+static const struct snd_soc_ops spitz_ops = {
         .startup = spitz_startup,
         .hw_params = spitz_hw_params,
 };
@@ -230,8 +230,8 @@ static const struct snd_soc_dapm_route spitz_audio_map[] = {
         {"Headset Jack", NULL, "ROUT1"},
 
         /* ext speaker connected to LOUT2, ROUT2  */
-        {"Ext Spk", NULL , "ROUT2"},
-        {"Ext Spk", NULL , "LOUT2"},
+        {"Ext Spk", NULL, "ROUT2"},
+        {"Ext Spk", NULL, "LOUT2"},
 
         /* mic is connected to input 1 - with bias */
         {"LINPUT1", NULL, "Mic Bias"},
diff --git a/sound/soc/pxa/tosa.c b/sound/soc/pxa/tosa.c
index e022b2a777f6..ae9c12e1ea2a 100644
--- a/sound/soc/pxa/tosa.c
+++ b/sound/soc/pxa/tosa.c
@@ -85,7 +85,7 @@ static int tosa_startup(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_soc_ops tosa_ops = {
+static const struct snd_soc_ops tosa_ops = {
         .startup = tosa_startup,
 };
 
@@ -133,7 +133,7 @@ static int tosa_set_spk(struct snd_kcontrol *kcontrol,
 static int tosa_hp_event(struct snd_soc_dapm_widget *w,
         struct snd_kcontrol *k, int event)
 {
-        gpio_set_value(TOSA_GPIO_L_MUTE, SND_SOC_DAPM_EVENT_ON(event) ? 1 :0);
+        gpio_set_value(TOSA_GPIO_L_MUTE, SND_SOC_DAPM_EVENT_ON(event) ? 1 : 0);
         return 0;
 }
 
diff --git a/sound/soc/pxa/z2.c b/sound/soc/pxa/z2.c
index 990b1aa6d7f6..5b0eccd2b4dd 100644
--- a/sound/soc/pxa/z2.c
+++ b/sound/soc/pxa/z2.c
@@ -119,8 +119,8 @@ static const struct snd_soc_dapm_route z2_audio_map[] = {
         {"Headphone Jack", NULL, "ROUT1"},
 
         /* ext speaker connected to LOUT2, ROUT2  */
-        {"Ext Spk", NULL , "ROUT2"},
-        {"Ext Spk", NULL , "LOUT2"},
+        {"Ext Spk", NULL, "ROUT2"},
+        {"Ext Spk", NULL, "LOUT2"},
 
         /* mic is connected to R input 2 - with bias */
         {"RINPUT2", NULL, "Mic Bias"},
@@ -152,7 +152,7 @@ err:
         return ret;
 }
 
-static struct snd_soc_ops z2_ops = {
+static const struct snd_soc_ops z2_ops = {
         .hw_params = z2_hw_params,
 };
 
diff --git a/sound/soc/pxa/zylonite.c b/sound/soc/pxa/zylonite.c
index 6fbcdf02c88d..ba468e560dd2 100644
--- a/sound/soc/pxa/zylonite.c
+++ b/sound/soc/pxa/zylonite.c
@@ -132,7 +132,7 @@ static int zylonite_voice_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_soc_ops zylonite_voice_ops = {
+static const struct snd_soc_ops zylonite_voice_ops = {
         .hw_params = zylonite_voice_hw_params,
 };
 
diff --git a/sound/soc/qcom/lpass-apq8016.c b/sound/soc/qcom/lpass-apq8016.c
index 8aed72be3224..8a74844d99e2 100644
--- a/sound/soc/qcom/lpass-apq8016.c
+++ b/sound/soc/qcom/lpass-apq8016.c
@@ -231,6 +231,18 @@ static struct lpass_variant apq8016_data = {
         .wrdma_channels         = 2,
         .dai_driver             = apq8016_lpass_cpu_dai_driver,
         .num_dai                = ARRAY_SIZE(apq8016_lpass_cpu_dai_driver),
+        .dai_osr_clk_names      = (const char *[]) {
+                                "mi2s-osr-clk0",
+                                "mi2s-osr-clk1",
+                                "mi2s-osr-clk2",
+                                "mi2s-osr-clk3",
+                                },
+        .dai_bit_clk_names      = (const char *[]) {
+                                "mi2s-bit-clk0",
+                                "mi2s-bit-clk1",
+                                "mi2s-bit-clk2",
+                                "mi2s-bit-clk3",
+                                },
         .init                   = apq8016_lpass_init,
         .exit                   = apq8016_lpass_exit,
         .alloc_dma_channel      = apq8016_lpass_alloc_dma_channel,
diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
index 5202a584e0c6..292b103abada 100644
--- a/sound/soc/qcom/lpass-cpu.c
+++ b/sound/soc/qcom/lpass-cpu.c
@@ -429,7 +429,6 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev)
         struct lpass_variant *variant;
         struct device *dev = &pdev->dev;
         const struct of_device_id *match;
-        char clk_name[16];
         int ret, i, dai_id;
 
         dsp_of_node = of_parse_phandle(pdev->dev.of_node, "qcom,adsp", 0);
@@ -477,31 +476,24 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev)
 
         for (i = 0; i < variant->num_dai; i++) {
                 dai_id = variant->dai_driver[i].id;
-                if (variant->num_dai > 1)
-                        sprintf(clk_name, "mi2s-osr-clk%d", i);
-                else
-                        sprintf(clk_name, "mi2s-osr-clk");
-
                 drvdata->mi2s_osr_clk[dai_id] = devm_clk_get(&pdev->dev,
-                                                                clk_name);
+                                             variant->dai_osr_clk_names[i]);
                 if (IS_ERR(drvdata->mi2s_osr_clk[dai_id])) {
                         dev_warn(&pdev->dev,
-                                "error getting optional mi2s-osr-clk: %ld\n",
+                                "%s() error getting optional %s: %ld\n",
+                                __func__,
+                                variant->dai_osr_clk_names[i],
                                 PTR_ERR(drvdata->mi2s_osr_clk[dai_id]));
 
                         drvdata->mi2s_osr_clk[dai_id] = NULL;
                 }
 
-                if (variant->num_dai > 1)
-                        sprintf(clk_name, "mi2s-bit-clk%d", i);
-                else
-                        sprintf(clk_name, "mi2s-bit-clk");
-
                 drvdata->mi2s_bit_clk[dai_id] = devm_clk_get(&pdev->dev,
-                                                            clk_name);
+                                                variant->dai_bit_clk_names[i]);
                 if (IS_ERR(drvdata->mi2s_bit_clk[dai_id])) {
                         dev_err(&pdev->dev,
-                                "error getting mi2s-bit-clk: %ld\n",
+                                "error getting %s: %ld\n",
+                                variant->dai_bit_clk_names[i],
                                 PTR_ERR(drvdata->mi2s_bit_clk[dai_id]));
                         return PTR_ERR(drvdata->mi2s_bit_clk[dai_id]);
                 }
diff --git a/sound/soc/qcom/lpass-ipq806x.c b/sound/soc/qcom/lpass-ipq806x.c
index 608c1a92af8a..ca1e1f2d2787 100644
--- a/sound/soc/qcom/lpass-ipq806x.c
+++ b/sound/soc/qcom/lpass-ipq806x.c
@@ -92,6 +92,12 @@ static struct lpass_variant ipq806x_data = {
         .wrdma_channels         = 4,
         .dai_driver             = &ipq806x_lpass_cpu_dai_driver,
         .num_dai                = 1,
+        .dai_osr_clk_names      = (const char *[]) {
+                                "mi2s-osr-clk",
+                                },
+        .dai_bit_clk_names      = (const char *[]) {
+                                "mi2s-bit-clk",
+                                },
         .alloc_dma_channel      = ipq806x_lpass_alloc_dma_channel,
         .free_dma_channel       = ipq806x_lpass_free_dma_channel,
 };
diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
index 9b031352ea3c..b848db2d6c3d 100644
--- a/sound/soc/qcom/lpass.h
+++ b/sound/soc/qcom/lpass.h
@@ -91,6 +91,8 @@ struct lpass_variant {
         /* SOC specific dais */
         struct snd_soc_dai_driver *dai_driver;
         int num_dai;
+        const char * const *dai_osr_clk_names;
+        const char * const *dai_bit_clk_names;
 };
 
 /* register the platform driver from the CPU DAI driver */
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index 85a33ac0a5c4..66203d107a11 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -43,6 +43,7 @@ struct rsnd_adg {
 };
 
 #define LRCLK_ASYNC     (1 << 0)
+#define AUDIO_OUT_48    (1 << 1)
 #define adg_mode_flags(adg)     (adg->flags)
 
 #define for_each_rsnd_clk(pos, adg, i)          \
@@ -364,7 +365,10 @@ found_clock:
 
         rsnd_adg_set_ssi_clk(ssi_mod, data);
 
-        if (!(adg_mode_flags(adg) & LRCLK_ASYNC)) {
+        if (adg_mode_flags(adg) & LRCLK_ASYNC) {
+                if (adg_mode_flags(adg) & AUDIO_OUT_48)
+                        ckr = 0x80000000;
+        } else {
                 if (0 == (rate % 8000))
                         ckr = 0x80000000;
         }
@@ -427,11 +431,14 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
         struct clk *clk;
         struct device *dev = rsnd_priv_to_dev(priv);
         struct device_node *np = dev->of_node;
+        struct property *prop;
         u32 ckr, rbgx, rbga, rbgb;
-        u32 rate, req_rate = 0, div;
+        u32 rate, div;
+#define REQ_SIZE 2
+        u32 req_rate[REQ_SIZE] = {};
         uint32_t count = 0;
         unsigned long req_48kHz_rate, req_441kHz_rate;
-        int i;
+        int i, req_size;
         const char *parent_clk_name = NULL;
         static const char * const clkout_name[] = {
                 [CLKOUT]  = "audio_clkout",
@@ -446,19 +453,32 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                 [CLKI] = 0x2,
         };
 
-        of_property_read_u32(np, "#clock-cells", &count);
+        ckr = 0;
+        rbga = 2; /* default 1/6 */
+        rbgb = 2; /* default 1/6 */
 
         /*
          * ADG supports BRRA/BRRB output only
          * this means all clkout0/1/2/3 will be same rate
          */
-        of_property_read_u32(np, "clock-frequency", &req_rate);
+        prop = of_find_property(np, "clock-frequency", NULL);
+        if (!prop)
+                goto rsnd_adg_get_clkout_end;
+
+        req_size = prop->length / sizeof(u32);
+
+        of_property_read_u32_array(np, "clock-frequency", req_rate, req_size);
         req_48kHz_rate = 0;
         req_441kHz_rate = 0;
-        if (0 == (req_rate % 44100))
-                req_441kHz_rate = req_rate;
-        if (0 == (req_rate % 48000))
-                req_48kHz_rate = req_rate;
+        for (i = 0; i < req_size; i++) {
+                if (0 == (req_rate[i] % 44100))
+                        req_441kHz_rate = req_rate[i];
+                if (0 == (req_rate[i] % 48000))
+                        req_48kHz_rate = req_rate[i];
+        }
+
+        if (req_rate[0] % 48000 == 0)
+                adg->flags = AUDIO_OUT_48;
 
         /*
          * This driver is assuming that AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC
@@ -469,9 +489,6 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
          *      rsnd_adg_ssi_clk_try_start()
          *      rsnd_ssi_master_clk_start()
          */
-        ckr = 0;
-        rbga = 2; /* default 1/6 */
-        rbgb = 2; /* default 1/6 */
         adg->rbga_rate_for_441khz       = 0;
         adg->rbgb_rate_for_48khz        = 0;
         for_each_rsnd_clk(clk, adg, i) {
@@ -505,10 +522,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                 rbgb = rbgx;
                                 adg->rbgb_rate_for_48khz = rate / div;
                                 ckr |= brg_table[i] << 16;
-                                if (req_48kHz_rate) {
+                                if (req_48kHz_rate)
                                         parent_clk_name = __clk_get_name(clk);
-                                        ckr |= 0x80000000;
-                                }
                         }
                 }
         }
@@ -518,12 +533,13 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
          * this means all clkout0/1/2/3 will be * same rate
          */
 
+        of_property_read_u32(np, "#clock-cells", &count);
         /*
          * for clkout
          */
         if (!count) {
                 clk = clk_register_fixed_rate(dev, clkout_name[CLKOUT],
-                                              parent_clk_name, 0, req_rate);
+                                              parent_clk_name, 0, req_rate[0]);
                 if (!IS_ERR(clk)) {
                         adg->clkout[CLKOUT] = clk;
                         of_clk_add_provider(np, of_clk_src_simple_get, clk);
@@ -536,19 +552,18 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                 for (i = 0; i < CLKOUTMAX; i++) {
                         clk = clk_register_fixed_rate(dev, clkout_name[i],
                                                       parent_clk_name, 0,
-                                                      req_rate);
-                        if (!IS_ERR(clk)) {
-                                adg->onecell.clks       = adg->clkout;
-                                adg->onecell.clk_num    = CLKOUTMAX;
-
+                                                      req_rate[0]);
+                        adg->clkout[i] = ERR_PTR(-ENOENT);
+                        if (!IS_ERR(clk))
                                 adg->clkout[i] = clk;
-
-                                of_clk_add_provider(np, of_clk_src_onecell_get,
-                                                    &adg->onecell);
-                        }
                 }
+                adg->onecell.clks       = adg->clkout;
+                adg->onecell.clk_num    = CLKOUTMAX;
+                of_clk_add_provider(np, of_clk_src_onecell_get,
+                                    &adg->onecell);
         }
 
+rsnd_adg_get_clkout_end:
         adg->ckr = ckr;
         adg->rbga = rbga;
         adg->rbgb = rbgb;
@@ -564,6 +579,7 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
         struct rsnd_adg *adg;
         struct device *dev = rsnd_priv_to_dev(priv);
         struct device_node *np = dev->of_node;
+        int ret;
 
         adg = devm_kzalloc(dev, sizeof(*adg), GFP_KERNEL);
         if (!adg) {
@@ -571,8 +587,10 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
                 return -ENOMEM;
         }
 
-        rsnd_mod_init(priv, &adg->mod, &adg_ops,
+        ret = rsnd_mod_init(priv, &adg->mod, &adg_ops,
                       NULL, NULL, 0, 0);
+        if (ret)
+                return ret;
 
         rsnd_adg_get_clkin(priv, adg);
         rsnd_adg_get_clkout(priv, adg);
@@ -589,5 +607,10 @@ int rsnd_adg_probe(struct rsnd_priv *priv)
 
 void rsnd_adg_remove(struct rsnd_priv *priv)
 {
+        struct device *dev = rsnd_priv_to_dev(priv);
+        struct device_node *np = dev->of_node;
+
+        of_clk_del_provider(np);
+
         rsnd_adg_clk_disable(priv);
 }
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index abb5eaac854a..7d92a24b7cfa 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -31,23 +31,24 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         struct rsnd_mod *mix = rsnd_io_to_mod_mix(io);
         struct device *dev = rsnd_priv_to_dev(priv);
         u32 data;
+        u32 path[] = {
+                [1] = 1 << 0,
+                [5] = 1 << 8,
+                [6] = 1 << 12,
+                [9] = 1 << 15,
+        };
 
         if (!mix && !dvc)
                 return 0;
 
+        if (ARRAY_SIZE(path) < rsnd_mod_id(mod) + 1)
+                return -ENXIO;
+
         if (mix) {
                 struct rsnd_dai *rdai;
                 struct rsnd_mod *src;
                 struct rsnd_dai_stream *tio;
                 int i;
-                u32 path[] = {
-                        [0] = 0,
-                        [1] = 1 << 0,
-                        [2] = 0,
-                        [3] = 0,
-                        [4] = 0,
-                        [5] = 1 << 8
-                };
 
                 /*
                  * it is assuming that integrater is well understanding about
@@ -70,16 +71,19 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
         } else {
                 struct rsnd_mod *src = rsnd_io_to_mod_src(io);
 
