Merge tag 'drm-intel-next-2015-03-27-merge' of git://anongit.freedesktop.org/drm-intel into drm-next

This backmerges 4.0-rc6 due to the recent fixes in rc5/6 - DP link rate refactoring from Ville - byt/bsw rps tuning from Chris - kerneldoc for the shrinker code - more dynamic ppgtt pte work (Michel, Ben, ...) - vlv dpll code refactoring to prep fro bxt (Imre) - refactoring the sprite colorkey code (Ville) - rotated ggtt view support from Tvrtko - roll out struct drm_atomic_state to prep for atomic update (Ander) * tag 'drm-intel-next-2015-03-27-merge' of git://anongit.freedesktop.org/drm-intel: (473 commits) Linux 4.0-rc6 arm64: juno: Fix misleading name of UART reference clock drm/i915: Update DRIVER_DATE to 20150327 drm/i915: Skip allocating shadow batch for 0-length batches drm/i915: Handle error to get connector state when staging config drm/i915: Compare GGTT view structs instead of types drm/i915: fix simple_return.cocci warnings drm/i915: Add module param to test the load detect code drm/i915: Remove usage of encoder->new_crtc from clock computations drm/i915: Don't look at staged config crtc when changing DRRS state drm/i915: Convert intel_pipe_will_have_type() to using atomic state drm/i915: Pass an atomic state to modeset_global_resources() functions drm/i915: Add dynamic page trace events drm/i915: Finish gen6/7 dynamic page table allocation drm/i915: Remove unnecessary gen6_ppgtt_unmap_pages drm/i915: Fix i915_dma_map_single positive error code drm/i915: Prevent out of range pt in gen6_for_each_pde drm/i915: fix definition of the DRM_IOCTL_I915_GET_SPRITE_COLORKEY ioctl drm/i915: Rip out GET_SPRITE_COLORKEY ioctl watchdog: imgpdc: Fix default heartbeat ...
author: Dave Airlie <airlied@redhat.com> 2015-03-31 18:21:46 -0400
committer: Dave Airlie <airlied@redhat.com> 2015-03-31 18:21:46 -0400
commit: 9e87e48f8e5de2146842fd0ff436e0256b52c4a9 (patch)
tree: 9ada800ddc51e4250aafacc54ef9fb18abf38e37
parent: d7de390bff7ad0f551fc0e409543e98db86a65df (diff)
parent: 6e0aa8018f9c676b115b7ca6c20a056fc57c68a9 (diff)
432 files changed, 6662 insertions, 4477 deletions
diff --git a/Documentation/DocBook/drm.tmpl b/Documentation/DocBook/drm.tmpl
index 7a45775518f6..f4976cd7b32b 100644
--- a/Documentation/DocBook/drm.tmpl
+++ b/Documentation/DocBook/drm.tmpl
@@ -4184,7 +4184,7 @@ int num_ioctls;</synopsis>
      <sect2>
        <title>Buffer Object Eviction</title>
        <para>
-          This section documents the interface function for evicting buffer
+          This section documents the interface functions for evicting buffer
          objects to make space available in the virtual gpu address spaces.
          Note that this is mostly orthogonal to shrinking buffer objects
          caches, which has the goal to make main memory (shared with the gpu
@@ -4192,6 +4192,17 @@ int num_ioctls;</synopsis>
        </para>
 !Idrivers/gpu/drm/i915/i915_gem_evict.c
      </sect2>
+      <sect2>
+        <title>Buffer Object Memory Shrinking</title>
+        <para>
+          This section documents the interface function for shrinking memory
+          usage of buffer object caches. Shrinking is used to make main memory
+          available.  Note that this is mostly orthogonal to evicting buffer
+          objects, which has the goal to make space in gpu virtual address
+          spaces.
+        </para>
+!Idrivers/gpu/drm/i915/i915_gem_shrinker.c
+      </sect2>
    </sect1>
    <sect1>
diff --git a/MAINTAINERS b/MAINTAINERS
index 74778886321e..36cf1007037c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1186,7 +1186,7 @@ M:	Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-mvebu/
-F:      drivers/rtc/armada38x-rtc
+F:      drivers/rtc/rtc-armada38x.c
 ARM/Marvell Berlin SoC support
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
@@ -1362,6 +1362,7 @@ F:	drivers/i2c/busses/i2c-rk3x.c
 F:      drivers/*/*rockchip*
 F:      drivers/*/*/*rockchip*
 F:      sound/soc/rockchip/
+N:      rockchip
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
@@ -1675,8 +1676,8 @@ F:	drivers/misc/eeprom/at24.c
 F:      include/linux/platform_data/at24.h
 ATA OVER ETHERNET (AOE) DRIVER
-M:      "Ed L. Cashin" <ecashin@coraid.com>
+M:      "Ed L. Cashin" <ed.cashin@acm.org>
-W:      http://support.coraid.com/support/linux
+W:      http://www.openaoe.org/
 S:      Supported
 F:      Documentation/aoe/
 F:      drivers/block/aoe/
@@ -1741,7 +1742,7 @@ S:	Maintained
 F:      drivers/net/ethernet/atheros/
 ATM
-M:      Chas Williams <chas@cmf.nrl.navy.mil>
+M:      Chas Williams <3chas3@gmail.com>
 L:      linux-atm-general@lists.sourceforge.net (moderated for non-subscribers)
 L:      netdev@vger.kernel.org
 W:      http://linux-atm.sourceforge.net
@@ -3252,6 +3253,13 @@ S:	Maintained
 F:      Documentation/hwmon/dme1737
 F:      drivers/hwmon/dme1737.c
+DMI/SMBIOS SUPPORT
+M:      Jean Delvare <jdelvare@suse.de>
+S:      Maintained
+F:      drivers/firmware/dmi-id.c
+F:      drivers/firmware/dmi_scan.c
+F:      include/linux/dmi.h
 DOCKING STATION DRIVER
 M:      Shaohua Li <shaohua.li@intel.com>
 L:      linux-acpi@vger.kernel.org
@@ -10206,6 +10214,13 @@ S:	Maintained
 F:      Documentation/usb/ohci.txt
 F:      drivers/usb/host/ohci*
+USB OTG FSM (Finite State Machine)
+M:      Peter Chen <Peter.Chen@freescale.com>
+T:      git git://github.com/hzpeterchen/linux-usb.git
+L:      linux-usb@vger.kernel.org
+S:      Maintained
+F:      drivers/usb/common/usb-otg-fsm.c
 USB OVER IP DRIVER
 M:      Valentina Manea <valentina.manea.m@gmail.com>
 M:      Shuah Khan <shuah.kh@samsung.com>
diff --git a/Makefile b/Makefile
index e734965b1604..da36a3be7969 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc6
 NAME = Hurr durr I'ma sheep
 # *DOCUMENTATION*
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index 114234e83caa..edda76fae83f 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -67,7 +67,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
               sigset_t *set)
 {
        int err;
-        err = __copy_to_user(&(sf->uc.uc_mcontext.regs), regs,
+        err = __copy_to_user(&(sf->uc.uc_mcontext.regs.scratch), regs,
                             sizeof(sf->uc.uc_mcontext.regs.scratch));
        err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
@@ -83,7 +83,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
        if (!err)
                set_current_blocked(&set);
-        err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs),
+        err |= __copy_from_user(regs, &(sf->uc.uc_mcontext.regs.scratch),
                                sizeof(sf->uc.uc_mcontext.regs.scratch));
        return err;
@@ -131,6 +131,15 @@ SYSCALL_DEFINE0(rt_sigreturn)
        /* Don't restart from sigreturn */
        syscall_wont_restart(regs);
+        /*
+         * Ensure that sigreturn always returns to user mode (in case the
+         * regs saved on user stack got fudged between save and sigreturn)
+         * Otherwise it is easy to panic the kernel with a custom
+         * signal handler and/or restorer which clobberes the status32/ret
+         * to return to a bogus location in kernel mode.
+         */
+        regs->status32 |= STATUS_U_MASK;
        return regs->r0;
 badframe:
@@ -229,8 +238,11 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
        /*
         * handler returns using sigreturn stub provided already by userpsace
+         * If not, nuke the process right away
         */
-        BUG_ON(!(ksig->ka.sa.sa_flags & SA_RESTORER));
+        if(!(ksig->ka.sa.sa_flags & SA_RESTORER))
+                return 1;
        regs->blink = (unsigned long)ksig->ka.sa.sa_restorer;
        /* User Stack for signal handler will be above the frame just carved */
@@ -296,12 +308,12 @@ static void
 handle_signal(struct ksignal *ksig, struct pt_regs *regs)
 {
        sigset_t *oldset = sigmask_to_save();
-        int ret;
+        int failed;
        /* Set up the stack frame */
-        ret = setup_rt_frame(ksig, oldset, regs);
+        failed = setup_rt_frame(ksig, oldset, regs);
-        signal_setup_done(ret, ksig, 0);
+        signal_setup_done(failed, ksig, 0);
 }
 void do_signal(struct pt_regs *regs)
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 9f1f09a2bc9b..cf4c0c99aa25 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -619,6 +619,7 @@ config ARCH_PXA
        select GENERIC_CLOCKEVENTS
        select GPIO_PXA
        select HAVE_IDE
+        select IRQ_DOMAIN
        select MULTI_IRQ_HANDLER
        select PLAT_PXA
        select SPARSE_IRQ
diff --git a/arch/arm/boot/dts/dm8168-evm.dts b/arch/arm/boot/dts/dm8168-evm.dts
index d3a29c1b8417..afe678f6d2e9 100644
--- a/arch/arm/boot/dts/dm8168-evm.dts
+++ b/arch/arm/boot/dts/dm8168-evm.dts
@@ -36,6 +36,20 @@
                >;
        };
+        mmc_pins: pinmux_mmc_pins {
+                pinctrl-single,pins = <
+                        DM816X_IOPAD(0x0a70, MUX_MODE0)                 /* SD_POW */
+                        DM816X_IOPAD(0x0a74, MUX_MODE0)                 /* SD_CLK */
+                        DM816X_IOPAD(0x0a78, MUX_MODE0)                 /* SD_CMD */
+                        DM816X_IOPAD(0x0a7C, MUX_MODE0)                 /* SD_DAT0 */
+                        DM816X_IOPAD(0x0a80, MUX_MODE0)                 /* SD_DAT1 */
+                        DM816X_IOPAD(0x0a84, MUX_MODE0)                 /* SD_DAT2 */
+                        DM816X_IOPAD(0x0a88, MUX_MODE0)                 /* SD_DAT2 */
+                        DM816X_IOPAD(0x0a8c, MUX_MODE2)                 /* GP1[7] */
+                        DM816X_IOPAD(0x0a90, MUX_MODE2)                 /* GP1[8] */
+                >;
+        };
        usb0_pins: pinmux_usb0_pins {
                pinctrl-single,pins = <
                        DM816X_IOPAD(0x0d00, MUX_MODE0)                 /* USB0_DRVVBUS */
@@ -137,7 +151,12 @@
 };
 &mmc1 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&mmc_pins>;
        vmmc-supply = <&vmmcsd_fixed>;
+        bus-width = <4>;
+        cd-gpios = <&gpio2 7 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
 };
 /* At least dm8168-evm rev c won't support multipoint, later may */
diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi
index 3c97b5f2addc..f35715bc6992 100644
--- a/arch/arm/boot/dts/dm816x.dtsi
+++ b/arch/arm/boot/dts/dm816x.dtsi
@@ -150,17 +150,27 @@
                };
                gpio1: gpio@48032000 {
-                        compatible = "ti,omap3-gpio";
+                        compatible = "ti,omap4-gpio";
                        ti,hwmods = "gpio1";
+                        ti,gpio-always-on;
                        reg = <0x48032000 0x1000>;
-                        interrupts = <97>;
+                        interrupts = <96>;
+                        gpio-controller;
+                        #gpio-cells = <2>;
+                        interrupt-controller;
+                        #interrupt-cells = <2>;
                };
                gpio2: gpio@4804c000 {
-                        compatible = "ti,omap3-gpio";
+                        compatible = "ti,omap4-gpio";
                        ti,hwmods = "gpio2";
+                        ti,gpio-always-on;
                        reg = <0x4804c000 0x1000>;
-                        interrupts = <99>;
+                        interrupts = <98>;
+                        gpio-controller;
+                        #gpio-cells = <2>;
+                        interrupt-controller;
+                        #interrupt-cells = <2>;
                };
                gpmc: gpmc@50000000 {
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 127608d79033..c4659a979c41 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1111,7 +1111,6 @@
                                              "wkupclk", "refclk",
                                              "div-clk", "phy-div";
                                #phy-cells = <0>;
-                                ti,hwmods = "pcie1-phy";
                        };
                        pcie2_phy: pciephy@4a095000 {
@@ -1130,7 +1129,6 @@
                                              "wkupclk", "refclk",
                                              "div-clk", "phy-div";
                                #phy-cells = <0>;
-                                ti,hwmods = "pcie2-phy";
                                status = "disabled";
                        };
                };
diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi
index f4f78c40b564..3fdc84fddb70 100644
--- a/arch/arm/boot/dts/omap3.dtsi
+++ b/arch/arm/boot/dts/omap3.dtsi
@@ -92,6 +92,8 @@
                        ti,hwmods = "aes";
                        reg = <0x480c5000 0x50>;
                        interrupts = <0>;
+                        dmas = <&sdma 65 &sdma 66>;
+                        dma-names = "tx", "rx";
                };
                prm: prm@48306000 {
@@ -550,6 +552,8 @@
                        ti,hwmods = "sham";
                        reg = <0x480c3000 0x64>;
                        interrupts = <49>;
+                        dmas = <&sdma 69>;
+                        dma-names = "rx";
                };
                smartreflex_core: smartreflex@480cb000 {
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index d771f687a13b..eccc78d3220b 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -411,6 +411,7 @@
                        "mac_clk_rx", "mac_clk_tx",
                        "clk_mac_ref", "clk_mac_refout",
                        "aclk_mac", "pclk_mac";
+                status = "disabled";
        };
        usb_host0_ehci: usb@ff500000 {
diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
index 9d8760956752..d9176e606173 100644
--- a/arch/arm/boot/dts/socfpga.dtsi
+++ b/arch/arm/boot/dts/socfpga.dtsi
@@ -660,7 +660,7 @@
                        #address-cells = <1>;
                        #size-cells = <0>;
                        reg = <0xfff01000 0x1000>;
-                        interrupts = <0 156 4>;
+                        interrupts = <0 155 4>;
                        num-cs = <4>;
                        clocks = <&spi_m_clk>;
                        status = "disabled";
diff --git a/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts b/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts
index ab7891c43231..75742f8f96f3 100644
--- a/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts
+++ b/arch/arm/boot/dts/sun4i-a10-olinuxino-lime.dts
@@ -56,6 +56,22 @@
        model = "Olimex A10-OLinuXino-LIME";
        compatible = "olimex,a10-olinuxino-lime", "allwinner,sun4i-a10";
+        cpus {
+                cpu0: cpu@0 {
+                        /*
+                         * The A10-Lime is known to be unstable
+                         * when running at 1008 MHz
+                         */
+                        operating-points = <
+                                /* kHz    uV */
+                                912000  1350000
+                                864000  1300000
+                                624000  1250000
+                                >;
+                        cooling-max-level = <2>;
+                };
+        };
        soc@01c00000 {
                emac: ethernet@01c0b000 {
                        pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
index 5c2925831f20..eebb7853e00b 100644
--- a/arch/arm/boot/dts/sun4i-a10.dtsi
+++ b/arch/arm/boot/dts/sun4i-a10.dtsi
@@ -75,7 +75,6 @@
                        clock-latency = <244144>; /* 8 32k periods */
                        operating-points = <
                                /* kHz    uV */
-                                1056000 1500000
                                1008000 1400000
                                912000  1350000
                                864000  1300000
@@ -83,7 +82,7 @@
                                >;
                        #cooling-cells = <2>;
                        cooling-min-level = <0>;
-                        cooling-max-level = <4>;
+                        cooling-max-level = <3>;
                };
        };
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index f8818f1edbbe..883cb4873688 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -47,7 +47,6 @@
                        clock-latency = <244144>; /* 8 32k periods */
                        operating-points = <
                                /* kHz    uV */
-                                1104000 1500000
                                1008000 1400000
                                912000  1350000
                                864000  1300000
@@ -57,7 +56,7 @@
                                >;
                        #cooling-cells = <2>;
                        cooling-min-level = <0>;
-                        cooling-max-level = <6>;
+                        cooling-max-level = <5>;
                };
        };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 3a8530b79f1c..fdd181792b4b 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -105,7 +105,6 @@
                        clock-latency = <244144>; /* 8 32k periods */
                        operating-points = <
                                /* kHz    uV */
-                                1008000 1450000
                                960000  1400000
                                912000  1400000
                                864000  1300000
@@ -116,7 +115,7 @@
                                >;
                        #cooling-cells = <2>;
                        cooling-min-level = <0>;
-                        cooling-max-level = <7>;
+                        cooling-max-level = <6>;
                };
                cpu@1 {
diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
index 71e5fc7cfb18..1d1800f71c5b 100644
--- a/arch/arm/crypto/aesbs-core.S_shipped
+++ b/arch/arm/crypto/aesbs-core.S_shipped
@@ -58,14 +58,18 @@
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 #ifdef __thumb__
 # define adrl adr
 #endif
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -74,8 +78,6 @@
 .code   32
 #endif
-.fpu    neon
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
        vld1.8  {q8}, [r0]                      @ initial tweak
        adr     r2, .Lxts_magic
+#ifndef XTS_CHAIN_TWEAK
        tst     r9, #0xf                        @ if not multiple of 16
        it      ne                              @ Thumb2 thing, sanity check in ARM
        subne   r9, #0x10                       @ subtract another 16 bytes
+#endif
        subs    r9, #0x80
        blo     .Lxts_dec_short
diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
index be068db960ee..a4d3856e7d24 100644
--- a/arch/arm/crypto/bsaes-armv7.pl
+++ b/arch/arm/crypto/bsaes-armv7.pl
@@ -701,14 +701,18 @@ $code.=<<___;
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__   7
+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_MAX_ARCH__ 7
 #endif
 #ifdef __thumb__
 # define adrl adr
 #endif
-#if __ARM_ARCH__>=7
+#if __ARM_MAX_ARCH__>=7
+.arch   armv7-a
+.fpu    neon
 .text
 .syntax unified         @ ARMv7-capable assembler is expected to handle this
 #ifdef __thumb2__
@@ -717,8 +721,6 @@ $code.=<<___;
 .code   32
 #endif
-.fpu    neon
 .type   _bsaes_decrypt8,%function
 .align  4
 _bsaes_decrypt8:
@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
        vld1.8  {@XMM[8]}, [r0]                 @ initial tweak
        adr     $magic, .Lxts_magic
+#ifndef XTS_CHAIN_TWEAK
        tst     $len, #0xf                      @ if not multiple of 16
        it      ne                              @ Thumb2 thing, sanity check in ARM
        subne   $len, #0x10                     @ subtract another 16 bytes
+#endif
        subs    $len, #0x80
        blo     .Lxts_dec_short
diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
index bf0fe99e8ca9..4cf48c3aca13 100644
--- a/arch/arm/include/asm/kvm_mmu.h
+++ b/arch/arm/include/asm/kvm_mmu.h
@@ -149,29 +149,28 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
        (__boundary - 1 < (end) - 1)? __boundary: (end);                \
 })
+#define kvm_pgd_index(addr)                     pgd_index(addr)
 static inline bool kvm_page_empty(void *ptr)
 {
        struct page *ptr_page = virt_to_page(ptr);
        return page_count(ptr_page) == 1;
 }
 #define kvm_pte_table_empty(kvm, ptep) kvm_page_empty(ptep)
 #define kvm_pmd_table_empty(kvm, pmdp) kvm_page_empty(pmdp)
 #define kvm_pud_table_empty(kvm, pudp) (0)
 #define KVM_PREALLOC_LEVEL      0
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
+static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
-        return 0;
+        return kvm->arch.pgd;
 }
-static inline void kvm_free_hwpgd(struct kvm *kvm) { }
+static inline unsigned int kvm_get_hwpgd_size(void)
-static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
-        return kvm->arch.pgd;
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
 }
 struct kvm;
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index e55408e96559..1d60bebea4b8 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -246,12 +246,9 @@ static int __get_cpu_architecture(void)
                if (cpu_arch)
                        cpu_arch += CPU_ARCH_ARMv3;
        } else if ((read_cpuid_id() & 0x000f0000) == 0x000f0000) {
-                unsigned int mmfr0;
                /* Revised CPUID format. Read the Memory Model Feature
                 * Register 0 and check for VMSAv7 or PMSAv7 */
-                asm("mrc        p15, 0, %0, c0, c1, 4"
+                unsigned int mmfr0 = read_cpuid_ext(CPUID_EXT_MMFR0);
-                    : "=r" (mmfr0));
                if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
                    (mmfr0 & 0x000000f0) >= 0x00000030)
                        cpu_arch = CPU_ARCH_ARMv7;
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 3e6859bc3e11..5656d79c5a44 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -290,7 +290,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
        phys_addr_t addr = start, end = start + size;
        phys_addr_t next;
-        pgd = pgdp + pgd_index(addr);
+        pgd = pgdp + kvm_pgd_index(addr);
        do {
                next = kvm_pgd_addr_end(addr, end);
                if (!pgd_none(*pgd))
@@ -355,7 +355,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
        phys_addr_t next;
        pgd_t *pgd;
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
        do {
                next = kvm_pgd_addr_end(addr, end);
                stage2_flush_puds(kvm, pgd, addr, next);
@@ -632,6 +632,20 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
                                     __phys_to_pfn(phys_addr), PAGE_HYP_DEVICE);
 }
+/* Free the HW pgd, one page at a time */
+static void kvm_free_hwpgd(void *hwpgd)
+{
+        free_pages_exact(hwpgd, kvm_get_hwpgd_size());
+}
+/* Allocate the HW PGD, making sure that each page gets its own refcount */
+static void *kvm_alloc_hwpgd(void)
+{
+        unsigned int size = kvm_get_hwpgd_size();
+        return alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO);
+}
 /**
 * kvm_alloc_stage2_pgd - allocate level-1 table for stage-2 translation.
 * @kvm:        The KVM struct pointer for the VM.
@@ -645,15 +659,31 @@ int create_hyp_io_mappings(void *from, void *to, phys_addr_t phys_addr)
 */
 int kvm_alloc_stage2_pgd(struct kvm *kvm)
 {
-        int ret;
        pgd_t *pgd;
+        void *hwpgd;
        if (kvm->arch.pgd != NULL) {
                kvm_err("kvm_arch already initialized?\n");
                return -EINVAL;
        }
+        hwpgd = kvm_alloc_hwpgd();
+        if (!hwpgd)
+                return -ENOMEM;
+        /* When the kernel uses more levels of page tables than the
+         * guest, we allocate a fake PGD and pre-populate it to point
+         * to the next-level page table, which will be the real
+         * initial page table pointed to by the VTTBR.
+         *
+         * When KVM_PREALLOC_LEVEL==2, we allocate a single page for
+         * the PMD and the kernel will use folded pud.
+         * When KVM_PREALLOC_LEVEL==1, we allocate 2 consecutive PUD
+         * pages.
+         */
        if (KVM_PREALLOC_LEVEL > 0) {
+                int i;
                /*
                 * Allocate fake pgd for the page table manipulation macros to
                 * work.  This is not used by the hardware and we have no
@@ -661,30 +691,32 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm)
                 */
                pgd = (pgd_t *)kmalloc(PTRS_PER_S2_PGD * sizeof(pgd_t),
                                       GFP_KERNEL | __GFP_ZERO);
+                if (!pgd) {
+                        kvm_free_hwpgd(hwpgd);
+                        return -ENOMEM;
+                }
+                /* Plug the HW PGD into the fake one. */
+                for (i = 0; i < PTRS_PER_S2_PGD; i++) {
+                        if (KVM_PREALLOC_LEVEL == 1)
+                                pgd_populate(NULL, pgd + i,
+                                             (pud_t *)hwpgd + i * PTRS_PER_PUD);
+                        else if (KVM_PREALLOC_LEVEL == 2)
+                                pud_populate(NULL, pud_offset(pgd, 0) + i,
+                                             (pmd_t *)hwpgd + i * PTRS_PER_PMD);
+                }
        } else {
                /*
                 * Allocate actual first-level Stage-2 page table used by the
                 * hardware for Stage-2 page table walks.
                 */
-                pgd = (pgd_t *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, S2_PGD_ORDER);
+                pgd = (pgd_t *)hwpgd;
        }
-        if (!pgd)
-                return -ENOMEM;
-        ret = kvm_prealloc_hwpgd(kvm, pgd);
-        if (ret)
-                goto out_err;
        kvm_clean_pgd(pgd);
        kvm->arch.pgd = pgd;
        return 0;
-out_err:
-        if (KVM_PREALLOC_LEVEL > 0)
-                kfree(pgd);
-        else
-                free_pages((unsigned long)pgd, S2_PGD_ORDER);
-        return ret;
 }
 /**
@@ -785,11 +817,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm)
                return;
        unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
-        kvm_free_hwpgd(kvm);
+        kvm_free_hwpgd(kvm_get_hwpgd(kvm));
        if (KVM_PREALLOC_LEVEL > 0)
                kfree(kvm->arch.pgd);
-        else
-                free_pages((unsigned long)kvm->arch.pgd, S2_PGD_ORDER);
        kvm->arch.pgd = NULL;
 }
@@ -799,7 +830,7 @@ static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
        pgd_t *pgd;
        pud_t *pud;
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
        if (WARN_ON(pgd_none(*pgd))) {
                if (!cache)
                        return NULL;
@@ -1089,7 +1120,7 @@ static void stage2_wp_range(struct kvm *kvm, phys_addr_t addr, phys_addr_t end)
        pgd_t *pgd;
        phys_addr_t next;
-        pgd = kvm->arch.pgd + pgd_index(addr);
+        pgd = kvm->arch.pgd + kvm_pgd_index(addr);
        do {
                /*
                 * Release kvm_mmu_lock periodically if the memory region is
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 2a2f4d56e4c8..25f1beea453e 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -720,6 +720,8 @@ static const char * __init omap_get_family(void)
                return kasprintf(GFP_KERNEL, "OMAP4");
        else if (soc_is_omap54xx())
                return kasprintf(GFP_KERNEL, "OMAP5");
+        else if (soc_is_am33xx() || soc_is_am335x())
+                return kasprintf(GFP_KERNEL, "AM33xx");
        else if (soc_is_am43xx())
                return kasprintf(GFP_KERNEL, "AM43xx");
        else if (soc_is_dra7xx())
diff --git a/arch/arm/mach-pxa/irq.c b/arch/arm/mach-pxa/irq.c
index 0eecd83c624e..89a7c06570d3 100644
--- a/arch/arm/mach-pxa/irq.c
+++ b/arch/arm/mach-pxa/irq.c
@@ -11,6 +11,7 @@
 *  it under the terms of the GNU General Public License version 2 as
 *  published by the Free Software Foundation.
 */
+#include <linux/bitops.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
@@ -40,7 +41,6 @@
 #define ICHP_VAL_IRQ            (1 << 31)
 #define ICHP_IRQ(i)             (((i) >> 16) & 0x7fff)
 #define IPR_VALID               (1 << 31)
-#define IRQ_BIT(n)              (((n) - PXA_IRQ(0)) & 0x1f)
 #define MAX_INTERNAL_IRQS       128
@@ -51,6 +51,7 @@
 static void __iomem *pxa_irq_base;
 static int pxa_internal_irq_nr;
 static bool cpu_has_ipr;
+static struct irq_domain *pxa_irq_domain;
 static inline void __iomem *irq_base(int i)
 {
@@ -66,18 +67,20 @@ static inline void __iomem *irq_base(int i)
 void pxa_mask_irq(struct irq_data *d)
 {
        void __iomem *base = irq_data_get_irq_chip_data(d);
+        irq_hw_number_t irq = irqd_to_hwirq(d);
        uint32_t icmr = __raw_readl(base + ICMR);
-        icmr &= ~(1 << IRQ_BIT(d->irq));
+        icmr &= ~BIT(irq & 0x1f);
        __raw_writel(icmr, base + ICMR);
 }
 void pxa_unmask_irq(struct irq_data *d)
 {
        void __iomem *base = irq_data_get_irq_chip_data(d);
+        irq_hw_number_t irq = irqd_to_hwirq(d);
        uint32_t icmr = __raw_readl(base + ICMR);
-        icmr |= 1 << IRQ_BIT(d->irq);
+        icmr |= BIT(irq & 0x1f);
        __raw_writel(icmr, base + ICMR);
 }
@@ -118,40 +121,63 @@ asmlinkage void __exception_irq_entry ichp_handle_irq(struct pt_regs *regs)
        } while (1);
 }
-void __init pxa_init_irq(int irq_nr, int (*fn)(struct irq_data *, unsigned int))
+static int pxa_irq_map(struct irq_domain *h, unsigned int virq,
+                       irq_hw_number_t hw)
 {
-        int irq, i, n;
+        void __iomem *base = irq_base(hw / 32);
-        BUG_ON(irq_nr > MAX_INTERNAL_IRQS);
+        /* initialize interrupt priority */
+        if (cpu_has_ipr)
+                __raw_writel(hw | IPR_VALID, pxa_irq_base + IPR(hw));
+        irq_set_chip_and_handler(virq, &pxa_internal_irq_chip,
+                                 handle_level_irq);
+        irq_set_chip_data(virq, base);
+        set_irq_flags(virq, IRQF_VALID);
+        return 0;
+}
+static struct irq_domain_ops pxa_irq_ops = {
+        .map    = pxa_irq_map,
+        .xlate  = irq_domain_xlate_onecell,
+};
+static __init void
+pxa_init_irq_common(struct device_node *node, int irq_nr,
+                    int (*fn)(struct irq_data *, unsigned int))
+{
+        int n;
        pxa_internal_irq_nr = irq_nr;
-        cpu_has_ipr = !cpu_is_pxa25x();
+        pxa_irq_domain = irq_domain_add_legacy(node, irq_nr,
-        pxa_irq_base = io_p2v(0x40d00000);
+                                               PXA_IRQ(0), 0,
+                                               &pxa_irq_ops, NULL);
+        if (!pxa_irq_domain)
+                panic("Unable to add PXA IRQ domain\n");
+        irq_set_default_host(pxa_irq_domain);
        for (n = 0; n < irq_nr; n += 32) {
                void __iomem *base = irq_base(n >> 5);
                __raw_writel(0, base + ICMR);   /* disable all IRQs */
                __raw_writel(0, base + ICLR);   /* all IRQs are IRQ, not FIQ */
-                for (i = n; (i < (n + 32)) && (i < irq_nr); i++) {
-                        /* initialize interrupt priority */
-                        if (cpu_has_ipr)
-                                __raw_writel(i | IPR_VALID, pxa_irq_base + IPR(i));
-                        irq = PXA_IRQ(i);
-                        irq_set_chip_and_handler(irq, &pxa_internal_irq_chip,
-                                                 handle_level_irq);
-                        irq_set_chip_data(irq, base);
-                        set_irq_flags(irq, IRQF_VALID);
-                }
        }
        /* only unmasked interrupts kick us out of idle */
        __raw_writel(1, irq_base(0) + ICCR);
        pxa_internal_irq_chip.irq_set_wake = fn;
 }
+void __init pxa_init_irq(int irq_nr, int (*fn)(struct irq_data *, unsigned int))
+{
+        BUG_ON(irq_nr > MAX_INTERNAL_IRQS);
+        pxa_irq_base = io_p2v(0x40d00000);
+        cpu_has_ipr = !cpu_is_pxa25x();
+        pxa_init_irq_common(NULL, irq_nr, fn);
+}
 #ifdef CONFIG_PM
 static unsigned long saved_icmr[MAX_INTERNAL_IRQS/32];
 static unsigned long saved_ipr[MAX_INTERNAL_IRQS];
@@ -203,30 +229,6 @@ struct syscore_ops pxa_irq_syscore_ops = {
 };
 #ifdef CONFIG_OF
-static struct irq_domain *pxa_irq_domain;
-static int pxa_irq_map(struct irq_domain *h, unsigned int virq,
-                       irq_hw_number_t hw)
-{
-        void __iomem *base = irq_base(hw / 32);
-        /* initialize interrupt priority */
-        if (cpu_has_ipr)
-                __raw_writel(hw | IPR_VALID, pxa_irq_base + IPR(hw));
-        irq_set_chip_and_handler(hw, &pxa_internal_irq_chip,
-                                 handle_level_irq);
-        irq_set_chip_data(hw, base);
-        set_irq_flags(hw, IRQF_VALID);
-        return 0;
-}
-static struct irq_domain_ops pxa_irq_ops = {
-        .map    = pxa_irq_map,
-        .xlate  = irq_domain_xlate_onecell,
-};
 static const struct of_device_id intc_ids[] __initconst = {
        { .compatible = "marvell,pxa-intc", },
        {}
@@ -236,7 +238,7 @@ void __init pxa_dt_irq_init(int (*fn)(struct irq_data *, unsigned int))
 {
        struct device_node *node;
        struct resource res;
-        int n, ret;
+        int ret;
        node = of_find_matching_node(NULL, intc_ids);
        if (!node) {
@@ -267,23 +269,6 @@ void __init pxa_dt_irq_init(int (*fn)(struct irq_data *, unsigned int))
                return;
        }
-        pxa_irq_domain = irq_domain_add_legacy(node, pxa_internal_irq_nr, 0, 0,
+        pxa_init_irq_common(node, pxa_internal_irq_nr, fn);
-                                               &pxa_irq_ops, NULL);
-        if (!pxa_irq_domain)
-                panic("Unable to add PXA IRQ domain\n");
-        irq_set_default_host(pxa_irq_domain);
-        for (n = 0; n < pxa_internal_irq_nr; n += 32) {
-                void __iomem *base = irq_base(n >> 5);
-                __raw_writel(0, base + ICMR);   /* disable all IRQs */
-                __raw_writel(0, base + ICLR);   /* all IRQs are IRQ, not FIQ */
-        }
-        /* only unmasked interrupts kick us out of idle */
-        __raw_writel(1, irq_base(0) + ICCR);
-        pxa_internal_irq_chip.irq_set_wake = fn;
 }
 #endif /* CONFIG_OF */
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index 205f9bf3821e..ac2ae5c71ab4 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -412,7 +412,7 @@ static struct fixed_voltage_config can_regulator_pdata = {
 };
 static struct platform_device can_regulator_device = {
-        .name   = "reg-fixed-volage",
+        .name   = "reg-fixed-voltage",
        .id     = 0,
        .dev    = {
                .platform_data  = &can_regulator_pdata,
diff --git a/arch/arm/mach-sunxi/Kconfig b/arch/arm/mach-sunxi/Kconfig
index a77604fbaf25..81502b90dd91 100644
--- a/arch/arm/mach-sunxi/Kconfig
+++ b/arch/arm/mach-sunxi/Kconfig
@@ -1,10 +1,12 @@
 menuconfig ARCH_SUNXI
        bool "Allwinner SoCs" if ARCH_MULTI_V7
        select ARCH_REQUIRE_GPIOLIB
+        select ARCH_HAS_RESET_CONTROLLER
        select CLKSRC_MMIO
        select GENERIC_IRQ_CHIP
        select PINCTRL
        select SUN4I_TIMER
+        select RESET_CONTROLLER
 if ARCH_SUNXI
@@ -20,10 +22,8 @@ config MACH_SUN5I
 config MACH_SUN6I
        bool "Allwinner A31 (sun6i) SoCs support"
        default ARCH_SUNXI
-        select ARCH_HAS_RESET_CONTROLLER
        select ARM_GIC
        select MFD_SUN6I_PRCM
-        select RESET_CONTROLLER
        select SUN5I_HSTIMER
 config MACH_SUN7I
@@ -37,16 +37,12 @@ config MACH_SUN7I
 config MACH_SUN8I
        bool "Allwinner A23 (sun8i) SoCs support"
        default ARCH_SUNXI
-        select ARCH_HAS_RESET_CONTROLLER
        select ARM_GIC
        select MFD_SUN6I_PRCM
-        select RESET_CONTROLLER
 config MACH_SUN9I
        bool "Allwinner (sun9i) SoCs support"
        default ARCH_SUNXI
-        select ARCH_HAS_RESET_CONTROLLER
        select ARM_GIC
-        select RESET_CONTROLLER
 endif
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index c6c7696b8db9..8f15f70622a6 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -1131,23 +1131,22 @@ static void __init l2c310_of_parse(const struct device_node *np,
        }
        ret = l2x0_cache_size_of_parse(np, aux_val, aux_mask, &assoc, SZ_512K);
-        if (ret)
+        if (!ret) {
-                return;
+                switch (assoc) {
+                case 16:
-        switch (assoc) {
+                        *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-        case 16:
+                        *aux_val |= L310_AUX_CTRL_ASSOCIATIVITY_16;
-                *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                *aux_val |= L310_AUX_CTRL_ASSOCIATIVITY_16;
+                        break;
-                *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                case 8:
-                break;
+                        *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-        case 8:
+                        *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
-                *aux_val &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                        break;
-                *aux_mask &= ~L2X0_AUX_CTRL_ASSOC_MASK;
+                default:
-                break;
+                        pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
-        default:
+                               assoc);
-                pr_err("L2C-310 OF cache associativity %d invalid, only 8 or 16 permitted\n",
+                        break;
-                       assoc);
+                }
-                break;
        }
        prefetch = l2x0_saved_regs.prefetch_ctrl;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 170a116d1b29..c27447653903 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -171,7 +171,7 @@ static int __dma_supported(struct device *dev, u64 mask, bool warn)
         */
        if (sizeof(mask) != sizeof(dma_addr_t) &&
            mask > (dma_addr_t)~0 &&
-            dma_to_pfn(dev, ~0) < max_pfn) {
+            dma_to_pfn(dev, ~0) < max_pfn - 1) {
                if (warn) {
                        dev_warn(dev, "Coherent DMA mask %#llx is larger than dma_addr_t allows\n",
                                 mask);
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index a982dc3190df..6333d9c17875 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -552,6 +552,7 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
        pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
                inf->name, fsr, addr);
+        show_pte(current->mm, addr);
        info.si_signo = inf->sig;
        info.si_errno = 0;
diff --git a/arch/arm/mm/pageattr.c b/arch/arm/mm/pageattr.c
index 004e35cdcfff..cf30daff8932 100644
--- a/arch/arm/mm/pageattr.c
+++ b/arch/arm/mm/pageattr.c
@@ -49,7 +49,10 @@ static int change_memory_common(unsigned long addr, int numpages,
                WARN_ON_ONCE(1);
        }
-        if (!is_module_address(start) || !is_module_address(end - 1))
+        if (start < MODULES_VADDR || start >= MODULES_END)
+                return -EINVAL;
+        if (end < MODULES_VADDR || start >= MODULES_END)
                return -EINVAL;
        data.set_mask = set_mask;
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index db10169a08de..8ca94d379bc3 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -799,6 +799,7 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
        struct device *dev = &pdev->dev;
        const struct of_device_id *match;
        const struct dmtimer_platform_data *pdata;
+        int ret;
        match = of_match_device(of_match_ptr(omap_timer_match), dev);
        pdata = match ? match->data : dev->platform_data;
@@ -860,7 +861,12 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
        }
        if (!timer->reserved) {
-                pm_runtime_get_sync(dev);
+                ret = pm_runtime_get_sync(dev);
+                if (ret < 0) {
+                        dev_err(dev, "%s: pm_runtime_get_sync failed!\n",
+                                __func__);
+                        goto err_get_sync;
+                }
                __omap_dm_timer_init_regs(timer);
                pm_runtime_put(dev);
        }
@@ -873,6 +879,11 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
        dev_dbg(dev, "Device Probed.\n");
        return 0;
+err_get_sync:
+        pm_runtime_put_noidle(dev);
+        pm_runtime_disable(dev);
+        return ret;
 }
 /**
@@ -899,6 +910,8 @@ static int omap_dm_timer_remove(struct platform_device *pdev)
                }
        spin_unlock_irqrestore(&dm_timer_lock, flags);
+        pm_runtime_disable(&pdev->dev);
        return ret;
 }
diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
index ea2b5666a16f..c9b89efe0f56 100644
--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
@@ -8,7 +8,7 @@
 */
        /* SoC fixed clocks */
-        soc_uartclk: refclk72738khz {
+        soc_uartclk: refclk7273800hz {
                compatible = "fixed-clock";
                #clock-cells = <0>;
                clock-frequency = <7273800>;
diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
index cb9593079f29..d8c25b7b18fb 100644
--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -246,14 +246,30 @@ static inline unsigned long __cmpxchg_mb(volatile void *ptr, unsigned long old,
        __ret; \
 })
-#define this_cpu_cmpxchg_1(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+#define _protect_cmpxchg_local(pcp, o, n)                       \
-#define this_cpu_cmpxchg_2(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+({                                                              \
-#define this_cpu_cmpxchg_4(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+        typeof(*raw_cpu_ptr(&(pcp))) __ret;                     \
-#define this_cpu_cmpxchg_8(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+        preempt_disable();                                      \
+        __ret = cmpxchg_local(raw_cpu_ptr(&(pcp)), o, n);       \
-#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2) \
+        preempt_enable();                                       \
-        cmpxchg_double_local(raw_cpu_ptr(&(ptr1)), raw_cpu_ptr(&(ptr2)), \
+        __ret;                                                  \
-                                o1, o2, n1, n2)
+})
+#define this_cpu_cmpxchg_1(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_2(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_4(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_8(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
+#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2)           \
+({                                                                      \
+        int __ret;                                                      \
+        preempt_disable();                                              \
+        __ret = cmpxchg_double_local(   raw_cpu_ptr(&(ptr1)),           \
+                                        raw_cpu_ptr(&(ptr2)),           \
+                                        o1, o2, n1, n2);                \
+        preempt_enable();                                               \
+        __ret;                                                          \
+})
 #define cmpxchg64(ptr,o,n)              cmpxchg((ptr),(o),(n))
 #define cmpxchg64_local(ptr,o,n)        cmpxchg_local((ptr),(o),(n))
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 94674eb7e7bb..54bb4ba97441 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -129,6 +129,9 @@
 * 40 bits wide (T0SZ = 24).  Systems with a PARange smaller than 40 bits are
 * not known to exist and will break with this configuration.
 *
+ * VTCR_EL2.PS is extracted from ID_AA64MMFR0_EL1.PARange at boot time
+ * (see hyp-init.S).
+ *
 * Note that when using 4K pages, we concatenate two first level page tables
 * together.
 *
@@ -138,7 +141,6 @@
 #ifdef CONFIG_ARM64_64K_PAGES
 /*
 * Stage2 translation configuration:
- * 40bits output (PS = 2)
 * 40bits input  (T0SZ = 24)
 * 64kB pages (TG0 = 1)
 * 2 level page tables (SL = 1)
@@ -150,7 +152,6 @@
 #else
 /*
 * Stage2 translation configuration:
- * 40bits output (PS = 2)
 * 40bits input  (T0SZ = 24)
 * 4kB pages (TG0 = 0)
 * 3 level page tables (SL = 1)
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 6458b5373142..bbfb600fa822 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -158,6 +158,8 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define PTRS_PER_S2_PGD         (1 << PTRS_PER_S2_PGD_SHIFT)
 #define S2_PGD_ORDER            get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
+#define kvm_pgd_index(addr)     (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
 /*
 * If we are concatenating first level stage-2 page tables, we would have less
 * than or equal to 16 pointers in the fake PGD, because that's what the
@@ -171,43 +173,6 @@ static inline bool kvm_s2pmd_readonly(pmd_t *pmd)
 #define KVM_PREALLOC_LEVEL      (0)
 #endif
-/**
- * kvm_prealloc_hwpgd - allocate inital table for VTTBR
- * @kvm:        The KVM struct pointer for the VM.
- * @pgd:        The kernel pseudo pgd
- *
- * When the kernel uses more levels of page tables than the guest, we allocate
- * a fake PGD and pre-populate it to point to the next-level page table, which
- * will be the real initial page table pointed to by the VTTBR.
- *
- * When KVM_PREALLOC_LEVEL==2, we allocate a single page for the PMD and
- * the kernel will use folded pud.  When KVM_PREALLOC_LEVEL==1, we
- * allocate 2 consecutive PUD pages.
- */
-static inline int kvm_prealloc_hwpgd(struct kvm *kvm, pgd_t *pgd)
-{
-        unsigned int i;
-        unsigned long hwpgd;
-        if (KVM_PREALLOC_LEVEL == 0)
-                return 0;
-        hwpgd = __get_free_pages(GFP_KERNEL | __GFP_ZERO, PTRS_PER_S2_PGD_SHIFT);
-        if (!hwpgd)
-                return -ENOMEM;
-        for (i = 0; i < PTRS_PER_S2_PGD; i++) {
-                if (KVM_PREALLOC_LEVEL == 1)
-                        pgd_populate(NULL, pgd + i,
-                                     (pud_t *)hwpgd + i * PTRS_PER_PUD);
-                else if (KVM_PREALLOC_LEVEL == 2)
-                        pud_populate(NULL, pud_offset(pgd, 0) + i,
-                                     (pmd_t *)hwpgd + i * PTRS_PER_PMD);
-        }
-        return 0;
-}
 static inline void *kvm_get_hwpgd(struct kvm *kvm)
 {
        pgd_t *pgd = kvm->arch.pgd;
@@ -224,12 +189,11 @@ static inline void *kvm_get_hwpgd(struct kvm *kvm)
        return pmd_offset(pud, 0);
 }
-static inline void kvm_free_hwpgd(struct kvm *kvm)
+static inline unsigned int kvm_get_hwpgd_size(void)
 {
-        if (KVM_PREALLOC_LEVEL > 0) {
+        if (KVM_PREALLOC_LEVEL > 0)
-                unsigned long hwpgd = (unsigned long)kvm_get_hwpgd(kvm);
+                return PTRS_PER_S2_PGD * PAGE_SIZE;
-                free_pages(hwpgd, PTRS_PER_S2_PGD_SHIFT);
+        return PTRS_PER_S2_PGD * sizeof(pgd_t);
-        }
 }
 static inline bool kvm_page_empty(void *ptr)
diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index a9eee33dfa62..101a42bde728 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
        unsigned int cpu = smp_processor_id();
+        /*
+         * init_mm.pgd does not contain any user mappings and it is always
+         * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
+         */
+        if (next == &init_mm) {
+                cpu_set_reserved_ttbr0();
+                return;
+        }
        if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
                check_and_switch_context(next, tsk);
 }
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 09da25bc596f..4fde8c1df97f 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -204,25 +204,47 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
        return ret;
 }
+#define _percpu_read(pcp)                                               \
+({                                                                      \
+        typeof(pcp) __retval;                                           \
+        preempt_disable();                                              \
+        __retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)),      \
+                                              sizeof(pcp));             \
+        preempt_enable();                                               \
+        __retval;                                                       \
+})
+#define _percpu_write(pcp, val)                                         \
+do {                                                                    \
+        preempt_disable();                                              \
+        __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val),       \
+                                sizeof(pcp));                           \
+        preempt_enable();                                               \
+} while(0)                                                              \
+#define _pcp_protect(operation, pcp, val)                       \
+({                                                              \
+        typeof(pcp) __retval;                                   \
+        preempt_disable();                                      \
+        __retval = (typeof(pcp))operation(raw_cpu_ptr(&(pcp)),  \
+                                          (val), sizeof(pcp));  \
+        preempt_enable();                                       \
+        __retval;                                               \
+})
 #define _percpu_add(pcp, val) \
-        __percpu_add(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+        _pcp_protect(__percpu_add, pcp, val)
-#define _percpu_add_return(pcp, val) (typeof(pcp)) (_percpu_add(pcp, val))
+#define _percpu_add_return(pcp, val) _percpu_add(pcp, val)
 #define _percpu_and(pcp, val) \
-        __percpu_and(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+        _pcp_protect(__percpu_and, pcp, val)
 #define _percpu_or(pcp, val) \
-        __percpu_or(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+        _pcp_protect(__percpu_or, pcp, val)
-#define _percpu_read(pcp) (typeof(pcp)) \
-        (__percpu_read(raw_cpu_ptr(&(pcp)), sizeof(pcp)))
-#define _percpu_write(pcp, val) \
-        __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp))
 #define _percpu_xchg(pcp, val) (typeof(pcp)) \
-        (__percpu_xchg(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp)))
+        _pcp_protect(__percpu_xchg, pcp, (unsigned long)(val))
 #define this_cpu_add_1(pcp, val) _percpu_add(pcp, val)
 #define this_cpu_add_2(pcp, val) _percpu_add(pcp, val)
diff --git a/arch/arm64/include/asm/proc-fns.h b/arch/arm64/include/asm/proc-fns.h
index 9a8fd84f8fb2..941c375616e2 100644
--- a/arch/arm64/include/asm/proc-fns.h
+++ b/arch/arm64/include/asm/proc-fns.h
@@ -39,7 +39,11 @@ extern u64 cpu_do_resume(phys_addr_t ptr, u64 idmap_ttbr);
 #include <asm/memory.h>
-#define cpu_switch_mm(pgd,mm) cpu_do_switch_mm(virt_to_phys(pgd),mm)
+#define cpu_switch_mm(pgd,mm)                           \
+do {                                                    \
+        BUG_ON(pgd == swapper_pg_dir);                  \
+        cpu_do_switch_mm(virt_to_phys(pgd),mm);         \
+} while (0)
 #define cpu_get_pgd()                                   \
 ({                                                      \
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index 2b8d70164428..ab21e0d58278 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -337,7 +337,11 @@ core_initcall(arm64_dmi_init);
 static void efi_set_pgd(struct mm_struct *mm)
 {
-        cpu_switch_mm(mm->pgd, mm);
+        if (mm == &init_mm)
+                cpu_set_reserved_ttbr0();
+        else
+                cpu_switch_mm(mm->pgd, mm);
        flush_tlb_all();
        if (icache_is_aivivt())
                __flush_icache_all();
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 58e0c2bdde04..ef7d112f5ce0 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -51,7 +51,7 @@ static int __init early_coherent_pool(char *p)
 }
 early_param("coherent_pool", early_coherent_pool);
-static void *__alloc_from_pool(size_t size, struct page **ret_page)
+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
 {
        unsigned long val;
        void *ptr = NULL;
@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
                *ret_page = phys_to_page(phys);
                ptr = (void *)val;
+                if (flags & __GFP_ZERO)
+                        memset(ptr, 0, size);
        }
        return ptr;
@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
                flags |= GFP_DMA;
        if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
                struct page *page;
+                void *addr;
                size = PAGE_ALIGN(size);
                page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
                        return NULL;
                *dma_handle = phys_to_dma(dev, page_to_phys(page));
-                return page_address(page);
+                addr = page_address(page);
+                if (flags & __GFP_ZERO)
+                        memset(addr, 0, size);
+                return addr;
        } else {
                return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
        }
@@ -146,7 +152,7 @@ static void *__dma_alloc(struct device *dev, size_t size,
        if (!coherent && !(flags & __GFP_WAIT)) {
                struct page *page = NULL;
-                void *addr = __alloc_from_pool(size, &page);
+                void *addr = __alloc_from_pool(size, &page, flags);
                if (addr)
                        *dma_handle = phys_to_dma(dev, page_to_phys(page));
diff --git a/arch/metag/include/asm/io.h b/arch/metag/include/asm/io.h
index 9359e5048442..d5779b0ec573 100644
--- a/arch/metag/include/asm/io.h
+++ b/arch/metag/include/asm/io.h
@@ -2,6 +2,7 @@
 #define _ASM_METAG_IO_H
 #include <linux/types.h>
+#include <asm/pgtable-bits.h>
 #define IO_SPACE_LIMIT  0
diff --git a/arch/metag/include/asm/pgtable-bits.h b/arch/metag/include/asm/pgtable-bits.h
new file mode 100644
index 000000000000..25ba6729f496
--- /dev/null
+++ b/arch/metag/include/asm/pgtable-bits.h
@@ -0,0 +1,104 @@
+/*
+ * Meta page table definitions.
+ */
+#ifndef _METAG_PGTABLE_BITS_H
+#define _METAG_PGTABLE_BITS_H
+#include <asm/metag_mem.h>
+/*
+ * Definitions for MMU descriptors
+ *
+ * These are the hardware bits in the MMCU pte entries.
+ * Derived from the Meta toolkit headers.
+ */
+#define _PAGE_PRESENT           MMCU_ENTRY_VAL_BIT
+#define _PAGE_WRITE             MMCU_ENTRY_WR_BIT
+#define _PAGE_PRIV              MMCU_ENTRY_PRIV_BIT
+/* Write combine bit - this can cause writes to occur out of order */
+#define _PAGE_WR_COMBINE        MMCU_ENTRY_WRC_BIT
+/* Sys coherent bit - this bit is never used by Linux */
+#define _PAGE_SYS_COHERENT      MMCU_ENTRY_SYS_BIT
+#define _PAGE_ALWAYS_ZERO_1     0x020
+#define _PAGE_CACHE_CTRL0       0x040
+#define _PAGE_CACHE_CTRL1       0x080
+#define _PAGE_ALWAYS_ZERO_2     0x100
+#define _PAGE_ALWAYS_ZERO_3     0x200
+#define _PAGE_ALWAYS_ZERO_4     0x400
+#define _PAGE_ALWAYS_ZERO_5     0x800
+/* These are software bits that we stuff into the gaps in the hardware
+ * pte entries that are not used.  Note, these DO get stored in the actual
+ * hardware, but the hardware just does not use them.
+ */
+#define _PAGE_ACCESSED          _PAGE_ALWAYS_ZERO_1
+#define _PAGE_DIRTY             _PAGE_ALWAYS_ZERO_2
+/* Pages owned, and protected by, the kernel. */
+#define _PAGE_KERNEL            _PAGE_PRIV
+/* No cacheing of this page */
+#define _PAGE_CACHE_WIN0        (MMCU_CWIN_UNCACHED << MMCU_ENTRY_CWIN_S)
+/* burst cacheing - good for data streaming */
+#define _PAGE_CACHE_WIN1        (MMCU_CWIN_BURST << MMCU_ENTRY_CWIN_S)
+/* One cache way per thread */
+#define _PAGE_CACHE_WIN2        (MMCU_CWIN_C1SET << MMCU_ENTRY_CWIN_S)
+/* Full on cacheing */
+#define _PAGE_CACHE_WIN3        (MMCU_CWIN_CACHED << MMCU_ENTRY_CWIN_S)
+#define _PAGE_CACHEABLE         (_PAGE_CACHE_WIN3 | _PAGE_WR_COMBINE)
+/* which bits are used for cache control ... */
+#define _PAGE_CACHE_MASK        (_PAGE_CACHE_CTRL0 | _PAGE_CACHE_CTRL1 | \
+                                 _PAGE_WR_COMBINE)
+/* This is a mask of the bits that pte_modify is allowed to change. */
+#define _PAGE_CHG_MASK          (PAGE_MASK)
+#define _PAGE_SZ_SHIFT          1
+#define _PAGE_SZ_4K             (0x0)
+#define _PAGE_SZ_8K             (0x1 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_16K            (0x2 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_32K            (0x3 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_64K            (0x4 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_128K           (0x5 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_256K           (0x6 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_512K           (0x7 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_1M             (0x8 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_2M             (0x9 << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_4M             (0xa << _PAGE_SZ_SHIFT)
+#define _PAGE_SZ_MASK           (0xf << _PAGE_SZ_SHIFT)
+#if defined(CONFIG_PAGE_SIZE_4K)
+#define _PAGE_SZ                (_PAGE_SZ_4K)
+#elif defined(CONFIG_PAGE_SIZE_8K)
+#define _PAGE_SZ                (_PAGE_SZ_8K)
+#elif defined(CONFIG_PAGE_SIZE_16K)
+#define _PAGE_SZ                (_PAGE_SZ_16K)
+#endif
+#define _PAGE_TABLE             (_PAGE_SZ | _PAGE_PRESENT)
+#if defined(CONFIG_HUGETLB_PAGE_SIZE_8K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_8K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_16K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_16K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_32K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_32K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_64K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_64K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_128K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_128K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_256K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_256K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_512K)
+# define _PAGE_SZHUGE           (_PAGE_SZ_512K)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_1M)
+# define _PAGE_SZHUGE           (_PAGE_SZ_1M)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_2M)
+# define _PAGE_SZHUGE           (_PAGE_SZ_2M)
+#elif defined(CONFIG_HUGETLB_PAGE_SIZE_4M)
+# define _PAGE_SZHUGE           (_PAGE_SZ_4M)
+#endif
+#endif /* _METAG_PGTABLE_BITS_H */
diff --git a/arch/metag/include/asm/pgtable.h b/arch/metag/include/asm/pgtable.h
index d0604c0a8702..ffa3a3a2ecad 100644
--- a/arch/metag/include/asm/pgtable.h
+++ b/arch/metag/include/asm/pgtable.h
@@ -5,6 +5,7 @@
 #ifndef _METAG_PGTABLE_H
 #define _METAG_PGTABLE_H
+#include <asm/pgtable-bits.h>
 #include <asm-generic/pgtable-nopmd.h>
 /* Invalid regions on Meta: 0x00000000-0x001FFFFF and 0xFFFF0000-0xFFFFFFFF */
@@ -21,100 +22,6 @@
 #endif
 /*
- * Definitions for MMU descriptors
- *
- * These are the hardware bits in the MMCU pte entries.
- * Derived from the Meta toolkit headers.
- */
-#define _PAGE_PRESENT           MMCU_ENTRY_VAL_BIT
-#define _PAGE_WRITE             MMCU_ENTRY_WR_BIT
-#define _PAGE_PRIV              MMCU_ENTRY_PRIV_BIT
-/* Write combine bit - this can cause writes to occur out of order */
-#define _PAGE_WR_COMBINE        MMCU_ENTRY_WRC_BIT
-/* Sys coherent bit - this bit is never used by Linux */
-#define _PAGE_SYS_COHERENT      MMCU_ENTRY_SYS_BIT
-#define _PAGE_ALWAYS_ZERO_1     0x020
-#define _PAGE_CACHE_CTRL0       0x040
-#define _PAGE_CACHE_CTRL1       0x080
-#define _PAGE_ALWAYS_ZERO_2     0x100
-#define _PAGE_ALWAYS_ZERO_3     0x200
-#define _PAGE_ALWAYS_ZERO_4     0x400
-#define _PAGE_ALWAYS_ZERO_5     0x800
-/* These are software bits that we stuff into the gaps in the hardware
- * pte entries that are not used.  Note, these DO get stored in the actual
- * hardware, but the hardware just does not use them.
- */
-#define _PAGE_ACCESSED          _PAGE_ALWAYS_ZERO_1
-#define _PAGE_DIRTY             _PAGE_ALWAYS_ZERO_2
-/* Pages owned, and protected by, the kernel. */
-#define _PAGE_KERNEL            _PAGE_PRIV
-/* No cacheing of this page */
-#define _PAGE_CACHE_WIN0        (MMCU_CWIN_UNCACHED << MMCU_ENTRY_CWIN_S)
-/* burst cacheing - good for data streaming */
-#define _PAGE_CACHE_WIN1        (MMCU_CWIN_BURST << MMCU_ENTRY_CWIN_S)
-/* One cache way per thread */
-#define _PAGE_CACHE_WIN2        (MMCU_CWIN_C1SET << MMCU_ENTRY_CWIN_S)
-/* Full on cacheing */
-#define _PAGE_CACHE_WIN3        (MMCU_CWIN_CACHED << MMCU_ENTRY_CWIN_S)
-#define _PAGE_CACHEABLE         (_PAGE_CACHE_WIN3 | _PAGE_WR_COMBINE)
-/* which bits are used for cache control ... */
-#define _PAGE_CACHE_MASK        (_PAGE_CACHE_CTRL0 | _PAGE_CACHE_CTRL1 | \
-                                 _PAGE_WR_COMBINE)
-/* This is a mask of the bits that pte_modify is allowed to change. */
-#define _PAGE_CHG_MASK          (PAGE_MASK)
-#define _PAGE_SZ_SHIFT          1
-#define _PAGE_SZ_4K             (0x0)
-#define _PAGE_SZ_8K             (0x1 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_16K            (0x2 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_32K            (0x3 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_64K            (0x4 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_128K           (0x5 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_256K           (0x6 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_512K           (0x7 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_1M             (0x8 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_2M             (0x9 << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_4M             (0xa << _PAGE_SZ_SHIFT)
-#define _PAGE_SZ_MASK           (0xf << _PAGE_SZ_SHIFT)
-#if defined(CONFIG_PAGE_SIZE_4K)
-#define _PAGE_SZ                (_PAGE_SZ_4K)
-#elif defined(CONFIG_PAGE_SIZE_8K)
-#define _PAGE_SZ                (_PAGE_SZ_8K)
-#elif defined(CONFIG_PAGE_SIZE_16K)
-#define _PAGE_SZ                (_PAGE_SZ_16K)
-#endif
-#define _PAGE_TABLE             (_PAGE_SZ | _PAGE_PRESENT)
-#if defined(CONFIG_HUGETLB_PAGE_SIZE_8K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_8K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_16K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_16K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_32K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_32K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_64K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_64K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_128K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_128K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_256K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_256K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_512K)
-# define _PAGE_SZHUGE           (_PAGE_SZ_512K)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_1M)
-# define _PAGE_SZHUGE           (_PAGE_SZ_1M)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_2M)
-# define _PAGE_SZHUGE           (_PAGE_SZ_2M)
-#elif defined(CONFIG_HUGETLB_PAGE_SIZE_4M)
-# define _PAGE_SZHUGE           (_PAGE_SZ_4M)
-#endif
-/*
 * The Linux memory management assumes a three-level page table setup. On
 * Meta, we use that, but "fold" the mid level into the top-level page
 * table.
diff --git a/arch/nios2/include/uapi/asm/Kbuild b/arch/nios2/include/uapi/asm/Kbuild
index 376131194cc3..e0bb972a50d7 100644
--- a/arch/nios2/include/uapi/asm/Kbuild
+++ b/arch/nios2/include/uapi/asm/Kbuild
@@ -1,6 +1,5 @@
 include include/uapi/asm-generic/Kbuild.asm
 header-y += elf.h
-header-y += ucontext.h
 generic-y += ucontext.h
diff --git a/arch/nios2/mm/fault.c b/arch/nios2/mm/fault.c
index 0d231adfe576..0c9b6afe69e9 100644
--- a/arch/nios2/mm/fault.c
+++ b/arch/nios2/mm/fault.c
@@ -126,7 +126,6 @@ good_area:
                break;
        }
-survive:
        /*
         * If for any reason at all we couldn't handle the fault,
         * make sure we exit gracefully rather than endlessly redo
@@ -220,11 +219,6 @@ no_context:
 */
 out_of_memory:
        up_read(&mm->mmap_sem);
-        if (is_global_init(tsk)) {
-                yield();
-                down_read(&mm->mmap_sem);
-                goto survive;
-        }
        if (!user_mode(regs))
                goto no_context;
        pagefault_out_of_memory();
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index f213f5b4c423..d17437238a2c 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -26,7 +26,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
        if (likely(pgd != NULL)) {
                memset(pgd, 0, PAGE_SIZE<<PGD_ALLOC_ORDER);
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
                actual_pgd += PTRS_PER_PGD;
                /* Populate first pmd with allocated memory.  We mark it
                 * with PxD_FLAG_ATTACHED as a signal to the system that this
@@ -45,7 +45,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
        pgd -= PTRS_PER_PGD;
 #endif
        free_pages((unsigned long)pgd, PGD_ALLOC_ORDER);
@@ -72,12 +72,15 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
-#ifdef CONFIG_64BIT
        if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
-                /* This is the permanent pmd attached to the pgd;
+                /*
-                 * cannot free it */
+                 * This is the permanent pmd attached to the pgd;
+                 * cannot free it.
+                 * Increment the counter to compensate for the decrement
+                 * done by generic mm code.