-                u32 path[] = {
-                        [0] = 0x30000,
-                        [1] = 0x30001,
-                        [2] = 0x40000,
-                        [3] = 0x10000,
-                        [4] = 0x20000,
-                        [5] = 0x40100
+                u8 cmd_case[] = {
+                        [0] = 0x3,
+                        [1] = 0x3,
+                        [2] = 0x4,
+                        [3] = 0x1,
+                        [4] = 0x2,
+                        [5] = 0x4,
+                        [6] = 0x1,
+                        [9] = 0x2,
                 };
 
-                data = path[rsnd_mod_id(src)];
+                data = path[rsnd_mod_id(src)] |
+                        cmd_case[rsnd_mod_id(src)] << 16;
         }
 
         dev_dbg(dev, "ctu/mix path = 0x%08x", data);
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 47b370cb2d3b..1744015408c3 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -96,7 +96,7 @@
 #include <linux/pm_runtime.h>
 #include "rsnd.h"
 
-#define RSND_RATES SNDRV_PCM_RATE_8000_96000
+#define RSND_RATES SNDRV_PCM_RATE_8000_192000
 #define RSND_FMTS (SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S16_LE)
 
 static const struct of_device_id rsnd_of_match[] = {
@@ -110,7 +110,6 @@ MODULE_DEVICE_TABLE(of, rsnd_of_match);
 /*
  *      rsnd_mod functions
  */
-#ifdef DEBUG
 void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type)
 {
         if (mod->type != type) {
@@ -121,7 +120,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type)
                          rsnd_mod_name(mod), rsnd_mod_id(mod));
         }
 }
-#endif
 
 char *rsnd_mod_name(struct rsnd_mod *mod)
 {
@@ -674,12 +672,10 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         /* set clock inversion */
         switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
         case SND_SOC_DAIFMT_NB_IF:
-                rdai->bit_clk_inv =  rdai->bit_clk_inv;
                 rdai->frm_clk_inv = !rdai->frm_clk_inv;
                 break;
         case SND_SOC_DAIFMT_IB_NF:
                 rdai->bit_clk_inv = !rdai->bit_clk_inv;
-                rdai->frm_clk_inv =  rdai->frm_clk_inv;
                 break;
         case SND_SOC_DAIFMT_IB_IF:
                 rdai->bit_clk_inv = !rdai->bit_clk_inv;
@@ -1002,13 +998,30 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl,
         return change;
 }
 
-static int __rsnd_kctrl_new(struct rsnd_mod *mod,
-                            struct rsnd_dai_stream *io,
-                            struct snd_soc_pcm_runtime *rtd,
-                            const unsigned char *name,
-                            struct rsnd_kctrl_cfg *cfg,
-                            void (*update)(struct rsnd_dai_stream *io,
-                                           struct rsnd_mod *mod))
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg)
+{
+        cfg->cfg.val = cfg->val;
+
+        return &cfg->cfg;
+}
+
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg)
+{
+        cfg->cfg.val = &cfg->val;
+
+        return &cfg->cfg;
+}
+
+int rsnd_kctrl_new(struct rsnd_mod *mod,
+                   struct rsnd_dai_stream *io,
+                   struct snd_soc_pcm_runtime *rtd,
+                   const unsigned char *name,
+                   void (*update)(struct rsnd_dai_stream *io,
+                                  struct rsnd_mod *mod),
+                   struct rsnd_kctrl_cfg *cfg,
+                   const char * const *texts,
+                   int size,
+                   u32 max)
 {
         struct snd_card *card = rtd->card->snd_card;
         struct snd_kcontrol *kctrl;
@@ -1023,6 +1036,9 @@ static int __rsnd_kctrl_new(struct rsnd_mod *mod,
         };
         int ret;
 
+        if (size > RSND_MAX_CHANNELS)
+                return -EINVAL;
+
         kctrl = snd_ctl_new1(&knew, mod);
         if (!kctrl)
                 return -ENOMEM;
@@ -1031,74 +1047,17 @@ static int __rsnd_kctrl_new(struct rsnd_mod *mod,
         if (ret < 0)
                 return ret;
 
-        cfg->update = update;
-        cfg->card = card;
-        cfg->kctrl = kctrl;
-        cfg->io = io;
+        cfg->texts      = texts;
+        cfg->max        = max;
+        cfg->size       = size;
+        cfg->update     = update;
+        cfg->card       = card;
+        cfg->kctrl      = kctrl;
+        cfg->io         = io;
 
         return 0;
 }
 
-void _rsnd_kctrl_remove(struct rsnd_kctrl_cfg *cfg)
-{
-        if (cfg->card && cfg->kctrl)
-                snd_ctl_remove(cfg->card, cfg->kctrl);
-
-        cfg->card = NULL;
-        cfg->kctrl = NULL;
-}
-
-int rsnd_kctrl_new_m(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_m *_cfg,
-                     int ch_size,
-                     u32 max)
-{
-        if (ch_size > RSND_MAX_CHANNELS)
-                return -EINVAL;
-
-        _cfg->cfg.max   = max;
-        _cfg->cfg.size  = ch_size;
-        _cfg->cfg.val   = _cfg->val;
-        return __rsnd_kctrl_new(mod, io, rtd, name, &_cfg->cfg, update);
-}
-
-int rsnd_kctrl_new_s(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     u32 max)
-{
-        _cfg->cfg.max   = max;
-        _cfg->cfg.size  = 1;
-        _cfg->cfg.val   = &_cfg->val;
-        return __rsnd_kctrl_new(mod, io, rtd, name, &_cfg->cfg, update);
-}
-
-int rsnd_kctrl_new_e(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     const char * const *texts,
-                     u32 max)
-{
-        _cfg->cfg.max   = max;
-        _cfg->cfg.size  = 1;
-        _cfg->cfg.val   = &_cfg->val;
-        _cfg->cfg.texts = texts;
-        return __rsnd_kctrl_new(mod, io, rtd, name, &_cfg->cfg, update);
-}
-
 /*
  *              snd_soc_platform
  */
diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c
index 1f405c833867..241cb3b08a07 100644
--- a/sound/soc/sh/rcar/dma.c
+++ b/sound/soc/sh/rcar/dma.c
@@ -454,6 +454,20 @@ static u32 rsnd_dmapp_read(struct rsnd_dma *dma, u32 reg)
         return ioread32(rsnd_dmapp_addr(dmac, dma, reg));
 }
 
+static void rsnd_dmapp_bset(struct rsnd_dma *dma, u32 data, u32 mask, u32 reg)
+{
+        struct rsnd_mod *mod = rsnd_mod_get(dma);
+        struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
+        struct rsnd_dma_ctrl *dmac = rsnd_priv_to_dmac(priv);
+        void __iomem *addr = rsnd_dmapp_addr(dmac, dma, reg);
+        u32 val = ioread32(addr);
+
+        val &= ~mask;
+        val |= (data & mask);
+
+        iowrite32(val, addr);
+}
+
 static int rsnd_dmapp_stop(struct rsnd_mod *mod,
                            struct rsnd_dai_stream *io,
                            struct rsnd_priv *priv)
@@ -461,10 +475,10 @@ static int rsnd_dmapp_stop(struct rsnd_mod *mod,
         struct rsnd_dma *dma = rsnd_mod_to_dma(mod);
         int i;
 
-        rsnd_dmapp_write(dma, 0, PDMACHCR);
+        rsnd_dmapp_bset(dma, 0,  PDMACHCR_DE, PDMACHCR);
 
         for (i = 0; i < 1024; i++) {
-                if (0 == rsnd_dmapp_read(dma, PDMACHCR))
+                if (0 == (rsnd_dmapp_read(dma, PDMACHCR) & PDMACHCR_DE))
                         return 0;
                 udelay(1);
         }
diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c
index cf8f59cdd8d7..463de8360985 100644
--- a/sound/soc/sh/rcar/dvc.c
+++ b/sound/soc/sh/rcar/dvc.c
@@ -218,21 +218,6 @@ static int rsnd_dvc_probe_(struct rsnd_mod *mod,
         return rsnd_cmd_attach(io, rsnd_mod_id(mod));
 }
 
-static int rsnd_dvc_remove_(struct rsnd_mod *mod,
-                            struct rsnd_dai_stream *io,
-                            struct rsnd_priv *priv)
-{
-        struct rsnd_dvc *dvc = rsnd_mod_to_dvc(mod);
-
-        rsnd_kctrl_remove(dvc->volume);
-        rsnd_kctrl_remove(dvc->mute);
-        rsnd_kctrl_remove(dvc->ren);
-        rsnd_kctrl_remove(dvc->rup);
-        rsnd_kctrl_remove(dvc->rdown);
-
-        return 0;
-}
-
 static int rsnd_dvc_init(struct rsnd_mod *mod,
                          struct rsnd_dai_stream *io,
                          struct rsnd_priv *priv)
@@ -300,18 +285,18 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
         ret = rsnd_kctrl_new_e(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Up Rate" : "DVC In Ramp Up Rate",
-                        &dvc->rup,
                         rsnd_dvc_volume_update,
-                        dvc_ramp_rate, ARRAY_SIZE(dvc_ramp_rate));
+                        &dvc->rup,
+                        dvc_ramp_rate);
         if (ret < 0)
                 return ret;
 
         ret = rsnd_kctrl_new_e(mod, io, rtd,
                         is_play ?
                         "DVC Out Ramp Down Rate" : "DVC In Ramp Down Rate",
-                        &dvc->rdown,
                         rsnd_dvc_volume_update,
-                        dvc_ramp_rate, ARRAY_SIZE(dvc_ramp_rate));
+                        &dvc->rdown,
+                        dvc_ramp_rate);
 
         if (ret < 0)
                 return ret;
@@ -332,7 +317,6 @@ static struct rsnd_mod_ops rsnd_dvc_ops = {
         .name           = DVC_NAME,
         .dma_req        = rsnd_dvc_dma_req,
         .probe          = rsnd_dvc_probe_,
-        .remove         = rsnd_dvc_remove_,
         .init           = rsnd_dvc_init,
         .quit           = rsnd_dvc_quit,
         .pcm_new        = rsnd_dvc_pcm_new,
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index 7410ec0174db..dbf4163427e8 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -611,35 +611,30 @@ struct rsnd_kctrl_cfg_s {
         u32 val;
 };
 
-void _rsnd_kctrl_remove(struct rsnd_kctrl_cfg *cfg);
-#define rsnd_kctrl_remove(_cfg) _rsnd_kctrl_remove(&((_cfg).cfg))
-
-int rsnd_kctrl_new_m(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_m *_cfg,
-                     int ch_size,
-                     u32 max);
-int rsnd_kctrl_new_s(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     u32 max);
-int rsnd_kctrl_new_e(struct rsnd_mod *mod,
-                     struct rsnd_dai_stream *io,
-                     struct snd_soc_pcm_runtime *rtd,
-                     const unsigned char *name,
-                     struct rsnd_kctrl_cfg_s *_cfg,
-                     void (*update)(struct rsnd_dai_stream *io,
-                                    struct rsnd_mod *mod),
-                     const char * const *texts,
-                     u32 max);
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg);
+struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg);
+int rsnd_kctrl_new(struct rsnd_mod *mod,
+                   struct rsnd_dai_stream *io,
+                   struct snd_soc_pcm_runtime *rtd,
+                   const unsigned char *name,
+                   void (*update)(struct rsnd_dai_stream *io,
+                                  struct rsnd_mod *mod),
+                   struct rsnd_kctrl_cfg *cfg,
+                   const char * const *texts,
+                   int size,
+                   u32 max);
+
+#define rsnd_kctrl_new_m(mod, io, rtd, name, update, cfg, size, max) \
+        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_m(cfg), \
+                       NULL, size, max)
+
+#define rsnd_kctrl_new_s(mod, io, rtd, name, update, cfg, max)  \
+        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_s(cfg), \
+                       NULL, 1, max)
+
+#define rsnd_kctrl_new_e(mod, io, rtd, name, update, cfg, texts)        \
+        rsnd_kctrl_new(mod, io, rtd, name, update, rsnd_kctrl_init_s(cfg), \
+                       texts, 1, ARRAY_SIZE(texts))
 
 /*
  *      R-Car SSI
@@ -732,8 +727,8 @@ void rsnd_cmd_remove(struct rsnd_priv *priv);
 int rsnd_cmd_attach(struct rsnd_dai_stream *io, int id);
 struct rsnd_mod *rsnd_cmd_mod_get(struct rsnd_priv *priv, int id);
 
-#ifdef DEBUG
 void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type);
+#ifdef DEBUG
 #define rsnd_mod_confirm_ssi(mssi)      rsnd_mod_make_sure(mssi, RSND_MOD_SSI)
 #define rsnd_mod_confirm_src(msrc)      rsnd_mod_make_sure(msrc, RSND_MOD_SRC)
 #define rsnd_mod_confirm_dvc(mdvc)      rsnd_mod_make_sure(mdvc, RSND_MOD_DVC)
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 42db48db09ba..20b5b2ec625e 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -167,6 +167,7 @@ static int rsnd_src_hw_params(struct rsnd_mod *mod,
          *      dpcm_fe_dai_hw_params()
          *      dpcm_be_dai_hw_params()
          */
+        src->convert_rate = 0;
         if (fe->dai_link->dynamic) {
                 int stream = substream->stream;
                 struct snd_soc_dpcm *dpcm;
@@ -414,8 +415,6 @@ static int rsnd_src_quit(struct rsnd_mod *mod,
 
         rsnd_mod_power_off(mod);
 
-        src->convert_rate = 0;
-
         /* reset sync convert_rate */
         src->sync.val = 0;
 
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 411bda2387ad..135c5669f796 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -228,6 +228,15 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
         for (j = 0; j < ARRAY_SIZE(ssi_clk_mul_table); j++) {
 
                 /*
+                 * It will set SSIWSR.CONT here, but SSICR.CKDV = 000
+                 * with it is not allowed. (SSIWSR.WS_MODE with
+                 * SSICR.CKDV = 000 is not allowed either).
+                 * Skip it. See SSICR.CKDV
+                 */
+                if (j == 0)
+                        continue;
+
+                /*
                  * this driver is assuming that
                  * system word is 32bit x chan
                  * see rsnd_ssi_init()
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 4e817c8a18c0..14fafdaf1395 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -64,7 +64,11 @@ static int rsnd_ssiu_init(struct rsnd_mod *mod,
         mask1 = (1 << 4) | (1 << 20);   /* mask sync bit */
         mask2 = (1 << 4);               /* mask sync bit */
         val1  = val2  = 0;
-        if (rsnd_ssi_is_pin_sharing(io)) {
+        if (id == 8) {
+                /*
+                 * SSI8 pin is sharing with SSI7, nothing to do.
+                 */
+        } else if (rsnd_ssi_is_pin_sharing(io)) {
                 int shift = -1;
 
                 switch (id) {
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 6dca408faae3..f45748ef9f13 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1776,7 +1776,6 @@ static int soc_bind_aux_dev(struct snd_soc_card *card, int num)
         }
 
         component->init = aux_dev->init;
-        component->auxiliary = 1;
         list_add(&component->card_aux_list, &card->aux_comp_list);
 
         return 0;
@@ -1788,14 +1787,13 @@ err_defer:
 
 static int soc_probe_aux_devices(struct snd_soc_card *card)
 {
-        struct snd_soc_component *comp, *tmp;
+        struct snd_soc_component *comp;
         int order;
         int ret;
 
         for (order = SND_SOC_COMP_ORDER_FIRST; order <= SND_SOC_COMP_ORDER_LAST;
                 order++) {
-                list_for_each_entry_safe(comp, tmp, &card->aux_comp_list,
-                                         card_aux_list) {
+                list_for_each_entry(comp, &card->aux_comp_list, card_aux_list) {
                         if (comp->driver->probe_order == order) {
                                 ret = soc_probe_component(card, comp);
                                 if (ret < 0) {
@@ -1804,7 +1802,6 @@ static int soc_probe_aux_devices(struct snd_soc_card *card)
                                                 comp->name, ret);
                                         return ret;
                                 }
-                                list_del(&comp->card_aux_list);
                         }
                 }
         }
@@ -1820,14 +1817,12 @@ static void soc_remove_aux_devices(struct snd_soc_card *card)
         for (order = SND_SOC_COMP_ORDER_FIRST; order <= SND_SOC_COMP_ORDER_LAST;
                 order++) {
                 list_for_each_entry_safe(comp, _comp,
-                        &card->component_dev_list, card_list) {
-
-                        if (!comp->auxiliary)
-                                continue;
+                        &card->aux_comp_list, card_aux_list) {
 
                         if (comp->driver->remove_order == order) {
                                 soc_remove_component(comp);
-                                comp->auxiliary = 0;
+                                /* remove it from the card's aux_comp_list */
+                                list_del(&comp->card_aux_list);
                         }
                 }
         }
@@ -1918,6 +1913,7 @@ int snd_soc_runtime_set_dai_fmt(struct snd_soc_pcm_runtime *rtd,
 EXPORT_SYMBOL_GPL(snd_soc_runtime_set_dai_fmt);
 
 
+#ifdef CONFIG_DMI
 /* Trim special characters, and replace '-' with '_' since '-' is used to
  * separate different DMI fields in the card long name. Only number and
  * alphabet characters and a few separator characters are kept.
@@ -2049,6 +2045,7 @@ int snd_soc_set_dmi_name(struct snd_soc_card *card, const char *flavour)
         return 0;
 }
 EXPORT_SYMBOL_GPL(snd_soc_set_dmi_name);
+#endif /* CONFIG_DMI */
 
 static int snd_soc_instantiate_card(struct snd_soc_card *card)
 {
@@ -2190,6 +2187,9 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
                 snd_soc_dapm_add_routes(&card->dapm, card->of_dapm_routes,
                                         card->num_of_dapm_routes);
 
+        /* try to set some sane longname if DMI is available */
+        snd_soc_set_dmi_name(card, NULL);
+
         snprintf(card->snd_card->shortname, sizeof(card->snd_card->shortname),
                  "%s", card->name);
         snprintf(card->snd_card->longname, sizeof(card->snd_card->longname),
@@ -3139,7 +3139,7 @@ static int snd_soc_component_initialize(struct snd_soc_component *component,
         component->suspend = component->driver->suspend;
         component->resume = component->driver->resume;
         component->pcm_new = component->driver->pcm_new;
-        component->pcm_free= component->driver->pcm_free;
+        component->pcm_free = component->driver->pcm_free;
 
         dapm = &component->dapm;
         dapm->dev = dev;
@@ -3326,7 +3326,10 @@ static int snd_soc_platform_drv_pcm_new(struct snd_soc_pcm_runtime *rtd)
 {
         struct snd_soc_platform *platform = rtd->platform;
 
-        return platform->driver->pcm_new(rtd);
+        if (platform->driver->pcm_new)
+                return platform->driver->pcm_new(rtd);
+        else
+                return 0;
 }
 
 static void snd_soc_platform_drv_pcm_free(struct snd_pcm *pcm)
@@ -3334,7 +3337,8 @@ static void snd_soc_platform_drv_pcm_free(struct snd_pcm *pcm)
         struct snd_soc_pcm_runtime *rtd = pcm->private_data;
         struct snd_soc_platform *platform = rtd->platform;
 
-        platform->driver->pcm_free(pcm);
+        if (platform->driver->pcm_free)
+                platform->driver->pcm_free(pcm);
 }
 
 /**
diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c
index fbaa1bb41102..7daf21fee355 100644
--- a/sound/soc/soc-jack.c
+++ b/sound/soc/soc-jack.c
@@ -19,9 +19,28 @@
 #include <linux/workqueue.h>
 #include <linux/delay.h>
 #include <linux/export.h>
+#include <linux/suspend.h>
 #include <trace/events/asoc.h>
 
 /**
+ * snd_soc_codec_set_jack - configure codec jack.
+ * @codec: CODEC
+ * @jack: structure to use for the jack
+ * @data: can be used if codec driver need extra data for configuring jack
+ *
+ * Configures and enables jack detection function.
+ */
+int snd_soc_codec_set_jack(struct snd_soc_codec *codec,
+        struct snd_soc_jack *jack, void *data)
+{
+        if (codec->driver->set_jack)
+                return codec->driver->set_jack(codec, jack, data);
+        else
+                return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(snd_soc_codec_set_jack);
+
+/**
  * snd_soc_card_jack_new - Create a new jack
  * @card:  ASoC card
  * @id:    an identifying string for this jack
@@ -293,6 +312,27 @@ static void gpio_work(struct work_struct *work)
         snd_soc_jack_gpio_detect(gpio);
 }
 
+static int snd_soc_jack_pm_notifier(struct notifier_block *nb,
+                                    unsigned long action, void *data)
+{
+        struct snd_soc_jack_gpio *gpio =
+                        container_of(nb, struct snd_soc_jack_gpio, pm_notifier);
+
+        switch (action) {
+        case PM_POST_SUSPEND:
+        case PM_POST_HIBERNATION:
+        case PM_POST_RESTORE:
+                /*
+                 * Use workqueue so we do not have to care about running
+                 * concurrently with work triggered by the interrupt handler.
+                 */
+                queue_delayed_work(system_power_efficient_wq, &gpio->work, 0);
+                break;
+        }
+
+        return NOTIFY_DONE;
+}
+
 /**
  * snd_soc_jack_add_gpios - Associate GPIO pins with an ASoC jack
  *
@@ -369,6 +409,13 @@ got_gpio:
                                         i, ret);
                 }
 
+                /*
+                 * Register PM notifier so we do not miss state transitions
+                 * happening while system is asleep.
+                 */
+                gpios[i].pm_notifier.notifier_call = snd_soc_jack_pm_notifier;
+                register_pm_notifier(&gpios[i].pm_notifier);
+
                 /* Expose GPIO value over sysfs for diagnostic purposes */
                 gpiod_export(gpios[i].desc, false);
 
@@ -428,6 +475,7 @@ void snd_soc_jack_free_gpios(struct snd_soc_jack *jack, int count,
 
         for (i = 0; i < count; i++) {
                 gpiod_unexport(gpios[i].desc);
+                unregister_pm_notifier(&gpios[i].pm_notifier);
                 free_irq(gpiod_to_irq(gpios[i].desc), &gpios[i]);
                 cancel_delayed_work_sync(&gpios[i].work);
                 gpiod_put(gpios[i].desc);
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 3e9b1c0bb1ce..058bc99c6c34 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -933,6 +933,7 @@ static int soc_tplg_denum_create_texts(struct soc_enum *se,
                 }
         }
 
+        se->texts = (const char * const *)se->dobj.control.dtexts;
         return 0;
 
 err:
diff --git a/sound/soc/sti/uniperif.h b/sound/soc/sti/uniperif.h
index d487dd2ef016..cfcb0ea9d99d 100644
--- a/sound/soc/sti/uniperif.h
+++ b/sound/soc/sti/uniperif.h
@@ -1299,6 +1299,7 @@ struct uniperif {
         int ver; /* IP version, used by register access macros */
         struct regmap_field *clk_sel;
         struct regmap_field *valid_sel;
+        spinlock_t irq_lock; /* use to prevent race condition with IRQ */
 
         /* capabilities */
         const struct snd_pcm_hardware *hw;
diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
index 60ae31a303ab..d7e8dd46d2cc 100644
--- a/sound/soc/sti/uniperif_player.c
+++ b/sound/soc/sti/uniperif_player.c
@@ -65,10 +65,13 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
         unsigned int status;
         unsigned int tmp;
 
-        if (player->state == UNIPERIF_STATE_STOPPED) {
-                /* Unexpected IRQ: do nothing */
-                return IRQ_NONE;
-        }
+        spin_lock(&player->irq_lock);
+        if (!player->substream)
+                goto irq_spin_unlock;
+
+        snd_pcm_stream_lock(player->substream);
+        if (player->state == UNIPERIF_STATE_STOPPED)
+                goto stream_unlock;
 
         /* Get interrupt status & clear them immediately */
         status = GET_UNIPERIF_ITS(player);
@@ -88,9 +91,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
                         SET_UNIPERIF_ITM_BCLR_FIFO_ERROR(player);
 
                         /* Stop the player */
-                        snd_pcm_stream_lock(player->substream);
                         snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN);
-                        snd_pcm_stream_unlock(player->substream);
                 }
 
                 ret = IRQ_HANDLED;
@@ -104,9 +105,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
                 SET_UNIPERIF_ITM_BCLR_DMA_ERROR(player);
 
                 /* Stop the player */
-                snd_pcm_stream_lock(player->substream);
                 snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN);
-                snd_pcm_stream_unlock(player->substream);
 
                 ret = IRQ_HANDLED;
         }
@@ -116,7 +115,8 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
                 if (!player->underflow_enabled) {
                         dev_err(player->dev,
                                 "unexpected Underflow recovering\n");
-                        return -EPERM;
+                        ret = -EPERM;
+                        goto stream_unlock;
                 }
                 /* Read the underflow recovery duration */
                 tmp = GET_UNIPERIF_STATUS_1_UNDERFLOW_DURATION(player);
@@ -138,13 +138,16 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
                 dev_err(player->dev, "Underflow recovery failed\n");
 
                 /* Stop the player */
-                snd_pcm_stream_lock(player->substream);
                 snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN);
-                snd_pcm_stream_unlock(player->substream);
 
                 ret = IRQ_HANDLED;
         }
 
+stream_unlock:
+        snd_pcm_stream_unlock(player->substream);
+irq_spin_unlock:
+        spin_unlock(&player->irq_lock);
+
         return ret;
 }
 
@@ -588,6 +591,7 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
         struct sti_uniperiph_data *priv = snd_soc_dai_get_drvdata(dai);
         struct uniperif *player = priv->dai_data.uni;
         struct snd_aes_iec958 *iec958 =  &player->stream_settings.iec958;
+        unsigned long flags;
 
         mutex_lock(&player->ctrl_lock);
         iec958->status[0] = ucontrol->value.iec958.status[0];
@@ -596,12 +600,14 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
         iec958->status[3] = ucontrol->value.iec958.status[3];
         mutex_unlock(&player->ctrl_lock);
 
+        spin_lock_irqsave(&player->irq_lock, flags);
         if (player->substream && player->substream->runtime)
                 uni_player_set_channel_status(player,
                                               player->substream->runtime);
         else
                 uni_player_set_channel_status(player, NULL);
 
+        spin_unlock_irqrestore(&player->irq_lock, flags);
         return 0;
 }
 
@@ -686,9 +692,12 @@ static int uni_player_startup(struct snd_pcm_substream *substream,
 {
         struct sti_uniperiph_data *priv = snd_soc_dai_get_drvdata(dai);
         struct uniperif *player = priv->dai_data.uni;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&player->irq_lock, flags);
         player->substream = substream;
+        spin_unlock_irqrestore(&player->irq_lock, flags);
 
         player->clk_adj = 0;
 
@@ -986,12 +995,15 @@ static void uni_player_shutdown(struct snd_pcm_substream *substream,
 {
         struct sti_uniperiph_data *priv = snd_soc_dai_get_drvdata(dai);
         struct uniperif *player = priv->dai_data.uni;
+        unsigned long flags;
 
+        spin_lock_irqsave(&player->irq_lock, flags);
         if (player->state != UNIPERIF_STATE_STOPPED)
                 /* Stop the player */
                 uni_player_stop(player);
 
         player->substream = NULL;
+        spin_unlock_irqrestore(&player->irq_lock, flags);
 }
 
 static int uni_player_parse_dt_audio_glue(struct platform_device *pdev,
@@ -1096,6 +1108,7 @@ int uni_player_init(struct platform_device *pdev,
         }
 
         mutex_init(&player->ctrl_lock);
+        spin_lock_init(&player->irq_lock);
 
         /* Ensure that disabled by default */
         SET_UNIPERIF_CONFIG_BACK_STALL_REQ_DISABLE(player);
diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c
index 5992c6ab3833..ee0055e60852 100644
--- a/sound/soc/sti/uniperif_reader.c
+++ b/sound/soc/sti/uniperif_reader.c
@@ -46,10 +46,15 @@ static irqreturn_t uni_reader_irq_handler(int irq, void *dev_id)
         struct uniperif *reader = dev_id;
         unsigned int status;
 
+        spin_lock(&reader->irq_lock);
+        if (!reader->substream)
+                goto irq_spin_unlock;
+
+        snd_pcm_stream_lock(reader->substream);
         if (reader->state == UNIPERIF_STATE_STOPPED) {
                 /* Unexpected IRQ: do nothing */
                 dev_warn(reader->dev, "unexpected IRQ\n");
-                return IRQ_HANDLED;
+                goto stream_unlock;
         }
 
         /* Get interrupt status & clear them immediately */
@@ -60,13 +65,16 @@ static irqreturn_t uni_reader_irq_handler(int irq, void *dev_id)
         if (unlikely(status & UNIPERIF_ITS_FIFO_ERROR_MASK(reader))) {
                 dev_err(reader->dev, "FIFO error detected\n");
 
-                snd_pcm_stream_lock(reader->substream);
                 snd_pcm_stop(reader->substream, SNDRV_PCM_STATE_XRUN);
-                snd_pcm_stream_unlock(reader->substream);
 
-                return IRQ_HANDLED;
+                ret = IRQ_HANDLED;
         }
 
+stream_unlock:
+        snd_pcm_stream_unlock(reader->substream);
+irq_spin_unlock:
+        spin_unlock(&reader->irq_lock);
+
         return ret;
 }
 
@@ -347,8 +355,13 @@ static int uni_reader_startup(struct snd_pcm_substream *substream,
 {
         struct sti_uniperiph_data *priv = snd_soc_dai_get_drvdata(dai);
         struct uniperif *reader = priv->dai_data.uni;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&reader->irq_lock, flags);
+        reader->substream = substream;
+        spin_unlock_irqrestore(&reader->irq_lock, flags);
+
         if (!UNIPERIF_TYPE_IS_TDM(reader))
                 return 0;
 
@@ -373,11 +386,15 @@ static void uni_reader_shutdown(struct snd_pcm_substream *substream,
 {
         struct sti_uniperiph_data *priv = snd_soc_dai_get_drvdata(dai);
         struct uniperif *reader = priv->dai_data.uni;
+        unsigned long flags;
 
+        spin_lock_irqsave(&reader->irq_lock, flags);
         if (reader->state != UNIPERIF_STATE_STOPPED) {
                 /* Stop the reader */
                 uni_reader_stop(reader);
         }
+        reader->substream = NULL;
+        spin_unlock_irqrestore(&reader->irq_lock, flags);
 }
 
 static const struct snd_soc_dai_ops uni_reader_dai_ops = {
@@ -412,6 +429,8 @@ int uni_reader_init(struct platform_device *pdev,
                 return -EBUSY;
         }
 
+        spin_lock_init(&reader->irq_lock);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(uni_reader_init);
diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
index b92bdc8361af..7527ba29a5a0 100644
--- a/sound/soc/sunxi/sun8i-codec.c
+++ b/sound/soc/sunxi/sun8i-codec.c
@@ -259,25 +259,20 @@ static int sun8i_codec_hw_params(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static const struct snd_kcontrol_new sun8i_output_left_mixer_controls[] = {
-        SOC_DAPM_SINGLE("LSlot 0", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA0L, 1, 0),
-        SOC_DAPM_SINGLE("LSlot 1", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA1L, 1, 0),
-        SOC_DAPM_SINGLE("DACL", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF2DACL, 1, 0),
-        SOC_DAPM_SINGLE("ADCL", SUN8I_DAC_MXR_SRC,
-                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_ADCL, 1, 0),
-};
-
-static const struct snd_kcontrol_new sun8i_output_right_mixer_controls[] = {
-        SOC_DAPM_SINGLE("RSlot 0", SUN8I_DAC_MXR_SRC,
+static const struct snd_kcontrol_new sun8i_dac_mixer_controls[] = {
+        SOC_DAPM_DOUBLE("AIF1 Slot 0 Digital DAC Playback Switch",
+                        SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA0L,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_AIF1DA0R, 1, 0),
-        SOC_DAPM_SINGLE("RSlot 1", SUN8I_DAC_MXR_SRC,
+        SOC_DAPM_DOUBLE("AIF1 Slot 1 Digital DAC Playback Switch",
+                        SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF1DA1L,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_AIF1DA1R, 1, 0),
-        SOC_DAPM_SINGLE("DACR", SUN8I_DAC_MXR_SRC,
+        SOC_DAPM_DOUBLE("AIF2 Digital DAC Playback Switch", SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_AIF2DACL,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_AIF2DACR, 1, 0),
-        SOC_DAPM_SINGLE("ADCR", SUN8I_DAC_MXR_SRC,
+        SOC_DAPM_DOUBLE("ADC Digital DAC Playback Switch", SUN8I_DAC_MXR_SRC,
+                        SUN8I_DAC_MXR_SRC_DACL_MXR_SRC_ADCL,
                         SUN8I_DAC_MXR_SRC_DACR_MXR_SRC_ADCR, 1, 0),
 };
 