+                 */
+                mm_inc_nr_pmds(mm);
                return;
-#endif
        free_pages((unsigned long)pmd, PMD_ORDER);
 }
@@ -99,7 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 static inline void
 pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd, pte_t *pte)
 {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
        /* preserve the gateway marker if this is the beginning of
         * the permanent pmd */
        if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 5a8997d63899..8eefb12d1d33 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -55,8 +55,8 @@
 #define ENTRY_COMP(_name_) .word sys_##_name_
 #endif
-        ENTRY_SAME(restart_syscall)     /* 0 */
+90:     ENTRY_SAME(restart_syscall)     /* 0 */
-        ENTRY_SAME(exit)
+91:     ENTRY_SAME(exit)
        ENTRY_SAME(fork_wrapper)
        ENTRY_SAME(read)
        ENTRY_SAME(write)
@@ -439,7 +439,10 @@
        ENTRY_SAME(bpf)
        ENTRY_COMP(execveat)
-        /* Nothing yet */
+.ifne (. - 90b) - (__NR_Linux_syscalls * (91b - 90b))
+.error "size of syscall table does not fit value of __NR_Linux_syscalls"
+.endif
 #undef ENTRY_SAME
 #undef ENTRY_DIFF
diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
index 03cd858a401c..4cbe23af400a 100644
--- a/arch/powerpc/include/asm/ppc-opcode.h
+++ b/arch/powerpc/include/asm/ppc-opcode.h
@@ -153,6 +153,7 @@
 #define PPC_INST_MFSPR_PVR_MASK         0xfc1fffff
 #define PPC_INST_MFTMR                  0x7c0002dc
 #define PPC_INST_MSGSND                 0x7c00019c
+#define PPC_INST_MSGCLR                 0x7c0001dc
 #define PPC_INST_MSGSNDP                0x7c00011c
 #define PPC_INST_MTTMR                  0x7c0003dc
 #define PPC_INST_NOP                    0x60000000
@@ -309,6 +310,8 @@
                                        ___PPC_RB(b) | __PPC_EH(eh))
 #define PPC_MSGSND(b)           stringify_in_c(.long PPC_INST_MSGSND | \
                                        ___PPC_RB(b))
+#define PPC_MSGCLR(b)           stringify_in_c(.long PPC_INST_MSGCLR | \
+                                        ___PPC_RB(b))
 #define PPC_MSGSNDP(b)          stringify_in_c(.long PPC_INST_MSGSNDP | \
                                        ___PPC_RB(b))
 #define PPC_POPCNTB(a, s)       stringify_in_c(.long PPC_INST_POPCNTB | \
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 1c874fb533bb..af56b5c6c81a 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -608,13 +608,16 @@
 #define   SRR1_ISI_N_OR_G       0x10000000 /* ISI: Access is no-exec or G */
 #define   SRR1_ISI_PROT         0x08000000 /* ISI: Other protection fault */
 #define   SRR1_WAKEMASK         0x00380000 /* reason for wakeup */
+#define   SRR1_WAKEMASK_P8      0x003c0000 /* reason for wakeup on POWER8 */
 #define   SRR1_WAKESYSERR       0x00300000 /* System error */
 #define   SRR1_WAKEEE           0x00200000 /* External interrupt */
 #define   SRR1_WAKEMT           0x00280000 /* mtctrl */
 #define   SRR1_WAKEHMI          0x00280000 /* Hypervisor maintenance */
 #define   SRR1_WAKEDEC          0x00180000 /* Decrementer interrupt */
+#define   SRR1_WAKEDBELL        0x00140000 /* Privileged doorbell on P8 */
 #define   SRR1_WAKETHERM        0x00100000 /* Thermal management interrupt */
 #define   SRR1_WAKERESET        0x00100000 /* System reset */
+#define   SRR1_WAKEHDBELL       0x000c0000 /* Hypervisor doorbell on P8 */
 #define   SRR1_WAKESTATE        0x00030000 /* Powersave exit mask [46:47] */
 #define   SRR1_WS_DEEPEST       0x00030000 /* Some resources not maintained,
                                          * may not be recoverable */
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index f337666768a7..f83046878336 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -437,6 +437,26 @@ static struct cpu_spec __initdata cpu_specs[] = {
                .machine_check_early    = __machine_check_early_realmode_p8,
                .platform               = "power8",
        },
+        {       /* Power8NVL */
+                .pvr_mask               = 0xffff0000,
+                .pvr_value              = 0x004c0000,
+                .cpu_name               = "POWER8NVL (raw)",
+                .cpu_features           = CPU_FTRS_POWER8,
+                .cpu_user_features      = COMMON_USER_POWER8,
+                .cpu_user_features2     = COMMON_USER2_POWER8,
+                .mmu_features           = MMU_FTRS_POWER8,
+                .icache_bsize           = 128,
+                .dcache_bsize           = 128,
+                .num_pmcs               = 6,
+                .pmc_type               = PPC_PMC_IBM,
+                .oprofile_cpu_type      = "ppc64/power8",
+                .oprofile_type          = PPC_OPROFILE_INVALID,
+                .cpu_setup              = __setup_cpu_power8,
+                .cpu_restore            = __restore_cpu_power8,
+                .flush_tlb              = __flush_tlb_power8,
+                .machine_check_early    = __machine_check_early_realmode_p8,
+                .platform               = "power8",
+        },
        {       /* Power8 DD1: Does not support doorbell IPIs */
                .pvr_mask               = 0xffffff00,
                .pvr_value              = 0x004d0100,
diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
index f4217819cc31..2128f3a96c32 100644
--- a/arch/powerpc/kernel/dbell.c
+++ b/arch/powerpc/kernel/dbell.c
@@ -17,6 +17,7 @@
 #include <asm/dbell.h>
 #include <asm/irq_regs.h>
+#include <asm/kvm_ppc.h>
 #ifdef CONFIG_SMP
 void doorbell_setup_this_cpu(void)
@@ -41,6 +42,7 @@ void doorbell_exception(struct pt_regs *regs)
        may_hard_irq_enable();
+        kvmppc_set_host_ipi(smp_processor_id(), 0);
        __this_cpu_inc(irq_stat.doorbell_irqs);
        smp_ipi_demux();
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index c2df8150bd7a..9519e6bdc6d7 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1408,7 +1408,7 @@ machine_check_handle_early:
        bne     9f                      /* continue in V mode if we are. */
 5:
-#ifdef CONFIG_KVM_BOOK3S_64_HV
+#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
        /*
         * We are coming from kernel context. Check if we are coming from
         * guest. if yes, then we can continue. We will fall through
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index de4018a1bc4b..de747563d29d 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -636,7 +636,7 @@ static int kvmppc_get_yield_count(struct kvm_vcpu *vcpu)
        spin_lock(&vcpu->arch.vpa_update_lock);
        lppaca = (struct lppaca *)vcpu->arch.vpa.pinned_addr;
        if (lppaca)
-                yield_count = lppaca->yield_count;
+                yield_count = be32_to_cpu(lppaca->yield_count);
        spin_unlock(&vcpu->arch.vpa_update_lock);
        return yield_count;
 }
@@ -942,20 +942,20 @@ static int kvm_arch_vcpu_ioctl_set_sregs_hv(struct kvm_vcpu *vcpu,
 static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
                bool preserve_top32)
 {
+        struct kvm *kvm = vcpu->kvm;
        struct kvmppc_vcore *vc = vcpu->arch.vcore;
        u64 mask;
+        mutex_lock(&kvm->lock);
        spin_lock(&vc->lock);
        /*
         * If ILE (interrupt little-endian) has changed, update the
         * MSR_LE bit in the intr_msr for each vcpu in this vcore.
         */
        if ((new_lpcr & LPCR_ILE) != (vc->lpcr & LPCR_ILE)) {
-                struct kvm *kvm = vcpu->kvm;
                struct kvm_vcpu *vcpu;
                int i;
-                mutex_lock(&kvm->lock);
                kvm_for_each_vcpu(i, vcpu, kvm) {
                        if (vcpu->arch.vcore != vc)
                                continue;
@@ -964,7 +964,6 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
                        else
                                vcpu->arch.intr_msr &= ~MSR_LE;
                }
-                mutex_unlock(&kvm->lock);
        }
        /*
@@ -981,6 +980,7 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr,
                mask &= 0xFFFFFFFF;
        vc->lpcr = (vc->lpcr & ~mask) | (new_lpcr & mask);
        spin_unlock(&vc->lock);
+        mutex_unlock(&kvm->lock);
 }
 static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index bb94e6f20c81..6cbf1630cb70 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1005,6 +1005,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
        /* Save HEIR (HV emulation assist reg) in emul_inst
           if this is an HEI (HV emulation interrupt, e40) */
        li      r3,KVM_INST_FETCH_FAILED
+        stw     r3,VCPU_LAST_INST(r9)
        cmpwi   r12,BOOK3S_INTERRUPT_H_EMUL_ASSIST
        bne     11f
        mfspr   r3,SPRN_HEIR
diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index fc34025ef822..38a45088f633 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c
@@ -33,6 +33,8 @@
 #include <asm/runlatch.h>
 #include <asm/code-patching.h>
 #include <asm/dbell.h>
+#include <asm/kvm_ppc.h>
+#include <asm/ppc-opcode.h>
 #include "powernv.h"
@@ -149,7 +151,7 @@ static int pnv_smp_cpu_disable(void)
 static void pnv_smp_cpu_kill_self(void)
 {
        unsigned int cpu;
-        unsigned long srr1;
+        unsigned long srr1, wmask;
        u32 idle_states;
        /* Standard hot unplug procedure */
@@ -161,6 +163,10 @@ static void pnv_smp_cpu_kill_self(void)
        generic_set_cpu_dead(cpu);
        smp_wmb();
+        wmask = SRR1_WAKEMASK;
+        if (cpu_has_feature(CPU_FTR_ARCH_207S))
+                wmask = SRR1_WAKEMASK_P8;
        idle_states = pnv_get_supported_cpuidle_states();
        /* We don't want to take decrementer interrupts while we are offline,
         * so clear LPCR:PECE1. We keep PECE2 enabled.
@@ -191,10 +197,14 @@ static void pnv_smp_cpu_kill_self(void)
                 * having finished executing in a KVM guest, then srr1
                 * contains 0.
                 */
-                if ((srr1 & SRR1_WAKEMASK) == SRR1_WAKEEE) {
+                if ((srr1 & wmask) == SRR1_WAKEEE) {
                        icp_native_flush_interrupt();
                        local_paca->irq_happened &= PACA_IRQ_HARD_DIS;
                        smp_mb();
+                } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
+                        unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
+                        asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
+                        kvmppc_set_host_ipi(cpu, 0);
                }
                if (cpu_core_split_required())
diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
index 90cf3dcbd9f2..8f35d525cede 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
@@ -25,10 +25,10 @@
 static struct kobject *mobility_kobj;
 struct update_props_workarea {
-        u32 phandle;
+        __be32 phandle;
-        u32 state;
+        __be32 state;
-        u64 reserved;
+        __be64 reserved;
-        u32 nprops;
+        __be32 nprops;
 } __packed;
 #define NODE_ACTION_MASK        0xff000000
@@ -54,11 +54,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
        return rc;
 }
-static int delete_dt_node(u32 phandle)
+static int delete_dt_node(__be32 phandle)
 {
        struct device_node *dn;
-        dn = of_find_node_by_phandle(phandle);
+        dn = of_find_node_by_phandle(be32_to_cpu(phandle));
        if (!dn)
                return -ENOENT;
@@ -127,7 +127,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
        return 0;
 }
-static int update_dt_node(u32 phandle, s32 scope)
+static int update_dt_node(__be32 phandle, s32 scope)
 {
        struct update_props_workarea *upwa;
        struct device_node *dn;
@@ -136,6 +136,7 @@ static int update_dt_node(u32 phandle, s32 scope)
        char *prop_data;
        char *rtas_buf;
        int update_properties_token;
+        u32 nprops;
        u32 vd;
        update_properties_token = rtas_token("ibm,update-properties");
@@ -146,7 +147,7 @@ static int update_dt_node(u32 phandle, s32 scope)
        if (!rtas_buf)
                return -ENOMEM;
-        dn = of_find_node_by_phandle(phandle);
+        dn = of_find_node_by_phandle(be32_to_cpu(phandle));
        if (!dn) {
                kfree(rtas_buf);
                return -ENOENT;
@@ -162,6 +163,7 @@ static int update_dt_node(u32 phandle, s32 scope)
                        break;
                prop_data = rtas_buf + sizeof(*upwa);
+                nprops = be32_to_cpu(upwa->nprops);
                /* On the first call to ibm,update-properties for a node the
                 * the first property value descriptor contains an empty
@@ -170,17 +172,17 @@ static int update_dt_node(u32 phandle, s32 scope)
                 */
                if (*prop_data == 0) {
                        prop_data++;
-                        vd = *(u32 *)prop_data;
+                        vd = be32_to_cpu(*(__be32 *)prop_data);
                        prop_data += vd + sizeof(vd);
-                        upwa->nprops--;
+                        nprops--;
                }
-                for (i = 0; i < upwa->nprops; i++) {
+                for (i = 0; i < nprops; i++) {
                        char *prop_name;
                        prop_name = prop_data;
                        prop_data += strlen(prop_name) + 1;
-                        vd = *(u32 *)prop_data;
+                        vd = be32_to_cpu(*(__be32 *)prop_data);
                        prop_data += sizeof(vd);
                        switch (vd) {
@@ -212,13 +214,13 @@ static int update_dt_node(u32 phandle, s32 scope)
        return 0;
 }
-static int add_dt_node(u32 parent_phandle, u32 drc_index)
+static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
 {
        struct device_node *dn;
        struct device_node *parent_dn;
        int rc;
-        parent_dn = of_find_node_by_phandle(parent_phandle);
+        parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
        if (!parent_dn)
                return -ENOENT;
@@ -237,7 +239,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
 int pseries_devicetree_update(s32 scope)
 {
        char *rtas_buf;
-        u32 *data;
+        __be32 *data;
        int update_nodes_token;
        int rc;
@@ -254,17 +256,17 @@ int pseries_devicetree_update(s32 scope)
                if (rc && rc != 1)
                        break;
-                data = (u32 *)rtas_buf + 4;
+                data = (__be32 *)rtas_buf + 4;
-                while (*data & NODE_ACTION_MASK) {
+                while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
                        int i;
-                        u32 action = *data & NODE_ACTION_MASK;
+                        u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
-                        int node_count = *data & NODE_COUNT_MASK;
+                        u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
                        data++;
                        for (i = 0; i < node_count; i++) {
-                                u32 phandle = *data++;
+                                __be32 phandle = *data++;
-                                u32 drc_index;
+                                __be32 drc_index;
                                switch (action) {
                                case DELETE_DT_NODE:
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index c9df40b5c0ac..c9c875d9ed31 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -211,7 +211,7 @@ do {								\
 extern unsigned long mmap_rnd_mask;
-#define STACK_RND_MASK  (mmap_rnd_mask)
+#define STACK_RND_MASK  (test_thread_flag(TIF_31BIT) ? 0x7ff : mmap_rnd_mask)
 #define ARCH_DLINFO                                                         \
 do {                                                                        \
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 82c19899574f..6c79f1b44fe7 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -57,6 +57,44 @@
 unsigned long ftrace_plt;
+static inline void ftrace_generate_orig_insn(struct ftrace_insn *insn)
+{
+#ifdef CC_USING_HOTPATCH
+        /* brcl 0,0 */
+        insn->opc = 0xc004;
+        insn->disp = 0;
+#else
+        /* stg r14,8(r15) */
+        insn->opc = 0xe3e0;
+        insn->disp = 0xf0080024;
+#endif
+}
+static inline int is_kprobe_on_ftrace(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_KPROBES
+        if (insn->opc == BREAKPOINT_INSTRUCTION)
+                return 1;
+#endif
+        return 0;
+}
+static inline void ftrace_generate_kprobe_nop_insn(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_KPROBES
+        insn->opc = BREAKPOINT_INSTRUCTION;
+        insn->disp = KPROBE_ON_FTRACE_NOP;
+#endif
+}
+static inline void ftrace_generate_kprobe_call_insn(struct ftrace_insn *insn)
+{
+#ifdef CONFIG_KPROBES
+        insn->opc = BREAKPOINT_INSTRUCTION;
+        insn->disp = KPROBE_ON_FTRACE_CALL;
+#endif
+}
 int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
                       unsigned long addr)
 {
@@ -72,16 +110,9 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
                return -EFAULT;
        if (addr == MCOUNT_ADDR) {
                /* Initial code replacement */
-#ifdef CC_USING_HOTPATCH
+                ftrace_generate_orig_insn(&orig);
-                /* We expect to see brcl 0,0 */
-                ftrace_generate_nop_insn(&orig);
-#else
-                /* We expect to see stg r14,8(r15) */
-                orig.opc = 0xe3e0;
-                orig.disp = 0xf0080024;
-#endif
                ftrace_generate_nop_insn(&new);
-        } else if (old.opc == BREAKPOINT_INSTRUCTION) {
+        } else if (is_kprobe_on_ftrace(&old)) {
                /*
                 * If we find a breakpoint instruction, a kprobe has been
                 * placed at the beginning of the function. We write the
@@ -89,9 +120,8 @@ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
                 * bytes of the original instruction so that the kprobes
                 * handler can execute a nop, if it reaches this breakpoint.
                 */
-                new.opc = orig.opc = BREAKPOINT_INSTRUCTION;
+                ftrace_generate_kprobe_call_insn(&orig);
-                orig.disp = KPROBE_ON_FTRACE_CALL;
+                ftrace_generate_kprobe_nop_insn(&new);
-                new.disp = KPROBE_ON_FTRACE_NOP;
        } else {
                /* Replace ftrace call with a nop. */
                ftrace_generate_call_insn(&orig, rec->ip);
@@ -111,7 +141,7 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
        if (probe_kernel_read(&old, (void *) rec->ip, sizeof(old)))
                return -EFAULT;
-        if (old.opc == BREAKPOINT_INSTRUCTION) {
+        if (is_kprobe_on_ftrace(&old)) {
                /*
                 * If we find a breakpoint instruction, a kprobe has been
                 * placed at the beginning of the function. We write the
@@ -119,9 +149,8 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
                 * bytes of the original instruction so that the kprobes
                 * handler can execute a brasl if it reaches this breakpoint.
                 */
-                new.opc = orig.opc = BREAKPOINT_INSTRUCTION;
+                ftrace_generate_kprobe_nop_insn(&orig);
-                orig.disp = KPROBE_ON_FTRACE_NOP;
+                ftrace_generate_kprobe_call_insn(&new);
-                new.disp = KPROBE_ON_FTRACE_CALL;
        } else {
                /* Replace nop with an ftrace call. */
                ftrace_generate_nop_insn(&orig);
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index c3f8d157cb0d..e6a1578fc000 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -1415,7 +1415,7 @@ CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC_DIAG, PERF_EVENT_CPUM_SF_DIAG);
 static struct attribute *cpumsf_pmu_events_attr[] = {
        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC),
-        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC_DIAG),
+        NULL,
        NULL,
 };
@@ -1606,8 +1606,11 @@ static int __init init_cpum_sampling_pmu(void)
                return -EINVAL;
        }
-        if (si.ad)
+        if (si.ad) {
                sfb_set_limits(CPUM_SF_MIN_SDB, CPUM_SF_MAX_SDB);
+                cpumsf_pmu_events_attr[1] =
+                        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC_DIAG);
+        }
        sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80);
        if (!sfdbg)
diff --git a/arch/s390/kernel/swsusp_asm64.S b/arch/s390/kernel/swsusp_asm64.S
index 6b09fdffbd2f..ca6294645dd3 100644
--- a/arch/s390/kernel/swsusp_asm64.S
+++ b/arch/s390/kernel/swsusp_asm64.S
@@ -177,6 +177,17 @@ restart_entry:
        lhi     %r1,1
        sigp    %r1,%r0,SIGP_SET_ARCHITECTURE
        sam64
+#ifdef CONFIG_SMP
+        larl    %r1,smp_cpu_mt_shift
+        icm     %r1,15,0(%r1)
+        jz      smt_done
+        llgfr   %r1,%r1
+smt_loop:
+        sigp    %r1,%r0,SIGP_SET_MULTI_THREADING
+        brc     8,smt_done                      /* accepted */
+        brc     2,smt_loop                      /* busy, try again */
+smt_done:
+#endif
        larl    %r1,.Lnew_pgm_check_psw
        lpswe   0(%r1)
 pgm_check_entry:
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f6579cfde2df..19e17bd7aec0 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -165,7 +165,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
        case KVM_CAP_ONE_REG:
        case KVM_CAP_ENABLE_CAP:
        case KVM_CAP_S390_CSS_SUPPORT:
-        case KVM_CAP_IRQFD:
        case KVM_CAP_IOEVENTFD:
        case KVM_CAP_DEVICE_CTRL:
        case KVM_CAP_ENABLE_CAP_VM:
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 96ac69c5eba0..efb00ec75805 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -86,6 +86,9 @@ config ARCH_DEFCONFIG
        default "arch/sparc/configs/sparc32_defconfig" if SPARC32
        default "arch/sparc/configs/sparc64_defconfig" if SPARC64
+config ARCH_PROC_KCORE_TEXT
+        def_bool y
 config IOMMU_HELPER
        bool
        default y if SPARC64
diff --git a/arch/sparc/include/asm/hypervisor.h b/arch/sparc/include/asm/hypervisor.h
index 4f6725ff4c33..f5b6537306f0 100644
--- a/arch/sparc/include/asm/hypervisor.h
+++ b/arch/sparc/include/asm/hypervisor.h
@@ -2957,6 +2957,17 @@ unsigned long sun4v_t5_set_perfreg(unsigned long reg_num,
                                   unsigned long reg_val);
 #endif
+#define HV_FAST_M7_GET_PERFREG  0x43
+#define HV_FAST_M7_SET_PERFREG  0x44
+#ifndef __ASSEMBLY__
+unsigned long sun4v_m7_get_perfreg(unsigned long reg_num,
+                                      unsigned long *reg_val);
+unsigned long sun4v_m7_set_perfreg(unsigned long reg_num,
+                                      unsigned long reg_val);
+#endif
 /* Function numbers for HV_CORE_TRAP.  */
 #define HV_CORE_SET_VER                 0x00
 #define HV_CORE_PUTCHAR                 0x01
@@ -2981,6 +2992,7 @@ unsigned long sun4v_t5_set_perfreg(unsigned long reg_num,
 #define HV_GRP_SDIO                     0x0108
 #define HV_GRP_SDIO_ERR                 0x0109
 #define HV_GRP_REBOOT_DATA              0x0110
+#define HV_GRP_M7_PERF                  0x0114
 #define HV_GRP_NIAG_PERF                0x0200
 #define HV_GRP_FIRE_PERF                0x0201
 #define HV_GRP_N2_CPU                   0x0202
diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
index 9b672be70dda..50d4840d9aeb 100644
--- a/arch/sparc/include/asm/io_64.h
+++ b/arch/sparc/include/asm/io_64.h
@@ -407,16 +407,16 @@ static inline void iounmap(volatile void __iomem *addr)
 {
 }
-#define ioread8(X)                      readb(X)
+#define ioread8                 readb
-#define ioread16(X)                     readw(X)
+#define ioread16                readw
-#define ioread16be(X)                   __raw_readw(X)
+#define ioread16be              __raw_readw
-#define ioread32(X)                     readl(X)
+#define ioread32                readl
-#define ioread32be(X)                   __raw_readl(X)
+#define ioread32be              __raw_readl
-#define iowrite8(val,X)                 writeb(val,X)
+#define iowrite8                writeb
-#define iowrite16(val,X)                writew(val,X)
+#define iowrite16               writew
-#define iowrite16be(val,X)              __raw_writew(val,X)
+#define iowrite16be             __raw_writew
-#define iowrite32(val,X)                writel(val,X)
+#define iowrite32               writel
-#define iowrite32be(val,X)              __raw_writel(val,X)
+#define iowrite32be             __raw_writel
 /* Create a virtual mapping cookie for an IO port range */
 void __iomem *ioport_map(unsigned long port, unsigned int nr);
diff --git a/arch/sparc/include/asm/starfire.h b/arch/sparc/include/asm/starfire.h
index c100dc27a0a9..176fa0ad19f1 100644
--- a/arch/sparc/include/asm/starfire.h
+++ b/arch/sparc/include/asm/starfire.h
@@ -12,7 +12,6 @@
 extern int this_is_starfire;
 void check_if_starfire(void);
-int starfire_hard_smp_processor_id(void);
 void starfire_hookup(int);
 unsigned int starfire_translate(unsigned long imap, unsigned int upaid);
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 88d322b67fac..07cc49e541f4 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -98,11 +98,7 @@ void sun4v_do_mna(struct pt_regs *regs,
 void do_privop(struct pt_regs *regs);
 void do_privact(struct pt_regs *regs);
 void do_cee(struct pt_regs *regs);
-void do_cee_tl1(struct pt_regs *regs);
-void do_dae_tl1(struct pt_regs *regs);
-void do_iae_tl1(struct pt_regs *regs);
 void do_div0_tl1(struct pt_regs *regs);
-void do_fpdis_tl1(struct pt_regs *regs);
 void do_fpieee_tl1(struct pt_regs *regs);
 void do_fpother_tl1(struct pt_regs *regs);
 void do_ill_tl1(struct pt_regs *regs);
diff --git a/arch/sparc/kernel/hvapi.c b/arch/sparc/kernel/hvapi.c
index 5c55145bfbf0..662500fa555f 100644
--- a/arch/sparc/kernel/hvapi.c
+++ b/arch/sparc/kernel/hvapi.c
@@ -48,6 +48,7 @@ static struct api_info api_table[] = {
        { .group = HV_GRP_VT_CPU,                               },
        { .group = HV_GRP_T5_CPU,                               },
        { .group = HV_GRP_DIAG,         .flags = FLAG_PRE_API   },
+        { .group = HV_GRP_M7_PERF,                              },
 };
 static DEFINE_SPINLOCK(hvapi_lock);
diff --git a/arch/sparc/kernel/hvcalls.S b/arch/sparc/kernel/hvcalls.S
index caedf8320416..afbaba52d2f1 100644
--- a/arch/sparc/kernel/hvcalls.S
+++ b/arch/sparc/kernel/hvcalls.S
@@ -837,3 +837,19 @@ ENTRY(sun4v_t5_set_perfreg)
        retl
         nop
 ENDPROC(sun4v_t5_set_perfreg)
+ENTRY(sun4v_m7_get_perfreg)
+        mov     %o1, %o4
+        mov     HV_FAST_M7_GET_PERFREG, %o5
+        ta      HV_FAST_TRAP
+        stx     %o1, [%o4]
+        retl
+        nop
+ENDPROC(sun4v_m7_get_perfreg)
+ENTRY(sun4v_m7_set_perfreg)
+        mov     HV_FAST_M7_SET_PERFREG, %o5
+        ta      HV_FAST_TRAP
+        retl
+        nop
+ENDPROC(sun4v_m7_set_perfreg)
diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
index 7e967c8018c8..eb978c77c76a 100644
--- a/arch/sparc/kernel/pcr.c
+++ b/arch/sparc/kernel/pcr.c
@@ -217,6 +217,31 @@ static const struct pcr_ops n5_pcr_ops = {
        .pcr_nmi_disable        = PCR_N4_PICNPT,
 };
+static u64 m7_pcr_read(unsigned long reg_num)
+{
+        unsigned long val;
+        (void) sun4v_m7_get_perfreg(reg_num, &val);
+        return val;
+}
+static void m7_pcr_write(unsigned long reg_num, u64 val)
+{
+        (void) sun4v_m7_set_perfreg(reg_num, val);
+}
+static const struct pcr_ops m7_pcr_ops = {
+        .read_pcr               = m7_pcr_read,
+        .write_pcr              = m7_pcr_write,
+        .read_pic               = n4_pic_read,
+        .write_pic              = n4_pic_write,
+        .nmi_picl_value         = n4_picl_value,
+        .pcr_nmi_enable         = (PCR_N4_PICNPT | PCR_N4_STRACE |
+                                   PCR_N4_UTRACE | PCR_N4_TOE |
+                                   (26 << PCR_N4_SL_SHIFT)),
+        .pcr_nmi_disable        = PCR_N4_PICNPT,
+};
 static unsigned long perf_hsvc_group;
 static unsigned long perf_hsvc_major;
@@ -248,6 +273,10 @@ static int __init register_perf_hsvc(void)
                        perf_hsvc_group = HV_GRP_T5_CPU;
                        break;
+                case SUN4V_CHIP_SPARC_M7:
+                        perf_hsvc_group = HV_GRP_M7_PERF;
+                        break;
                default:
                        return -ENODEV;
                }
@@ -293,6 +322,10 @@ static int __init setup_sun4v_pcr_ops(void)
                pcr_ops = &n5_pcr_ops;
                break;
+        case SUN4V_CHIP_SPARC_M7:
+                pcr_ops = &m7_pcr_ops;
+                break;
        default:
                ret = -ENODEV;
                break;
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 46a5e4508752..86eebfa3b158 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -792,6 +792,42 @@ static const struct sparc_pmu niagara4_pmu = {
        .num_pic_regs   = 4,
 };
+static void sparc_m7_write_pmc(int idx, u64 val)
+{
+        u64 pcr;
+        pcr = pcr_ops->read_pcr(idx);
+        /* ensure ov and ntc are reset */
+        pcr &= ~(PCR_N4_OV | PCR_N4_NTC);
+        pcr_ops->write_pic(idx, val & 0xffffffff);
+        pcr_ops->write_pcr(idx, pcr);
+}
+static const struct sparc_pmu sparc_m7_pmu = {
+        .event_map      = niagara4_event_map,
+        .cache_map      = &niagara4_cache_map,
+        .max_events     = ARRAY_SIZE(niagara4_perfmon_event_map),
+        .read_pmc       = sparc_vt_read_pmc,
+        .write_pmc      = sparc_m7_write_pmc,
+        .upper_shift    = 5,
+        .lower_shift    = 5,
+        .event_mask     = 0x7ff,
+        .user_bit       = PCR_N4_UTRACE,
+        .priv_bit       = PCR_N4_STRACE,
+        /* We explicitly don't support hypervisor tracing. */
+        .hv_bit         = 0,
+        .irq_bit        = PCR_N4_TOE,
+        .upper_nop      = 0,
+        .lower_nop      = 0,
+        .flags          = 0,
+        .max_hw_events  = 4,
+        .num_pcrs       = 4,
+        .num_pic_regs   = 4,
+};
 static const struct sparc_pmu *sparc_pmu __read_mostly;
 static u64 event_encoding(u64 event_id, int idx)
@@ -960,6 +996,8 @@ out:
        cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
 }
+static void sparc_pmu_start(struct perf_event *event, int flags);
 /* On this PMU each PIC has it's own PCR control register.  */
 static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
 {
@@ -972,20 +1010,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
                struct perf_event *cp = cpuc->event[i];
                struct hw_perf_event *hwc = &cp->hw;
                int idx = hwc->idx;
-                u64 enc;
                if (cpuc->current_idx[i] != PIC_NO_INDEX)
                        continue;
-                sparc_perf_event_set_period(cp, hwc, idx);
                cpuc->current_idx[i] = idx;
-                enc = perf_event_get_enc(cpuc->events[i]);
+                sparc_pmu_start(cp, PERF_EF_RELOAD);
-                cpuc->pcr[idx] &= ~mask_for_index(idx);
-                if (hwc->state & PERF_HES_STOPPED)
-                        cpuc->pcr[idx] |= nop_for_index(idx);
-                else
-                        cpuc->pcr[idx] |= event_encoding(enc, idx);
        }
 out:
        for (i = 0; i < cpuc->n_events; i++) {
@@ -1101,7 +1132,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
        int i;
        local_irq_save(flags);
-        perf_pmu_disable(event->pmu);
        for (i = 0; i < cpuc->n_events; i++) {
                if (event == cpuc->event[i]) {
@@ -1127,7 +1157,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
                }
        }
-        perf_pmu_enable(event->pmu);
        local_irq_restore(flags);
 }
@@ -1361,7 +1390,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
        unsigned long flags;
        local_irq_save(flags);
-        perf_pmu_disable(event->pmu);
        n0 = cpuc->n_events;
        if (n0 >= sparc_pmu->max_hw_events)
@@ -1394,7 +1422,6 @@ nocheck:
        ret = 0;
 out:
-        perf_pmu_enable(event->pmu);
        local_irq_restore(flags);
        return ret;
 }
@@ -1667,6 +1694,10 @@ static bool __init supported_pmu(void)
                sparc_pmu = &niagara4_pmu;
                return true;
        }
+        if (!strcmp(sparc_pmu_type, "sparc-m7")) {
+                sparc_pmu = &sparc_m7_pmu;
+                return true;
+        }
        return false;
 }
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index 0be7bf978cb1..46a59643bb1c 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -287,6 +287,8 @@ void arch_trigger_all_cpu_backtrace(bool include_self)
                        printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
                               gp->tpc, gp->o7, gp->i7, gp->rpc);
                }
+                touch_nmi_watchdog();
        }
        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
@@ -362,6 +364,8 @@ static void pmu_snapshot_all_cpus(void)
                       (cpu == this_cpu ? '*' : ' '), cpu,
                       pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
                       pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
+                touch_nmi_watchdog();
        }
        memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index da6f1a7fc4db..61139d9924ca 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1406,11 +1406,32 @@ void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs)
        scheduler_ipi();
 }
-/* This is a nop because we capture all other cpus
+static void stop_this_cpu(void *dummy)
- * anyways when making the PROM active.