@@ -286,19 +281,21 @@ static const struct snd_soc_dapm_widget sun8i_codec_dapm_widgets[] = {
         SND_SOC_DAPM_SUPPLY("DAC", SUN8I_DAC_DIG_CTRL, SUN8I_DAC_DIG_CTRL_ENDA,
                             0, NULL, 0),
 
-        /* Analog DAC */
-        SND_SOC_DAPM_DAC("Digital Left DAC", "Playback", SUN8I_AIF1_DACDAT_CTRL,
-                         SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0L_ENA, 0),
-        SND_SOC_DAPM_DAC("Digital Right DAC", "Playback", SUN8I_AIF1_DACDAT_CTRL,
-                         SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0R_ENA, 0),
+        /* Analog DAC AIF */
+        SND_SOC_DAPM_AIF_IN("AIF1 Slot 0 Left", "Playback", 0,
+                            SUN8I_AIF1_DACDAT_CTRL,
+                            SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0L_ENA, 0),
+        SND_SOC_DAPM_AIF_IN("AIF1 Slot 0 Right", "Playback", 0,
+                            SUN8I_AIF1_DACDAT_CTRL,
+                            SUN8I_AIF1_DACDAT_CTRL_AIF1_DA0R_ENA, 0),
 
         /* DAC Mixers */
-        SND_SOC_DAPM_MIXER("Left DAC Mixer", SND_SOC_NOPM, 0, 0,
-                           sun8i_output_left_mixer_controls,
-                           ARRAY_SIZE(sun8i_output_left_mixer_controls)),
-        SND_SOC_DAPM_MIXER("Right DAC Mixer", SND_SOC_NOPM, 0, 0,
-                           sun8i_output_right_mixer_controls,
-                           ARRAY_SIZE(sun8i_output_right_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Left Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
+                           sun8i_dac_mixer_controls,
+                           ARRAY_SIZE(sun8i_dac_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Right Digital DAC Mixer", SND_SOC_NOPM, 0, 0,
+                           sun8i_dac_mixer_controls,
+                           ARRAY_SIZE(sun8i_dac_mixer_controls)),
 
         /* Clocks */
         SND_SOC_DAPM_SUPPLY("MODCLK AFI1", SUN8I_MOD_CLK_ENA,
@@ -321,8 +318,6 @@ static const struct snd_soc_dapm_widget sun8i_codec_dapm_widgets[] = {
                             SUN8I_MOD_RST_CTL_AIF1, 0, NULL, 0),
         SND_SOC_DAPM_SUPPLY("RST DAC", SUN8I_MOD_RST_CTL,
                             SUN8I_MOD_RST_CTL_DAC, 0, NULL, 0),
-
-        SND_SOC_DAPM_OUTPUT("HP"),
 };
 
 static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
@@ -338,16 +333,14 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
         { "DAC", NULL, "MODCLK DAC" },
 
         /* DAC Routes */
-        { "Digital Left DAC", NULL, "DAC" },
-        { "Digital Right DAC", NULL, "DAC" },
+        { "AIF1 Slot 0 Right", NULL, "DAC" },
+        { "AIF1 Slot 0 Left", NULL, "DAC" },
 
         /* DAC Mixer Routes */
-        { "Left DAC Mixer", "LSlot 0", "Digital Left DAC"},
-        { "Right DAC Mixer", "RSlot 0", "Digital Right DAC"},
-
-        /* End of route : HP out */
-        { "HP", NULL, "Left DAC Mixer" },
-        { "HP", NULL, "Right DAC Mixer" },
+        { "Left Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
+          "AIF1 Slot 0 Left"},
+        { "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
+          "AIF1 Slot 0 Right"},
 };
 
 static struct snd_soc_dai_ops sun8i_codec_dai_ops = {
diff --git a/sound/x86/Kconfig b/sound/x86/Kconfig
index 84c8f8fc597c..8adf4d1bd46e 100644
--- a/sound/x86/Kconfig
+++ b/sound/x86/Kconfig
@@ -1,6 +1,7 @@
 menuconfig SND_X86
-        tristate "X86 sound devices"
+        bool "X86 sound devices"
         depends on X86
+        default y
         ---help---
           X86 sound devices that don't fall under SoC or PCI categories
 
diff --git a/tools/include/linux/filter.h b/tools/include/linux/filter.h
index 122153b16ea4..390d7c9685fd 100644
--- a/tools/include/linux/filter.h
+++ b/tools/include/linux/filter.h
@@ -168,6 +168,16 @@
                 .off   = OFF,                                   \
                 .imm   = 0 })
 
+/* Atomic memory add, *(uint *)(dst_reg + off16) += src_reg */
+
+#define BPF_STX_XADD(SIZE, DST, SRC, OFF)                       \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD,   \
+                .dst_reg = DST,                                 \
+                .src_reg = SRC,                                 \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Memory store, *(uint *) (dst_reg + off16) = imm32 */
 
 #define BPF_ST_MEM(SIZE, DST, OFF, IMM)                         \
diff --git a/tools/include/uapi/linux/bpf_perf_event.h b/tools/include/uapi/linux/bpf_perf_event.h
new file mode 100644
index 000000000000..067427259820
--- /dev/null
+++ b/tools/include/uapi/linux/bpf_perf_event.h
@@ -0,0 +1,18 @@
+/* Copyright (c) 2016 Facebook
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ */
+#ifndef _UAPI__LINUX_BPF_PERF_EVENT_H__
+#define _UAPI__LINUX_BPF_PERF_EVENT_H__
+
+#include <linux/types.h>
+#include <linux/ptrace.h>
+
+struct bpf_perf_event_data {
+        struct pt_regs regs;
+        __u64 sample_period;
+};
+
+#endif /* _UAPI__LINUX_BPF_PERF_EVENT_H__ */
diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
index 11c8d9bc762e..5d19fdf80292 100644
--- a/tools/lguest/lguest.c
+++ b/tools/lguest/lguest.c
@@ -1387,7 +1387,7 @@ static bool pci_data_iowrite(u16 port, u32 mask, u32 val)
                 /* Allow writing to any other BAR, or expansion ROM */
                 iowrite(portoff, val, mask, &d->config_words[reg]);
                 return true;
-                /* We let them overide latency timer and cacheline size */
+                /* We let them override latency timer and cacheline size */
         } else if (&d->config_words[reg] == (void *)&d->config.cacheline_size) {
                 /* Only let them change the first two fields. */
                 if (mask == 0xFFFFFFFF)
diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index e2efddf10231..1f5300e56b44 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -132,7 +132,7 @@ else
   Q = @
 endif
 
-# Disable command line variables (CFLAGS) overide from top
+# Disable command line variables (CFLAGS) override from top
 # level Makefile (perf), otherwise build Makefile will get
 # the same command line setup.
 MAKEOVERRIDES=
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index 47076b15eebe..9b8555ea3459 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -135,7 +135,7 @@ else
   Q = @
 endif
 
-# Disable command line variables (CFLAGS) overide from top
+# Disable command line variables (CFLAGS) override from top
 # level Makefile (perf), otherwise build Makefile will get
 # the same command line setup.
 MAKEOVERRIDES=
diff --git a/tools/lib/traceevent/event-parse.h b/tools/lib/traceevent/event-parse.h
index 66342804161c..0c03538df74c 100644
--- a/tools/lib/traceevent/event-parse.h
+++ b/tools/lib/traceevent/event-parse.h
@@ -140,7 +140,7 @@ struct pevent_plugin_option {
  *   struct pevent_plugin_option PEVENT_PLUGIN_OPTIONS[] = {
  *      {
  *              .name = "option-name",
- *              .plugin_alias = "overide-file-name", (optional)
+ *              .plugin_alias = "override-file-name", (optional)
  *              .description = "description of option to show users",
  *      },
  *      {
diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c
index 4cfdbb5b6967..066086dd59a8 100644
--- a/tools/objtool/builtin-check.c
+++ b/tools/objtool/builtin-check.c
@@ -805,11 +805,20 @@ static struct rela *find_switch_table(struct objtool_file *file,
                      insn->jump_dest->offset > orig_insn->offset))
                     break;
 
+                /* look for a relocation which references .rodata */
                 text_rela = find_rela_by_dest_range(insn->sec, insn->offset,
                                                     insn->len);
-                if (text_rela && text_rela->sym == file->rodata->sym)
-                        return find_rela_by_dest(file->rodata,
-                                                 text_rela->addend);
+                if (!text_rela || text_rela->sym != file->rodata->sym)
+                        continue;
+
+                /*
+                 * Make sure the .rodata address isn't associated with a
+                 * symbol.  gcc jump tables are anonymous data.
+                 */
+                if (find_symbol_containing(file->rodata, text_rela->addend))
+                        continue;
+
+                return find_rela_by_dest(file->rodata, text_rela->addend);
         }
 
         return NULL;
diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index 0d7983ac63ef..d897702ce742 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -85,6 +85,18 @@ struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset)
         return NULL;
 }
 
+struct symbol *find_symbol_containing(struct section *sec, unsigned long offset)
+{
+        struct symbol *sym;
+
+        list_for_each_entry(sym, &sec->symbol_list, list)
+                if (sym->type != STT_SECTION &&
+                    offset >= sym->offset && offset < sym->offset + sym->len)
+                        return sym;
+
+        return NULL;
+}
+
 struct rela *find_rela_by_dest_range(struct section *sec, unsigned long offset,
                                      unsigned int len)
 {
diff --git a/tools/objtool/elf.h b/tools/objtool/elf.h
index aa1ff6596684..731973e1a3f5 100644
--- a/tools/objtool/elf.h
+++ b/tools/objtool/elf.h
@@ -79,6 +79,7 @@ struct elf {
 struct elf *elf_open(const char *name);
 struct section *find_section_by_name(struct elf *elf, const char *name);
 struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset);
+struct symbol *find_symbol_containing(struct section *sec, unsigned long offset);
 struct rela *find_rela_by_dest(struct section *sec, unsigned long offset);
 struct rela *find_rela_by_dest_range(struct section *sec, unsigned long offset,
                                      unsigned int len);
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 273f21fa32b5..7aa57225cbf7 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -130,6 +130,12 @@ static struct arch architectures[] = {
                 .name = "powerpc",
                 .init = powerpc__annotate_init,
         },
+        {
+                .name = "s390",
+                .objdump =  {
+                        .comment_char = '#',
+                },
+        },
 };
 
 static void ins__delete(struct ins_operands *ops)
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
index 7913363bde5c..4f3c758d875d 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c
@@ -31,7 +31,7 @@
 #error Instruction buffer size too small
 #endif
 
-/* Based on branch_type() from perf_event_intel_lbr.c */
+/* Based on branch_type() from arch/x86/events/intel/lbr.c */
 static void intel_pt_insn_decoder(struct insn *insn,
                                   struct intel_pt_insn *intel_pt_insn)
 {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 70e389bc4af7..9b4d8ba22fed 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -202,7 +202,7 @@ void symbols__fixup_end(struct rb_root *symbols)
 
         /* Last entry */
         if (curr->end == curr->start)
-                curr->end = roundup(curr->start, 4096);
+                curr->end = roundup(curr->start, 4096) + 4096;
 }
 
 void __map_groups__fixup_end(struct map_groups *mg, enum map_type type)
diff --git a/tools/power/cpupower/utils/helpers/cpuid.c b/tools/power/cpupower/utils/helpers/cpuid.c
index 93b0aa74ca03..39c2c7d067bb 100644
--- a/tools/power/cpupower/utils/helpers/cpuid.c
+++ b/tools/power/cpupower/utils/helpers/cpuid.c
@@ -156,6 +156,7 @@ out:
                                          */
                         case 0x2C:      /* Westmere EP - Gulftown */
                                 cpu_info->caps |= CPUPOWER_CAP_HAS_TURBO_RATIO;
+                                break;
                         case 0x2A:      /* SNB */
                         case 0x2D:      /* SNB Xeon */
                         case 0x3A:      /* IVB */
diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index fedca3285326..ccf2a69365cc 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8
@@ -100,6 +100,8 @@ The system configuration dump (if --quiet is not used) is followed by statistics
 \fBCPU%c1, CPU%c3, CPU%c6, CPU%c7\fP show the percentage residency in hardware core idle states.  These numbers are from hardware residency counters.
 \fBCoreTmp\fP Degrees Celsius reported by the per-core Digital Thermal Sensor.
 \fBPkgTtmp\fP Degrees Celsius reported by the per-package Package Thermal Monitor.
+\fBGFX%rc6\fP The percentage of time the GPU is in the "render C6" state, rc6, during the measurement interval. From /sys/class/drm/card0/power/rc6_residency_ms.
+\fBGFXMHz\fP Instantaneous snapshot of what sysfs presents at the end of the measurement interval. From /sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz.
 \fBPkg%pc2, Pkg%pc3, Pkg%pc6, Pkg%pc7\fP percentage residency in hardware package idle states.  These numbers are from hardware residency counters.
 \fBPkgWatt\fP Watts consumed by the whole package.
 \fBCorWatt\fP Watts consumed by the core part of the package.
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 828dccd3f01e..b11294730771 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -1142,7 +1142,7 @@ delta_thread(struct thread_data *new, struct thread_data *old,
                  * it is possible for mperf's non-halted cycles + idle states
                  * to exceed TSC's all cycles: show c1 = 0% in that case.
                  */
-                if ((old->mperf + core_delta->c3 + core_delta->c6 + core_delta->c7) > old->tsc)
+                if ((old->mperf + core_delta->c3 + core_delta->c6 + core_delta->c7) > (old->tsc * tsc_tweak))
                         old->c1 = 0;
                 else {
                         /* normal case, derive c1 */
@@ -2485,8 +2485,10 @@ int snapshot_gfx_mhz(void)
 
         if (fp == NULL)
                 fp = fopen_or_die("/sys/class/graphics/fb0/device/drm/card0/gt_cur_freq_mhz", "r");
-        else
+        else {
                 rewind(fp);
+                fflush(fp);
+        }
 
         retval = fscanf(fp, "%d", &gfx_cur_mhz);
         if (retval != 1)
@@ -3111,7 +3113,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return 0;
 
         fprintf(outf, "cpu%d: MSR_HWP_CAPABILITIES: 0x%08llx "
-                        "(high 0x%x guar 0x%x eff 0x%x low 0x%x)\n",
+                        "(high %d guar %d eff %d low %d)\n",
                         cpu, msr,
                         (unsigned int)HWP_HIGHEST_PERF(msr),
                         (unsigned int)HWP_GUARANTEED_PERF(msr),
@@ -3122,7 +3124,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                 return 0;
 
         fprintf(outf, "cpu%d: MSR_HWP_REQUEST: 0x%08llx "
-                        "(min 0x%x max 0x%x des 0x%x epp 0x%x window 0x%x pkg 0x%x)\n",
+                        "(min %d max %d des %d epp 0x%x window 0x%x pkg 0x%x)\n",
                         cpu, msr,
                         (unsigned int)(((msr) >> 0) & 0xff),
                         (unsigned int)(((msr) >> 8) & 0xff),
@@ -3136,7 +3138,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
                         return 0;
 
                 fprintf(outf, "cpu%d: MSR_HWP_REQUEST_PKG: 0x%08llx "
-                        "(min 0x%x max 0x%x des 0x%x epp 0x%x window 0x%x)\n",
+                        "(min %d max %d des %d epp 0x%x window 0x%x)\n",
                         cpu, msr,
                         (unsigned int)(((msr) >> 0) & 0xff),
                         (unsigned int)(((msr) >> 8) & 0xff),
@@ -3353,17 +3355,19 @@ void rapl_probe(unsigned int family, unsigned int model)
         case INTEL_FAM6_SKYLAKE_DESKTOP:        /* SKL */
         case INTEL_FAM6_KABYLAKE_MOBILE:        /* KBL */
         case INTEL_FAM6_KABYLAKE_DESKTOP:       /* KBL */
-                do_rapl = RAPL_PKG | RAPL_DRAM | RAPL_DRAM_PERF_STATUS | RAPL_PKG_PERF_STATUS | RAPL_PKG_POWER_INFO;
+                do_rapl = RAPL_PKG | RAPL_CORES | RAPL_CORE_POLICY | RAPL_DRAM | RAPL_DRAM_PERF_STATUS | RAPL_PKG_PERF_STATUS | RAPL_GFX | RAPL_PKG_POWER_INFO;
                 BIC_PRESENT(BIC_PKG__);
                 BIC_PRESENT(BIC_RAM__);
                 if (rapl_joules) {
                         BIC_PRESENT(BIC_Pkg_J);
                         BIC_PRESENT(BIC_Cor_J);
                         BIC_PRESENT(BIC_RAM_J);
+                        BIC_PRESENT(BIC_GFX_J);
                 } else {
                         BIC_PRESENT(BIC_PkgWatt);
                         BIC_PRESENT(BIC_CorWatt);
                         BIC_PRESENT(BIC_RAMWatt);
+                        BIC_PRESENT(BIC_GFXWatt);
                 }
                 break;
         case INTEL_FAM6_HASWELL_X:      /* HSX */
@@ -3478,7 +3482,7 @@ void perf_limit_reasons_probe(unsigned int family, unsigned int model)
 int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p)
 {
         unsigned long long msr;
-        unsigned int dts;
+        unsigned int dts, dts2;
         int cpu;
 
         if (!(do_dts || do_ptm))
@@ -3503,7 +3507,6 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 fprintf(outf, "cpu%d: MSR_IA32_PACKAGE_THERM_STATUS: 0x%08llx (%d C)\n",
                         cpu, msr, tcc_activation_temp - dts);
 
-#ifdef  THERM_DEBUG
                 if (get_msr(cpu, MSR_IA32_PACKAGE_THERM_INTERRUPT, &msr))
                         return 0;
 
@@ -3511,11 +3514,10 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 dts2 = (msr >> 8) & 0x7F;
                 fprintf(outf, "cpu%d: MSR_IA32_PACKAGE_THERM_INTERRUPT: 0x%08llx (%d C, %d C)\n",
                         cpu, msr, tcc_activation_temp - dts, tcc_activation_temp - dts2);
-#endif
         }
 
 
-        if (do_dts) {
+        if (do_dts && debug) {
                 unsigned int resolution;
 
                 if (get_msr(cpu, MSR_IA32_THERM_STATUS, &msr))
@@ -3526,7 +3528,6 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 fprintf(outf, "cpu%d: MSR_IA32_THERM_STATUS: 0x%08llx (%d C +/- %d)\n",
                         cpu, msr, tcc_activation_temp - dts, resolution);
 
-#ifdef THERM_DEBUG
                 if (get_msr(cpu, MSR_IA32_THERM_INTERRUPT, &msr))
                         return 0;
 
@@ -3534,7 +3535,6 @@ int print_thermal(struct thread_data *t, struct core_data *c, struct pkg_data *p
                 dts2 = (msr >> 8) & 0x7F;
                 fprintf(outf, "cpu%d: MSR_IA32_THERM_INTERRUPT: 0x%08llx (%d C, %d C)\n",
                         cpu, msr, tcc_activation_temp - dts, tcc_activation_temp - dts2);
-#endif
         }
 
         return 0;
@@ -4578,7 +4578,7 @@ int get_and_dump_counters(void)
 }
 
 void print_version() {
-        fprintf(outf, "turbostat version 17.02.24"
+        fprintf(outf, "turbostat version 17.04.12"
                 " - Len Brown <lenb@kernel.org>\n");
 }
 
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 6e4eb2fc2d1e..0c8b61f8398e 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -1880,6 +1880,7 @@ sub get_grub_index {
 sub wait_for_input
 {
     my ($fp, $time) = @_;
+    my $start_time;
     my $rin;
     my $rout;
     my $nr;
@@ -1895,17 +1896,22 @@ sub wait_for_input
     vec($rin, fileno($fp), 1) = 1;
     vec($rin, fileno(\*STDIN), 1) = 1;
 
+    $start_time = time;
+
     while (1) {
         $nr = select($rout=$rin, undef, undef, $time);
 
-        if ($nr <= 0) {
-            return undef;
-        }
+        last if ($nr <= 0);
 
         # copy data from stdin to the console
         if (vec($rout, fileno(\*STDIN), 1) == 1) {
-            sysread(\*STDIN, $buf, 1000);
-            syswrite($fp, $buf, 1000);
+            $nr = sysread(\*STDIN, $buf, 1000);
+            syswrite($fp, $buf, $nr) if ($nr > 0);
+        }
+
+        # The timeout is based on time waiting for the fp data
+        if (vec($rout, fileno($fp), 1) != 1) {
+            last if (defined($time) && (time - $start_time > $time));
             next;
         }
 
@@ -1917,12 +1923,11 @@ sub wait_for_input
             last if ($ch eq "\n");
         }
 
-        if (!length($line)) {
-            return undef;
-        }
+        last if (!length($line));
 
         return $line;
     }
+    return undef;
 }
 
 sub reboot_to {
diff --git a/tools/testing/radix-tree/Makefile b/tools/testing/radix-tree/Makefile
index f11315bedefc..6a9480c03cbd 100644
--- a/tools/testing/radix-tree/Makefile
+++ b/tools/testing/radix-tree/Makefile
@@ -1,6 +1,7 @@
 
 CFLAGS += -I. -I../../include -g -O2 -Wall -D_LGPL_SOURCE -fsanitize=address
-LDFLAGS += -lpthread -lurcu
+LDFLAGS += -fsanitize=address
+LDLIBS+= -lpthread -lurcu
 TARGETS = main idr-test multiorder
 CORE_OFILES := radix-tree.o idr.o linux.o test.o find_bit.o
 OFILES = main.o $(CORE_OFILES) regression1.o regression2.o regression3.o \
@@ -10,23 +11,25 @@ ifndef SHIFT
         SHIFT=3
 endif
 
+ifeq ($(BUILD), 32)
+        CFLAGS += -m32
+        LDFLAGS += -m32
+endif
+
 targets: mapshift $(TARGETS)
 
 main:   $(OFILES)
-        $(CC) $(CFLAGS) $(LDFLAGS) $^ -o main
 
 idr-test: idr-test.o $(CORE_OFILES)
-        $(CC) $(CFLAGS) $(LDFLAGS) $^ -o idr-test
 
 multiorder: multiorder.o $(CORE_OFILES)
-        $(CC) $(CFLAGS) $(LDFLAGS) $^ -o multiorder
 
 clean:
         $(RM) $(TARGETS) *.o radix-tree.c idr.c generated/map-shift.h
 
 vpath %.c ../../lib
 
-$(OFILES): *.h */*.h generated/map-shift.h \
+$(OFILES): Makefile *.h */*.h generated/map-shift.h \
         ../../include/linux/*.h \
         ../../include/asm/*.h \
         ../../../include/linux/radix-tree.h \
@@ -41,7 +44,7 @@ idr.c: ../../../lib/idr.c
 .PHONY: mapshift
 
 mapshift:
-        @if ! grep -qw $(SHIFT) generated/map-shift.h; then             \
+        @if ! grep -qws $(SHIFT) generated/map-shift.h; then            \
                 echo "#define RADIX_TREE_MAP_SHIFT $(SHIFT)" >          \
                                 generated/map-shift.h;                  \
         fi
diff --git a/tools/testing/radix-tree/benchmark.c b/tools/testing/radix-tree/benchmark.c
index 9b09ddfe462f..99c40f3ed133 100644
--- a/tools/testing/radix-tree/benchmark.c
+++ b/tools/testing/radix-tree/benchmark.c
@@ -17,6 +17,9 @@
 #include <time.h>
 #include "test.h"
 
+#define for_each_index(i, base, order) \
+                for (i = base; i < base + (1 << order); i++)
+
 #define NSEC_PER_SEC    1000000000L
 
 static long long benchmark_iter(struct radix_tree_root *root, bool tagged)
@@ -57,27 +60,176 @@ again:
         return nsec;
 }
 
+static void benchmark_insert(struct radix_tree_root *root,
+                             unsigned long size, unsigned long step, int order)
+{
+        struct timespec start, finish;
+        unsigned long index;
+        long long nsec;
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (index = 0 ; index < size ; index += step)
+                item_insert_order(root, index, order);
+
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        printv(2, "Size: %8ld, step: %8ld, order: %d, insertion: %15lld ns\n",
+                size, step, order, nsec);
+}
+
+static void benchmark_tagging(struct radix_tree_root *root,
+                             unsigned long size, unsigned long step, int order)
+{
+        struct timespec start, finish;
+        unsigned long index;
+        long long nsec;
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (index = 0 ; index < size ; index += step)
+                radix_tree_tag_set(root, index, 0);
+
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        printv(2, "Size: %8ld, step: %8ld, order: %d, tagging: %17lld ns\n",
+                size, step, order, nsec);
+}
+
+static void benchmark_delete(struct radix_tree_root *root,
+                             unsigned long size, unsigned long step, int order)
+{
+        struct timespec start, finish;
+        unsigned long index, i;
+        long long nsec;
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        for (index = 0 ; index < size ; index += step)
+                for_each_index(i, index, order)
+                        item_delete(root, i);
+
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        printv(2, "Size: %8ld, step: %8ld, order: %d, deletion: %16lld ns\n",
+                size, step, order, nsec);
+}
+
 static void benchmark_size(unsigned long size, unsigned long step, int order)
 {
         RADIX_TREE(tree, GFP_KERNEL);
         long long normal, tagged;
-        unsigned long index;
 
-        for (index = 0 ; index < size ; index += step) {
-                item_insert_order(&tree, index, order);
-                radix_tree_tag_set(&tree, index, 0);
-        }
+        benchmark_insert(&tree, size, step, order);
+        benchmark_tagging(&tree, size, step, order);
 
         tagged = benchmark_iter(&tree, true);
         normal = benchmark_iter(&tree, false);
 
-        printv(2, "Size %ld, step %6ld, order %d tagged %10lld ns, normal %10lld ns\n",
-                size, step, order, tagged, normal);
+        printv(2, "Size: %8ld, step: %8ld, order: %d, tagged iteration: %8lld ns\n",
+                size, step, order, tagged);
+        printv(2, "Size: %8ld, step: %8ld, order: %d, normal iteration: %8lld ns\n",
+                size, step, order, normal);
+
+        benchmark_delete(&tree, size, step, order);
 
         item_kill_tree(&tree);
         rcu_barrier();
 }
 
+static long long  __benchmark_split(unsigned long index,
+                                    int old_order, int new_order)
+{
+        struct timespec start, finish;
+        long long nsec;
+        RADIX_TREE(tree, GFP_ATOMIC);
+
+        item_insert_order(&tree, index, old_order);
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+        radix_tree_split(&tree, index, new_order);
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+               (finish.tv_nsec - start.tv_nsec);
+
+        item_kill_tree(&tree);
+
+        return nsec;
+
+}
+
+static void benchmark_split(unsigned long size, unsigned long step)
+{
+        int i, j, idx;
+        long long nsec = 0;
+
+
+        for (idx = 0; idx < size; idx += step) {
+                for (i = 3; i < 11; i++) {
+                        for (j = 0; j < i; j++) {
+                                nsec += __benchmark_split(idx, i, j);
+                        }
+                }
+        }
+
+        printv(2, "Size %8ld, step %8ld, split time %10lld ns\n",
+                        size, step, nsec);
+
+}
+
+static long long  __benchmark_join(unsigned long index,
+                             unsigned order1, unsigned order2)
+{
+        unsigned long loc;
+        struct timespec start, finish;
+        long long nsec;
+        void *item, *item2 = item_create(index + 1, order1);
+        RADIX_TREE(tree, GFP_KERNEL);
+
+        item_insert_order(&tree, index, order2);
+        item = radix_tree_lookup(&tree, index);
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+        radix_tree_join(&tree, index + 1, order1, item2);
+        clock_gettime(CLOCK_MONOTONIC, &finish);
+        nsec = (finish.tv_sec - start.tv_sec) * NSEC_PER_SEC +
+                (finish.tv_nsec - start.tv_nsec);
+
+        loc = find_item(&tree, item);
+        if (loc == -1)
+                free(item);
+
+        item_kill_tree(&tree);
+
+        return nsec;
+}
+
+static void benchmark_join(unsigned long step)
+{
+        int i, j, idx;
+        long long nsec = 0;
+
+        for (idx = 0; idx < 1 << 10; idx += step) {
+                for (i = 1; i < 15; i++) {
+                        for (j = 0; j < i; j++) {
+                                nsec += __benchmark_join(idx, i, j);
+                        }
+                }
+        }
+
+        printv(2, "Size %8d, step %8ld, join time %10lld ns\n",
+                        1 << 10, step, nsec);
+}
+
 void benchmark(void)
 {
         unsigned long size[] = {1 << 10, 1 << 20, 0};
@@ -95,4 +247,11 @@ void benchmark(void)
         for (c = 0; size[c]; c++)
                 for (s = 0; step[s]; s++)
                         benchmark_size(size[c], step[s] << 9, 9);
+
+        for (c = 0; size[c]; c++)
+                for (s = 0; step[s]; s++)
+                        benchmark_split(size[c], step[s]);
+
+        for (s = 0; step[s]; s++)
+                benchmark_join(step[s]);
 }
diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c
index a26098c6123d..30cd0b296f1a 100644
--- a/tools/testing/radix-tree/idr-test.c
+++ b/tools/testing/radix-tree/idr-test.c
@@ -153,6 +153,30 @@ void idr_nowait_test(void)
         idr_destroy(&idr);
 }
 
+void idr_get_next_test(void)
+{
+        unsigned long i;
+        int nextid;
+        DEFINE_IDR(idr);
+
+        int indices[] = {4, 7, 9, 15, 65, 128, 1000, 99999, 0};
+
+        for(i = 0; indices[i]; i++) {
+                struct item *item = item_create(indices[i], 0);
+                assert(idr_alloc(&idr, item, indices[i], indices[i+1],
+                                 GFP_KERNEL) == indices[i]);
+        }
+
+        for(i = 0, nextid = 0; indices[i]; i++) {
+                idr_get_next(&idr, &nextid);
+                assert(nextid == indices[i]);
+                nextid++;
+        }
+
+        idr_for_each(&idr, item_idr_free, &idr);
+        idr_destroy(&idr);
+}
+
 void idr_checks(void)
 {
         unsigned long i;
@@ -202,6 +226,7 @@ void idr_checks(void)
         idr_alloc_test();
         idr_null_test();
         idr_nowait_test();
+        idr_get_next_test();
 }
 
 /*
@@ -338,7 +363,7 @@ void ida_check_random(void)
 {
         DEFINE_IDA(ida);
         DECLARE_BITMAP(bitmap, 2048);
-        int id;
+        int id, err;
         unsigned int i;
         time_t s = time(NULL);
 
@@ -352,8 +377,11 @@ void ida_check_random(void)
                         ida_remove(&ida, bit);
                 } else {
                         __set_bit(bit, bitmap);
-                        ida_pre_get(&ida, GFP_KERNEL);
-                        assert(!ida_get_new_above(&ida, bit, &id));
+                        do {
+                                ida_pre_get(&ida, GFP_KERNEL);
+                                err = ida_get_new_above(&ida, bit, &id);
+                        } while (err == -ENOMEM);
+                        assert(!err);
                         assert(id == bit);
                 }
         }
@@ -362,6 +390,24 @@ void ida_check_random(void)
                 goto repeat;
 }
 