+{
- */
+        prom_stopself();
+}
 void smp_send_stop(void)
 {
+        int cpu;
+        if (tlb_type == hypervisor) {
+                for_each_online_cpu(cpu) {
+                        if (cpu == smp_processor_id())
+                                continue;
+#ifdef CONFIG_SUN_LDOMS
+                        if (ldom_domaining_enabled) {
+                                unsigned long hv_err;
+                                hv_err = sun4v_cpu_stop(cpu);
+                                if (hv_err)
+                                        printk(KERN_ERR "sun4v_cpu_stop() "
+                                               "failed err=%lu\n", hv_err);
+                        } else
+#endif
+                                prom_stopcpu_cpuid(cpu);
+                }
+        } else
+                smp_call_function(stop_this_cpu, NULL, 0);
 }
 /**
diff --git a/arch/sparc/kernel/starfire.c b/arch/sparc/kernel/starfire.c
index 82281a566bb8..167fdfd9c837 100644
--- a/arch/sparc/kernel/starfire.c
+++ b/arch/sparc/kernel/starfire.c
@@ -28,11 +28,6 @@ void check_if_starfire(void)
                this_is_starfire = 1;
 }
-int starfire_hard_smp_processor_id(void)
-{
-        return upa_readl(0x1fff40000d0UL);
-}
 /*
 * Each Starfire board has 32 registers which perform translation
 * and delivery of traditional interrupt packets into the extended
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index c85403d0496c..30e7ddb27a3a 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
        long err;
        /* No need for backward compatibility. We can start fresh... */
-        if (call <= SEMCTL) {
+        if (call <= SEMTIMEDOP) {
                switch (call) {
                case SEMOP:
                        err = sys_semtimedop(first, ptr,
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index a27651e866e7..0e699745d643 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2427,6 +2427,8 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs)
                }
                user_instruction_dump ((unsigned int __user *) regs->tpc);
        }
+        if (panic_on_oops)
+                panic("Fatal exception");
        if (regs->tstate & TSTATE_PRIV)
                do_exit(SIGKILL);
        do_exit(SIGSEGV);
@@ -2564,27 +2566,6 @@ void do_cee(struct pt_regs *regs)
        die_if_kernel("TL0: Cache Error Exception", regs);
 }
-void do_cee_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Cache Error Exception", regs);
-}
-void do_dae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Data Access Exception", regs);
-}
-void do_iae_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: Instruction Access Exception", regs);
-}
 void do_div0_tl1(struct pt_regs *regs)
 {
        exception_enter();
@@ -2592,13 +2573,6 @@ void do_div0_tl1(struct pt_regs *regs)
        die_if_kernel("TL1: DIV0 Exception", regs);
 }
-void do_fpdis_tl1(struct pt_regs *regs)
-{
-        exception_enter();
-        dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-        die_if_kernel("TL1: FPU Disabled", regs);
-}
 void do_fpieee_tl1(struct pt_regs *regs)
 {
        exception_enter();
diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
index b7f6334e159f..857ad4f8905f 100644
--- a/arch/sparc/lib/memmove.S
+++ b/arch/sparc/lib/memmove.S
@@ -8,9 +8,11 @@
        .text
 ENTRY(memmove) /* o0=dst o1=src o2=len */
-        mov             %o0, %g1
+        brz,pn          %o2, 99f
+         mov            %o0, %g1
        cmp             %o0, %o1
-        bleu,pt         %xcc, memcpy
+        bleu,pt         %xcc, 2f
         add            %o1, %o2, %g7
        cmp             %g7, %o0
        bleu,pt         %xcc, memcpy
@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
        stb             %g7, [%o0]
        bne,pt          %icc, 1b
         sub            %o0, 1, %o0
+99:
        retl
         mov            %g1, %o0
+        /* We can't just call memcpy for these memmove cases.  On some
+         * chips the memcpy uses cache initializing stores and when dst
+         * and src are close enough, those can clobber the source data
+         * before we've loaded it in.
+         */
+2:      or              %o0, %o1, %g7
+        or              %o2, %g7, %g7
+        andcc           %g7, 0x7, %g0
+        bne,pn          %xcc, 4f
+         nop
+3:      ldx             [%o1], %g7
+        add             %o1, 8, %o1
+        subcc           %o2, 8, %o2
+        add             %o0, 8, %o0
+        bne,pt          %icc, 3b
+         stx            %g7, [%o0 - 0x8]
+        ba,a,pt         %xcc, 99b
+4:      ldub            [%o1], %g7
+        add             %o1, 1, %o1
+        subcc           %o2, 1, %o2
+        add             %o0, 1, %o0
+        bne,pt          %icc, 4b
+         stb            %g7, [%o0 - 0x1]
+        ba,a,pt         %xcc, 99b
 ENDPROC(memmove)
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 3ea267c53320..4ca0d6ba5ec8 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2820,7 +2820,7 @@ static int __init report_memory(void)
        return 0;
 }
-device_initcall(report_memory);
+arch_initcall(report_memory);
 #ifdef CONFIG_SMP
 #define do_flush_tlb_kernel_range       smp_flush_tlb_kernel_range
diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
index 7083c16cccba..bb1376381985 100644
--- a/arch/x86/boot/compressed/aslr.c
+++ b/arch/x86/boot/compressed/aslr.c
@@ -14,13 +14,6 @@
 static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
                LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
-struct kaslr_setup_data {
-        __u64 next;
-        __u32 type;
-        __u32 len;
-        __u8 data[1];
-} kaslr_setup_data;
 #define I8254_PORT_CONTROL      0x43
 #define I8254_PORT_COUNTER0     0x40
 #define I8254_CMD_READBACK      0xC0
@@ -302,29 +295,7 @@ static unsigned long find_random_addr(unsigned long minimum,
        return slots_fetch_random();
 }
-static void add_kaslr_setup_data(struct boot_params *params, __u8 enabled)
+unsigned char *choose_kernel_location(unsigned char *input,
-{
-        struct setup_data *data;
-        kaslr_setup_data.type = SETUP_KASLR;
-        kaslr_setup_data.len = 1;
-        kaslr_setup_data.next = 0;
-        kaslr_setup_data.data[0] = enabled;
-        data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
-        while (data && data->next)
-                data = (struct setup_data *)(unsigned long)data->next;
-        if (data)
-                data->next = (unsigned long)&kaslr_setup_data;
-        else
-                params->hdr.setup_data = (unsigned long)&kaslr_setup_data;
-}
-unsigned char *choose_kernel_location(struct boot_params *params,
-                                      unsigned char *input,
                                      unsigned long input_size,
                                      unsigned char *output,
                                      unsigned long output_size)
@@ -335,17 +306,14 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 #ifdef CONFIG_HIBERNATION
        if (!cmdline_find_option_bool("kaslr")) {
                debug_putstr("KASLR disabled by default...\n");
-                add_kaslr_setup_data(params, 0);
                goto out;
        }
 #else
        if (cmdline_find_option_bool("nokaslr")) {
                debug_putstr("KASLR disabled by cmdline...\n");
-                add_kaslr_setup_data(params, 0);
                goto out;
        }
 #endif
-        add_kaslr_setup_data(params, 1);
        /* Record the various known unsafe memory ranges. */
        mem_avoid_init((unsigned long)input, input_size,
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 5903089c818f..a950864a64da 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -401,8 +401,7 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
         * the entire decompressed kernel plus relocation table, or the
         * entire decompressed kernel plus .bss and .brk sections.
         */
-        output = choose_kernel_location(real_mode, input_data, input_len,
+        output = choose_kernel_location(input_data, input_len, output,
-                                        output,
                                        output_len > run_size ? output_len
                                                              : run_size);
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index ee3576b2666b..04477d68403f 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -57,8 +57,7 @@ int cmdline_find_option_bool(const char *option);
 #if CONFIG_RANDOMIZE_BASE
 /* aslr.c */
-unsigned char *choose_kernel_location(struct boot_params *params,
+unsigned char *choose_kernel_location(unsigned char *input,
-                                      unsigned char *input,
                                      unsigned long input_size,
                                      unsigned char *output,
                                      unsigned long output_size);
@@ -66,8 +65,7 @@ unsigned char *choose_kernel_location(struct boot_params *params,
 bool has_cpuflag(int flag);
 #else
 static inline
-unsigned char *choose_kernel_location(struct boot_params *params,
+unsigned char *choose_kernel_location(unsigned char *input,
-                                      unsigned char *input,
                                      unsigned long input_size,
                                      unsigned char *output,
                                      unsigned long output_size)
diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 947c6bf52c33..54f60ab41c63 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -1155,7 +1155,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
                if (!src)
                        return -ENOMEM;
-                assoc = (src + req->cryptlen + auth_tag_len);
+                assoc = (src + req->cryptlen);
                scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
                scatterwalk_map_and_copy(assoc, req->assoc, 0,
                        req->assoclen, 0);
@@ -1180,7 +1180,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
                scatterwalk_done(&src_sg_walk, 0, 0);
                scatterwalk_done(&assoc_sg_walk, 0, 0);
        } else {
-                scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
+                scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
                kfree(src);
        }
        return retval;
diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
index 0dbc08282291..72ba21a8b5fc 100644
--- a/arch/x86/include/asm/fpu-internal.h
+++ b/arch/x86/include/asm/fpu-internal.h
@@ -370,7 +370,7 @@ static inline void drop_fpu(struct task_struct *tsk)
        preempt_disable();
        tsk->thread.fpu_counter = 0;
        __drop_fpu(tsk);
-        clear_used_math();
+        clear_stopped_child_used_math(tsk);
        preempt_enable();
 }
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
index 95e11f79f123..f97fbe3abb67 100644
--- a/arch/x86/include/asm/page_types.h
+++ b/arch/x86/include/asm/page_types.h
@@ -51,8 +51,6 @@ extern int devmem_is_allowed(unsigned long pagenr);
 extern unsigned long max_low_pfn_mapped;
 extern unsigned long max_pfn_mapped;
-extern bool kaslr_enabled;
 static inline phys_addr_t get_max_mapped(void)
 {
        return (phys_addr_t)max_pfn_mapped << PAGE_SHIFT;
diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
index fa1195dae425..164e3f8d3c3d 100644
--- a/arch/x86/include/asm/pci_x86.h
+++ b/arch/x86/include/asm/pci_x86.h
@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock;
 extern int (*pcibios_enable_irq)(struct pci_dev *dev);
 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+extern bool mp_should_keep_irq(struct device *dev);
 struct pci_raw_ops {
        int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
                                                int reg, int len, u32 *val);
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 44e6dd7e36a2..225b0988043a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -7,7 +7,6 @@
 #define SETUP_DTB                       2
 #define SETUP_PCI                       3
 #define SETUP_EFI                       4
-#define SETUP_KASLR                     5
 /* ram_size flags */
 #define RAMDISK_IMAGE_START_MASK        0x07FF
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 3d525c6124f6..803b684676ff 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1338,6 +1338,26 @@ static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
 }
 /*
+ * ACPI offers an alternative platform interface model that removes
+ * ACPI hardware requirements for platforms that do not implement
+ * the PC Architecture.
+ *
+ * We initialize the Hardware-reduced ACPI model here:
+ */
+static void __init acpi_reduced_hw_init(void)
+{
+        if (acpi_gbl_reduced_hardware) {
+                /*
+                 * Override x86_init functions and bypass legacy pic
+                 * in Hardware-reduced ACPI mode
+                 */
+                x86_init.timers.timer_init      = x86_init_noop;
+                x86_init.irqs.pre_vector_init   = x86_init_noop;
+                legacy_pic                      = &null_legacy_pic;
+        }
+}
+/*
 * If your system is blacklisted here, but you find that acpi=force
 * works for you, please contact linux-acpi@vger.kernel.org
 */
@@ -1536,6 +1556,11 @@ int __init early_acpi_boot_init(void)
         */
        early_acpi_process_madt();
+        /*
+         * Hardware-reduced ACPI mode initialization:
+         */
+        acpi_reduced_hw_init();
        return 0;
 }
diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
index c2fd21fed002..017149cded07 100644
--- a/arch/x86/kernel/apic/apic_numachip.c
+++ b/arch/x86/kernel/apic/apic_numachip.c
@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
 static unsigned int get_apic_id(unsigned long x)
 {
        unsigned long value;
-        unsigned int id;
+        unsigned int id = (x >> 24) & 0xff;
-        rdmsrl(MSR_FAM10H_NODE_ID, value);
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
-        id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
+                rdmsrl(MSR_FAM10H_NODE_ID, value);
+                id |= (value << 2) & 0xff00;
+        }
        return id;
 }
@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
 static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
 {
-        if (c->phys_proc_id != node) {
+        u64 val;
-                c->phys_proc_id = node;
+        u32 nodes = 1;
-                per_cpu(cpu_llc_id, smp_processor_id()) = node;
+        this_cpu_write(cpu_llc_id, node);
+        /* Account for nodes per socket in multi-core-module processors */
+        if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
+                rdmsrl(MSR_FAM10H_NODE_ID, val);
+                nodes = ((val >> 3) & 7) + 1;
        }
+        c->phys_proc_id = node / nodes;
 }
 static int __init numachip_system_init(void)
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 1d74d161687c..2babb393915e 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -364,12 +364,21 @@ system_call_fastpath:
 * Has incomplete stack frame and undefined top of stack.
 */
 ret_from_sys_call:
-        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
-        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
        LOCKDEP_SYS_EXIT
        DISABLE_INTERRUPTS(CLBR_NONE)
        TRACE_IRQS_OFF
+        /*
+         * We must check ti flags with interrupts (or at least preemption)
+         * off because we must *never* return to userspace without
+         * processing exit work that is enqueued if we're preempted here.
+         * In particular, returning to userspace with any of the one-shot
+         * flags (TIF_NOTIFY_RESUME, TIF_USER_RETURN_NOTIFY, etc) set is
+         * very bad.
+         */
+        testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
+        jnz int_ret_from_sys_call_fixup /* Go the the slow path */
        CFI_REMEMBER_STATE
        /*
         * sysretq will re-enable interrupts:
@@ -386,7 +395,7 @@ ret_from_sys_call:
 int_ret_from_sys_call_fixup:
        FIXUP_TOP_OF_STACK %r11, -ARGOFFSET
-        jmp int_ret_from_sys_call
+        jmp int_ret_from_sys_call_irqs_off
        /* Do syscall tracing */
 tracesys:
@@ -432,6 +441,7 @@ tracesys_phase2:
 GLOBAL(int_ret_from_sys_call)
        DISABLE_INTERRUPTS(CLBR_NONE)
        TRACE_IRQS_OFF
+int_ret_from_sys_call_irqs_off:
        movl $_TIF_ALLWORK_MASK,%edi
        /* edi: mask to check */
 GLOBAL(int_with_check)
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index 9bbb9b35c144..d1ac80b72c72 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -47,13 +47,21 @@ do {							\
 #ifdef CONFIG_RANDOMIZE_BASE
 static unsigned long module_load_offset;
+static int randomize_modules = 1;
 /* Mutex protects the module_load_offset. */
 static DEFINE_MUTEX(module_kaslr_mutex);
+static int __init parse_nokaslr(char *p)
+{
+        randomize_modules = 0;
+        return 0;
+}
+early_param("nokaslr", parse_nokaslr);
 static unsigned long int get_module_load_offset(void)
 {
-        if (kaslr_enabled) {
+        if (randomize_modules) {
                mutex_lock(&module_kaslr_mutex);
                /*
                 * Calculate the module_load_offset the first time this
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 98dc9317286e..0a2421cca01f 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -122,8 +122,6 @@
 unsigned long max_low_pfn_mapped;
 unsigned long max_pfn_mapped;
-bool __read_mostly kaslr_enabled = false;
 #ifdef CONFIG_DMI
 RESERVE_BRK(dmi_alloc, 65536);
 #endif
@@ -427,11 +425,6 @@ static void __init reserve_initrd(void)
 }
 #endif /* CONFIG_BLK_DEV_INITRD */
-static void __init parse_kaslr_setup(u64 pa_data, u32 data_len)
-{
-        kaslr_enabled = (bool)(pa_data + sizeof(struct setup_data));
-}
 static void __init parse_setup_data(void)
 {
        struct setup_data *data;
@@ -457,9 +450,6 @@ static void __init parse_setup_data(void)
                case SETUP_EFI:
                        parse_efi_setup(pa_data, data_len);
                        break;
-                case SETUP_KASLR:
-                        parse_kaslr_setup(pa_data, data_len);
-                        break;
                default:
                        break;
                }
@@ -842,14 +832,10 @@ static void __init trim_low_memory_range(void)
 static int
 dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
 {
-        if (kaslr_enabled)
+        pr_emerg("Kernel Offset: 0x%lx from 0x%lx "
-                pr_emerg("Kernel Offset: 0x%lx from 0x%lx (relocation range: 0x%lx-0x%lx)\n",
+                 "(relocation range: 0x%lx-0x%lx)\n",
-                         (unsigned long)&_text - __START_KERNEL,
+                 (unsigned long)&_text - __START_KERNEL, __START_KERNEL,
-                         __START_KERNEL,
+                 __START_KERNEL_map, MODULES_VADDR-1);
-                         __START_KERNEL_map,
-                         MODULES_VADDR-1);
-        else
-                pr_emerg("Kernel Offset: disabled\n");
        return 0;
 }
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 9d2073e2ecc9..4ff5d162ff9f 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -384,7 +384,7 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
                goto exit;
        conditional_sti(regs);
-        if (!user_mode(regs))
+        if (!user_mode_vm(regs))
                die("bounds", regs, error_code);
        if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
@@ -637,7 +637,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
         * then it's very likely the result of an icebp/int01 trap.
         * User wants a sigtrap for that.
         */
-        if (!dr6 && user_mode(regs))
+        if (!dr6 && user_mode_vm(regs))
                user_icebp = 1;
        /* Catch kmemcheck conditions first of all! */
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 34f66e58a896..cdc6cf903078 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -379,7 +379,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                 * thread's fpu state, reconstruct fxstate from the fsave
                 * header. Sanitize the copied state etc.
                 */
-                struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
+                struct fpu *fpu = &tsk->thread.fpu;
                struct user_i387_ia32_struct env;
                int err = 0;
@@ -393,14 +393,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
                 */
                drop_fpu(tsk);
-                if (__copy_from_user(xsave, buf_fx, state_size) ||
+                if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
                    __copy_from_user(&env, buf, sizeof(env))) {
+                        fpu_finit(fpu);
                        err = -1;
                } else {
                        sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-                        set_used_math();
                }
+                set_used_math();
                if (use_eager_fpu()) {
                        preempt_disable();
                        math_state_restore();
diff --git a/arch/x86/kvm/i8259.c b/arch/x86/kvm/i8259.c
index cc31f7c06d3d..9541ba34126b 100644
--- a/arch/x86/kvm/i8259.c
+++ b/arch/x86/kvm/i8259.c
@@ -507,6 +507,7 @@ static int picdev_read(struct kvm_pic *s,
                return -EOPNOTSUPP;
        if (len != 1) {
+                memset(val, 0, len);
                pr_pic_unimpl("non byte read\n");
                return 0;
        }
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index b1947e0f3e10..46d4449772bc 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -422,6 +422,7 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
                        struct kvm_ioapic *ioapic, int vector, int trigger_mode)
 {
        int i;
+        struct kvm_lapic *apic = vcpu->arch.apic;
        for (i = 0; i < IOAPIC_NUM_PINS; i++) {
                union kvm_ioapic_redirect_entry *ent = &ioapic->redirtbl[i];
@@ -443,7 +444,8 @@ static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
                kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
                spin_lock(&ioapic->lock);
-                if (trigger_mode != IOAPIC_LEVEL_TRIG)
+                if (trigger_mode != IOAPIC_LEVEL_TRIG ||
+                    kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI)
                        continue;
                ASSERT(ent->fields.trig_mode == IOAPIC_LEVEL_TRIG);
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index bd4e34de24c7..4ee827d7bf36 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -833,8 +833,7 @@ int kvm_apic_compare_prio(struct kvm_vcpu *vcpu1, struct kvm_vcpu *vcpu2)
 static void kvm_ioapic_send_eoi(struct kvm_lapic *apic, int vector)
 {
-        if (!(kvm_apic_get_reg(apic, APIC_SPIV) & APIC_SPIV_DIRECTED_EOI) &&
+        if (kvm_ioapic_handles_vector(apic->vcpu->kvm, vector)) {
-            kvm_ioapic_handles_vector(apic->vcpu->kvm, vector)) {
                int trigger_mode;
                if (apic_test_vector(vector, apic->regs + APIC_TMR))
                        trigger_mode = IOAPIC_LEVEL_TRIG;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f7b20b417a3a..ae4f6d35d19c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2168,7 +2168,10 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
 {
        unsigned long *msr_bitmap;
-        if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) {
+        if (is_guest_mode(vcpu))
+                msr_bitmap = vmx_msr_bitmap_nested;
+        else if (irqchip_in_kernel(vcpu->kvm) &&
+                apic_x2apic_mode(vcpu->arch.apic)) {
                if (is_long_mode(vcpu))
                        msr_bitmap = vmx_msr_bitmap_longmode_x2apic;
                else
@@ -2476,8 +2479,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
        if (enable_ept) {
                /* nested EPT: emulate EPT also to L1 */
                vmx->nested.nested_vmx_secondary_ctls_high |=
-                        SECONDARY_EXEC_ENABLE_EPT |
+                        SECONDARY_EXEC_ENABLE_EPT;
-                        SECONDARY_EXEC_UNRESTRICTED_GUEST;
                vmx->nested.nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
                         VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
                         VMX_EPT_INVEPT_BIT;
@@ -2491,6 +2493,10 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx)
        } else
                vmx->nested.nested_vmx_ept_caps = 0;
+        if (enable_unrestricted_guest)
+                vmx->nested.nested_vmx_secondary_ctls_high |=
+                        SECONDARY_EXEC_UNRESTRICTED_GUEST;
        /* miscellaneous data */
        rdmsr(MSR_IA32_VMX_MISC,
                vmx->nested.nested_vmx_misc_low,
@@ -9218,9 +9224,9 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
        }
        if (cpu_has_vmx_msr_bitmap() &&
-            exec_control & CPU_BASED_USE_MSR_BITMAPS &&
+            exec_control & CPU_BASED_USE_MSR_BITMAPS) {
-            nested_vmx_merge_msr_bitmap(vcpu, vmcs12)) {
+                nested_vmx_merge_msr_bitmap(vcpu, vmcs12);
-                vmcs_write64(MSR_BITMAP, __pa(vmx_msr_bitmap_nested));
+                /* MSR_BITMAP will be set by following vmx_set_efer. */
        } else
                exec_control &= ~CPU_BASED_USE_MSR_BITMAPS;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bd7a70be41b3..32bf19ef3115 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2744,7 +2744,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
        case KVM_CAP_USER_NMI:
        case KVM_CAP_REINJECT_CONTROL:
        case KVM_CAP_IRQ_INJECT_STATUS:
-        case KVM_CAP_IRQFD:
        case KVM_CAP_IOEVENTFD:
        case KVM_CAP_IOEVENTFD_NO_LENGTH:
        case KVM_CAP_PIT2:
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 3d2612b68694..2fb384724ebb 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -513,31 +513,6 @@ void __init pcibios_set_cache_line_size(void)
        }
 }
-/*
- * Some device drivers assume dev->irq won't change after calling
- * pci_disable_device(). So delay releasing of IRQ resource to driver
- * unbinding time. Otherwise it will break PM subsystem and drivers
- * like xen-pciback etc.
- */
-static int pci_irq_notifier(struct notifier_block *nb, unsigned long action,
-                            void *data)
-{
-        struct pci_dev *dev = to_pci_dev(data);
-        if (action != BUS_NOTIFY_UNBOUND_DRIVER)
-                return NOTIFY_DONE;
-        if (pcibios_disable_irq)
-                pcibios_disable_irq(dev);
-        return NOTIFY_OK;
-}
-static struct notifier_block pci_irq_nb = {
-        .notifier_call = pci_irq_notifier,
-        .priority = INT_MIN,
-};
 int __init pcibios_init(void)
 {
        if (!raw_pci_ops) {
@@ -550,9 +525,6 @@ int __init pcibios_init(void)
        if (pci_bf_sort >= pci_force_bf)
                pci_sort_breadthfirst();
-        bus_register_notifier(&pci_bus_type, &pci_irq_nb);
        return 0;
 }
@@ -711,6 +683,12 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
        return 0;
 }
+void pcibios_disable_device (struct pci_dev *dev)
+{
+        if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq)
+                pcibios_disable_irq(dev);
+}
 int pci_ext_cfg_avail(void)
 {
        if (raw_pci_ext_ops)
diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
index efb849323c74..852aa4c92da0 100644
--- a/arch/x86/pci/intel_mid_pci.c
+++ b/arch/x86/pci/intel_mid_pci.c
@@ -234,10 +234,10 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
 static void intel_mid_pci_irq_disable(struct pci_dev *dev)
 {
-        if (dev->irq_managed && dev->irq > 0) {
+        if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed &&
+            dev->irq > 0) {
                mp_unmap_irq(dev->irq);
                dev->irq_managed = 0;
-                dev->irq = 0;
        }
 }
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index e71b3dbd87b8..5dc6ca5e1741 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -1256,9 +1256,22 @@ static int pirq_enable_irq(struct pci_dev *dev)
        return 0;
 }
+bool mp_should_keep_irq(struct device *dev)
+{
+        if (dev->power.is_prepared)
+                return true;
+#ifdef CONFIG_PM
+        if (dev->power.runtime_status == RPM_SUSPENDING)
+                return true;
+#endif
+        return false;
+}
 static void pirq_disable_irq(struct pci_dev *dev)
 {
-        if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) {
+        if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
+            dev->irq_managed && dev->irq) {
                mp_unmap_irq(dev->irq);
                dev->irq = 0;
                dev->irq_managed = 0;
diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
index 31776d0efc8c..d7ec4e251c0a 100644
--- a/arch/x86/vdso/vdso32/sigreturn.S
+++ b/arch/x86/vdso/vdso32/sigreturn.S
@@ -17,6 +17,7 @@
        .text
        .globl __kernel_sigreturn
        .type __kernel_sigreturn,@function
+        nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
        ALIGN
 __kernel_sigreturn:
 .LSTART_sigreturn:
diff --git a/block/blk-merge.c b/block/blk-merge.c
index fc1ff3b1ea1f..fd3fee81c23c 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -592,7 +592,7 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
        if (q->queue_flags & (1 << QUEUE_FLAG_SG_GAPS)) {
                struct bio_vec *bprev;
-                bprev = &rq->biotail->bi_io_vec[bio->bi_vcnt - 1];
+                bprev = &rq->biotail->bi_io_vec[rq->biotail->bi_vcnt - 1];
                if (bvec_gap_to_prev(bprev, bio->bi_io_vec[0].bv_offset))
                        return false;
        }
diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index d53a764b05ea..be3290cc0644 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -278,9 +278,11 @@ static int bt_get(struct blk_mq_alloc_data *data,
                /*
                 * We're out of tags on this hardware queue, kick any
                 * pending IO submits before going to sleep waiting for
-                 * some to complete.
+                 * some to complete. Note that hctx can be NULL here for
+                 * reserved tag allocation.
                 */
-                blk_mq_run_hw_queue(hctx, false);
+                if (hctx)
+                        blk_mq_run_hw_queue(hctx, false);
                /*
                 * Retry tag allocation after running the hardware queue,
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 4f4bea21052e..b7b8933ec241 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1938,7 +1938,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
         */
        if (percpu_ref_init(&q->mq_usage_counter, blk_mq_usage_counter_release,
                            PERCPU_REF_INIT_ATOMIC, GFP_KERNEL))
-                goto err_map;
+                goto err_mq_usage;
        setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
        blk_queue_rq_timeout(q, 30000);
@@ -1981,7 +1981,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
        blk_mq_init_cpu_queues(q, set->nr_hw_queues);
        if (blk_mq_init_hw_queues(q, set))
-                goto err_hw;
+                goto err_mq_usage;
        mutex_lock(&all_q_mutex);
        list_add_tail(&q->all_q_node, &all_q_list);
@@ -1993,7 +1993,7 @@ struct request_queue *blk_mq_init_queue(struct blk_mq_tag_set *set)
        return q;
-err_hw:
+err_mq_usage:
        blk_cleanup_queue(q);
 err_hctxs:
        kfree(map);
diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
index e7f718d6918a..b1def411c0b8 100644
--- a/drivers/acpi/pci_irq.c
+++ b/drivers/acpi/pci_irq.c
@@ -485,6 +485,14 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
        if (!pin || !dev->irq_managed || dev->irq <= 0)
                return;
+        /* Keep IOAPIC pin configuration when suspending */
+        if (dev->dev.power.is_prepared)
+                return;
+#ifdef  CONFIG_PM
+        if (dev->dev.power.runtime_status == RPM_SUSPENDING)
+                return;
+#endif
        entry = acpi_pci_irq_lookup(dev, pin);
        if (!entry)
                return;
@@ -505,6 +513,5 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
        if (gsi >= 0) {
                acpi_unregister_gsi(gsi);
                dev->irq_managed = 0;
-                dev->irq = 0;
        }
 }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 4c35f0822d06..ef150ebb4c30 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4737,7 +4737,7 @@ struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev, int tag)
                return NULL;
        /* libsas case */
-        if (!ap->scsi_host) {
+        if (ap->flags & ATA_FLAG_SAS_HOST) {
                tag = ata_sas_allocate_tag(ap);
                if (tag < 0)
                        return NULL;
@@ -4776,7 +4776,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
        tag = qc->tag;
        if (likely(ata_tag_valid(tag))) {
                qc->tag = ATA_TAG_POISON;
-                if (!ap->scsi_host)
+                if (ap->flags & ATA_FLAG_SAS_HOST)
                        ata_sas_free_tag(tag, ap);
        }
 }
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index beb8b27d4621..a13587b5c2be 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -243,4 +243,12 @@ extern struct regcache_ops regcache_rbtree_ops;
 extern struct regcache_ops regcache_lzo_ops;
 extern struct regcache_ops regcache_flat_ops;
+static inline const char *regmap_name(const struct regmap *map)
+{
+        if (map->dev)
+                return dev_name(map->dev);
+        return map->name;
+}
 #endif
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index d453a2c98ad0..81751a49d8bf 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
        if (pos == 0) {
                memmove(blk + offset * map->cache_word_size,
                        blk, rbnode->blklen * map->cache_word_size);
-                bitmap_shift_right(present, present, offset, blklen);
+                bitmap_shift_left(present, present, offset, blklen);
        }
        /* update the rbnode block, its size and the base register */
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index f373c35f9e1d..87db9893b463 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -218,7 +218,7 @@ int regcache_read(struct regmap *map,
                ret = map->cache_ops->read(map, reg, value);
                if (ret == 0)
-                        trace_regmap_reg_read_cache(map->dev, reg, *value);
+                        trace_regmap_reg_read_cache(map, reg, *value);
                return ret;
        }
@@ -311,7 +311,7 @@ int regcache_sync(struct regmap *map)
        dev_dbg(map->dev, "Syncing %s cache\n",
                map->cache_ops->name);
        name = map->cache_ops->name;
-        trace_regcache_sync(map->dev, name, "start");
+        trace_regcache_sync(map, name, "start");
        if (!map->cache_dirty)
                goto out;
@@ -346,7 +346,7 @@ out:
        regmap_async_complete(map);
-        trace_regcache_sync(map->dev, name, "stop");
+        trace_regcache_sync(map, name, "stop");
        return ret;
 }
@@ -381,7 +381,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
        name = map->cache_ops->name;
        dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
-        trace_regcache_sync(map->dev, name, "start region");
+        trace_regcache_sync(map, name, "start region");
        if (!map->cache_dirty)
                goto out;
@@ -401,7 +401,7 @@ out:
        regmap_async_complete(map);
-        trace_regcache_sync(map->dev, name, "stop region");
+        trace_regcache_sync(map, name, "stop region");
        return ret;
 }
@@ -428,7 +428,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
        map->lock(map->lock_arg);
-        trace_regcache_drop_region(map->dev, min, max);
+        trace_regcache_drop_region(map, min, max);
        ret = map->cache_ops->drop(map, min, max);
@@ -455,7 +455,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
        map->lock(map->lock_arg);
        WARN_ON(map->cache_bypass && enable);
        map->cache_only = enable;
-        trace_regmap_cache_only(map->dev, enable);
+        trace_regmap_cache_only(map, enable);
        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_only);
@@ -493,7 +493,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
        map->lock(map->lock_arg);
        WARN_ON(map->cache_only && enable);
        map->cache_bypass = enable;
-        trace_regmap_cache_bypass(map->dev, enable);
+        trace_regmap_cache_bypass(map, enable);
        map->unlock(map->lock_arg);
 }
 EXPORT_SYMBOL_GPL(regcache_cache_bypass);
@@ -608,7 +608,8 @@ static int regcache_sync_block_single(struct regmap *map, void *block,
        for (i = start; i < end; i++) {
                regtmp = block_base + (i * map->reg_stride);
-                if (!regcache_reg_present(cache_present, i))
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp))
                        continue;
                val = regcache_get_val(map, block, i);
@@ -677,7 +678,8 @@ static int regcache_sync_block_raw(struct regmap *map, void *block,
        for (i = start; i < end; i++) {
                regtmp = block_base + (i * map->reg_stride);
-                if (!regcache_reg_present(cache_present, i)) {
+                if (!regcache_reg_present(cache_present, i) ||
+                    !regmap_writeable(map, regtmp)) {
                        ret = regcache_sync_block_raw_flush(map, &data,
                                                            base, regtmp);
                        if (ret != 0)
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 6299a50a5960..a6c3f75b4b01 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -499,7 +499,8 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                goto err_alloc;
        }
-        ret = request_threaded_irq(irq, NULL, regmap_irq_thread, irq_flags,
+        ret = request_threaded_irq(irq, NULL, regmap_irq_thread,
+                                   irq_flags | IRQF_ONESHOT,
                                   chip->name, d);
        if (ret != 0) {
                dev_err(map->dev, "Failed to request IRQ %d for %s: %d\n",
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index f99b098ddabf..dbfe6a69c3da 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1281,7 +1281,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
        if (map->async && map->bus->async_write) {
                struct regmap_async *async;
-                trace_regmap_async_write_start(map->dev, reg, val_len);
+                trace_regmap_async_write_start(map, reg, val_len);
                spin_lock_irqsave(&map->async_lock, flags);
                async = list_first_entry_or_null(&map->async_free,
@@ -1339,8 +1339,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                return ret;
        }
-        trace_regmap_hw_write_start(map->dev, reg,
+        trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
-                                    val_len / map->format.val_bytes);
        /* If we're doing a single register write we can probably just
         * send the work_buf directly, otherwise try to do a gather
@@ -1372,8 +1371,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                kfree(buf);
        }
-        trace_regmap_hw_write_done(map->dev, reg,
+        trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
-                                   val_len / map->format.val_bytes);
        return ret;
 }
@@ -1407,12 +1405,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
        map->format.format_write(map, reg, val);
-        trace_regmap_hw_write_start(map->dev, reg, 1);
+        trace_regmap_hw_write_start(map, reg, 1);
        ret = map->bus->write(map->bus_context, map->work_buf,
                              map->format.buf_size);
-        trace_regmap_hw_write_done(map->dev, reg, 1);
+        trace_regmap_hw_write_done(map, reg, 1);
        return ret;
 }
@@ -1470,7 +1468,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
                dev_info(map->dev, "%x <= %x\n", reg, val);
 #endif
-        trace_regmap_reg_write(map->dev, reg, val);
+        trace_regmap_reg_write(map, reg, val);
        return map->reg_write(context, reg, val);
 }
@@ -1773,7 +1771,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
        for (i = 0; i < num_regs; i++) {
                int reg = regs[i].reg;
                int val = regs[i].def;
-                trace_regmap_hw_write_start(map->dev, reg, 1);
+                trace_regmap_hw_write_start(map, reg, 1);
                map->format.format_reg(u8, reg, map->reg_shift);
                u8 += reg_bytes + pad_bytes;
                map->format.format_val(u8, val, 0);
@@ -1788,7 +1786,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
        for (i = 0; i < num_regs; i++) {
                int reg = regs[i].reg;
-                trace_regmap_hw_write_done(map->dev, reg, 1);
+                trace_regmap_hw_write_done(map, reg, 1);
        }
        return ret;
 }
@@ -2059,15 +2057,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
         */
        u8[0] |= map->read_flag_mask;
-        trace_regmap_hw_read_start(map->dev, reg,
+        trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
-                                   val_len / map->format.val_bytes);
        ret = map->bus->read(map->bus_context, map->work_buf,
                             map->format.reg_bytes + map->format.pad_bytes,
                             val, val_len);
-        trace_regmap_hw_read_done(map->dev, reg,
+        trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
-                                  val_len / map->format.val_bytes);
        return ret;
 }
@@ -2123,7 +2119,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
                        dev_info(map->dev, "%x => %x\n", reg, *val);
 #endif
-                trace_regmap_reg_read(map->dev, reg, *val);
+                trace_regmap_reg_read(map, reg, *val);
                if (!map->cache_bypass)
                        regcache_write(map, reg, *val);
@@ -2480,7 +2476,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
        struct regmap *map = async->map;
        bool wake;
-        trace_regmap_async_io_complete(map->dev);
+        trace_regmap_async_io_complete(map);
        spin_lock(&map->async_lock);
        list_move(&async->list, &map->async_free);
@@ -2525,7 +2521,7 @@ int regmap_async_complete(struct regmap *map)
        if (!map->bus || !map->bus->async_write)
                return 0;
-        trace_regmap_async_complete_start(map->dev);
+        trace_regmap_async_complete_start(map);
        wait_event(map->async_waitq, regmap_async_is_done(map));
@@ -2534,7 +2530,7 @@ int regmap_async_complete(struct regmap *map)
        map->async_ret = 0;
        spin_unlock_irqrestore(&map->async_lock, flags);
-        trace_regmap_async_complete_done(map->dev);
+        trace_regmap_async_complete_done(map);
        return ret;
 }
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 4bc2a5cb9935..a98c41f72c63 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -803,10 +803,6 @@ static int __init nbd_init(void)
                return -EINVAL;
        }
-        nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
-        if (!nbd_dev)
-                return -ENOMEM;
        part_shift = 0;
        if (max_part > 0) {
                part_shift = fls(max_part);
@@ -828,6 +824,10 @@ static int __init nbd_init(void)
        if (nbds_max > 1UL << (MINORBITS - part_shift))
                return -EINVAL;
+        nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+        if (!nbd_dev)
+                return -ENOMEM;
        for (i = 0; i < nbds_max; i++) {
                struct gendisk *disk = alloc_disk(1 << part_shift);
                if (!disk)
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index ceb32dd52a6c..e23be20a3417 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -3003,6 +3003,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        }
        get_device(dev->device);
+        INIT_LIST_HEAD(&dev->node);
        INIT_WORK(&dev->probe_work, nvme_async_probe);
        schedule_work(&dev->probe_work);
        return 0;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index fae2dbbf5745..72d7028f779b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -142,6 +142,7 @@ struct ports_device {
         * notification
         */
        struct work_struct control_work;
+        struct work_struct config_work;
        struct list_head ports;
@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
        portdev = vdev->priv;
+        if (!use_multiport(portdev))
+                schedule_work(&portdev->config_work);
+}
+static void config_work_handler(struct work_struct *work)
+{
+        struct ports_device *portdev;
+        portdev = container_of(work, struct ports_device, control_work);
        if (!use_multiport(portdev)) {
+                struct virtio_device *vdev;
                struct port *port;
                u16 rows, cols;
+                vdev = portdev->vdev;
                virtio_cread(vdev, struct virtio_console_config, cols, &cols);
                virtio_cread(vdev, struct virtio_console_config, rows, &rows);
@@ -2040,12 +2052,14 @@ static int virtcons_probe(struct virtio_device *vdev)
        virtio_device_ready(portdev->vdev);
+        INIT_WORK(&portdev->config_work, &config_work_handler);
+        INIT_WORK(&portdev->control_work, &control_work_handler);
        if (multiport) {
                unsigned int nr_added_bufs;
                spin_lock_init(&portdev->c_ivq_lock);
                spin_lock_init(&portdev->c_ovq_lock);
-                INIT_WORK(&portdev->control_work, &control_work_handler);
                nr_added_bufs = fill_queue(portdev->c_ivq,
                                           &portdev->c_ivq_lock);
@@ -2113,6 +2127,8 @@ static void virtcons_remove(struct virtio_device *vdev)
        /* Finish up work that's lined up */
        if (use_multiport(portdev))
                cancel_work_sync(&portdev->control_work);
+        else
+                cancel_work_sync(&portdev->config_work);
        list_for_each_entry_safe(port, port2, &portdev->ports, list)
                unplug_port(port);
@@ -2164,6 +2180,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
        virtqueue_disable_cb(portdev->c_ivq);
        cancel_work_sync(&portdev->control_work);
+        cancel_work_sync(&portdev->config_work);
        /*
         * Once more: if control_work_handler() was running, it would
         * enable the cb as the last step.
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 68161f7a07d6..a0b036ccb118 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -192,6 +192,7 @@ config SYS_SUPPORTS_EM_STI
 config SH_TIMER_CMT
        bool "Renesas CMT timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
        default SYS_SUPPORTS_SH_CMT
        help
          This enables build of a clocksource and clockevent driver for
@@ -201,6 +202,7 @@ config SH_TIMER_CMT
 config SH_TIMER_MTU2
        bool "Renesas MTU2 timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
        default SYS_SUPPORTS_SH_MTU2
        help
          This enables build of a clockevent driver for the Multi-Function
@@ -210,6 +212,7 @@ config SH_TIMER_MTU2
 config SH_TIMER_TMU
        bool "Renesas TMU timer driver" if COMPILE_TEST
        depends on GENERIC_CLOCKEVENTS
+        depends on HAS_IOMEM
        default SYS_SUPPORTS_SH_TMU
        help
          This enables build of a clocksource and clockevent driver for
diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
index bba62f9deefb..ec57ba2bbd87 100644
--- a/drivers/clocksource/time-efm32.c
+++ b/drivers/clocksource/time-efm32.c
@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
        clock_event_ddata.base = base;
        clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
-        setup_irq(irq, &efm32_clock_event_irq);
        clockevents_config_and_register(&clock_event_ddata.evtdev,
                                        DIV_ROUND_CLOSEST(rate, 1024),
                                        0xf, 0xffff);
+        setup_irq(irq, &efm32_clock_event_irq);
        return 0;
 err_get_irq:
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
index 02268448dc85..58597fbcc046 100644
--- a/drivers/clocksource/timer-sun5i.c
+++ b/drivers/clocksource/timer-sun5i.c
@@ -17,7 +17,6 @@
 #include <linux/irq.h>
 #include <linux/irqreturn.h>
 #include <linux/reset.h>
-#include <linux/sched_clock.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
@@ -137,11 +136,6 @@ static struct irqaction sun5i_timer_irq = {
        .dev_id = &sun5i_clockevent,
 };
-static u64 sun5i_timer_sched_read(void)
-{
-        return ~readl(timer_base + TIMER_CNTVAL_LO_REG(1));
-}
 static void __init sun5i_timer_init(struct device_node *node)
 {
        struct reset_control *rstc;
@@ -172,16 +166,11 @@ static void __init sun5i_timer_init(struct device_node *node)
        writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
               timer_base + TIMER_CTL_REG(1));
-        sched_clock_register(sun5i_timer_sched_read, 32, rate);
        clocksource_mmio_init(timer_base + TIMER_CNTVAL_LO_REG(1), node->name,
                              rate, 340, 32, clocksource_mmio_readl_down);
        ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
-        ret = setup_irq(irq, &sun5i_timer_irq);
-        if (ret)
-                pr_warn("failed to setup irq %d\n", irq);
        /* Enable timer0 interrupt */
        val = readl(timer_base + TIMER_IRQ_EN_REG);
        writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
@@ -191,6 +180,10 @@ static void __init sun5i_timer_init(struct device_node *node)
        clockevents_config_and_register(&sun5i_clockevent, rate,
                                        TIMER_SYNC_TICKS, 0xffffffff);
+        ret = setup_irq(irq, &sun5i_timer_irq);
+        if (ret)
+                pr_warn("failed to setup irq %d\n", irq);
 }
 CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
                       sun5i_timer_init);
diff --git a/drivers/cpuidle/cpuidle-mvebu-v7.c b/drivers/cpuidle/cpuidle-mvebu-v7.c
index 38e68618513a..980151f34707 100644
--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
+++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cpuidle_device *dev,
                deepidle = true;
        ret = mvebu_v7_cpu_suspend(deepidle);
+        cpu_pm_exit();
        if (ret)
                return ret;
-        cpu_pm_exit();
        return index;
 }
@@ -50,17 +50,17 @@ static struct cpuidle_driver armadaxp_idle_driver = {
        .states[0]              = ARM_CPUIDLE_WFI_STATE,
        .states[1]              = {
                .enter                  = mvebu_v7_enter_idle,
-                .exit_latency           = 10,
+                .exit_latency           = 100,
                .power_usage            = 50,
-                .target_residency       = 100,
+                .target_residency       = 1000,
                .name                   = "MV CPU IDLE",
                .desc                   = "CPU power down",
        },
        .states[2]              = {
                .enter                  = mvebu_v7_enter_idle,
-                .exit_latency           = 100,
+                .exit_latency           = 1000,
                .power_usage            = 5,
-                .target_residency       = 1000,
+                .target_residency       = 10000,
                .flags                  = MVEBU_V7_FLAG_DEEP_IDLE,
                .name                   = "MV CPU DEEP IDLE",
                .desc                   = "CPU and L2 Fabric power down",
diff --git a/drivers/dma/amba-pl08x.c b/drivers/dma/amba-pl08x.c
index 4a5fd245014e..83aa55d6fa5d 100644
--- a/drivers/dma/amba-pl08x.c
+++ b/drivers/dma/amba-pl08x.c
@@ -97,6 +97,12 @@
 #define DRIVER_NAME     "pl08xdmac"
+#define PL80X_DMA_BUSWIDTHS \
+        BIT(DMA_SLAVE_BUSWIDTH_UNDEFINED) | \
+        BIT(DMA_SLAVE_BUSWIDTH_1_BYTE) | \
+        BIT(DMA_SLAVE_BUSWIDTH_2_BYTES) | \
+        BIT(DMA_SLAVE_BUSWIDTH_4_BYTES)
 static struct amba_driver pl08x_amba_driver;
 struct pl08x_driver_data;
@@ -2070,6 +2076,10 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
        pl08x->memcpy.device_pause = pl08x_pause;
        pl08x->memcpy.device_resume = pl08x_resume;
        pl08x->memcpy.device_terminate_all = pl08x_terminate_all;
+        pl08x->memcpy.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->memcpy.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->memcpy.directions = BIT(DMA_MEM_TO_MEM);
+        pl08x->memcpy.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
        /* Initialize slave engine */
        dma_cap_set(DMA_SLAVE, pl08x->slave.cap_mask);
@@ -2086,6 +2096,10 @@ static int pl08x_probe(struct amba_device *adev, const struct amba_id *id)
        pl08x->slave.device_pause = pl08x_pause;
        pl08x->slave.device_resume = pl08x_resume;
        pl08x->slave.device_terminate_all = pl08x_terminate_all;
+        pl08x->slave.src_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->slave.dst_addr_widths = PL80X_DMA_BUSWIDTHS;
+        pl08x->slave.directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
+        pl08x->slave.residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
        /* Get the platform data */
        pl08x->pd = dev_get_platdata(&adev->dev);
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 1e1a4c567542..0b4fc6fb48ce 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -238,93 +238,126 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
 }
 /*
- * atc_get_current_descriptors -
+ * atc_get_desc_by_cookie - get the descriptor of a cookie
- * locate the descriptor which equal to physical address in DSCR
+ * @atchan: the DMA channel
- * @atchan: the channel we want to start
+ * @cookie: the cookie to get the descriptor for
- * @dscr_addr: physical descriptor address in DSCR
 */
-static struct at_desc *atc_get_current_descriptors(struct at_dma_chan *atchan,
+static struct at_desc *atc_get_desc_by_cookie(struct at_dma_chan *atchan,
-                                                        u32 dscr_addr)
+                                                dma_cookie_t cookie)
 {
-        struct at_desc  *desc, *_desc, *child, *desc_cur = NULL;
+        struct at_desc *desc, *_desc;
-        list_for_each_entry_safe(desc, _desc, &atchan->active_list, desc_node) {
+        list_for_each_entry_safe(desc, _desc, &atchan->queue, desc_node) {
-                if (desc->lli.dscr == dscr_addr) {
+                if (desc->txd.cookie == cookie)
-                        desc_cur = desc;
+                        return desc;
-                        break;
+        }
-                }
-                list_for_each_entry(child, &desc->tx_list, desc_node) {
+        list_for_each_entry_safe(desc, _desc, &atchan->active_list, desc_node) {
-                        if (child->lli.dscr == dscr_addr) {
+                if (desc->txd.cookie == cookie)
-                                desc_cur = child;
+                        return desc;
-                                break;
-                        }
-                }
        }
-        return desc_cur;
+        return NULL;
 }
-/*
+/**
- * atc_get_bytes_left -
+ * atc_calc_bytes_left - calculates the number of bytes left according to the
- * Get the number of bytes residue in dma buffer,
+ * value read from CTRLA.
- * @chan: the channel we want to start
+ *
+ * @current_len: the number of bytes left before reading CTRLA
+ * @ctrla: the value of CTRLA
+ * @desc: the descriptor containing the transfer width
+ */
+static inline int atc_calc_bytes_left(int current_len, u32 ctrla,
+                                        struct at_desc *desc)
+{
+        return current_len - ((ctrla & ATC_BTSIZE_MAX) << desc->tx_width);
+}
+/**
+ * atc_calc_bytes_left_from_reg - calculates the number of bytes left according
+ * to the current value of CTRLA.
+ *
+ * @current_len: the number of bytes left before reading CTRLA
+ * @atchan: the channel to read CTRLA for
+ * @desc: the descriptor containing the transfer width
+ */
+static inline int atc_calc_bytes_left_from_reg(int current_len,
+                        struct at_dma_chan *atchan, struct at_desc *desc)
+{
+        u32 ctrla = channel_readl(atchan, CTRLA);
+        return atc_calc_bytes_left(current_len, ctrla, desc);
+}
+/**
+ * atc_get_bytes_left - get the number of bytes residue for a cookie
+ * @chan: DMA channel
+ * @cookie: transaction identifier to check status of
 */
-static int atc_get_bytes_left(struct dma_chan *chan)
+static int atc_get_bytes_left(struct dma_chan *chan, dma_cookie_t cookie)
 {
        struct at_dma_chan      *atchan = to_at_dma_chan(chan);
-        struct at_dma           *atdma = to_at_dma(chan->device);
-        int     chan_id = atchan->chan_common.chan_id;
        struct at_desc *desc_first = atc_first_active(atchan);
-        struct at_desc *desc_cur;
+        struct at_desc *desc;
-        int ret = 0, count = 0;
+        int ret;
+        u32 ctrla, dscr;
        /*
-         * Initialize necessary values in the first time.
+         * If the cookie doesn't match to the currently running transfer then
-         * remain_desc record remain desc length.
+         * we can return the total length of the associated DMA transfer,
+         * because it is still queued.
         */
-        if (atchan->remain_desc == 0)
+        desc = atc_get_desc_by_cookie(atchan, cookie);
-                /* First descriptor embedds the transaction length */
+        if (desc == NULL)
-                atchan->remain_desc = desc_first->len;
+                return -EINVAL;
+        else if (desc != desc_first)
+                return desc->total_len;
-        /*
+        /* cookie matches to the currently running transfer */
-         * This happens when current descriptor transfer complete.
+        ret = desc_first->total_len;
-         * The residual buffer size should reduce current descriptor length.
-         */
-        if (unlikely(test_bit(ATC_IS_BTC, &atchan->status))) {
-                clear_bit(ATC_IS_BTC, &atchan->status);
-                desc_cur = atc_get_current_descriptors(atchan,
-                                                channel_readl(atchan, DSCR));
-                if (!desc_cur) {
-                        ret = -EINVAL;
-                        goto out;
-                }
-                count = (desc_cur->lli.ctrla & ATC_BTSIZE_MAX)
+        if (desc_first->lli.dscr) {
-                        << desc_first->tx_width;
+                /* hardware linked list transfer */
-                if (atchan->remain_desc < count) {
-                        ret = -EINVAL;
+                /*
-                        goto out;
+                 * Calculate the residue by removing the length of the child
+                 * descriptors already transferred from the total length.
+                 * To get the current child descriptor we can use the value of
+                 * the channel's DSCR register and compare it against the value
+                 * of the hardware linked list structure of each child
+                 * descriptor.
+                 */
+                ctrla = channel_readl(atchan, CTRLA);
+                rmb(); /* ensure CTRLA is read before DSCR */
+                dscr = channel_readl(atchan, DSCR);
+                /* for the first descriptor we can be more accurate */
+                if (desc_first->lli.dscr == dscr)
+                        return atc_calc_bytes_left(ret, ctrla, desc_first);
+                ret -= desc_first->len;
+                list_for_each_entry(desc, &desc_first->tx_list, desc_node) {
+                        if (desc->lli.dscr == dscr)
+                                break;
+                        ret -= desc->len;
                }
-                atchan->remain_desc -= count;
-                ret = atchan->remain_desc;
-        } else {
                /*
-                 * Get residual bytes when current
+                 * For the last descriptor in the chain we can calculate
-                 * descriptor transfer in progress.
+                 * the remaining bytes using the channel's register.
+                 * Note that the transfer width of the first and last
+                 * descriptor may differ.
                 */
-                count = (channel_readl(atchan, CTRLA) & ATC_BTSIZE_MAX)
+                if (!desc->lli.dscr)
-                                << (desc_first->tx_width);
+                        ret = atc_calc_bytes_left_from_reg(ret, atchan, desc);
-                ret = atchan->remain_desc - count;
+        } else {
+                /* single transfer */
+                ret = atc_calc_bytes_left_from_reg(ret, atchan, desc_first);
        }
-        /*
-         * Check fifo empty.
-         */
-        if (!(dma_readl(atdma, CHSR) & AT_DMA_EMPT(chan_id)))
-                atc_issue_pending(chan);
-out:
        return ret;
 }
@@ -539,8 +572,6 @@ static irqreturn_t at_dma_interrupt(int irq, void *dev_id)
                                        /* Give information to tasklet */
                                        set_bit(ATC_IS_ERROR, &atchan->status);
                                }
-                                if (pending & AT_DMA_BTC(i))
-                                        set_bit(ATC_IS_BTC, &atchan->status);
                                tasklet_schedule(&atchan->tasklet);
                                ret = IRQ_HANDLED;
                        }
@@ -653,14 +684,18 @@ atc_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
                desc->lli.ctrlb = ctrlb;
                desc->txd.cookie = 0;
+                desc->len = xfer_count << src_width;
                atc_desc_chain(&first, &prev, desc);
        }
        /* First descriptor of the chain embedds additional information */
        first->txd.cookie = -EBUSY;
-        first->len = len;
+        first->total_len = len;
+        /* set transfer width for the calculation of the residue */
        first->tx_width = src_width;
+        prev->tx_width = src_width;
        /* set end-of-link to the last link descriptor of list*/
        set_desc_eol(desc);
@@ -752,6 +787,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                                        | ATC_SRC_WIDTH(mem_width)
                                        | len >> mem_width;
                        desc->lli.ctrlb = ctrlb;
+                        desc->len = len;
                        atc_desc_chain(&first, &prev, desc);
                        total_len += len;
@@ -792,6 +828,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                                        | ATC_DST_WIDTH(mem_width)
                                        | len >> reg_width;
                        desc->lli.ctrlb = ctrlb;
+                        desc->len = len;
                        atc_desc_chain(&first, &prev, desc);
                        total_len += len;
@@ -806,8 +843,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
        /* First descriptor of the chain embedds additional information */
        first->txd.cookie = -EBUSY;
-        first->len = total_len;
+        first->total_len = total_len;
+        /* set transfer width for the calculation of the residue */
        first->tx_width = reg_width;
+        prev->tx_width = reg_width;
        /* first link descriptor of list is responsible of flags */
        first->txd.flags = flags; /* client is in control of this ack */
@@ -872,6 +912,7 @@ atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
                                | ATC_FC_MEM2PER
                                | ATC_SIF(atchan->mem_if)
                                | ATC_DIF(atchan->per_if);
+                desc->len = period_len;
                break;
        case DMA_DEV_TO_MEM:
@@ -883,6 +924,7 @@ atc_dma_cyclic_fill_desc(struct dma_chan *chan, struct at_desc *desc,
                                | ATC_FC_PER2MEM
                                | ATC_SIF(atchan->per_if)
                                | ATC_DIF(atchan->mem_if);
+                desc->len = period_len;
                break;
        default:
@@ -964,7 +1006,7 @@ atc_prep_dma_cyclic(struct dma_chan *chan, dma_addr_t buf_addr, size_t buf_len,
        /* First descriptor of the chain embedds additional information */
        first->txd.cookie = -EBUSY;
-        first->len = buf_len;
+        first->total_len = buf_len;
        first->tx_width = reg_width;
        return &first->txd;
@@ -1118,7 +1160,7 @@ atc_tx_status(struct dma_chan *chan,
        spin_lock_irqsave(&atchan->lock, flags);
        /*  Get number of bytes left in the active transactions */
-        bytes = atc_get_bytes_left(chan);
+        bytes = atc_get_bytes_left(chan, cookie);
        spin_unlock_irqrestore(&atchan->lock, flags);
@@ -1214,7 +1256,6 @@ static int atc_alloc_chan_resources(struct dma_chan *chan)
        spin_lock_irqsave(&atchan->lock, flags);
        atchan->descs_allocated = i;
-        atchan->remain_desc = 0;
        list_splice(&tmp_list, &atchan->free_list);
        dma_cookie_init(chan);
        spin_unlock_irqrestore(&atchan->lock, flags);
@@ -1257,7 +1298,6 @@ static void atc_free_chan_resources(struct dma_chan *chan)
        list_splice_init(&atchan->free_list, &list);
        atchan->descs_allocated = 0;
        atchan->status = 0;
-        atchan->remain_desc = 0;
        dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
 }
diff --git a/drivers/dma/at_hdmac_regs.h b/drivers/dma/at_hdmac_regs.h
index d6bba6c636c2..2727ca560572 100644
--- a/drivers/dma/at_hdmac_regs.h
+++ b/drivers/dma/at_hdmac_regs.h
@@ -181,8 +181,9 @@ struct at_lli {
 * @at_lli: hardware lli structure
 * @txd: support for the async_tx api
 * @desc_node: node on the channed descriptors list
- * @len: total transaction bytecount
+ * @len: descriptor byte count
 * @tx_width: transfer width
+ * @total_len: total transaction byte count
 */
 struct at_desc {
        /* FIRST values the hardware uses */
@@ -194,6 +195,7 @@ struct at_desc {
        struct list_head                desc_node;
        size_t                          len;
        u32                             tx_width;
+        size_t                          total_len;
 };
 static inline struct at_desc *
@@ -213,7 +215,6 @@ txd_to_at_desc(struct dma_async_tx_descriptor *txd)
 enum atc_status {
        ATC_IS_ERROR = 0,
        ATC_IS_PAUSED = 1,
-        ATC_IS_BTC = 2,
        ATC_IS_CYCLIC = 24,
 };
@@ -231,7 +232,6 @@ enum atc_status {
 * @save_cfg: configuration register that is saved on suspend/resume cycle
 * @save_dscr: for cyclic operations, preserve next descriptor address in
 *             the cyclic list on suspend/resume cycle
- * @remain_desc: to save remain desc length
 * @dma_sconfig: configuration for slave transfers, passed via
 * .device_config
 * @lock: serializes enqueue/dequeue operations to descriptors lists
@@ -251,7 +251,6 @@ struct at_dma_chan {
        struct tasklet_struct   tasklet;
        u32                     save_cfg;
        u32                     save_dscr;
-        u32                     remain_desc;
        struct dma_slave_config dma_sconfig;
        spinlock_t              lock;
diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
index 6565a361e7e5..b2c3ae071429 100644
--- a/drivers/dma/dw/platform.c
+++ b/drivers/dma/dw/platform.c
@@ -26,6 +26,8 @@
 #include "internal.h"
+#define DRV_NAME        "dw_dmac"
 static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
                                        struct of_dma *ofdma)
 {
@@ -284,7 +286,7 @@ static struct platform_driver dw_driver = {
        .remove         = dw_remove,
        .shutdown       = dw_shutdown,
        .driver = {
-                .name   = "dw_dmac",
+                .name   = DRV_NAME,
                .pm     = &dw_dev_pm_ops,
                .of_match_table = of_match_ptr(dw_dma_of_id_table),
                .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
@@ -305,3 +307,4 @@ module_exit(dw_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 18c0a131e4e4..66a0efb9651d 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -531,6 +531,10 @@ static int sdma_run_channel0(struct sdma_engine *sdma)
                dev_err(sdma->dev, "Timeout waiting for CH0 ready\n");
        }
+        /* Set bits of CONFIG register with dynamic context switching */
+        if (readl(sdma->regs + SDMA_H_CONFIG) == 0)
+                writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
        return ret ? 0 : -ETIMEDOUT;
 }
@@ -1394,9 +1398,6 @@ static int sdma_init(struct sdma_engine *sdma)
        writel_relaxed(ccb_phys, sdma->regs + SDMA_H_C0PTR);
-        /* Set bits of CONFIG register with given context switching mode */
-        writel_relaxed(SDMA_H_CONFIG_CSM, sdma->regs + SDMA_H_CONFIG);
        /* Initializes channel's priorities */
        sdma_set_channel_priority(&sdma->channel[0], 7);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index d7174300f501..69af73f15310 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -649,6 +649,7 @@ static int create_sdma_queue_nocpsch(struct device_queue_manager *dqm,
        pr_debug("     sdma queue id: %d\n", q->properties.sdma_queue_id);
        pr_debug("     sdma engine id: %d\n", q->properties.sdma_engine_id);
+        init_sdma_vm(dqm, q, qpd);
        retval = mqd->init_mqd(mqd, &q->mqd, &q->mqd_mem_obj,
                                &q->gart_mqd_addr, &q->properties);
        if (retval != 0) {
@@ -656,7 +657,14 @@ static int create_sdma_queue_nocpsch(struct device_queue_manager *dqm,
                return retval;
        }
-        init_sdma_vm(dqm, q, qpd);
+        retval = mqd->load_mqd(mqd, q->mqd, 0,
+                                0, NULL);
+        if (retval != 0) {
+                deallocate_sdma_queue(dqm, q->sdma_id);
+                mqd->uninit_mqd(mqd, q->mqd, q->mqd_mem_obj);
+                return retval;
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
index e415a2a9207e..c7d298e62c96 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -44,7 +44,7 @@ static bool initialize(struct kernel_queue *kq, struct kfd_dev *dev,
        BUG_ON(!kq || !dev);
        BUG_ON(type != KFD_QUEUE_TYPE_DIQ && type != KFD_QUEUE_TYPE_HIQ);
-        pr_debug("kfd: In func %s initializing queue type %d size %d\n",
+        pr_debug("amdkfd: In func %s initializing queue type %d size %d\n",
                        __func__, KFD_QUEUE_TYPE_HIQ, queue_size);
        nop.opcode = IT_NOP;
@@ -69,12 +69,16 @@ static bool initialize(struct kernel_queue *kq, struct kfd_dev *dev,
        prop.doorbell_ptr = kfd_get_kernel_doorbell(dev, &prop.doorbell_off);
-        if (prop.doorbell_ptr == NULL)
+        if (prop.doorbell_ptr == NULL) {
+                pr_err("amdkfd: error init doorbell");
                goto err_get_kernel_doorbell;
+        }
        retval = kfd_gtt_sa_allocate(dev, queue_size, &kq->pq);
-        if (retval != 0)
+        if (retval != 0) {
+                pr_err("amdkfd: error init pq queues size (%d)\n", queue_size);
                goto err_pq_allocate_vidmem;
+        }
        kq->pq_kernel_addr = kq->pq->cpu_ptr;
        kq->pq_gpu_addr = kq->pq->gpu_addr;
@@ -165,10 +169,8 @@ err_rptr_allocate_vidmem:
 err_eop_allocate_vidmem:
        kfd_gtt_sa_free(dev, kq->pq);
 err_pq_allocate_vidmem:
-        pr_err("kfd: error init pq\n");
        kfd_release_kernel_doorbell(dev, prop.doorbell_ptr);
 err_get_kernel_doorbell:
-        pr_err("kfd: error init doorbell");
        return false;
 }
@@ -187,6 +189,8 @@ static void uninitialize(struct kernel_queue *kq)
        else if (kq->queue->properties.type == KFD_QUEUE_TYPE_DIQ)
                kfd_gtt_sa_free(kq->dev, kq->fence_mem_obj);
+        kq->mqd->uninit_mqd(kq->mqd, kq->queue->mqd, kq->queue->mqd_mem_obj);
        kfd_gtt_sa_free(kq->dev, kq->rptr_mem);
        kfd_gtt_sa_free(kq->dev, kq->wptr_mem);
        kq->ops_asic_specific.uninitialize(kq);
@@ -211,7 +215,7 @@ static int acquire_packet_buffer(struct kernel_queue *kq,
        queue_address = (unsigned int *)kq->pq_kernel_addr;
        queue_size_dwords = kq->queue->properties.queue_size / sizeof(uint32_t);
-        pr_debug("kfd: In func %s\nrptr: %d\nwptr: %d\nqueue_address 0x%p\n",
+        pr_debug("amdkfd: In func %s\nrptr: %d\nwptr: %d\nqueue_address 0x%p\n",
                        __func__, rptr, wptr, queue_address);
        available_size = (rptr - 1 - wptr + queue_size_dwords) %
@@ -296,7 +300,7 @@ struct kernel_queue *kernel_queue_init(struct kfd_dev *dev,
        }
        if (kq->ops.initialize(kq, dev, type, KFD_KERNEL_QUEUE_SIZE) == false) {
-                pr_err("kfd: failed to init kernel queue\n");
+                pr_err("amdkfd: failed to init kernel queue\n");
                kfree(kq);
                return NULL;
        }
@@ -319,7 +323,7 @@ static __attribute__((unused)) void test_kq(struct kfd_dev *dev)
        BUG_ON(!dev);
-        pr_err("kfd: starting kernel queue test\n");
+        pr_err("amdkfd: starting kernel queue test\n");
        kq = kernel_queue_init(dev, KFD_QUEUE_TYPE_HIQ);
        BUG_ON(!kq);
@@ -330,7 +334,7 @@ static __attribute__((unused)) void test_kq(struct kfd_dev *dev)
                buffer[i] = kq->nop_packet;
        kq->ops.submit_packet(kq);
-        pr_err("kfd: ending kernel queue test\n");
+        pr_err("amdkfd: ending kernel queue test\n");
 }
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index a5e74612100e..0a6780367d28 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -50,7 +50,7 @@ config DRM_EXYNOS_DSI
 config DRM_EXYNOS_DP
        bool "EXYNOS DRM DP driver support"
-        depends on (DRM_EXYNOS_FIMD || DRM_EXYNOS7DECON) && ARCH_EXYNOS && (DRM_PTN3460=n || DRM_PTN3460=y || DRM_PTN3460=DRM_EXYNOS)
+        depends on (DRM_EXYNOS_FIMD || DRM_EXYNOS7_DECON) && ARCH_EXYNOS && (DRM_PTN3460=n || DRM_PTN3460=y || DRM_PTN3460=DRM_EXYNOS)
        default DRM_EXYNOS
        select DRM_PANEL
        help
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index 63f02e2380ae..970046199608 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -888,8 +888,8 @@ static int decon_probe(struct platform_device *pdev)
        of_node_put(i80_if_timings);
        ctx->regs = of_iomap(dev->of_node, 0);
-        if (IS_ERR(ctx->regs)) {
+        if (!ctx->regs) {
-                ret = PTR_ERR(ctx->regs);
+                ret = -ENOMEM;
                goto err_del_component;
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
deleted file mode 100644
index ba9b3d5ed672..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ /dev/null
@@ -1,245 +0,0 @@
-/*
- * Copyright (c) 2011 Samsung Electronics Co., Ltd.