+void ida_simple_get_remove_test(void)
+{
+        DEFINE_IDA(ida);
+        unsigned long i;
+
+        for (i = 0; i < 10000; i++) {
+                assert(ida_simple_get(&ida, 0, 20000, GFP_KERNEL) == i);
+        }
+        assert(ida_simple_get(&ida, 5, 30, GFP_KERNEL) < 0);
+
+        for (i = 0; i < 10000; i++) {
+                ida_simple_remove(&ida, i);
+        }
+        assert(ida_is_empty(&ida));
+
+        ida_destroy(&ida);
+}
+
 void ida_checks(void)
 {
         DEFINE_IDA(ida);
@@ -428,15 +474,41 @@ void ida_checks(void)
         ida_check_max();
         ida_check_conv();
         ida_check_random();
+        ida_simple_get_remove_test();
 
         radix_tree_cpu_dead(1);
 }
 
+static void *ida_random_fn(void *arg)
+{
+        rcu_register_thread();
+        ida_check_random();
+        rcu_unregister_thread();
+        return NULL;
+}
+
+void ida_thread_tests(void)
+{
+        pthread_t threads[10];
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(threads); i++)
+                if (pthread_create(&threads[i], NULL, ida_random_fn, NULL)) {
+                        perror("creating ida thread");
+                        exit(1);
+                }
+
+        while (i--)
+                pthread_join(threads[i], NULL);
+}
+
 int __weak main(void)
 {
         radix_tree_init();
         idr_checks();
         ida_checks();
+        ida_thread_tests();
+        radix_tree_cpu_dead(1);
         rcu_barrier();
         if (nr_allocated)
                 printf("nr_allocated = %d\n", nr_allocated);
diff --git a/tools/testing/radix-tree/main.c b/tools/testing/radix-tree/main.c
index b829127d5670..bc9a78449572 100644
--- a/tools/testing/radix-tree/main.c
+++ b/tools/testing/radix-tree/main.c
@@ -368,6 +368,7 @@ int main(int argc, char **argv)
         iteration_test(0, 10 + 90 * long_run);
         iteration_test(7, 10 + 90 * long_run);
         single_thread_tests(long_run);
+        ida_thread_tests();
 
         /* Free any remaining preallocated nodes */
         radix_tree_cpu_dead(0);
diff --git a/tools/testing/radix-tree/tag_check.c b/tools/testing/radix-tree/tag_check.c
index d4ff00989245..36dcf7d6945d 100644
--- a/tools/testing/radix-tree/tag_check.c
+++ b/tools/testing/radix-tree/tag_check.c
@@ -330,6 +330,34 @@ static void single_check(void)
         item_kill_tree(&tree);
 }
 
+void radix_tree_clear_tags_test(void)
+{
+        unsigned long index;
+        struct radix_tree_node *node;
+        struct radix_tree_iter iter;
+        void **slot;
+
+        RADIX_TREE(tree, GFP_KERNEL);
+
+        item_insert(&tree, 0);
+        item_tag_set(&tree, 0, 0);
+        __radix_tree_lookup(&tree, 0, &node, &slot);
+        radix_tree_clear_tags(&tree, node, slot);
+        assert(item_tag_get(&tree, 0, 0) == 0);
+
+        for (index = 0; index < 1000; index++) {
+                item_insert(&tree, index);
+                item_tag_set(&tree, index, 0);
+        }
+
+        radix_tree_for_each_slot(slot, &tree, &iter, 0) {
+                radix_tree_clear_tags(&tree, iter.node, slot);
+                assert(item_tag_get(&tree, iter.index, 0) == 0);
+        }
+
+        item_kill_tree(&tree);
+}
+
 void tag_check(void)
 {
         single_check();
@@ -347,4 +375,5 @@ void tag_check(void)
         thrash_tags();
         rcu_barrier();
         printv(2, "after thrash_tags: %d allocated\n", nr_allocated);
+        radix_tree_clear_tags_test();
 }
diff --git a/tools/testing/radix-tree/test.h b/tools/testing/radix-tree/test.h
index b30e11d9d271..0f8220cc6166 100644
--- a/tools/testing/radix-tree/test.h
+++ b/tools/testing/radix-tree/test.h
@@ -36,6 +36,7 @@ void iteration_test(unsigned order, unsigned duration);
 void benchmark(void);
 void idr_checks(void);
 void ida_checks(void);
+void ida_thread_tests(void);
 
 struct item *
 item_tag_set(struct radix_tree_root *root, unsigned long index, int tag);
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 4b498265dae6..9af09e8099c0 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -1,20 +1,30 @@
 LIBDIR := ../../../lib
-BPFOBJ := $(LIBDIR)/bpf/bpf.o
+BPFDIR := $(LIBDIR)/bpf
+APIDIR := ../../../include/uapi
+GENDIR := ../../../../include/generated
+GENHDR := $(GENDIR)/autoconf.h
 
-CFLAGS += -Wall -O2 -lcap -I../../../include/uapi -I$(LIBDIR)
+ifneq ($(wildcard $(GENHDR)),)
+  GENFLAGS := -DHAVE_GENHDR
+endif
+
+CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS)
+LDLIBS += -lcap
 
 TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map
 
 TEST_PROGS := test_kmod.sh
 
-.PHONY: all clean force
+include ../lib.mk
+
+BPFOBJ := $(OUTPUT)/bpf.o
+
+$(TEST_GEN_PROGS): $(BPFOBJ)
+
+.PHONY: force
 
 # force a rebuild of BPFOBJ when its dependencies are updated
 force:
 
 $(BPFOBJ): force
-        $(MAKE) -C $(dir $(BPFOBJ))
-
-$(test_objs): $(BPFOBJ)
-
-include ../lib.mk
+        $(MAKE) -C $(BPFDIR) OUTPUT=$(OUTPUT)/
diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index cada17ac00b8..20f1871874df 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -80,8 +80,9 @@ static void test_hashmap(int task, void *data)
         assert(bpf_map_update_elem(fd, &key, &value, BPF_EXIST) == 0);
         key = 2;
         assert(bpf_map_update_elem(fd, &key, &value, BPF_ANY) == 0);
-        key = 1;
-        assert(bpf_map_update_elem(fd, &key, &value, BPF_ANY) == 0);
+        key = 3;
+        assert(bpf_map_update_elem(fd, &key, &value, BPF_NOEXIST) == -1 &&
+               errno == E2BIG);
 
         /* Check that key = 0 doesn't exist. */
         key = 0;
@@ -110,6 +111,24 @@ static void test_hashmap(int task, void *data)
         close(fd);
 }
 
+static void test_hashmap_sizes(int task, void *data)
+{
+        int fd, i, j;
+
+        for (i = 1; i <= 512; i <<= 1)
+                for (j = 1; j <= 1 << 18; j <<= 1) {
+                        fd = bpf_create_map(BPF_MAP_TYPE_HASH, i, j,
+                                            2, map_flags);
+                        if (fd < 0) {
+                                printf("Failed to create hashmap key=%d value=%d '%s'\n",
+                                       i, j, strerror(errno));
+                                exit(1);
+                        }
+                        close(fd);
+                        usleep(10); /* give kernel time to destroy */
+                }
+}
+
 static void test_hashmap_percpu(int task, void *data)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
@@ -263,7 +282,7 @@ static void test_arraymap_percpu(int task, void *data)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
         int key, next_key, fd, i;
-        long values[nr_cpus];
+        long long values[nr_cpus];
 
         fd = bpf_create_map(BPF_MAP_TYPE_PERCPU_ARRAY, sizeof(key),
                             sizeof(values[0]), 2, 0);
@@ -317,8 +336,11 @@ static void test_arraymap_percpu(int task, void *data)
 static void test_arraymap_percpu_many_keys(void)
 {
         unsigned int nr_cpus = bpf_num_possible_cpus();
-        unsigned int nr_keys = 20000;
-        long values[nr_cpus];
+        /* nr_keys is not too large otherwise the test stresses percpu
+         * allocator more than anything else
+         */
+        unsigned int nr_keys = 2000;
+        long long values[nr_cpus];
         int key, fd, i;
 
         fd = bpf_create_map(BPF_MAP_TYPE_PERCPU_ARRAY, sizeof(key),
@@ -419,6 +441,7 @@ static void test_map_stress(void)
 {
         run_parallel(100, test_hashmap, NULL);
         run_parallel(100, test_hashmap_percpu, NULL);
+        run_parallel(100, test_hashmap_sizes, NULL);
 
         run_parallel(100, test_arraymap, NULL);
         run_parallel(100, test_arraymap_percpu, NULL);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index e1f5b9eea1e8..c848e90b6421 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -8,6 +8,8 @@
  * License as published by the Free Software Foundation.
  */
 
+#include <asm/types.h>
+#include <linux/types.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -28,6 +30,14 @@
 
 #include <bpf/bpf.h>
 
+#ifdef HAVE_GENHDR
+# include "autoconf.h"
+#else
+# if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
+#  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
+# endif
+#endif
+
 #include "../../../include/linux/filter.h"
 
 #ifndef ARRAY_SIZE
@@ -37,6 +47,8 @@
 #define MAX_INSNS       512
 #define MAX_FIXUPS      8
 
+#define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
+
 struct bpf_test {
         const char *descr;
         struct bpf_insn insns[MAX_INSNS];
@@ -51,6 +63,7 @@ struct bpf_test {
                 REJECT
         } result, result_unpriv;
         enum bpf_prog_type prog_type;
+        uint8_t flags;
 };
 
 /* Note we want this to be 64 bit aligned so that the end of our array is
@@ -2430,6 +2443,30 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "direct packet access: test15 (spill with xadd)",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
+                        BPF_MOV64_IMM(BPF_REG_5, 4096),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
+                        BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 invalid mem access 'inv'",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
+        {
                 "helper access to packet: test1, valid packet_ptr range",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -2932,6 +2969,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
                 .result = ACCEPT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "valid map access into an array with a variable",
@@ -2955,6 +2993,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
                 .result = ACCEPT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "valid map access into an array with a signed variable",
@@ -2982,6 +3021,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
                 .result = ACCEPT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a constant",
@@ -3023,6 +3063,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is outside of the array range",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a variable",
@@ -3046,6 +3087,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with no floor check",
@@ -3072,6 +3114,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a invalid max check",
@@ -3098,6 +3141,7 @@ static struct bpf_test tests[] = {
                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid map access into an array with a invalid max check",
@@ -3127,6 +3171,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result_unpriv = REJECT,
                 .result = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "multiple registers share map_lookup_elem result",
@@ -3250,6 +3295,7 @@ static struct bpf_test tests[] = {
                 .result = REJECT,
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "constant register |= constant should keep constant type",
@@ -3416,6 +3462,26 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
         },
         {
+                "overlapping checks for direct packet access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+        },
+        {
                 "invalid access of tc_classid for LWT_IN",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
@@ -3959,7 +4025,208 @@ static struct bpf_test tests[] = {
                 .result_unpriv = REJECT,
         },
         {
-                "map element value (adjusted) is preserved across register spilling",
+                "map element value or null is marked on register spilling",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 leaks addr",
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value store of cleared call register",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R1 !read_ok",
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value with unaligned store",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
+                        BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
+                        BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "map element value with unaligned load",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+                        BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
+                        BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .result = ACCEPT,
+                .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+        },
+        {
+                "map element value illegal alu op, 1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+                        BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value illegal alu op, 5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_MOV64_IMM(BPF_REG_3, 4096),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map2 = { 3 },
+                .errstr_unpriv = "R0 invalid mem access 'inv'",
+                .errstr = "R0 invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "map element value is preserved across register spilling",
                 .insns = {
                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
@@ -3981,6 +4248,7 @@ static struct bpf_test tests[] = {
                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
                 .result = ACCEPT,
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
@@ -4419,6 +4687,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result = REJECT,
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         },
         {
                 "invalid range check",
@@ -4450,6 +4719,7 @@ static struct bpf_test tests[] = {
                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
                 .result = REJECT,
                 .result_unpriv = REJECT,
+                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
         }
 };
 
@@ -4528,11 +4798,11 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
 static void do_test_single(struct bpf_test *test, bool unpriv,
                            int *passes, int *errors)
 {
+        int fd_prog, expected_ret, reject_from_alignment;
         struct bpf_insn *prog = test->insns;
         int prog_len = probe_filter_length(prog);
         int prog_type = test->prog_type;
         int fd_f1 = -1, fd_f2 = -1, fd_f3 = -1;
-        int fd_prog, expected_ret;
         const char *expected_err;
 
         do_test_fixup(test, prog, &fd_f1, &fd_f2, &fd_f3);
@@ -4545,8 +4815,19 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
                        test->result_unpriv : test->result;
         expected_err = unpriv && test->errstr_unpriv ?
                        test->errstr_unpriv : test->errstr;
+
+        reject_from_alignment = fd_prog < 0 &&
+                                (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
+                                strstr(bpf_vlog, "Unknown alignment.");
+#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+        if (reject_from_alignment) {
+                printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
+                       strerror(errno));
+                goto fail_log;
+        }
+#endif
         if (expected_ret == ACCEPT) {
-                if (fd_prog < 0) {
+                if (fd_prog < 0 && !reject_from_alignment) {
                         printf("FAIL\nFailed to load prog '%s'!\n",
                                strerror(errno));
                         goto fail_log;
@@ -4556,14 +4837,15 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
                         printf("FAIL\nUnexpected success to load!\n");
                         goto fail_log;
                 }
-                if (!strstr(bpf_vlog, expected_err)) {
+                if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
                         printf("FAIL\nUnexpected error message!\n");
                         goto fail_log;
                 }
         }
 
         (*passes)++;
-        printf("OK\n");
+        printf("OK%s\n", reject_from_alignment ?
+               " (NOTE: reject due to unknown alignment)" : "");
 close_fds:
         close(fd_prog);
         close(fd_f1);
@@ -4583,10 +4865,12 @@ static bool is_admin(void)
         cap_flag_value_t sysadmin = CAP_CLEAR;
         const cap_value_t cap_val = CAP_SYS_ADMIN;
 
+#ifdef CAP_IS_SUPPORTED
         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
                 perror("cap_get_flag");
                 return false;
         }
+#endif
         caps = cap_get_proc();
         if (!caps) {
                 perror("cap_get_proc");
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc
new file mode 100644
index 000000000000..bab5ff7c607e
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-pid.tc
@@ -0,0 +1,117 @@
+#!/bin/sh
+# description: ftrace - function pid filters
+
+# Make sure that function pid matching filter works.
+# Also test it on an instance directory
+
+if ! grep -q function available_tracers; then
+    echo "no function tracer configured"
+    exit_unsupported
+fi
+
+if [ ! -f set_ftrace_pid ]; then
+    echo "set_ftrace_pid not found? Is function tracer not set?"
+    exit_unsupported
+fi
+
+if [ ! -f set_ftrace_filter ]; then
+    echo "set_ftrace_filter not found? Is function tracer not set?"
+    exit_unsupported
+fi
+
+do_function_fork=1
+
+if [ ! -f options/function-fork ]; then
+    do_function_fork=0
+    echo "no option for function-fork found. Option will not be tested."
+fi
+
+read PID _ < /proc/self/stat
+
+if [ $do_function_fork -eq 1 ]; then
+    # default value of function-fork option
+    orig_value=`grep function-fork trace_options`
+fi
+
+do_reset() {
+    reset_tracer
+    clear_trace
+    enable_tracing
+    echo > set_ftrace_filter
+    echo > set_ftrace_pid
+
+    if [ $do_function_fork -eq 0 ]; then
+        return
+    fi
+
+    echo $orig_value > trace_options
+}
+
+fail() { # msg
+    do_reset
+    echo $1
+    exit $FAIL
+}
+
+yield() {
+    ping localhost -c 1 || sleep .001 || usleep 1 || sleep 1
+}
+
+do_test() {
+    disable_tracing
+
+    echo do_execve* > set_ftrace_filter
+    echo *do_fork >> set_ftrace_filter
+
+    echo $PID > set_ftrace_pid
+    echo function > current_tracer
+
+    if [ $do_function_fork -eq 1 ]; then
+        # don't allow children to be traced
+        echo nofunction-fork > trace_options
+    fi
+
+    enable_tracing
+    yield
+
+    count_pid=`cat trace | grep -v ^# | grep $PID | wc -l`
+    count_other=`cat trace | grep -v ^# | grep -v $PID | wc -l`
+
+    # count_other should be 0
+    if [ $count_pid -eq 0 -o $count_other -ne 0 ]; then
+        fail "PID filtering not working?"
+    fi
+
+    disable_tracing
+    clear_trace
+
+    if [ $do_function_fork -eq 0 ]; then
+        return
+    fi
+
+    # allow children to be traced
+    echo function-fork > trace_options
+
+    enable_tracing
+    yield
+
+    count_pid=`cat trace | grep -v ^# | grep $PID | wc -l`
+    count_other=`cat trace | grep -v ^# | grep -v $PID | wc -l`
+
+    # count_other should NOT be 0
+    if [ $count_pid -eq 0 -o $count_other -eq 0 ]; then
+        fail "PID filtering not following fork?"
+    fi
+}
+
+do_test
+
+mkdir instances/foo
+cd instances/foo
+do_test
+cd ../../
+rmdir instances/foo
+
+do_reset
+
+exit 0
diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 412459369686..e62bb354820c 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -75,7 +75,7 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
 {
         int fd, val;
 
-        fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP));
+        fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP));
         if (fd < 0) {
                 perror("socket packet");
                 exit(1);
@@ -95,6 +95,24 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
         return fd;
 }
 
+static void sock_fanout_set_cbpf(int fd)
+{
+        struct sock_filter bpf_filter[] = {
+                BPF_STMT(BPF_LD+BPF_B+BPF_ABS, 80),           /* ldb [80] */
+                BPF_STMT(BPF_RET+BPF_A, 0),                   /* ret A */
+        };
+        struct sock_fprog bpf_prog;
+
+        bpf_prog.filter = bpf_filter;
+        bpf_prog.len = sizeof(bpf_filter) / sizeof(struct sock_filter);
+
+        if (setsockopt(fd, SOL_PACKET, PACKET_FANOUT_DATA, &bpf_prog,
+                       sizeof(bpf_prog))) {
+                perror("fanout data cbpf");
+                exit(1);
+        }
+}
+
 static void sock_fanout_set_ebpf(int fd)
 {
         const int len_off = __builtin_offsetof(struct __sk_buff, len);
@@ -270,7 +288,7 @@ static int test_datapath(uint16_t typeflags, int port_off,
                 exit(1);
         }
         if (type == PACKET_FANOUT_CBPF)
-                sock_setfilter(fds[0], SOL_PACKET, PACKET_FANOUT_DATA);
+                sock_fanout_set_cbpf(fds[0]);
         else if (type == PACKET_FANOUT_EBPF)
                 sock_fanout_set_ebpf(fds[0]);
 
diff --git a/tools/testing/selftests/net/psock_lib.h b/tools/testing/selftests/net/psock_lib.h
index a77da88bf946..7d990d6c861b 100644
--- a/tools/testing/selftests/net/psock_lib.h
+++ b/tools/testing/selftests/net/psock_lib.h
@@ -38,7 +38,7 @@
 # define __maybe_unused         __attribute__ ((__unused__))
 #endif
 
-static __maybe_unused void sock_setfilter(int fd, int lvl, int optnum)
+static __maybe_unused void pair_udp_setfilter(int fd)
 {
         /* the filter below checks for all of the following conditions that
          * are based on the contents of create_payload()
@@ -76,23 +76,16 @@ static __maybe_unused void sock_setfilter(int fd, int lvl, int optnum)
         };
         struct sock_fprog bpf_prog;
 
-        if (lvl == SOL_PACKET && optnum == PACKET_FANOUT_DATA)
-                bpf_filter[5].code = 0x16;   /* RET A                         */
-
         bpf_prog.filter = bpf_filter;
         bpf_prog.len = sizeof(bpf_filter) / sizeof(struct sock_filter);
-        if (setsockopt(fd, lvl, optnum, &bpf_prog,
+
+        if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &bpf_prog,
                        sizeof(bpf_prog))) {
                 perror("setsockopt SO_ATTACH_FILTER");
                 exit(1);
         }
 }
 
-static __maybe_unused void pair_udp_setfilter(int fd)
-{
-        sock_setfilter(fd, SOL_SOCKET, SO_ATTACH_FILTER);
-}
-
 static __maybe_unused void pair_udp_open(int fds[], uint16_t port)
 {
         struct sockaddr_in saddr, daddr;
diff --git a/tools/testing/selftests/powerpc/Makefile b/tools/testing/selftests/powerpc/Makefile
index 1c5d0575802e..bf13fc2297aa 100644
--- a/tools/testing/selftests/powerpc/Makefile
+++ b/tools/testing/selftests/powerpc/Makefile
@@ -34,34 +34,34 @@ endif
 all: $(SUB_DIRS)
 
 $(SUB_DIRS):
-        BUILD_TARGET=$$OUTPUT/$@; mkdir -p $$BUILD_TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -k -C $@ all
+        BUILD_TARGET=$(OUTPUT)/$@; mkdir -p $$BUILD_TARGET; $(MAKE) OUTPUT=$$BUILD_TARGET -k -C $@ all
 
 include ../lib.mk
 
 override define RUN_TESTS
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests;\
         done;
 endef
 
 override define INSTALL_RULE
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET install;\
         done;
 endef
 
 override define EMIT_TESTS
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -s -C $$TARGET emit_tests;\
         done;
 endef
 
 clean:
         @for TARGET in $(SUB_DIRS); do \
-                BUILD_TARGET=$$OUTPUT/$$TARGET; \
+                BUILD_TARGET=$(OUTPUT)/$$TARGET;        \
                 $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean; \
         done;
         rm -f tags
diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c
index 248a820048df..66d31de60b9a 100644
--- a/tools/testing/selftests/powerpc/harness.c
+++ b/tools/testing/selftests/powerpc/harness.c
@@ -114,9 +114,11 @@ int test_harness(int (test_function)(void), char *name)
 
         rc = run_test(test_function, name);
 
-        if (rc == MAGIC_SKIP_RETURN_VALUE)
+        if (rc == MAGIC_SKIP_RETURN_VALUE) {
                 test_skip(name);
-        else
+                /* so that skipped test is not marked as failed */
+                rc = 0;
+        } else
                 test_finish(name, rc);
 
         return rc;
diff --git a/tools/testing/selftests/powerpc/include/vsx_asm.h b/tools/testing/selftests/powerpc/include/vsx_asm.h
index d828bfb6ef2d..54064ced9e95 100644
--- a/tools/testing/selftests/powerpc/include/vsx_asm.h
+++ b/tools/testing/selftests/powerpc/include/vsx_asm.h
@@ -16,56 +16,56 @@
  */
 FUNC_START(load_vsx)
         li      r5,0
-        lxvx    vs20,r5,r3
+        lxvd2x  vs20,r5,r3
         addi    r5,r5,16
-        lxvx    vs21,r5,r3
+        lxvd2x  vs21,r5,r3
         addi    r5,r5,16
-        lxvx    vs22,r5,r3
+        lxvd2x  vs22,r5,r3
         addi    r5,r5,16
-        lxvx    vs23,r5,r3
+        lxvd2x  vs23,r5,r3
         addi    r5,r5,16
-        lxvx    vs24,r5,r3
+        lxvd2x  vs24,r5,r3
         addi    r5,r5,16
-        lxvx    vs25,r5,r3
+        lxvd2x  vs25,r5,r3
         addi    r5,r5,16
-        lxvx    vs26,r5,r3
+        lxvd2x  vs26,r5,r3
         addi    r5,r5,16
-        lxvx    vs27,r5,r3
+        lxvd2x  vs27,r5,r3
         addi    r5,r5,16
-        lxvx    vs28,r5,r3
+        lxvd2x  vs28,r5,r3
         addi    r5,r5,16
-        lxvx    vs29,r5,r3
+        lxvd2x  vs29,r5,r3
         addi    r5,r5,16
-        lxvx    vs30,r5,r3
+        lxvd2x  vs30,r5,r3
         addi    r5,r5,16
-        lxvx    vs31,r5,r3
+        lxvd2x  vs31,r5,r3
         blr
 FUNC_END(load_vsx)
 
 FUNC_START(store_vsx)
         li      r5,0
-        stxvx   vs20,r5,r3
+        stxvd2x vs20,r5,r3
         addi    r5,r5,16
-        stxvx   vs21,r5,r3
+        stxvd2x vs21,r5,r3
         addi    r5,r5,16
-        stxvx   vs22,r5,r3
+        stxvd2x vs22,r5,r3
         addi    r5,r5,16
-        stxvx   vs23,r5,r3
+        stxvd2x vs23,r5,r3
         addi    r5,r5,16
-        stxvx   vs24,r5,r3
+        stxvd2x vs24,r5,r3
         addi    r5,r5,16
-        stxvx   vs25,r5,r3
+        stxvd2x vs25,r5,r3
         addi    r5,r5,16
-        stxvx   vs26,r5,r3
+        stxvd2x vs26,r5,r3
         addi    r5,r5,16
-        stxvx   vs27,r5,r3
+        stxvd2x vs27,r5,r3
         addi    r5,r5,16
-        stxvx   vs28,r5,r3
+        stxvd2x vs28,r5,r3
         addi    r5,r5,16
-        stxvx   vs29,r5,r3
+        stxvd2x vs29,r5,r3
         addi    r5,r5,16
-        stxvx   vs30,r5,r3
+        stxvd2x vs30,r5,r3
         addi    r5,r5,16
-        stxvx   vs31,r5,r3
+        stxvd2x vs31,r5,r3
         blr
 FUNC_END(store_vsx)
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 4cff7e7ddcc4..41642ba5e318 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -1,5 +1,9 @@
 # Makefile for vm selftests
 
+ifndef OUTPUT
+  OUTPUT := $(shell pwd)
+endif
+
 CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS)
 LDLIBS = -lrt
 TEST_GEN_FILES = compaction_test
diff --git a/tools/testing/selftests/x86/fsgsbase.c b/tools/testing/selftests/x86/fsgsbase.c
index 5b2b4b3c634c..b4967d875236 100644
--- a/tools/testing/selftests/x86/fsgsbase.c
+++ b/tools/testing/selftests/x86/fsgsbase.c
@@ -245,7 +245,7 @@ void do_unexpected_base(void)
                 long ret;
                 asm volatile ("int $0x80"
                               : "=a" (ret) : "a" (243), "b" (low_desc)
-                              : "flags");
+                              : "r8", "r9", "r10", "r11");
                 memcpy(&desc, low_desc, sizeof(desc));
                 munmap(low_desc, sizeof(desc));
 
diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c
index 4af47079cf04..f6121612e769 100644
--- a/tools/testing/selftests/x86/ldt_gdt.c
+++ b/tools/testing/selftests/x86/ldt_gdt.c
@@ -45,6 +45,12 @@
 #define AR_DB                   (1 << 22)
 #define AR_G                    (1 << 23)
 
+#ifdef __x86_64__
+# define INT80_CLOBBERS "r8", "r9", "r10", "r11"
+#else
+# define INT80_CLOBBERS
+#endif
+
 static int nerrs;
 
 /* Points to an array of 1024 ints, each holding its own index. */
@@ -588,7 +594,7 @@ static int invoke_set_thread_area(void)
         asm volatile ("int $0x80"
                       : "=a" (ret), "+m" (low_user_desc) :
                         "a" (243), "b" (low_user_desc)
-                      : "flags");
+                      : INT80_CLOBBERS);
         return ret;
 }
 
@@ -657,7 +663,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
         if (sel != 0) {
                 result = "FAIL";
@@ -688,7 +694,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
         if (sel != 0) {
                 result = "FAIL";
@@ -721,7 +727,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
 #ifdef __x86_64__
         syscall(SYS_arch_prctl, ARCH_GET_FS, &new_base);
@@ -774,7 +780,7 @@ static void test_gdt_invalidation(void)
                         "+a" (eax)
                       : "m" (low_user_desc_clear),
                         [arg1] "r" ((unsigned int)(unsigned long)low_user_desc_clear)
-                      : "flags");
+                      : INT80_CLOBBERS);
 
 #ifdef __x86_64__
         syscall(SYS_arch_prctl, ARCH_GET_GS, &new_base);
diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c
index b037ce9cf116..eaea92439708 100644
--- a/tools/testing/selftests/x86/ptrace_syscall.c
+++ b/tools/testing/selftests/x86/ptrace_syscall.c
@@ -58,7 +58,8 @@ static void do_full_int80(struct syscall_args32 *args)
         asm volatile ("int $0x80"
                       : "+a" (args->nr),
                         "+b" (args->arg0), "+c" (args->arg1), "+d" (args->arg2),
-                        "+S" (args->arg3), "+D" (args->arg4), "+r" (bp));
+                        "+S" (args->arg3), "+D" (args->arg4), "+r" (bp)
+                        : : "r8", "r9", "r10", "r11");
         args->arg5 = bp;
 #else
         sys32_helper(args, int80_and_ret);
diff --git a/tools/testing/selftests/x86/single_step_syscall.c b/tools/testing/selftests/x86/single_step_syscall.c
index 50c26358e8b7..a48da95c18fd 100644
--- a/tools/testing/selftests/x86/single_step_syscall.c
+++ b/tools/testing/selftests/x86/single_step_syscall.c
@@ -56,9 +56,11 @@ static volatile sig_atomic_t sig_traps;
 #ifdef __x86_64__
 # define REG_IP REG_RIP
 # define WIDTH "q"
+# define INT80_CLOBBERS "r8", "r9", "r10", "r11"
 #else
 # define REG_IP REG_EIP
 # define WIDTH "l"
+# define INT80_CLOBBERS
 #endif
 
 static unsigned long get_eflags(void)
@@ -140,7 +142,8 @@ int main()
 
         printf("[RUN]\tSet TF and check int80\n");
         set_eflags(get_eflags() | X86_EFLAGS_TF);
-        asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid));
+        asm volatile ("int $0x80" : "=a" (tmp) : "a" (SYS_getpid)
+                        : INT80_CLOBBERS);
         check_result();
 
         /*
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index 276139a24e6f..702f8108608d 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -392,6 +392,25 @@ static irqreturn_t vgic_maintenance_handler(int irq, void *data)
 }
 
 /**
+ * kvm_vgic_init_cpu_hardware - initialize the GIC VE hardware
+ *
+ * For a specific CPU, initialize the GIC VE hardware.
+ */
+void kvm_vgic_init_cpu_hardware(void)
+{
+        BUG_ON(preemptible());
+
+        /*
+         * We want to make sure the list registers start out clear so that we
+         * only have the program the used registers.
+         */
+        if (kvm_vgic_global_state.type == VGIC_V2)
+                vgic_v2_init_lrs();
+        else
+                kvm_call_hyp(__vgic_v3_init_lrs);
+}
+
+/**
  * kvm_vgic_hyp_init: populates the kvm_vgic_global_state variable
  * according to the host GIC model. Accordingly calls either
  * vgic_v2/v3_probe which registers the KVM_DEVICE that can be
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 571b64a01c50..8d1da1af4b09 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -360,29 +360,6 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
         return ret;
 }
 
-static unsigned long vgic_mmio_read_its_ctlr(struct kvm *vcpu,
-                                             struct vgic_its *its,
-                                             gpa_t addr, unsigned int len)
-{
-        u32 reg = 0;
-
-        mutex_lock(&its->cmd_lock);
-        if (its->creadr == its->cwriter)
-                reg |= GITS_CTLR_QUIESCENT;
-        if (its->enabled)
-                reg |= GITS_CTLR_ENABLE;
-        mutex_unlock(&its->cmd_lock);
-
-        return reg;
-}
-
-static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its,
-                                     gpa_t addr, unsigned int len,
-                                     unsigned long val)
-{
-        its->enabled = !!(val & GITS_CTLR_ENABLE);
-}
-
 static unsigned long vgic_mmio_read_its_typer(struct kvm *kvm,
                                               struct vgic_its *its,
                                               gpa_t addr, unsigned int len)
@@ -1161,33 +1138,16 @@ static void vgic_mmio_write_its_cbaser(struct kvm *kvm, struct vgic_its *its,
 #define ITS_CMD_SIZE                    32
 #define ITS_CMD_OFFSET(reg)             ((reg) & GENMASK(19, 5))
 