- * Authors:
- *      Inki Dae <inki.dae@samsung.com>
- *      Joonyoung Shim <jy0922.shim@samsung.com>
- *      Seung-Woo Kim <sw0312.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#include <drm/drmP.h>
-#include <drm/drm_crtc_helper.h>
-#include <drm/exynos_drm.h>
-#include "exynos_drm_drv.h"
-#include "exynos_drm_encoder.h"
-#include "exynos_drm_connector.h"
-#define to_exynos_connector(x)  container_of(x, struct exynos_drm_connector,\
-                                drm_connector)
-struct exynos_drm_connector {
-        struct drm_connector            drm_connector;
-        uint32_t                        encoder_id;
-        struct exynos_drm_display       *display;
-};
-static int exynos_drm_connector_get_modes(struct drm_connector *connector)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        struct edid *edid = NULL;
-        unsigned int count = 0;
-        int ret;
-        /*
-         * if get_edid() exists then get_edid() callback of hdmi side
-         * is called to get edid data through i2c interface else
-         * get timing from the FIMD driver(display controller).
-         *
-         * P.S. in case of lcd panel, count is always 1 if success
-         * because lcd panel has only one mode.
-         */
-        if (display->ops->get_edid) {
-                edid = display->ops->get_edid(display, connector);
-                if (IS_ERR_OR_NULL(edid)) {
-                        ret = PTR_ERR(edid);
-                        edid = NULL;
-                        DRM_ERROR("Panel operation get_edid failed %d\n", ret);
-                        goto out;
-                }
-                count = drm_add_edid_modes(connector, edid);
-                if (!count) {
-                        DRM_ERROR("Add edid modes failed %d\n", count);
-                        goto out;
-                }
-                drm_mode_connector_update_edid_property(connector, edid);
-        } else {
-                struct exynos_drm_panel_info *panel;
-                struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                if (!mode) {
-                        DRM_ERROR("failed to create a new display mode.\n");
-                        return 0;
-                }
-                if (display->ops->get_panel)
-                        panel = display->ops->get_panel(display);
-                else {
-                        drm_mode_destroy(connector->dev, mode);
-                        return 0;
-                }
-                drm_display_mode_from_videomode(&panel->vm, mode);
-                mode->width_mm = panel->width_mm;
-                mode->height_mm = panel->height_mm;
-                connector->display_info.width_mm = mode->width_mm;
-                connector->display_info.height_mm = mode->height_mm;
-                mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
-                drm_mode_set_name(mode);
-                drm_mode_probed_add(connector, mode);
-                count = 1;
-        }
-out:
-        kfree(edid);
-        return count;
-}
-static int exynos_drm_connector_mode_valid(struct drm_connector *connector,
-                                            struct drm_display_mode *mode)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        int ret = MODE_BAD;
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (display->ops->check_mode)
-                if (!display->ops->check_mode(display, mode))
-                        ret = MODE_OK;
-        return ret;
-}
-static struct drm_encoder *exynos_drm_best_encoder(
-                struct drm_connector *connector)
-{
-        struct drm_device *dev = connector->dev;
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        return drm_encoder_find(dev, exynos_connector->encoder_id);
-}
-static struct drm_connector_helper_funcs exynos_connector_helper_funcs = {
-        .get_modes      = exynos_drm_connector_get_modes,
-        .mode_valid     = exynos_drm_connector_mode_valid,
-        .best_encoder   = exynos_drm_best_encoder,
-};
-static int exynos_drm_connector_fill_modes(struct drm_connector *connector,
-                                unsigned int max_width, unsigned int max_height)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        unsigned int width, height;
-        width = max_width;
-        height = max_height;
-        /*
-         * if specific driver want to find desired_mode using maxmum
-         * resolution then get max width and height from that driver.
-         */
-        if (display->ops->get_max_resol)
-                display->ops->get_max_resol(display, &width, &height);
-        return drm_helper_probe_single_connector_modes(connector, width,
-                                                        height);
-}
-/* get detection status of display device. */
-static enum drm_connector_status
-exynos_drm_connector_detect(struct drm_connector *connector, bool force)
-{
-        struct exynos_drm_connector *exynos_connector =
-                                        to_exynos_connector(connector);
-        struct exynos_drm_display *display = exynos_connector->display;
-        enum drm_connector_status status = connector_status_disconnected;
-        if (display->ops->is_connected) {
-                if (display->ops->is_connected(display))
-                        status = connector_status_connected;
-                else
-                        status = connector_status_disconnected;
-        }
-        return status;
-}
-static void exynos_drm_connector_destroy(struct drm_connector *connector)
-{
-        struct exynos_drm_connector *exynos_connector =
-                to_exynos_connector(connector);
-        drm_connector_unregister(connector);
-        drm_connector_cleanup(connector);
-        kfree(exynos_connector);
-}
-static struct drm_connector_funcs exynos_connector_funcs = {
-        .dpms           = drm_helper_connector_dpms,
-        .fill_modes     = exynos_drm_connector_fill_modes,
-        .detect         = exynos_drm_connector_detect,
-        .destroy        = exynos_drm_connector_destroy,
-};
-struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
-                                                   struct drm_encoder *encoder)
-{
-        struct exynos_drm_connector *exynos_connector;
-        struct exynos_drm_display *display = exynos_drm_get_display(encoder);
-        struct drm_connector *connector;
-        int type;
-        int err;
-        exynos_connector = kzalloc(sizeof(*exynos_connector), GFP_KERNEL);
-        if (!exynos_connector)
-                return NULL;
-        connector = &exynos_connector->drm_connector;
-        switch (display->type) {
-        case EXYNOS_DISPLAY_TYPE_HDMI:
-                type = DRM_MODE_CONNECTOR_HDMIA;
-                connector->interlace_allowed = true;
-                connector->polled = DRM_CONNECTOR_POLL_HPD;
-                break;
-        case EXYNOS_DISPLAY_TYPE_VIDI:
-                type = DRM_MODE_CONNECTOR_VIRTUAL;
-                connector->polled = DRM_CONNECTOR_POLL_HPD;
-                break;
-        default:
-                type = DRM_MODE_CONNECTOR_Unknown;
-                break;
-        }
-        drm_connector_init(dev, connector, &exynos_connector_funcs, type);
-        drm_connector_helper_add(connector, &exynos_connector_helper_funcs);
-        err = drm_connector_register(connector);
-        if (err)
-                goto err_connector;
-        exynos_connector->encoder_id = encoder->base.id;
-        exynos_connector->display = display;
-        connector->dpms = DRM_MODE_DPMS_OFF;
-        connector->encoder = encoder;
-        err = drm_mode_connector_attach_encoder(connector, encoder);
-        if (err) {
-                DRM_ERROR("failed to attach a connector to a encoder\n");
-                goto err_sysfs;
-        }
-        DRM_DEBUG_KMS("connector has been created\n");
-        return connector;
-err_sysfs:
-        drm_connector_unregister(connector);
-err_connector:
-        drm_connector_cleanup(connector);
-        kfree(exynos_connector);
-        return NULL;
-}
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.h b/drivers/gpu/drm/exynos/exynos_drm_connector.h
deleted file mode 100644
index 4eb20d78379a..000000000000
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/*
- * Copyright (c) 2011 Samsung Electronics Co., Ltd.
- * Authors:
- *      Inki Dae <inki.dae@samsung.com>
- *      Joonyoung Shim <jy0922.shim@samsung.com>
- *      Seung-Woo Kim <sw0312.kim@samsung.com>
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#ifndef _EXYNOS_DRM_CONNECTOR_H_
-#define _EXYNOS_DRM_CONNECTOR_H_
-struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
-                                                   struct drm_encoder *encoder);
-#endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 925fc69af1a0..c300e22da8ac 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -284,14 +284,9 @@ static void fimd_clear_channel(struct fimd_context *ctx)
        }
 }
-static int fimd_ctx_initialize(struct fimd_context *ctx,
+static int fimd_iommu_attach_devices(struct fimd_context *ctx,
                        struct drm_device *drm_dev)
 {
-        struct exynos_drm_private *priv;
-        priv = drm_dev->dev_private;
-        ctx->drm_dev = drm_dev;
-        ctx->pipe = priv->pipe++;
        /* attach this sub driver to iommu mapping if supported. */
        if (is_drm_iommu_supported(ctx->drm_dev)) {
@@ -313,7 +308,7 @@ static int fimd_ctx_initialize(struct fimd_context *ctx,
        return 0;
 }
-static void fimd_ctx_remove(struct fimd_context *ctx)
+static void fimd_iommu_detach_devices(struct fimd_context *ctx)
 {
        /* detach this sub driver from iommu mapping if supported. */
        if (is_drm_iommu_supported(ctx->drm_dev))
@@ -1056,25 +1051,23 @@ static int fimd_bind(struct device *dev, struct device *master, void *data)
 {
        struct fimd_context *ctx = dev_get_drvdata(dev);
        struct drm_device *drm_dev = data;
+        struct exynos_drm_private *priv = drm_dev->dev_private;
        int ret;
-        ret = fimd_ctx_initialize(ctx, drm_dev);
+        ctx->drm_dev = drm_dev;
-        if (ret) {
+        ctx->pipe = priv->pipe++;
-                DRM_ERROR("fimd_ctx_initialize failed.\n");
-                return ret;
-        }
        ctx->crtc = exynos_drm_crtc_create(drm_dev, ctx->pipe,
                                           EXYNOS_DISPLAY_TYPE_LCD,
                                           &fimd_crtc_ops, ctx);
-        if (IS_ERR(ctx->crtc)) {
-                fimd_ctx_remove(ctx);
-                return PTR_ERR(ctx->crtc);
-        }
        if (ctx->display)
                exynos_drm_create_enc_conn(drm_dev, ctx->display);
+        ret = fimd_iommu_attach_devices(ctx, drm_dev);
+        if (ret)
+                return ret;
        return 0;
 }
@@ -1086,10 +1079,10 @@ static void fimd_unbind(struct device *dev, struct device *master,
        fimd_dpms(ctx->crtc, DRM_MODE_DPMS_OFF);
+        fimd_iommu_detach_devices(ctx);
        if (ctx->display)
                exynos_dpi_remove(ctx->display);
-        fimd_ctx_remove(ctx);
 }
 static const struct component_ops fimd_component_ops = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index a5616872eee7..8ad5b7294eb4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -175,7 +175,7 @@ static int exynos_disable_plane(struct drm_plane *plane)
        struct exynos_drm_plane *exynos_plane = to_exynos_plane(plane);
        struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(plane->crtc);
-        if (exynos_crtc->ops->win_disable)
+        if (exynos_crtc && exynos_crtc->ops->win_disable)
                exynos_crtc->ops->win_disable(exynos_crtc,
                                              exynos_plane->zpos);
diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index d3ebaf204408..a69002e2257d 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -28,6 +28,7 @@ i915-y += i915_cmd_parser.o \
          i915_gem_execbuffer.o \
          i915_gem_gtt.o \
          i915_gem.o \
+          i915_gem_shrinker.o \
          i915_gem_stolen.o \
          i915_gem_tiling.o \
          i915_gem_userptr.o \
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 1a52d6ab0f80..007c7d7d8295 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1200,6 +1200,9 @@ static int i915_frequency_info(struct seq_file *m, void *unused)
                seq_printf(m, "Max overclocked frequency: %dMHz\n",
                           intel_gpu_freq(dev_priv, dev_priv->rps.max_freq));
+                seq_printf(m, "Idle freq: %d MHz\n",
+                           intel_gpu_freq(dev_priv, dev_priv->rps.idle_freq));
        } else if (IS_VALLEYVIEW(dev)) {
                u32 freq_sts;
@@ -1214,6 +1217,9 @@ static int i915_frequency_info(struct seq_file *m, void *unused)
                seq_printf(m, "min GPU freq: %d MHz\n",
                           intel_gpu_freq(dev_priv, dev_priv->rps.min_freq));
+                seq_printf(m, "idle GPU freq: %d MHz\n",
+                           intel_gpu_freq(dev_priv, dev_priv->rps.idle_freq));
                seq_printf(m,
                           "efficient (RPe) frequency: %d MHz\n",
                           intel_gpu_freq(dev_priv, dev_priv->rps.efficient_freq));
@@ -2308,7 +2314,7 @@ static int i915_sink_crc(struct seq_file *m, void *data)
        u8 crc[6];
        drm_modeset_lock_all(dev);
-        for_each_intel_encoder(dev, connector) {
+        for_each_intel_connector(dev, connector) {
                if (connector->base.dpms != DRM_MODE_DPMS_ON)
                        continue;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index d49ed68f041e..68e0c85a17cf 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1199,7 +1199,7 @@ const struct drm_ioctl_desc i915_ioctls[] = {
        DRM_IOCTL_DEF_DRV(I915_OVERLAY_PUT_IMAGE, intel_overlay_put_image, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
        DRM_IOCTL_DEF_DRV(I915_OVERLAY_ATTRS, intel_overlay_attrs, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
        DRM_IOCTL_DEF_DRV(I915_SET_SPRITE_COLORKEY, intel_sprite_set_colorkey, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
-        DRM_IOCTL_DEF_DRV(I915_GET_SPRITE_COLORKEY, intel_sprite_get_colorkey, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
+        DRM_IOCTL_DEF_DRV(I915_GET_SPRITE_COLORKEY, drm_noop, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
        DRM_IOCTL_DEF_DRV(I915_GEM_WAIT, i915_gem_wait_ioctl, DRM_AUTH|DRM_UNLOCKED|DRM_RENDER_ALLOW),
        DRM_IOCTL_DEF_DRV(I915_GEM_CONTEXT_CREATE, i915_gem_context_create_ioctl, DRM_UNLOCKED|DRM_RENDER_ALLOW),
        DRM_IOCTL_DEF_DRV(I915_GEM_CONTEXT_DESTROY, i915_gem_context_destroy_ioctl, DRM_UNLOCKED|DRM_RENDER_ALLOW),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 8ba7e1b7b733..e326ac9730cf 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -56,7 +56,7 @@
 #define DRIVER_NAME             "i915"
 #define DRIVER_DESC             "Intel Graphics"
-#define DRIVER_DATE             "20150313"
+#define DRIVER_DATE             "20150327"
 #undef WARN_ON
 /* Many gcc seem to no see through this and fall over :( */
@@ -427,6 +427,8 @@ struct drm_i915_error_state {
        u32 forcewake;
        u32 error; /* gen6+ */
        u32 err_int; /* gen7 */
+        u32 fault_data0; /* gen8, gen9 */
+        u32 fault_data1; /* gen8, gen9 */
        u32 done_reg;
        u32 gac_eco;
        u32 gam_ecochk;
@@ -544,7 +546,7 @@ struct drm_i915_display_funcs {
         * Returns true on success, false on failure.
         */
        bool (*find_dpll)(const struct intel_limit *limit,
-                          struct intel_crtc *crtc,
+                          struct intel_crtc_state *crtc_state,
                          int target, int refclk,
                          struct dpll *match_clock,
                          struct dpll *best_clock);
@@ -553,7 +555,7 @@ struct drm_i915_display_funcs {
                                 struct drm_crtc *crtc,
                                 uint32_t sprite_width, uint32_t sprite_height,
                                 int pixel_size, bool enable, bool scaled);
-        void (*modeset_global_resources)(struct drm_device *dev);
+        void (*modeset_global_resources)(struct drm_atomic_state *state);
        /* Returns the active state of the crtc, and if the crtc is active,
         * fills out the pipe-config with the hw state. */
        bool (*get_pipe_config)(struct intel_crtc *,
@@ -1025,13 +1027,12 @@ struct intel_gen6_power_mgmt {
        u8 max_freq_softlimit;  /* Max frequency permitted by the driver */
        u8 max_freq;            /* Maximum frequency, RP0 if not overclocking */
        u8 min_freq;            /* AKA RPn. Minimum frequency */
+        u8 idle_freq;           /* Frequency to request when we are idle */
        u8 efficient_freq;      /* AKA RPe. Pre-determined balanced frequency */
        u8 rp1_freq;            /* "less than" RP0 power/freqency */
        u8 rp0_freq;            /* Non-overclocked max frequency. */
        u32 cz_freq;
-        u32 ei_interrupt_count;
        int last_adj;
        enum { LOW_POWER, BETWEEN, HIGH_POWER } power;
@@ -2442,7 +2443,6 @@ extern int i915_resume_legacy(struct drm_device *dev);
 struct i915_params {
        int modeset;
        int panel_ignore_lid;
-        unsigned int powersave;
        int semaphores;
        unsigned int lvds_downclock;
        int lvds_channel_mode;
@@ -2462,6 +2462,7 @@ struct i915_params {
        bool enable_hangcheck;
        bool fastboot;
        bool prefault_disable;
+        bool load_detect_test;
        bool reset;
        bool disable_display;
        bool disable_vtd_wa;
@@ -2601,12 +2602,6 @@ int i915_gem_get_aperture_ioctl(struct drm_device *dev, void *data,
 int i915_gem_wait_ioctl(struct drm_device *dev, void *data,
                        struct drm_file *file_priv);
 void i915_gem_load(struct drm_device *dev);
-unsigned long i915_gem_shrink(struct drm_i915_private *dev_priv,
-                              long target,
-                              unsigned flags);
-#define I915_SHRINK_PURGEABLE 0x1
-#define I915_SHRINK_UNBOUND 0x2
-#define I915_SHRINK_BOUND 0x4
 void *i915_gem_object_alloc(struct drm_device *dev);
 void i915_gem_object_free(struct drm_i915_gem_object *obj);
 void i915_gem_object_init(struct drm_i915_gem_object *obj,
@@ -2623,20 +2618,16 @@ void i915_gem_vma_destroy(struct i915_vma *vma);
 #define PIN_GLOBAL 0x4
 #define PIN_OFFSET_BIAS 0x8
 #define PIN_OFFSET_MASK (~4095)
-int __must_check i915_gem_object_pin_view(struct drm_i915_gem_object *obj,
+int __must_check
-                                          struct i915_address_space *vm,
+i915_gem_object_pin(struct drm_i915_gem_object *obj,
-                                          uint32_t alignment,
+                    struct i915_address_space *vm,
-                                          uint64_t flags,
+                    uint32_t alignment,
-                                          const struct i915_ggtt_view *view);
+                    uint64_t flags);
-static inline
+int __must_check
-int __must_check i915_gem_object_pin(struct drm_i915_gem_object *obj,
+i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
-                                     struct i915_address_space *vm,
+                         const struct i915_ggtt_view *view,
-                                     uint32_t alignment,
+                         uint32_t alignment,
-                                     uint64_t flags)
+                         uint64_t flags);
-{
-        return i915_gem_object_pin_view(obj, vm, alignment, flags,
-                                                &i915_ggtt_view_normal);
-}
 int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
                  u32 flags);
@@ -2776,8 +2767,10 @@ i915_gem_object_set_to_cpu_domain(struct drm_i915_gem_object *obj, bool write);
 int __must_check
 i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                     u32 alignment,
-                                     struct intel_engine_cs *pipelined);
+                                     struct intel_engine_cs *pipelined,
-void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj);
+                                     const struct i915_ggtt_view *view);
+void i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj,
+                                              const struct i915_ggtt_view *view);
 int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj,
                                int align);
 int i915_gem_open(struct drm_device *dev, struct drm_file *file);
@@ -2800,60 +2793,46 @@ struct dma_buf *i915_gem_prime_export(struct drm_device *dev,
 void i915_gem_restore_fences(struct drm_device *dev);
-unsigned long i915_gem_obj_offset_view(struct drm_i915_gem_object *o,
+unsigned long
-                                       struct i915_address_space *vm,
+i915_gem_obj_ggtt_offset_view(struct drm_i915_gem_object *o,
-                                       enum i915_ggtt_view_type view);
+                              const struct i915_ggtt_view *view);
-static inline
+unsigned long
-unsigned long i915_gem_obj_offset(struct drm_i915_gem_object *o,
+i915_gem_obj_offset(struct drm_i915_gem_object *o,
-                                  struct i915_address_space *vm)
+                    struct i915_address_space *vm);
+static inline unsigned long
+i915_gem_obj_ggtt_offset(struct drm_i915_gem_object *o)
 {
-        return i915_gem_obj_offset_view(o, vm, I915_GGTT_VIEW_NORMAL);
+        return i915_gem_obj_ggtt_offset_view(o, &i915_ggtt_view_normal);
 }
 bool i915_gem_obj_bound_any(struct drm_i915_gem_object *o);
-bool i915_gem_obj_bound_view(struct drm_i915_gem_object *o,
+bool i915_gem_obj_ggtt_bound_view(struct drm_i915_gem_object *o,
-                             struct i915_address_space *vm,
+                                  const struct i915_ggtt_view *view);
-                             enum i915_ggtt_view_type view);
-static inline
 bool i915_gem_obj_bound(struct drm_i915_gem_object *o,
-                        struct i915_address_space *vm)
+                        struct i915_address_space *vm);
-{
-        return i915_gem_obj_bound_view(o, vm, I915_GGTT_VIEW_NORMAL);
-}
 unsigned long i915_gem_obj_size(struct drm_i915_gem_object *o,
                                struct i915_address_space *vm);
-struct i915_vma *i915_gem_obj_to_vma_view(struct drm_i915_gem_object *obj,
-                                          struct i915_address_space *vm,
-                                          const struct i915_ggtt_view *view);
-static inline
-struct i915_vma *i915_gem_obj_to_vma(struct drm_i915_gem_object *obj,
-                                     struct i915_address_space *vm)
-{
-        return i915_gem_obj_to_vma_view(obj, vm, &i915_ggtt_view_normal);
-}
 struct i915_vma *
-i915_gem_obj_lookup_or_create_vma_view(struct drm_i915_gem_object *obj,
+i915_gem_obj_to_vma(struct drm_i915_gem_object *obj,
-                                       struct i915_address_space *vm,
+                    struct i915_address_space *vm);
-                                       const struct i915_ggtt_view *view);
+struct i915_vma *
+i915_gem_obj_to_ggtt_view(struct drm_i915_gem_object *obj,
+                          const struct i915_ggtt_view *view);
-static inline
 struct i915_vma *
 i915_gem_obj_lookup_or_create_vma(struct drm_i915_gem_object *obj,
-                                  struct i915_address_space *vm)
+                                  struct i915_address_space *vm);
-{
+struct i915_vma *
-        return i915_gem_obj_lookup_or_create_vma_view(obj, vm,
+i915_gem_obj_lookup_or_create_ggtt_vma(struct drm_i915_gem_object *obj,
-                                                &i915_ggtt_view_normal);
+                                       const struct i915_ggtt_view *view);
-}
-struct i915_vma *i915_gem_obj_to_ggtt(struct drm_i915_gem_object *obj);
+static inline struct i915_vma *
-static inline bool i915_gem_obj_is_pinned(struct drm_i915_gem_object *obj) {
+i915_gem_obj_to_ggtt(struct drm_i915_gem_object *obj)
-        struct i915_vma *vma;
+{
-        list_for_each_entry(vma, &obj->vma_list, vma_link)
+        return i915_gem_obj_to_ggtt_view(obj, &i915_ggtt_view_normal);
-                if (vma->pin_count > 0)
-                        return true;
-        return false;
 }
+bool i915_gem_obj_is_pinned(struct drm_i915_gem_object *obj);
 /* Some GGTT VM helpers */
 #define i915_obj_to_ggtt(obj) \
@@ -2876,13 +2855,7 @@ i915_vm_to_ppgtt(struct i915_address_space *vm)
 static inline bool i915_gem_obj_ggtt_bound(struct drm_i915_gem_object *obj)
 {
-        return i915_gem_obj_bound(obj, i915_obj_to_ggtt(obj));
+        return i915_gem_obj_ggtt_bound_view(obj, &i915_ggtt_view_normal);
-}
-static inline unsigned long
-i915_gem_obj_ggtt_offset(struct drm_i915_gem_object *obj)
-{
-        return i915_gem_obj_offset(obj, i915_obj_to_ggtt(obj));
 }
 static inline unsigned long
@@ -2906,7 +2879,13 @@ i915_gem_object_ggtt_unbind(struct drm_i915_gem_object *obj)
        return i915_vma_unbind(i915_gem_obj_to_ggtt(obj));
 }
-void i915_gem_object_ggtt_unpin(struct drm_i915_gem_object *obj);
+void i915_gem_object_ggtt_unpin_view(struct drm_i915_gem_object *obj,
+                                     const struct i915_ggtt_view *view);
+static inline void
+i915_gem_object_ggtt_unpin(struct drm_i915_gem_object *obj)
+{
+        i915_gem_object_ggtt_unpin_view(obj, &i915_ggtt_view_normal);
+}
 /* i915_gem_context.c */
 int __must_check i915_gem_context_init(struct drm_device *dev);
@@ -2978,6 +2957,17 @@ i915_gem_object_create_stolen_for_preallocated(struct drm_device *dev,
                                               u32 gtt_offset,
                                               u32 size);
+/* i915_gem_shrinker.c */
+unsigned long i915_gem_shrink(struct drm_i915_private *dev_priv,
+                              long target,
+                              unsigned flags);
+#define I915_SHRINK_PURGEABLE 0x1
+#define I915_SHRINK_UNBOUND 0x2
+#define I915_SHRINK_BOUND 0x4
+unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv);
+void i915_gem_shrinker_init(struct drm_i915_private *dev_priv);
 /* i915_gem_tiling.c */
 static inline bool i915_gem_object_needs_bit17_swizzle(struct drm_i915_gem_object *obj)
 {
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 0fe313d0f609..d07c0b1fb498 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2008 Intel Corporation
+ * Copyright © 2008-2015 Intel Corporation
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
@@ -32,7 +32,6 @@
 #include "i915_vgpu.h"
 #include "i915_trace.h"
 #include "intel_drv.h"
-#include <linux/oom.h>
 #include <linux/shmem_fs.h>
 #include <linux/slab.h>
 #include <linux/swap.h>
@@ -53,15 +52,6 @@ static void i915_gem_object_update_fence(struct drm_i915_gem_object *obj,
                                         struct drm_i915_fence_reg *fence,
                                         bool enable);
-static unsigned long i915_gem_shrinker_count(struct shrinker *shrinker,
-                                             struct shrink_control *sc);
-static unsigned long i915_gem_shrinker_scan(struct shrinker *shrinker,
-                                            struct shrink_control *sc);
-static int i915_gem_shrinker_oom(struct notifier_block *nb,
-                                 unsigned long event,
-                                 void *ptr);
-static unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv);
 static bool cpu_cache_is_coherent(struct drm_device *dev,
                                  enum i915_cache_level level)
 {
@@ -1936,12 +1926,6 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
        return i915_gem_mmap_gtt(file, dev, args->handle, &args->offset);
 }
-static inline int
-i915_gem_object_is_purgeable(struct drm_i915_gem_object *obj)
-{
-        return obj->madv == I915_MADV_DONTNEED;
-}
 /* Immediately discard the backing storage */
 static void
 i915_gem_object_truncate(struct drm_i915_gem_object *obj)
@@ -2047,85 +2031,6 @@ i915_gem_object_put_pages(struct drm_i915_gem_object *obj)
        return 0;
 }
-unsigned long
-i915_gem_shrink(struct drm_i915_private *dev_priv,
-                long target, unsigned flags)
-{
-        const struct {
-                struct list_head *list;
-                unsigned int bit;
-        } phases[] = {
-                { &dev_priv->mm.unbound_list, I915_SHRINK_UNBOUND },
-                { &dev_priv->mm.bound_list, I915_SHRINK_BOUND },
-                { NULL, 0 },
-        }, *phase;
-        unsigned long count = 0;
-        /*
-         * As we may completely rewrite the (un)bound list whilst unbinding
-         * (due to retiring requests) we have to strictly process only
-         * one element of the list at the time, and recheck the list
-         * on every iteration.
-         *
-         * In particular, we must hold a reference whilst removing the
-         * object as we may end up waiting for and/or retiring the objects.
-         * This might release the final reference (held by the active list)
-         * and result in the object being freed from under us. This is
-         * similar to the precautions the eviction code must take whilst
-         * removing objects.
-         *
-         * Also note that although these lists do not hold a reference to
-         * the object we can safely grab one here: The final object
-         * unreferencing and the bound_list are both protected by the
-         * dev->struct_mutex and so we won't ever be able to observe an
-         * object on the bound_list with a reference count equals 0.
-         */
-        for (phase = phases; phase->list; phase++) {
-                struct list_head still_in_list;
-                if ((flags & phase->bit) == 0)
-                        continue;
-                INIT_LIST_HEAD(&still_in_list);
-                while (count < target && !list_empty(phase->list)) {
-                        struct drm_i915_gem_object *obj;
-                        struct i915_vma *vma, *v;
-                        obj = list_first_entry(phase->list,
-                                               typeof(*obj), global_list);
-                        list_move_tail(&obj->global_list, &still_in_list);
-                        if (flags & I915_SHRINK_PURGEABLE &&
-                            !i915_gem_object_is_purgeable(obj))
-                                continue;
-                        drm_gem_object_reference(&obj->base);
-                        /* For the unbound phase, this should be a no-op! */
-                        list_for_each_entry_safe(vma, v,
-                                                 &obj->vma_list, vma_link)
-                                if (i915_vma_unbind(vma))
-                                        break;
-                        if (i915_gem_object_put_pages(obj) == 0)
-                                count += obj->base.size >> PAGE_SHIFT;
-                        drm_gem_object_unreference(&obj->base);
-                }
-                list_splice(&still_in_list, phase->list);
-        }
-        return count;
-}
-static unsigned long
-i915_gem_shrink_all(struct drm_i915_private *dev_priv)
-{
-        i915_gem_evict_everything(dev_priv->dev);
-        return i915_gem_shrink(dev_priv, LONG_MAX,
-                               I915_SHRINK_BOUND | I915_SHRINK_UNBOUND);
-}
 static int
 i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
 {
@@ -2755,24 +2660,11 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
        WARN_ON(i915_verify_lists(ring->dev));
-        /* Move any buffers on the active list that are no longer referenced
+        /* Retire requests first as we use it above for the early return.
-         * by the ringbuffer to the flushing/inactive lists as appropriate,
+         * If we retire requests last, we may use a later seqno and so clear
-         * before we free the context associated with the requests.
+         * the requests lists without clearing the active list, leading to
+         * confusion.
         */
-        while (!list_empty(&ring->active_list)) {
-                struct drm_i915_gem_object *obj;
-                obj = list_first_entry(&ring->active_list,
-                                      struct drm_i915_gem_object,
-                                      ring_list);
-                if (!i915_gem_request_completed(obj->last_read_req, true))
-                        break;
-                i915_gem_object_move_to_inactive(obj);
-        }
        while (!list_empty(&ring->request_list)) {
                struct drm_i915_gem_request *request;
@@ -2795,6 +2687,23 @@ i915_gem_retire_requests_ring(struct intel_engine_cs *ring)
                i915_gem_free_request(request);
        }
+        /* Move any buffers on the active list that are no longer referenced
+         * by the ringbuffer to the flushing/inactive lists as appropriate,
+         * before we free the context associated with the requests.
+         */
+        while (!list_empty(&ring->active_list)) {
+                struct drm_i915_gem_object *obj;
+                obj = list_first_entry(&ring->active_list,
+                                      struct drm_i915_gem_object,
+                                      ring_list);
+                if (!i915_gem_request_completed(obj->last_read_req, true))
+                        break;
+                i915_gem_object_move_to_inactive(obj);
+        }
        if (unlikely(ring->trace_irq_req &&
                     i915_gem_request_completed(ring->trace_irq_req, true))) {
                ring->irq_put(ring);
@@ -3518,9 +3427,9 @@ static bool i915_gem_valid_gtt_space(struct i915_vma *vma,
 static struct i915_vma *
 i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
                           struct i915_address_space *vm,
+                           const struct i915_ggtt_view *ggtt_view,
                           unsigned alignment,
-                           uint64_t flags,
+                           uint64_t flags)
-                           const struct i915_ggtt_view *view)
 {
        struct drm_device *dev = obj->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -3532,6 +3441,9 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
        struct i915_vma *vma;
        int ret;
+        if(WARN_ON(i915_is_ggtt(vm) != !!ggtt_view))
+                return ERR_PTR(-EINVAL);
        fence_size = i915_gem_get_gtt_size(dev,
                                           obj->base.size,
                                           obj->tiling_mode);
@@ -3570,7 +3482,9 @@ i915_gem_object_bind_to_vm(struct drm_i915_gem_object *obj,
        i915_gem_object_pin_pages(obj);
-        vma = i915_gem_obj_lookup_or_create_vma_view(obj, vm, view);
+        vma = ggtt_view ? i915_gem_obj_lookup_or_create_ggtt_vma(obj, ggtt_view) :
+                          i915_gem_obj_lookup_or_create_vma(obj, vm);
        if (IS_ERR(vma))
                goto err_unpin;
@@ -3600,6 +3514,17 @@ search_free:
        if (ret)
                goto err_remove_node;
+        /*  allocate before insert / bind */
+        if (vma->vm->allocate_va_range) {
+                trace_i915_va_alloc(vma->vm, vma->node.start, vma->node.size,
+                                VM_TO_TRACE_NAME(vma->vm));
+                ret = vma->vm->allocate_va_range(vma->vm,
+                                                vma->node.start,
+                                                vma->node.size);
+                if (ret)
+                        goto err_remove_node;
+        }
        trace_i915_vma_bind(vma, flags);
        ret = i915_vma_bind(vma, obj->cache_level,
                            flags & PIN_GLOBAL ? GLOBAL_BIND : 0);
@@ -3952,7 +3877,8 @@ static bool is_pin_display(struct drm_i915_gem_object *obj)
 int
 i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
                                     u32 alignment,
-                                     struct intel_engine_cs *pipelined)
+                                     struct intel_engine_cs *pipelined,
+                                     const struct i915_ggtt_view *view)
 {
        u32 old_read_domains, old_write_domain;
        bool was_pin_display;
@@ -3988,7 +3914,9 @@ i915_gem_object_pin_to_display_plane(struct drm_i915_gem_object *obj,
         * (e.g. libkms for the bootup splash), we have to ensure that we
         * always use map_and_fenceable for all scanout buffers.
         */
-        ret = i915_gem_obj_ggtt_pin(obj, alignment, PIN_MAPPABLE);
+        ret = i915_gem_object_ggtt_pin(obj, view, alignment,
+                                       view->type == I915_GGTT_VIEW_NORMAL ?
+                                       PIN_MAPPABLE : 0);
        if (ret)
                goto err_unpin_display;
@@ -4016,9 +3944,11 @@ err_unpin_display:
 }
 void
-i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj)
+i915_gem_object_unpin_from_display_plane(struct drm_i915_gem_object *obj,
+                                         const struct i915_ggtt_view *view)
 {
-        i915_gem_object_ggtt_unpin(obj);
+        i915_gem_object_ggtt_unpin_view(obj, view);
        obj->pin_display = is_pin_display(obj);
 }
@@ -4167,12 +4097,12 @@ i915_vma_misplaced(struct i915_vma *vma, uint32_t alignment, uint64_t flags)
        return false;
 }
-int
+static int
-i915_gem_object_pin_view(struct drm_i915_gem_object *obj,
+i915_gem_object_do_pin(struct drm_i915_gem_object *obj,
-                         struct i915_address_space *vm,
+                       struct i915_address_space *vm,
-                         uint32_t alignment,
+                       const struct i915_ggtt_view *ggtt_view,
-                         uint64_t flags,
+                       uint32_t alignment,
-                         const struct i915_ggtt_view *view)
+                       uint64_t flags)
 {
        struct drm_i915_private *dev_priv = obj->base.dev->dev_private;
        struct i915_vma *vma;
@@ -4188,17 +4118,29 @@ i915_gem_object_pin_view(struct drm_i915_gem_object *obj,
        if (WARN_ON((flags & (PIN_MAPPABLE | PIN_GLOBAL)) == PIN_MAPPABLE))
                return -EINVAL;
-        vma = i915_gem_obj_to_vma_view(obj, vm, view);
+        if (WARN_ON(i915_is_ggtt(vm) != !!ggtt_view))
+                return -EINVAL;
+        vma = ggtt_view ? i915_gem_obj_to_ggtt_view(obj, ggtt_view) :
+                          i915_gem_obj_to_vma(obj, vm);
+        if (IS_ERR(vma))
+                return PTR_ERR(vma);
        if (vma) {
                if (WARN_ON(vma->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
                        return -EBUSY;
                if (i915_vma_misplaced(vma, alignment, flags)) {
+                        unsigned long offset;
+                        offset = ggtt_view ? i915_gem_obj_ggtt_offset_view(obj, ggtt_view) :
+                                             i915_gem_obj_offset(obj, vm);
                        WARN(vma->pin_count,
-                             "bo is already pinned with incorrect alignment:"
+                             "bo is already pinned in %s with incorrect alignment:"
                             " offset=%lx, req.alignment=%x, req.map_and_fenceable=%d,"
                             " obj->map_and_fenceable=%d\n",
-                             i915_gem_obj_offset_view(obj, vm, view->type),
+                             ggtt_view ? "ggtt" : "ppgtt",
+                             offset,
                             alignment,
                             !!(flags & PIN_MAPPABLE),
                             obj->map_and_fenceable);
@@ -4212,8 +4154,12 @@ i915_gem_object_pin_view(struct drm_i915_gem_object *obj,
        bound = vma ? vma->bound : 0;
        if (vma == NULL || !drm_mm_node_allocated(&vma->node)) {
-                vma = i915_gem_object_bind_to_vm(obj, vm, alignment,
+                /* In true PPGTT, bind has possibly changed PDEs, which
-                                                 flags, view);
+                 * means we must do a context switch before the GPU can
+                 * accurately read some of the VMAs.
+                 */
+                vma = i915_gem_object_bind_to_vm(obj, vm, ggtt_view, alignment,
+                                                 flags);
                if (IS_ERR(vma))
                        return PTR_ERR(vma);
        }
@@ -4254,16 +4200,41 @@ i915_gem_object_pin_view(struct drm_i915_gem_object *obj,
        return 0;
 }
+int
+i915_gem_object_pin(struct drm_i915_gem_object *obj,
+                    struct i915_address_space *vm,
+                    uint32_t alignment,
+                    uint64_t flags)
+{
+        return i915_gem_object_do_pin(obj, vm,
+                                      i915_is_ggtt(vm) ? &i915_ggtt_view_normal : NULL,
+                                      alignment, flags);
+}
+int
+i915_gem_object_ggtt_pin(struct drm_i915_gem_object *obj,
+                         const struct i915_ggtt_view *view,
+                         uint32_t alignment,
+                         uint64_t flags)
+{
+        if (WARN_ONCE(!view, "no view specified"))
+                return -EINVAL;
+        return i915_gem_object_do_pin(obj, i915_obj_to_ggtt(obj), view,
+                                      alignment, flags | PIN_GLOBAL);
+}
 void
-i915_gem_object_ggtt_unpin(struct drm_i915_gem_object *obj)
+i915_gem_object_ggtt_unpin_view(struct drm_i915_gem_object *obj,
+                                const struct i915_ggtt_view *view)
 {
-        struct i915_vma *vma = i915_gem_obj_to_ggtt(obj);
+        struct i915_vma *vma = i915_gem_obj_to_ggtt_view(obj, view);
        BUG_ON(!vma);
-        BUG_ON(vma->pin_count == 0);
+        WARN_ON(vma->pin_count == 0);
-        BUG_ON(!i915_gem_obj_ggtt_bound(obj));
+        WARN_ON(!i915_gem_obj_ggtt_bound_view(obj, view));
-        if (--vma->pin_count == 0)
+        if (--vma->pin_count == 0 && view->type == I915_GGTT_VIEW_NORMAL)
                obj->pin_mappable = false;
 }
@@ -4384,7 +4355,7 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
                obj->madv = args->madv;
        /* if the object is no longer attached, discard its backing storage */
-        if (i915_gem_object_is_purgeable(obj) && obj->pages == NULL)
+        if (obj->madv == I915_MADV_DONTNEED && obj->pages == NULL)
                i915_gem_object_truncate(obj);
        args->retained = obj->madv != __I915_MADV_PURGED;
@@ -4559,15 +4530,33 @@ void i915_gem_free_object(struct drm_gem_object *gem_obj)
        intel_runtime_pm_put(dev_priv);
 }
-struct i915_vma *i915_gem_obj_to_vma_view(struct drm_i915_gem_object *obj,
+struct i915_vma *i915_gem_obj_to_vma(struct drm_i915_gem_object *obj,
-                                          struct i915_address_space *vm,
+                                     struct i915_address_space *vm)
-                                          const struct i915_ggtt_view *view)
 {
        struct i915_vma *vma;
-        list_for_each_entry(vma, &obj->vma_list, vma_link)
+        list_for_each_entry(vma, &obj->vma_list, vma_link) {
-                if (vma->vm == vm && vma->ggtt_view.type == view->type)
+                if (i915_is_ggtt(vma->vm) &&
+                    vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
+                        continue;
+                if (vma->vm == vm)
                        return vma;
+        }
+        return NULL;
+}
+struct i915_vma *i915_gem_obj_to_ggtt_view(struct drm_i915_gem_object *obj,
+                                           const struct i915_ggtt_view *view)
+{
+        struct i915_address_space *ggtt = i915_obj_to_ggtt(obj);
+        struct i915_vma *vma;
+        if (WARN_ONCE(!view, "no view specified"))
+                return ERR_PTR(-EINVAL);
+        list_for_each_entry(vma, &obj->vma_list, vma_link)
+                if (vma->vm == ggtt &&
+                    i915_ggtt_view_equal(&vma->ggtt_view, view))
+                        return vma;
        return NULL;
 }
@@ -5006,13 +4995,7 @@ i915_gem_load(struct drm_device *dev)
        dev_priv->mm.interruptible = true;
-        dev_priv->mm.shrinker.scan_objects = i915_gem_shrinker_scan;
+        i915_gem_shrinker_init(dev_priv);
-        dev_priv->mm.shrinker.count_objects = i915_gem_shrinker_count;
-        dev_priv->mm.shrinker.seeks = DEFAULT_SEEKS;
-        register_shrinker(&dev_priv->mm.shrinker);
-        dev_priv->mm.oom_notifier.notifier_call = i915_gem_shrinker_oom;
-        register_oom_notifier(&dev_priv->mm.oom_notifier);
        i915_gem_batch_pool_init(dev, &dev_priv->mm.batch_pool);
@@ -5104,106 +5087,70 @@ void i915_gem_track_fb(struct drm_i915_gem_object *old,
        }
 }
-static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task)
+/* All the new VM stuff */
-{
+unsigned long
-        if (!mutex_is_locked(mutex))
+i915_gem_obj_offset(struct drm_i915_gem_object *o,
-                return false;
+                    struct i915_address_space *vm)
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
-        return mutex->owner == task;
-#else
-        /* Since UP may be pre-empted, we cannot assume that we own the lock */
-        return false;
-#endif
-}
-static bool i915_gem_shrinker_lock(struct drm_device *dev, bool *unlock)
 {
-        if (!mutex_trylock(&dev->struct_mutex)) {
+        struct drm_i915_private *dev_priv = o->base.dev->dev_private;
-                if (!mutex_is_locked_by(&dev->struct_mutex, current))
+        struct i915_vma *vma;
-                        return false;
-                if (to_i915(dev)->mm.shrinker_no_lock_stealing)
+        WARN_ON(vm == &dev_priv->mm.aliasing_ppgtt->base);
-                        return false;
-                *unlock = false;
+        list_for_each_entry(vma, &o->vma_list, vma_link) {
-        } else
+                if (i915_is_ggtt(vma->vm) &&
-                *unlock = true;
+                    vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
+                        continue;
+                if (vma->vm == vm)
+                        return vma->node.start;
+        }
-        return true;
+        WARN(1, "%s vma for this object not found.\n",
+             i915_is_ggtt(vm) ? "global" : "ppgtt");
+        return -1;
 }
-static int num_vma_bound(struct drm_i915_gem_object *obj)
+unsigned long
+i915_gem_obj_ggtt_offset_view(struct drm_i915_gem_object *o,
+                              const struct i915_ggtt_view *view)
 {
+        struct i915_address_space *ggtt = i915_obj_to_ggtt(o);
        struct i915_vma *vma;
-        int count = 0;
-        list_for_each_entry(vma, &obj->vma_list, vma_link)
-                if (drm_mm_node_allocated(&vma->node))
-                        count++;
-        return count;
+        list_for_each_entry(vma, &o->vma_list, vma_link)
-}
+                if (vma->vm == ggtt &&
+                    i915_ggtt_view_equal(&vma->ggtt_view, view))
-static unsigned long
+                        return vma->node.start;
-i915_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)
-{
-        struct drm_i915_private *dev_priv =
-                container_of(shrinker, struct drm_i915_private, mm.shrinker);
-        struct drm_device *dev = dev_priv->dev;
-        struct drm_i915_gem_object *obj;
-        unsigned long count;
-        bool unlock;
-        if (!i915_gem_shrinker_lock(dev, &unlock))
-                return 0;
-        count = 0;
-        list_for_each_entry(obj, &dev_priv->mm.unbound_list, global_list)
-                if (obj->pages_pin_count == 0)
-                        count += obj->base.size >> PAGE_SHIFT;
-        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
-                if (!i915_gem_obj_is_pinned(obj) &&
-                    obj->pages_pin_count == num_vma_bound(obj))
-                        count += obj->base.size >> PAGE_SHIFT;
-        }
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
-        return count;
+        WARN(1, "global vma for this object not found.\n");
+        return -1;
 }
-/* All the new VM stuff */
+bool i915_gem_obj_bound(struct drm_i915_gem_object *o,
-unsigned long i915_gem_obj_offset_view(struct drm_i915_gem_object *o,
+                        struct i915_address_space *vm)
-                                       struct i915_address_space *vm,
-                                       enum i915_ggtt_view_type view)
 {
-        struct drm_i915_private *dev_priv = o->base.dev->dev_private;
        struct i915_vma *vma;
-        WARN_ON(vm == &dev_priv->mm.aliasing_ppgtt->base);
        list_for_each_entry(vma, &o->vma_list, vma_link) {
-                if (vma->vm == vm && vma->ggtt_view.type == view)
+                if (i915_is_ggtt(vma->vm) &&
-                        return vma->node.start;
+                    vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
+                        continue;
+                if (vma->vm == vm && drm_mm_node_allocated(&vma->node))
+                        return true;
        }
-        WARN(1, "%s vma for this object not found.\n",
-             i915_is_ggtt(vm) ? "global" : "ppgtt");
+        return false;
-        return -1;
 }
-bool i915_gem_obj_bound_view(struct drm_i915_gem_object *o,
+bool i915_gem_obj_ggtt_bound_view(struct drm_i915_gem_object *o,
-                             struct i915_address_space *vm,
+                                  const struct i915_ggtt_view *view)
-                             enum i915_ggtt_view_type view)
 {
+        struct i915_address_space *ggtt = i915_obj_to_ggtt(o);
        struct i915_vma *vma;
        list_for_each_entry(vma, &o->vma_list, vma_link)
-                if (vma->vm == vm &&
+                if (vma->vm == ggtt &&
-                    vma->ggtt_view.type == view &&
+                    i915_ggtt_view_equal(&vma->ggtt_view, view) &&
                    drm_mm_node_allocated(&vma->node))
                        return true;
@@ -5231,118 +5178,26 @@ unsigned long i915_gem_obj_size(struct drm_i915_gem_object *o,
        BUG_ON(list_empty(&o->vma_list));
-        list_for_each_entry(vma, &o->vma_list, vma_link)
+        list_for_each_entry(vma, &o->vma_list, vma_link) {
+                if (i915_is_ggtt(vma->vm) &&
+                    vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
+                        continue;
                if (vma->vm == vm)
                        return vma->node.size;
+        }
        return 0;
 }
-static unsigned long
+bool i915_gem_obj_is_pinned(struct drm_i915_gem_object *obj)
-i915_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)
 {
-        struct drm_i915_private *dev_priv =
+        struct i915_vma *vma;
-                container_of(shrinker, struct drm_i915_private, mm.shrinker);
+        list_for_each_entry(vma, &obj->vma_list, vma_link) {
-        struct drm_device *dev = dev_priv->dev;
+                if (i915_is_ggtt(vma->vm) &&
-        unsigned long freed;
+                    vma->ggtt_view.type != I915_GGTT_VIEW_NORMAL)
-        bool unlock;
-        if (!i915_gem_shrinker_lock(dev, &unlock))
-                return SHRINK_STOP;
-        freed = i915_gem_shrink(dev_priv,
-                                sc->nr_to_scan,
-                                I915_SHRINK_BOUND |
-                                I915_SHRINK_UNBOUND |
-                                I915_SHRINK_PURGEABLE);
-        if (freed < sc->nr_to_scan)
-                freed += i915_gem_shrink(dev_priv,
-                                         sc->nr_to_scan - freed,
-                                         I915_SHRINK_BOUND |
-                                         I915_SHRINK_UNBOUND);
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
-        return freed;
-}
-static int
-i915_gem_shrinker_oom(struct notifier_block *nb, unsigned long event, void *ptr)
-{
-        struct drm_i915_private *dev_priv =
-                container_of(nb, struct drm_i915_private, mm.oom_notifier);
-        struct drm_device *dev = dev_priv->dev;
-        struct drm_i915_gem_object *obj;
-        unsigned long timeout = msecs_to_jiffies(5000) + 1;
-        unsigned long pinned, bound, unbound, freed_pages;
-        bool was_interruptible;
-        bool unlock;
-        while (!i915_gem_shrinker_lock(dev, &unlock) && --timeout) {
-                schedule_timeout_killable(1);
-                if (fatal_signal_pending(current))
-                        return NOTIFY_DONE;
-        }
-        if (timeout == 0) {
-                pr_err("Unable to purge GPU memory due lock contention.\n");
-                return NOTIFY_DONE;
-        }
-        was_interruptible = dev_priv->mm.interruptible;
-        dev_priv->mm.interruptible = false;
-        freed_pages = i915_gem_shrink_all(dev_priv);
-        dev_priv->mm.interruptible = was_interruptible;
-        /* Because we may be allocating inside our own driver, we cannot
-         * assert that there are no objects with pinned pages that are not
-         * being pointed to by hardware.
-         */
-        unbound = bound = pinned = 0;
-        list_for_each_entry(obj, &dev_priv->mm.unbound_list, global_list) {
-                if (!obj->base.filp) /* not backed by a freeable object */
-                        continue;
-                if (obj->pages_pin_count)
-                        pinned += obj->base.size;
-                else
-                        unbound += obj->base.size;
-        }
-        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
-                if (!obj->base.filp)
                        continue;
+                if (vma->pin_count > 0)
-                if (obj->pages_pin_count)
+                        return true;
-                        pinned += obj->base.size;
-                else
-                        bound += obj->base.size;
        }
+        return false;
-        if (unlock)
-                mutex_unlock(&dev->struct_mutex);
-        if (freed_pages || unbound || bound)
-                pr_info("Purging GPU memory, %lu bytes freed, %lu bytes still pinned.\n",
-                        freed_pages << PAGE_SHIFT, pinned);
-        if (unbound || bound)
-                pr_err("%lu and %lu bytes still available in the "
-                       "bound and unbound GPU page lists.\n",
-                       bound, unbound);
-        *(unsigned long *)ptr += freed_pages;
-        return NOTIFY_DONE;
 }
-struct i915_vma *i915_gem_obj_to_ggtt(struct drm_i915_gem_object *obj)
-{
-        struct i915_address_space *ggtt = i915_obj_to_ggtt(obj);
-        struct i915_vma *vma;
-        list_for_each_entry(vma, &obj->vma_list, vma_link)
-                if (vma->vm == ggtt &&
-                    vma->ggtt_view.type == I915_GGTT_VIEW_NORMAL)
-                        return vma;
-        return NULL;
-}
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 70346b0028f9..f3e84c44d009 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -569,6 +569,66 @@ mi_set_context(struct intel_engine_cs *ring,
        return ret;
 }
+static inline bool should_skip_switch(struct intel_engine_cs *ring,
+                                      struct intel_context *from,
+                                      struct intel_context *to)
+{
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
+        if (to->remap_slice)
+                return false;
+        if (to->ppgtt) {
+                if (from == to && !test_bit(ring->id,
+                                &to->ppgtt->pd_dirty_rings))
+                        return true;
+        } else if (dev_priv->mm.aliasing_ppgtt) {
+                if (from == to && !test_bit(ring->id,
+                                &dev_priv->mm.aliasing_ppgtt->pd_dirty_rings))
+                        return true;
+        }
+        return false;
+}
+static bool
+needs_pd_load_pre(struct intel_engine_cs *ring, struct intel_context *to)
+{
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
+        if (!to->ppgtt)
+                return false;
+        if (INTEL_INFO(ring->dev)->gen < 8)
+                return true;
+        if (ring != &dev_priv->ring[RCS])
+                return true;
+        return false;
+}
+static bool
+needs_pd_load_post(struct intel_engine_cs *ring, struct intel_context *to,
+                u32 hw_flags)
+{
+        struct drm_i915_private *dev_priv = ring->dev->dev_private;
+        if (!to->ppgtt)
+                return false;
+        if (!IS_GEN8(ring->dev))
+                return false;
+        if (ring != &dev_priv->ring[RCS])
+                return false;
+        if (hw_flags & MI_RESTORE_INHIBIT)
+                return true;
+        return false;
+}
 static int do_switch(struct intel_engine_cs *ring,
                     struct intel_context *to)
 {
@@ -584,7 +644,7 @@ static int do_switch(struct intel_engine_cs *ring,
                BUG_ON(!i915_gem_obj_is_pinned(from->legacy_hw_ctx.rcs_state));
        }
-        if (from == to && !to->remap_slice)
+        if (should_skip_switch(ring, from, to))
                return 0;
        /* Trying to pin first makes error handling easier. */
@@ -602,11 +662,18 @@ static int do_switch(struct intel_engine_cs *ring,
         */
        from = ring->last_context;
-        if (to->ppgtt) {
+        if (needs_pd_load_pre(ring, to)) {
+                /* Older GENs and non render rings still want the load first,
+                 * "PP_DCLV followed by PP_DIR_BASE register through Load
+                 * Register Immediate commands in Ring Buffer before submitting
+                 * a context."*/
                trace_switch_mm(ring, to);
                ret = to->ppgtt->switch_mm(to->ppgtt, ring);
                if (ret)
                        goto unpin_out;
+                /* Doing a PD load always reloads the page dirs */
+                clear_bit(ring->id, &to->ppgtt->pd_dirty_rings);
        }
        if (ring != &dev_priv->ring[RCS]) {
@@ -637,13 +704,41 @@ static int do_switch(struct intel_engine_cs *ring,
                        goto unpin_out;
        }
-        if (!to->legacy_hw_ctx.initialized || i915_gem_context_is_default(to))
+        if (!to->legacy_hw_ctx.initialized) {
                hw_flags |= MI_RESTORE_INHIBIT;
+                /* NB: If we inhibit the restore, the context is not allowed to
+                 * die because future work may end up depending on valid address
+                 * space. This means we must enforce that a page table load
+                 * occur when this occurs. */
+        } else if (to->ppgtt &&
+                        test_and_clear_bit(ring->id, &to->ppgtt->pd_dirty_rings))
+                hw_flags |= MI_FORCE_RESTORE;
+        /* We should never emit switch_mm more than once */
+        WARN_ON(needs_pd_load_pre(ring, to) &&
+                        needs_pd_load_post(ring, to, hw_flags));
        ret = mi_set_context(ring, to, hw_flags);
        if (ret)
                goto unpin_out;
+        /* GEN8 does *not* require an explicit reload if the PDPs have been
+         * setup, and we do not wish to move them.
+         */
+        if (needs_pd_load_post(ring, to, hw_flags)) {
+                trace_switch_mm(ring, to);
+                ret = to->ppgtt->switch_mm(to->ppgtt, ring);
+                /* The hardware context switch is emitted, but we haven't
+                 * actually changed the state - so it's probably safe to bail
+                 * here. Still, let the user know something dangerous has
+                 * happened.
+                 */
+                if (ret) {
+                        DRM_ERROR("Failed to change address space on context switch\n");
+                        goto unpin_out;
+                }
+        }
        for (i = 0; i < MAX_L3_SLICES; i++) {
                if (!(to->remap_slice & (1<<i)))
                        continue;
@@ -681,7 +776,7 @@ static int do_switch(struct intel_engine_cs *ring,
                i915_gem_context_unreference(from);
        }
-        uninitialized = !to->legacy_hw_ctx.initialized && from == NULL;
+        uninitialized = !to->legacy_hw_ctx.initialized;
        to->legacy_hw_ctx.initialized = true;
 done:
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index e3a49d94da3a..d09e35ed9c9a 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -63,6 +63,10 @@ mark_free(struct i915_vma *vma, struct list_head *unwind)
 *
 * This function is used by the object/vma binding code.
 *
+ * Since this function is only used to free up virtual address space it only
+ * ignores pinned vmas, and not object where the backing storage itself is
+ * pinned. Hence obj->pages_pin_count does not protect against eviction.
+ *
 * To clarify: This is for freeing up virtual address space, not for freeing
 * memory in e.g. the shrinker.
 */
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index dc10bc43864e..a3190e793ed4 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -251,7 +251,6 @@ static inline int use_cpu_reloc(struct drm_i915_gem_object *obj)
 {
        return (HAS_LLC(obj->base.dev) ||
                obj->base.write_domain == I915_GEM_DOMAIN_CPU ||
-                !obj->map_and_fenceable ||
                obj->cache_level != I915_CACHE_NONE);
 }
@@ -337,6 +336,51 @@ relocate_entry_gtt(struct drm_i915_gem_object *obj,
        return 0;
 }
+static void
+clflush_write32(void *addr, uint32_t value)
+{
+        /* This is not a fast path, so KISS. */
+        drm_clflush_virt_range(addr, sizeof(uint32_t));
+        *(uint32_t *)addr = value;
+        drm_clflush_virt_range(addr, sizeof(uint32_t));
+}
+static int
+relocate_entry_clflush(struct drm_i915_gem_object *obj,
+                       struct drm_i915_gem_relocation_entry *reloc,
+                       uint64_t target_offset)
+{
+        struct drm_device *dev = obj->base.dev;
+        uint32_t page_offset = offset_in_page(reloc->offset);
+        uint64_t delta = (int)reloc->delta + target_offset;
+        char *vaddr;
+        int ret;
+        ret = i915_gem_object_set_to_gtt_domain(obj, true);
+        if (ret)
+                return ret;
+        vaddr = kmap_atomic(i915_gem_object_get_page(obj,
+                                reloc->offset >> PAGE_SHIFT));
+        clflush_write32(vaddr + page_offset, lower_32_bits(delta));
+        if (INTEL_INFO(dev)->gen >= 8) {
+                page_offset = offset_in_page(page_offset + sizeof(uint32_t));
+                if (page_offset == 0) {
+                        kunmap_atomic(vaddr);
+                        vaddr = kmap_atomic(i915_gem_object_get_page(obj,
+                            (reloc->offset + sizeof(uint32_t)) >> PAGE_SHIFT));
+                }
+                clflush_write32(vaddr + page_offset, upper_32_bits(delta));
+        }
+        kunmap_atomic(vaddr);
+        return 0;
+}
 static int
 i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
                                   struct eb_vmas *eb,
@@ -426,8 +470,14 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
        if (use_cpu_reloc(obj))
                ret = relocate_entry_cpu(obj, reloc, target_offset);
-        else
+        else if (obj->map_and_fenceable)
                ret = relocate_entry_gtt(obj, reloc, target_offset);
+        else if (cpu_has_clflush)
+                ret = relocate_entry_clflush(obj, reloc, target_offset);
+        else {
+                WARN_ONCE(1, "Impossible case in relocation handling\n");
+                ret = -ENODEV;
+        }
        if (ret)
                return ret;
@@ -525,6 +575,12 @@ i915_gem_execbuffer_relocate(struct eb_vmas *eb)
        return ret;
 }
+static bool only_mappable_for_reloc(unsigned int flags)
+{
+        return (flags & (EXEC_OBJECT_NEEDS_FENCE | __EXEC_OBJECT_NEEDS_MAP)) ==
+                __EXEC_OBJECT_NEEDS_MAP;
+}
 static int
 i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
                                struct intel_engine_cs *ring,
@@ -536,14 +592,21 @@ i915_gem_execbuffer_reserve_vma(struct i915_vma *vma,
        int ret;
        flags = 0;
-        if (entry->flags & __EXEC_OBJECT_NEEDS_MAP)
+        if (!drm_mm_node_allocated(&vma->node)) {
-                flags |= PIN_GLOBAL | PIN_MAPPABLE;
+                if (entry->flags & __EXEC_OBJECT_NEEDS_MAP)
-        if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
+                        flags |= PIN_GLOBAL | PIN_MAPPABLE;
-                flags |= PIN_GLOBAL;
+                if (entry->flags & EXEC_OBJECT_NEEDS_GTT)
-        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
+                        flags |= PIN_GLOBAL;
-                flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;
+                if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS)
+                        flags |= BATCH_OFFSET_BIAS | PIN_OFFSET_BIAS;
+        }
        ret = i915_gem_object_pin(obj, vma->vm, entry->alignment, flags);
+        if ((ret == -ENOSPC  || ret == -E2BIG) &&
+            only_mappable_for_reloc(entry->flags))
+                ret = i915_gem_object_pin(obj, vma->vm,
+                                          entry->alignment,
+                                          flags & ~(PIN_GLOBAL | PIN_MAPPABLE));
        if (ret)
                return ret;
@@ -605,13 +668,14 @@ eb_vma_misplaced(struct i915_vma *vma)
            vma->node.start & (entry->alignment - 1))
                return true;
-        if (entry->flags & __EXEC_OBJECT_NEEDS_MAP && !obj->map_and_fenceable)
-                return true;
        if (entry->flags & __EXEC_OBJECT_NEEDS_BIAS &&
            vma->node.start < BATCH_OFFSET_BIAS)
                return true;
+        /* avoid costly ping-pong once a batch bo ended up non-mappable */
+        if (entry->flags & __EXEC_OBJECT_NEEDS_MAP && !obj->map_and_fenceable)
+                return !only_mappable_for_reloc(entry->flags);
        return false;
 }
@@ -1187,6 +1251,13 @@ i915_gem_ringbuffer_submission(struct drm_device *dev, struct drm_file *file,
        if (ret)
                goto error;
+        if (ctx->ppgtt)
+                WARN(ctx->ppgtt->pd_dirty_rings & (1<<ring->id),
+                        "%s didn't clear reload\n", ring->name);
+        else if (dev_priv->mm.aliasing_ppgtt)
+                WARN(dev_priv->mm.aliasing_ppgtt->pd_dirty_rings &
+                        (1<<ring->id), "%s didn't clear reload\n", ring->name);
        instp_mode = args->flags & I915_EXEC_CONSTANTS_MASK;
        instp_mask = I915_EXEC_CONSTANTS_MASK;
        switch (instp_mode) {
@@ -1476,7 +1547,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                goto err;
        }
-        if (i915_needs_cmd_parser(ring)) {
+        if (i915_needs_cmd_parser(ring) && args->batch_len) {
                batch_obj = i915_gem_execbuffer_parse(ring,
                                                      &shadow_exec_entry,
                                                      eb,
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2034f7cf238b..0239fbff7bf7 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -67,8 +67,9 @@
 * i915_ggtt_view_type and struct i915_ggtt_view.