-/*
- * By writing to CWRITER the guest announces new commands to be processed.
- * To avoid any races in the first place, we take the its_cmd lock, which
- * protects our ring buffer variables, so that there is only one user
- * per ITS handling commands at a given time.
- */
-static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its,
-                                        gpa_t addr, unsigned int len,
-                                        unsigned long val)
+/* Must be called with the cmd_lock held. */
+static void vgic_its_process_commands(struct kvm *kvm, struct vgic_its *its)
 {
         gpa_t cbaser;
         u64 cmd_buf[4];
-        u32 reg;
 
-        if (!its)
-                return;
-
-        mutex_lock(&its->cmd_lock);
-
-        reg = update_64bit_reg(its->cwriter, addr & 7, len, val);
-        reg = ITS_CMD_OFFSET(reg);
-        if (reg >= ITS_CMD_BUFFER_SIZE(its->cbaser)) {
-                mutex_unlock(&its->cmd_lock);
+        /* Commands are only processed when the ITS is enabled. */
+        if (!its->enabled)
                 return;
-        }
 
-        its->cwriter = reg;
         cbaser = CBASER_ADDRESS(its->cbaser);
 
         while (its->cwriter != its->creadr) {
@@ -1207,6 +1167,34 @@ static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its,
                 if (its->creadr == ITS_CMD_BUFFER_SIZE(its->cbaser))
                         its->creadr = 0;
         }
+}
+
+/*
+ * By writing to CWRITER the guest announces new commands to be processed.
+ * To avoid any races in the first place, we take the its_cmd lock, which
+ * protects our ring buffer variables, so that there is only one user
+ * per ITS handling commands at a given time.
+ */
+static void vgic_mmio_write_its_cwriter(struct kvm *kvm, struct vgic_its *its,
+                                        gpa_t addr, unsigned int len,
+                                        unsigned long val)
+{
+        u64 reg;
+
+        if (!its)
+                return;
+
+        mutex_lock(&its->cmd_lock);
+
+        reg = update_64bit_reg(its->cwriter, addr & 7, len, val);
+        reg = ITS_CMD_OFFSET(reg);
+        if (reg >= ITS_CMD_BUFFER_SIZE(its->cbaser)) {
+                mutex_unlock(&its->cmd_lock);
+                return;
+        }
+        its->cwriter = reg;
+
+        vgic_its_process_commands(kvm, its);
 
         mutex_unlock(&its->cmd_lock);
 }
@@ -1287,6 +1275,39 @@ static void vgic_mmio_write_its_baser(struct kvm *kvm,
         *regptr = reg;
 }
 
+static unsigned long vgic_mmio_read_its_ctlr(struct kvm *vcpu,
+                                             struct vgic_its *its,
+                                             gpa_t addr, unsigned int len)
+{
+        u32 reg = 0;
+
+        mutex_lock(&its->cmd_lock);
+        if (its->creadr == its->cwriter)
+                reg |= GITS_CTLR_QUIESCENT;
+        if (its->enabled)
+                reg |= GITS_CTLR_ENABLE;
+        mutex_unlock(&its->cmd_lock);
+
+        return reg;
+}
+
+static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its,
+                                     gpa_t addr, unsigned int len,
+                                     unsigned long val)
+{
+        mutex_lock(&its->cmd_lock);
+
+        its->enabled = !!(val & GITS_CTLR_ENABLE);
+
+        /*
+         * Try to process any pending commands. This function bails out early
+         * if the ITS is disabled or no commands have been queued.
+         */
+        vgic_its_process_commands(kvm, its);
+
+        mutex_unlock(&its->cmd_lock);
+}
+
 #define REGISTER_ITS_DESC(off, rd, wr, length, acc)             \
 {                                                               \
         .reg_offset = off,                                      \
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c
index a3ad7ff95c9b..0a4283ed9aa7 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c
@@ -229,7 +229,15 @@ static unsigned long vgic_mmio_read_vcpuif(struct kvm_vcpu *vcpu,
                 val = vmcr.ctlr;
                 break;
         case GIC_CPU_PRIMASK:
-                val = vmcr.pmr;
+                /*
+                 * Our KVM_DEV_TYPE_ARM_VGIC_V2 device ABI exports the
+                 * the PMR field as GICH_VMCR.VMPriMask rather than
+                 * GICC_PMR.Priority, so we expose the upper five bits of
+                 * priority mask to userspace using the lower bits in the
+                 * unsigned long.
+                 */
+                val = (vmcr.pmr & GICV_PMR_PRIORITY_MASK) >>
+                        GICV_PMR_PRIORITY_SHIFT;
                 break;
         case GIC_CPU_BINPOINT:
                 val = vmcr.bpr;
@@ -262,7 +270,15 @@ static void vgic_mmio_write_vcpuif(struct kvm_vcpu *vcpu,
                 vmcr.ctlr = val;
                 break;
         case GIC_CPU_PRIMASK:
-                vmcr.pmr = val;
+                /*
+                 * Our KVM_DEV_TYPE_ARM_VGIC_V2 device ABI exports the
+                 * the PMR field as GICH_VMCR.VMPriMask rather than
+                 * GICC_PMR.Priority, so we expose the upper five bits of
+                 * priority mask to userspace using the lower bits in the
+                 * unsigned long.
+                 */
+                vmcr.pmr = (val << GICV_PMR_PRIORITY_SHIFT) &
+                        GICV_PMR_PRIORITY_MASK;
                 break;
         case GIC_CPU_BINPOINT:
                 vmcr.bpr = val;
diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c
index 3654b4c835ef..2a5db1352722 100644
--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -180,21 +180,37 @@ unsigned long vgic_mmio_read_active(struct kvm_vcpu *vcpu,
 static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
                                     bool new_active_state)
 {
+        struct kvm_vcpu *requester_vcpu;
         spin_lock(&irq->irq_lock);
+
+        /*
+         * The vcpu parameter here can mean multiple things depending on how
+         * this function is called; when handling a trap from the kernel it
+         * depends on the GIC version, and these functions are also called as
+         * part of save/restore from userspace.
+         *
+         * Therefore, we have to figure out the requester in a reliable way.
+         *
+         * When accessing VGIC state from user space, the requester_vcpu is
+         * NULL, which is fine, because we guarantee that no VCPUs are running
+         * when accessing VGIC state from user space so irq->vcpu->cpu is
+         * always -1.
+         */
+        requester_vcpu = kvm_arm_get_running_vcpu();
+
         /*
          * If this virtual IRQ was written into a list register, we
          * have to make sure the CPU that runs the VCPU thread has
-         * synced back LR state to the struct vgic_irq.  We can only
-         * know this for sure, when either this irq is not assigned to
-         * anyone's AP list anymore, or the VCPU thread is not
-         * running on any CPUs.
+         * synced back the LR state to the struct vgic_irq.
          *
-         * In the opposite case, we know the VCPU thread may be on its
-         * way back from the guest and still has to sync back this
-         * IRQ, so we release and re-acquire the spin_lock to let the
-         * other thread sync back the IRQ.
+         * As long as the conditions below are true, we know the VCPU thread
+         * may be on its way back from the guest (we kicked the VCPU thread in
+         * vgic_change_active_prepare)  and still has to sync back this IRQ,
+         * so we release and re-acquire the spin_lock to let the other thread
+         * sync back the IRQ.
          */
         while (irq->vcpu && /* IRQ may have state in an LR somewhere */
+               irq->vcpu != requester_vcpu && /* Current thread is not the VCPU thread */
                irq->vcpu->cpu != -1) /* VCPU thread is running */
                 cond_resched_lock(&irq->irq_lock);
 
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index b834ecdf3225..b637d9c7afe3 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -36,6 +36,21 @@ static unsigned long *u64_to_bitmask(u64 *val)
         return (unsigned long *)val;
 }
 
+static inline void vgic_v2_write_lr(int lr, u32 val)
+{
+        void __iomem *base = kvm_vgic_global_state.vctrl_base;
+
+        writel_relaxed(val, base + GICH_LR0 + (lr * 4));
+}
+
+void vgic_v2_init_lrs(void)
+{
+        int i;
+
+        for (i = 0; i < kvm_vgic_global_state.nr_lr; i++)
+                vgic_v2_write_lr(i, 0);
+}
+
 void vgic_v2_process_maintenance(struct kvm_vcpu *vcpu)
 {
         struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2;
@@ -191,8 +206,8 @@ void vgic_v2_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
                 GICH_VMCR_ALIAS_BINPOINT_MASK;
         vmcr |= (vmcrp->bpr << GICH_VMCR_BINPOINT_SHIFT) &
                 GICH_VMCR_BINPOINT_MASK;
-        vmcr |= (vmcrp->pmr << GICH_VMCR_PRIMASK_SHIFT) &
-                GICH_VMCR_PRIMASK_MASK;
+        vmcr |= ((vmcrp->pmr >> GICV_PMR_PRIORITY_SHIFT) <<
+                 GICH_VMCR_PRIMASK_SHIFT) & GICH_VMCR_PRIMASK_MASK;
 
         vcpu->arch.vgic_cpu.vgic_v2.vgic_vmcr = vmcr;
 }
@@ -207,8 +222,8 @@ void vgic_v2_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcrp)
                         GICH_VMCR_ALIAS_BINPOINT_SHIFT;
         vmcrp->bpr  = (vmcr & GICH_VMCR_BINPOINT_MASK) >>
                         GICH_VMCR_BINPOINT_SHIFT;
-        vmcrp->pmr  = (vmcr & GICH_VMCR_PRIMASK_MASK) >>
-                        GICH_VMCR_PRIMASK_SHIFT;
+        vmcrp->pmr  = ((vmcr & GICH_VMCR_PRIMASK_MASK) >>
+                        GICH_VMCR_PRIMASK_SHIFT) << GICV_PMR_PRIORITY_SHIFT;
 }
 
 void vgic_v2_enable(struct kvm_vcpu *vcpu)
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index edc6ee2dc852..be0f4c3e0142 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -229,10 +229,13 @@ void vgic_v3_enable(struct kvm_vcpu *vcpu)
         /*
          * If we are emulating a GICv3, we do it in an non-GICv2-compatible
          * way, so we force SRE to 1 to demonstrate this to the guest.
+         * Also, we don't support any form of IRQ/FIQ bypass.
          * This goes with the spec allowing the value to be RAO/WI.
          */
         if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
-                vgic_v3->vgic_sre = ICC_SRE_EL1_SRE;
+                vgic_v3->vgic_sre = (ICC_SRE_EL1_DIB |
+                                     ICC_SRE_EL1_DFB |
+                                     ICC_SRE_EL1_SRE);
                 vcpu->arch.vgic_cpu.pendbaser = INITIAL_PENDBASER_VALUE;
         } else {
                 vgic_v3->vgic_sre = 0;
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index db28f7cadab2..6cf557e9f718 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -81,11 +81,18 @@ static inline bool irq_is_pending(struct vgic_irq *irq)
                 return irq->pending_latch || irq->line_level;
 }
 
+/*
+ * This struct provides an intermediate representation of the fields contained
+ * in the GICH_VMCR and ICH_VMCR registers, such that code exporting the GIC
+ * state to userspace can generate either GICv2 or GICv3 CPU interface
+ * registers regardless of the hardware backed GIC used.
+ */
 struct vgic_vmcr {
         u32     ctlr;
         u32     abpr;
         u32     bpr;
-        u32     pmr;
+        u32     pmr;  /* Priority mask field in the GICC_PMR and
+                       * ICC_PMR_EL1 priority field format */
         /* Below member variable are valid only for GICv3 */
         u32     grpen0;
         u32     grpen1;
@@ -130,6 +137,8 @@ int vgic_v2_map_resources(struct kvm *kvm);
 int vgic_register_dist_iodev(struct kvm *kvm, gpa_t dist_base_address,
                              enum vgic_type);
 
+void vgic_v2_init_lrs(void);
+
 static inline void vgic_get_irq_kref(struct vgic_irq *irq)
 {
         if (irq->intid < VGIC_MIN_LPI)
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index a29786dd9522..4d28a9ddbee0 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -870,7 +870,8 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
                         continue;
 
                 kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-                kvm->buses[bus_idx]->ioeventfd_count--;
+                if (kvm->buses[bus_idx])
+                        kvm->buses[bus_idx]->ioeventfd_count--;
                 ioeventfd_release(p);
                 ret = 0;
                 break;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a17d78759727..88257b311cb5 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -727,8 +727,11 @@ static void kvm_destroy_vm(struct kvm *kvm)
         list_del(&kvm->vm_list);
         spin_unlock(&kvm_lock);
         kvm_free_irq_routing(kvm);
-        for (i = 0; i < KVM_NR_BUSES; i++)
-                kvm_io_bus_destroy(kvm->buses[i]);
+        for (i = 0; i < KVM_NR_BUSES; i++) {
+                if (kvm->buses[i])
+                        kvm_io_bus_destroy(kvm->buses[i]);
+                kvm->buses[i] = NULL;
+        }
         kvm_coalesced_mmio_free(kvm);
 #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
         mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
@@ -1062,7 +1065,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
          * changes) is disallowed above, so any other attribute changes getting
          * here can be skipped.
          */
-        if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) {
+        if (as_id == 0 && (change == KVM_MR_CREATE || change == KVM_MR_MOVE)) {
                 r = kvm_iommu_map_pages(kvm, &new);
                 return r;
         }
@@ -3474,6 +3477,8 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
         r = __kvm_io_bus_write(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
@@ -3491,6 +3496,8 @@ int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
 
         /* First try the device referenced by cookie. */
         if ((cookie >= 0) && (cookie < bus->dev_count) &&
@@ -3541,6 +3548,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
         };
 
         bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+        if (!bus)
+                return -ENOMEM;
         r = __kvm_io_bus_read(vcpu, bus, &range, val);
         return r < 0 ? r : 0;
 }
@@ -3553,6 +3562,9 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
+        if (!bus)
+                return -ENOMEM;
+
         /* exclude ioeventfd which is limited by maximum fd */
         if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
                 return -ENOSPC;
@@ -3572,37 +3584,41 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 }
 
 /* Caller must hold slots_lock. */
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-                              struct kvm_io_device *dev)
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+                               struct kvm_io_device *dev)
 {
-        int i, r;
+        int i;
         struct kvm_io_bus *new_bus, *bus;
 
         bus = kvm->buses[bus_idx];
-        r = -ENOENT;
+        if (!bus)
+                return;
+
         for (i = 0; i < bus->dev_count; i++)
                 if (bus->range[i].dev == dev) {
-                        r = 0;
                         break;
                 }
 
-        if (r)
-                return r;
+        if (i == bus->dev_count)
+                return;
 
         new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
                           sizeof(struct kvm_io_range)), GFP_KERNEL);
-        if (!new_bus)
-                return -ENOMEM;
+        if (!new_bus)  {
+                pr_err("kvm: failed to shrink bus, removing it completely\n");
+                goto broken;
+        }
 
         memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
         new_bus->dev_count--;
         memcpy(new_bus->range + i, bus->range + i + 1,
                (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
 
+broken:
         rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
         synchronize_srcu_expedited(&kvm->srcu);
         kfree(bus);
-        return r;
+        return;
 }
 
 struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
@@ -3615,6 +3631,8 @@ struct kvm_io_device *kvm_io_bus_get_dev(struct kvm *kvm, enum kvm_bus bus_idx,
         srcu_idx = srcu_read_lock(&kvm->srcu);
 
         bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
+        if (!bus)
+                goto out_unlock;
 
         dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
         if (dev_idx < 0)