 *
 * A new flavour of core GEM functions which work with GGTT bound objects were
- * added with the _view suffix. They take the struct i915_ggtt_view parameter
+ * added with the _ggtt_ infix, and sometimes with _view postfix to avoid
- * encapsulating all metadata required to implement a view.
+ * renaming  in large amounts of code. They take the struct i915_ggtt_view
+ * parameter encapsulating all metadata required to implement a view.
 *
 * As a helper for callers which are only interested in the normal view,
 * globally const i915_ggtt_view_normal singleton instance exists. All old core
@@ -92,6 +93,9 @@
 */
 const struct i915_ggtt_view i915_ggtt_view_normal;
+const struct i915_ggtt_view i915_ggtt_view_rotated = {
+        .type = I915_GGTT_VIEW_ROTATED
+};
 static void bdw_setup_private_ppat(struct drm_i915_private *dev_priv);
 static void chv_setup_private_ppat(struct drm_i915_private *dev_priv);
@@ -147,11 +151,11 @@ static void ppgtt_bind_vma(struct i915_vma *vma,
                           u32 flags);
 static void ppgtt_unbind_vma(struct i915_vma *vma);
-static inline gen8_gtt_pte_t gen8_pte_encode(dma_addr_t addr,
+static inline gen8_pte_t gen8_pte_encode(dma_addr_t addr,
-                                             enum i915_cache_level level,
+                                         enum i915_cache_level level,
-                                             bool valid)
+                                         bool valid)
 {
-        gen8_gtt_pte_t pte = valid ? _PAGE_PRESENT | _PAGE_RW : 0;
+        gen8_pte_t pte = valid ? _PAGE_PRESENT | _PAGE_RW : 0;
        pte |= addr;
        switch (level) {
@@ -169,11 +173,11 @@ static inline gen8_gtt_pte_t gen8_pte_encode(dma_addr_t addr,
        return pte;
 }
-static inline gen8_ppgtt_pde_t gen8_pde_encode(struct drm_device *dev,
+static inline gen8_pde_t gen8_pde_encode(struct drm_device *dev,
-                                             dma_addr_t addr,
+                                          dma_addr_t addr,
-                                             enum i915_cache_level level)
+                                          enum i915_cache_level level)
 {
-        gen8_ppgtt_pde_t pde = _PAGE_PRESENT | _PAGE_RW;
+        gen8_pde_t pde = _PAGE_PRESENT | _PAGE_RW;
        pde |= addr;
        if (level != I915_CACHE_NONE)
                pde |= PPAT_CACHED_PDE_INDEX;
@@ -182,11 +186,11 @@ static inline gen8_ppgtt_pde_t gen8_pde_encode(struct drm_device *dev,
        return pde;
 }
-static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
+static gen6_pte_t snb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level,
+                                 enum i915_cache_level level,
-                                     bool valid, u32 unused)
+                                 bool valid, u32 unused)
 {
-        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
+        gen6_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -204,11 +208,11 @@ static gen6_gtt_pte_t snb_pte_encode(dma_addr_t addr,
        return pte;
 }
-static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
+static gen6_pte_t ivb_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level,
+                                 enum i915_cache_level level,
-                                     bool valid, u32 unused)
+                                 bool valid, u32 unused)
 {
-        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
+        gen6_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -228,11 +232,11 @@ static gen6_gtt_pte_t ivb_pte_encode(dma_addr_t addr,
        return pte;
 }
-static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
+static gen6_pte_t byt_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level,
+                                 enum i915_cache_level level,
-                                     bool valid, u32 flags)
+                                 bool valid, u32 flags)
 {
-        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
+        gen6_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= GEN6_PTE_ADDR_ENCODE(addr);
        if (!(flags & PTE_READ_ONLY))
@@ -244,11 +248,11 @@ static gen6_gtt_pte_t byt_pte_encode(dma_addr_t addr,
        return pte;
 }
-static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
+static gen6_pte_t hsw_pte_encode(dma_addr_t addr,
-                                     enum i915_cache_level level,
+                                 enum i915_cache_level level,
-                                     bool valid, u32 unused)
+                                 bool valid, u32 unused)
 {
-        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
+        gen6_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= HSW_PTE_ADDR_ENCODE(addr);
        if (level != I915_CACHE_NONE)
@@ -257,11 +261,11 @@ static gen6_gtt_pte_t hsw_pte_encode(dma_addr_t addr,
        return pte;
 }
-static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
+static gen6_pte_t iris_pte_encode(dma_addr_t addr,
-                                      enum i915_cache_level level,
+                                  enum i915_cache_level level,
-                                      bool valid, u32 unused)
+                                  bool valid, u32 unused)
 {
-        gen6_gtt_pte_t pte = valid ? GEN6_PTE_VALID : 0;
+        gen6_pte_t pte = valid ? GEN6_PTE_VALID : 0;
        pte |= HSW_PTE_ADDR_ENCODE(addr);
        switch (level) {
@@ -278,29 +282,91 @@ static gen6_gtt_pte_t iris_pte_encode(dma_addr_t addr,
        return pte;
 }
-static void unmap_and_free_pt(struct i915_page_table_entry *pt, struct drm_device *dev)
+#define i915_dma_unmap_single(px, dev) \
+        __i915_dma_unmap_single((px)->daddr, dev)
+static inline void __i915_dma_unmap_single(dma_addr_t daddr,
+                                        struct drm_device *dev)
+{
+        struct device *device = &dev->pdev->dev;
+        dma_unmap_page(device, daddr, 4096, PCI_DMA_BIDIRECTIONAL);
+}
+/**
+ * i915_dma_map_single() - Create a dma mapping for a page table/dir/etc.
+ * @px: Page table/dir/etc to get a DMA map for
+ * @dev:        drm device
+ *
+ * Page table allocations are unified across all gens. They always require a
+ * single 4k allocation, as well as a DMA mapping. If we keep the structs
+ * symmetric here, the simple macro covers us for every page table type.
+ *
+ * Return: 0 if success.
+ */
+#define i915_dma_map_single(px, dev) \
+        i915_dma_map_page_single((px)->page, (dev), &(px)->daddr)
+static inline int i915_dma_map_page_single(struct page *page,
+                                           struct drm_device *dev,
+                                           dma_addr_t *daddr)
+{
+        struct device *device = &dev->pdev->dev;
+        *daddr = dma_map_page(device, page, 0, 4096, PCI_DMA_BIDIRECTIONAL);
+        if (dma_mapping_error(device, *daddr))
+                return -ENOMEM;
+        return 0;
+}
+static void unmap_and_free_pt(struct i915_page_table_entry *pt,
+                               struct drm_device *dev)
 {
        if (WARN_ON(!pt->page))
                return;
+        i915_dma_unmap_single(pt, dev);
        __free_page(pt->page);
+        kfree(pt->used_ptes);
        kfree(pt);
 }
 static struct i915_page_table_entry *alloc_pt_single(struct drm_device *dev)
 {
        struct i915_page_table_entry *pt;
+        const size_t count = INTEL_INFO(dev)->gen >= 8 ?
+                GEN8_PTES : GEN6_PTES;
+        int ret = -ENOMEM;
        pt = kzalloc(sizeof(*pt), GFP_KERNEL);
        if (!pt)
                return ERR_PTR(-ENOMEM);
-        pt->page = alloc_page(GFP_KERNEL | __GFP_ZERO);
+        pt->used_ptes = kcalloc(BITS_TO_LONGS(count), sizeof(*pt->used_ptes),
-        if (!pt->page) {
+                                GFP_KERNEL);
-                kfree(pt);
-                return ERR_PTR(-ENOMEM);
+        if (!pt->used_ptes)
-        }
+                goto fail_bitmap;
+        pt->page = alloc_page(GFP_KERNEL);
+        if (!pt->page)
+                goto fail_page;
+        ret = i915_dma_map_single(pt, dev);
+        if (ret)
+                goto fail_dma;
        return pt;
+fail_dma:
+        __free_page(pt->page);
+fail_page:
+        kfree(pt->used_ptes);
+fail_bitmap:
+        kfree(pt);
+        return ERR_PTR(ret);
 }
 /**
@@ -318,12 +384,12 @@ static struct i915_page_table_entry *alloc_pt_single(struct drm_device *dev)
 * Return: 0 if allocation succeeded.
 */
 static int alloc_pt_range(struct i915_page_directory_entry *pd, uint16_t pde, size_t count,
-                  struct drm_device *dev)
+                          struct drm_device *dev)
 {
        int i, ret;
        /* 512 is the max page tables per page_directory on any platform. */
-        if (WARN_ON(pde + count > GEN6_PPGTT_PD_ENTRIES))
+        if (WARN_ON(pde + count > I915_PDES))
                return -EINVAL;
        for (i = pde; i < pde + count; i++) {
@@ -401,7 +467,7 @@ static int gen8_mm_switch(struct i915_hw_ppgtt *ppgtt,
        int i, ret;
        /* bit of a hack to find the actual last used pd */
-        int used_pd = ppgtt->num_pd_entries / GEN8_PDES_PER_PAGE;
+        int used_pd = ppgtt->num_pd_entries / I915_PDES;
        for (i = used_pd - 1; i >= 0; i--) {
                dma_addr_t addr = ppgtt->pdp.page_directory[i]->daddr;
@@ -420,7 +486,7 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm,
 {
        struct i915_hw_ppgtt *ppgtt =
                container_of(vm, struct i915_hw_ppgtt, base);
-        gen8_gtt_pte_t *pt_vaddr, scratch_pte;
+        gen8_pte_t *pt_vaddr, scratch_pte;
        unsigned pdpe = start >> GEN8_PDPE_SHIFT & GEN8_PDPE_MASK;
        unsigned pde = start >> GEN8_PDE_SHIFT & GEN8_PDE_MASK;
        unsigned pte = start >> GEN8_PTE_SHIFT & GEN8_PTE_MASK;
@@ -451,8 +517,8 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm,
                page_table = pt->page;
                last_pte = pte + num_entries;
-                if (last_pte > GEN8_PTES_PER_PAGE)
+                if (last_pte > GEN8_PTES)
-                        last_pte = GEN8_PTES_PER_PAGE;
+                        last_pte = GEN8_PTES;
                pt_vaddr = kmap_atomic(page_table);
@@ -466,7 +532,7 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm,
                kunmap_atomic(pt_vaddr);
                pte = 0;
-                if (++pde == GEN8_PDES_PER_PAGE) {
+                if (++pde == I915_PDES) {
                        pdpe++;
                        pde = 0;
                }
@@ -480,7 +546,7 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm,
 {
        struct i915_hw_ppgtt *ppgtt =
                container_of(vm, struct i915_hw_ppgtt, base);
-        gen8_gtt_pte_t *pt_vaddr;
+        gen8_pte_t *pt_vaddr;
        unsigned pdpe = start >> GEN8_PDPE_SHIFT & GEN8_PDPE_MASK;
        unsigned pde = start >> GEN8_PDE_SHIFT & GEN8_PDE_MASK;
        unsigned pte = start >> GEN8_PTE_SHIFT & GEN8_PTE_MASK;
@@ -503,12 +569,12 @@ static void gen8_ppgtt_insert_entries(struct i915_address_space *vm,
                pt_vaddr[pte] =
                        gen8_pte_encode(sg_page_iter_dma_address(&sg_iter),
                                        cache_level, true);
-                if (++pte == GEN8_PTES_PER_PAGE) {
+                if (++pte == GEN8_PTES) {
                        if (!HAS_LLC(ppgtt->base.dev))
                                drm_clflush_virt_range(pt_vaddr, PAGE_SIZE);
                        kunmap_atomic(pt_vaddr);
                        pt_vaddr = NULL;
-                        if (++pde == GEN8_PDES_PER_PAGE) {
+                        if (++pde == I915_PDES) {
                                pdpe++;
                                pde = 0;
                        }
@@ -529,7 +595,7 @@ static void gen8_free_page_tables(struct i915_page_directory_entry *pd, struct d
        if (!pd->page)
                return;
-        for (i = 0; i < GEN8_PDES_PER_PAGE; i++) {
+        for (i = 0; i < I915_PDES; i++) {
                if (WARN_ON(!pd->page_table[i]))
                        continue;
@@ -565,7 +631,7 @@ static void gen8_ppgtt_unmap_pages(struct i915_hw_ppgtt *ppgtt)
                pci_unmap_page(hwdev, ppgtt->pdp.page_directory[i]->daddr, PAGE_SIZE,
                               PCI_DMA_BIDIRECTIONAL);
-                for (j = 0; j < GEN8_PDES_PER_PAGE; j++) {
+                for (j = 0; j < I915_PDES; j++) {
                        struct i915_page_directory_entry *pd = ppgtt->pdp.page_directory[i];
                        struct i915_page_table_entry *pt;
                        dma_addr_t addr;
@@ -598,7 +664,7 @@ static int gen8_ppgtt_allocate_page_tables(struct i915_hw_ppgtt *ppgtt)
        for (i = 0; i < ppgtt->num_pd_pages; i++) {
                ret = alloc_pt_range(ppgtt->pdp.page_directory[i],
-                                     0, GEN8_PDES_PER_PAGE, ppgtt->base.dev);
+                                     0, I915_PDES, ppgtt->base.dev);
                if (ret)
                        goto unwind_out;
        }
@@ -648,7 +714,7 @@ static int gen8_ppgtt_alloc(struct i915_hw_ppgtt *ppgtt,
        if (ret)
                goto err_out;
-        ppgtt->num_pd_entries = max_pdp * GEN8_PDES_PER_PAGE;
+        ppgtt->num_pd_entries = max_pdp * I915_PDES;
        return 0;
@@ -697,7 +763,7 @@ static int gen8_ppgtt_setup_page_tables(struct i915_hw_ppgtt *ppgtt,
        return 0;
 }
-/**
+/*
 * GEN8 legacy ppgtt programming is accomplished through a max 4 PDP registers
 * with a net effect resembling a 2-level page table in normal x86 terms. Each
 * PDP represents 1GB of memory 4 * 512 * 512 * 4096 = 4GB legacy 32b address
@@ -710,7 +776,7 @@ static int gen8_ppgtt_setup_page_tables(struct i915_hw_ppgtt *ppgtt,
 static int gen8_ppgtt_init(struct i915_hw_ppgtt *ppgtt, uint64_t size)
 {
        const int max_pdp = DIV_ROUND_UP(size, 1 << 30);
-        const int min_pt_pages = GEN8_PDES_PER_PAGE * max_pdp;
+        const int min_pt_pages = I915_PDES * max_pdp;
        int i, j, ret;
        if (size % (1<<30))
@@ -733,7 +799,7 @@ static int gen8_ppgtt_init(struct i915_hw_ppgtt *ppgtt, uint64_t size)
                if (ret)
                        goto bail;
-                for (j = 0; j < GEN8_PDES_PER_PAGE; j++) {
+                for (j = 0; j < I915_PDES; j++) {
                        ret = gen8_ppgtt_setup_page_tables(ppgtt, i, j);
                        if (ret)
                                goto bail;
@@ -750,9 +816,9 @@ static int gen8_ppgtt_init(struct i915_hw_ppgtt *ppgtt, uint64_t size)
         */
        for (i = 0; i < GEN8_LEGACY_PDPES; i++) {
                struct i915_page_directory_entry *pd = ppgtt->pdp.page_directory[i];
-                gen8_ppgtt_pde_t *pd_vaddr;
+                gen8_pde_t *pd_vaddr;
                pd_vaddr = kmap_atomic(ppgtt->pdp.page_directory[i]->page);
-                for (j = 0; j < GEN8_PDES_PER_PAGE; j++) {
+                for (j = 0; j < I915_PDES; j++) {
                        struct i915_page_table_entry *pt = pd->page_table[j];
                        dma_addr_t addr = pt->daddr;
                        pd_vaddr[j] = gen8_pde_encode(ppgtt->base.dev, addr,
@@ -770,11 +836,11 @@ static int gen8_ppgtt_init(struct i915_hw_ppgtt *ppgtt, uint64_t size)
        ppgtt->base.start = 0;
        /* This is the area that we advertise as usable for the caller */
-        ppgtt->base.total = max_pdp * GEN8_PDES_PER_PAGE * GEN8_PTES_PER_PAGE * PAGE_SIZE;
+        ppgtt->base.total = max_pdp * I915_PDES * GEN8_PTES * PAGE_SIZE;
        /* Set all ptes to a valid scratch page. Also above requested space */
        ppgtt->base.clear_range(&ppgtt->base, 0,
-                                ppgtt->num_pd_pages * GEN8_PTES_PER_PAGE * PAGE_SIZE,
+                                ppgtt->num_pd_pages * GEN8_PTES * PAGE_SIZE,
                                true);
        DRM_DEBUG_DRIVER("Allocated %d pages for page directories (%d wasted)\n",
@@ -794,22 +860,22 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *ppgtt, struct seq_file *m)
 {
        struct drm_i915_private *dev_priv = ppgtt->base.dev->dev_private;
        struct i915_address_space *vm = &ppgtt->base;
-        gen6_gtt_pte_t __iomem *pd_addr;
+        gen6_pte_t __iomem *pd_addr;
-        gen6_gtt_pte_t scratch_pte;
+        gen6_pte_t scratch_pte;
        uint32_t pd_entry;
        int pte, pde;
        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, true, 0);
-        pd_addr = (gen6_gtt_pte_t __iomem *)dev_priv->gtt.gsm +
+        pd_addr = (gen6_pte_t __iomem *)dev_priv->gtt.gsm +
-                ppgtt->pd.pd_offset / sizeof(gen6_gtt_pte_t);
+                ppgtt->pd.pd_offset / sizeof(gen6_pte_t);
        seq_printf(m, "  VM %p (pd_offset %x-%x):\n", vm,
                   ppgtt->pd.pd_offset,
                   ppgtt->pd.pd_offset + ppgtt->num_pd_entries);
        for (pde = 0; pde < ppgtt->num_pd_entries; pde++) {
                u32 expected;
-                gen6_gtt_pte_t *pt_vaddr;
+                gen6_pte_t *pt_vaddr;
                dma_addr_t pt_addr = ppgtt->pd.page_table[pde]->daddr;
                pd_entry = readl(pd_addr + pde);
                expected = (GEN6_PDE_ADDR_ENCODE(pt_addr) | GEN6_PDE_VALID);
@@ -822,9 +888,9 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *ppgtt, struct seq_file *m)
                seq_printf(m, "\tPDE: %x\n", pd_entry);
                pt_vaddr = kmap_atomic(ppgtt->pd.page_table[pde]->page);
-                for (pte = 0; pte < I915_PPGTT_PT_ENTRIES; pte+=4) {
+                for (pte = 0; pte < GEN6_PTES; pte+=4) {
                        unsigned long va =
-                                (pde * PAGE_SIZE * I915_PPGTT_PT_ENTRIES) +
+                                (pde * PAGE_SIZE * GEN6_PTES) +
                                (pte * PAGE_SIZE);
                        int i;
                        bool found = false;
@@ -847,26 +913,36 @@ static void gen6_dump_ppgtt(struct i915_hw_ppgtt *ppgtt, struct seq_file *m)
        }
 }
-static void gen6_write_pdes(struct i915_hw_ppgtt *ppgtt)
+/* Write pde (index) from the page directory @pd to the page table @pt */
+static void gen6_write_pde(struct i915_page_directory_entry *pd,
+                            const int pde, struct i915_page_table_entry *pt)
 {
-        struct drm_i915_private *dev_priv = ppgtt->base.dev->dev_private;
+        /* Caller needs to make sure the write completes if necessary */
-        gen6_gtt_pte_t __iomem *pd_addr;
+        struct i915_hw_ppgtt *ppgtt =
-        uint32_t pd_entry;
+                container_of(pd, struct i915_hw_ppgtt, pd);
-        int i;
+        u32 pd_entry;
-        WARN_ON(ppgtt->pd.pd_offset & 0x3f);
+        pd_entry = GEN6_PDE_ADDR_ENCODE(pt->daddr);
-        pd_addr = (gen6_gtt_pte_t __iomem*)dev_priv->gtt.gsm +
+        pd_entry |= GEN6_PDE_VALID;
-                ppgtt->pd.pd_offset / sizeof(gen6_gtt_pte_t);
-        for (i = 0; i < ppgtt->num_pd_entries; i++) {
-                dma_addr_t pt_addr;
-                pt_addr = ppgtt->pd.page_table[i]->daddr;
+        writel(pd_entry, ppgtt->pd_addr + pde);
-                pd_entry = GEN6_PDE_ADDR_ENCODE(pt_addr);
+}
-                pd_entry |= GEN6_PDE_VALID;
-                writel(pd_entry, pd_addr + i);
+/* Write all the page tables found in the ppgtt structure to incrementing page
-        }
+ * directories. */
-        readl(pd_addr);
+static void gen6_write_page_range(struct drm_i915_private *dev_priv,
+                                  struct i915_page_directory_entry *pd,
+                                  uint32_t start, uint32_t length)
+{
+        struct i915_page_table_entry *pt;
+        uint32_t pde, temp;
+        gen6_for_each_pde(pt, pd, start, length, temp, pde)
+                gen6_write_pde(pd, pde, pt);
+        /* Make sure write is complete before other code can use this page
+         * table. Also require for WC mapped PTEs */
+        readl(dev_priv->gtt.gsm);
 }
 static uint32_t get_pd_offset(struct i915_hw_ppgtt *ppgtt)
@@ -1022,19 +1098,19 @@ static void gen6_ppgtt_clear_range(struct i915_address_space *vm,
 {
        struct i915_hw_ppgtt *ppgtt =
                container_of(vm, struct i915_hw_ppgtt, base);
-        gen6_gtt_pte_t *pt_vaddr, scratch_pte;
+        gen6_pte_t *pt_vaddr, scratch_pte;
        unsigned first_entry = start >> PAGE_SHIFT;
        unsigned num_entries = length >> PAGE_SHIFT;
-        unsigned act_pt = first_entry / I915_PPGTT_PT_ENTRIES;
+        unsigned act_pt = first_entry / GEN6_PTES;
-        unsigned first_pte = first_entry % I915_PPGTT_PT_ENTRIES;
+        unsigned first_pte = first_entry % GEN6_PTES;
        unsigned last_pte, i;
        scratch_pte = vm->pte_encode(vm->scratch.addr, I915_CACHE_LLC, true, 0);
        while (num_entries) {
                last_pte = first_pte + num_entries;
-                if (last_pte > I915_PPGTT_PT_ENTRIES)
+                if (last_pte > GEN6_PTES)
-                        last_pte = I915_PPGTT_PT_ENTRIES;
+                        last_pte = GEN6_PTES;
                pt_vaddr = kmap_atomic(ppgtt->pd.page_table[act_pt]->page);
@@ -1056,10 +1132,10 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
 {
        struct i915_hw_ppgtt *ppgtt =
                container_of(vm, struct i915_hw_ppgtt, base);
-        gen6_gtt_pte_t *pt_vaddr;
+        gen6_pte_t *pt_vaddr;
        unsigned first_entry = start >> PAGE_SHIFT;
-        unsigned act_pt = first_entry / I915_PPGTT_PT_ENTRIES;
+        unsigned act_pt = first_entry / GEN6_PTES;
-        unsigned act_pte = first_entry % I915_PPGTT_PT_ENTRIES;
+        unsigned act_pte = first_entry % GEN6_PTES;
        struct sg_page_iter sg_iter;
        pt_vaddr = NULL;
@@ -1071,7 +1147,7 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
                        vm->pte_encode(sg_page_iter_dma_address(&sg_iter),
                                       cache_level, true, flags);
-                if (++act_pte == I915_PPGTT_PT_ENTRIES) {
+                if (++act_pte == GEN6_PTES) {
                        kunmap_atomic(pt_vaddr);
                        pt_vaddr = NULL;
                        act_pt++;
@@ -1082,23 +1158,133 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
                kunmap_atomic(pt_vaddr);
 }
-static void gen6_ppgtt_unmap_pages(struct i915_hw_ppgtt *ppgtt)
+/* PDE TLBs are a pain invalidate pre GEN8. It requires a context reload. If we
+ * are switching between contexts with the same LRCA, we also must do a force
+ * restore.
+ */
+static inline void mark_tlbs_dirty(struct i915_hw_ppgtt *ppgtt)
 {
+        /* If current vm != vm, */
+        ppgtt->pd_dirty_rings = INTEL_INFO(ppgtt->base.dev)->ring_mask;
+}
+static void gen6_initialize_pt(struct i915_address_space *vm,
+                struct i915_page_table_entry *pt)
+{
+        gen6_pte_t *pt_vaddr, scratch_pte;
        int i;
-        for (i = 0; i < ppgtt->num_pd_entries; i++)
+        WARN_ON(vm->scratch.addr == 0);
-                pci_unmap_page(ppgtt->base.dev->pdev,
-                               ppgtt->pd.page_table[i]->daddr,
+        scratch_pte = vm->pte_encode(vm->scratch.addr,
-                               4096, PCI_DMA_BIDIRECTIONAL);
+                        I915_CACHE_LLC, true, 0);
+        pt_vaddr = kmap_atomic(pt->page);
+        for (i = 0; i < GEN6_PTES; i++)
+                pt_vaddr[i] = scratch_pte;
+        kunmap_atomic(pt_vaddr);
+}
+static int gen6_alloc_va_range(struct i915_address_space *vm,
+                               uint64_t start, uint64_t length)
+{
+        DECLARE_BITMAP(new_page_tables, I915_PDES);
+        struct drm_device *dev = vm->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct i915_hw_ppgtt *ppgtt =
+                                container_of(vm, struct i915_hw_ppgtt, base);
+        struct i915_page_table_entry *pt;
+        const uint32_t start_save = start, length_save = length;
+        uint32_t pde, temp;
+        int ret;
+        WARN_ON(upper_32_bits(start));
+        bitmap_zero(new_page_tables, I915_PDES);
+        /* The allocation is done in two stages so that we can bail out with
+         * minimal amount of pain. The first stage finds new page tables that
+         * need allocation. The second stage marks use ptes within the page
+         * tables.
+         */
+        gen6_for_each_pde(pt, &ppgtt->pd, start, length, temp, pde) {
+                if (pt != ppgtt->scratch_pt) {
+                        WARN_ON(bitmap_empty(pt->used_ptes, GEN6_PTES));
+                        continue;
+                }
+                /* We've already allocated a page table */
+                WARN_ON(!bitmap_empty(pt->used_ptes, GEN6_PTES));
+                pt = alloc_pt_single(dev);
+                if (IS_ERR(pt)) {
+                        ret = PTR_ERR(pt);
+                        goto unwind_out;
+                }
+                gen6_initialize_pt(vm, pt);
+                ppgtt->pd.page_table[pde] = pt;
+                set_bit(pde, new_page_tables);
+                trace_i915_page_table_entry_alloc(vm, pde, start, GEN6_PDE_SHIFT);
+        }
+        start = start_save;
+        length = length_save;
+        gen6_for_each_pde(pt, &ppgtt->pd, start, length, temp, pde) {
+                DECLARE_BITMAP(tmp_bitmap, GEN6_PTES);
+                bitmap_zero(tmp_bitmap, GEN6_PTES);
+                bitmap_set(tmp_bitmap, gen6_pte_index(start),
+                           gen6_pte_count(start, length));
+                if (test_and_clear_bit(pde, new_page_tables))
+                        gen6_write_pde(&ppgtt->pd, pde, pt);
+                trace_i915_page_table_entry_map(vm, pde, pt,
+                                         gen6_pte_index(start),
+                                         gen6_pte_count(start, length),
+                                         GEN6_PTES);
+                bitmap_or(pt->used_ptes, tmp_bitmap, pt->used_ptes,
+                                GEN6_PTES);
+        }
+        WARN_ON(!bitmap_empty(new_page_tables, I915_PDES));
+        /* Make sure write is complete before other code can use this page
+         * table. Also require for WC mapped PTEs */
+        readl(dev_priv->gtt.gsm);
+        mark_tlbs_dirty(ppgtt);
+        return 0;
+unwind_out:
+        for_each_set_bit(pde, new_page_tables, I915_PDES) {
+                struct i915_page_table_entry *pt = ppgtt->pd.page_table[pde];
+                ppgtt->pd.page_table[pde] = ppgtt->scratch_pt;
+                unmap_and_free_pt(pt, vm->dev);
+        }
+        mark_tlbs_dirty(ppgtt);
+        return ret;
 }
 static void gen6_ppgtt_free(struct i915_hw_ppgtt *ppgtt)
 {
        int i;
-        for (i = 0; i < ppgtt->num_pd_entries; i++)
+        for (i = 0; i < ppgtt->num_pd_entries; i++) {
-                unmap_and_free_pt(ppgtt->pd.page_table[i], ppgtt->base.dev);
+                struct i915_page_table_entry *pt = ppgtt->pd.page_table[i];
+                if (pt != ppgtt->scratch_pt)
+                        unmap_and_free_pt(ppgtt->pd.page_table[i], ppgtt->base.dev);
+        }
+        unmap_and_free_pt(ppgtt->scratch_pt, ppgtt->base.dev);
        unmap_and_free_pd(&ppgtt->pd);
 }
@@ -1109,7 +1295,6 @@ static void gen6_ppgtt_cleanup(struct i915_address_space *vm)
        drm_mm_remove_node(&ppgtt->node);
-        gen6_ppgtt_unmap_pages(ppgtt);
        gen6_ppgtt_free(ppgtt);
 }
@@ -1125,6 +1310,12 @@ static int gen6_ppgtt_allocate_page_directories(struct i915_hw_ppgtt *ppgtt)
         * size. We allocate at the top of the GTT to avoid fragmentation.
         */
        BUG_ON(!drm_mm_initialized(&dev_priv->gtt.base.mm));
+        ppgtt->scratch_pt = alloc_pt_single(ppgtt->base.dev);
+        if (IS_ERR(ppgtt->scratch_pt))
+                return PTR_ERR(ppgtt->scratch_pt);
+        gen6_initialize_pt(&ppgtt->base, ppgtt->scratch_pt);
 alloc:
        ret = drm_mm_insert_node_in_range_generic(&dev_priv->gtt.base.mm,
                                                  &ppgtt->node, GEN6_PD_SIZE,
@@ -1138,66 +1329,43 @@ alloc:
                                               0, dev_priv->gtt.base.total,
                                               0);
                if (ret)
-                        return ret;
+                        goto err_out;
                retried = true;
                goto alloc;
        }
        if (ret)
-                return ret;
+                goto err_out;
        if (ppgtt->node.start < dev_priv->gtt.mappable_end)
                DRM_DEBUG("Forced to use aperture for PDEs\n");
-        ppgtt->num_pd_entries = GEN6_PPGTT_PD_ENTRIES;
+        ppgtt->num_pd_entries = I915_PDES;
        return 0;
+err_out:
+        unmap_and_free_pt(ppgtt->scratch_pt, ppgtt->base.dev);
+        return ret;
 }
 static int gen6_ppgtt_alloc(struct i915_hw_ppgtt *ppgtt)
 {
-        int ret;
+        return gen6_ppgtt_allocate_page_directories(ppgtt);
-        ret = gen6_ppgtt_allocate_page_directories(ppgtt);
-        if (ret)
-                return ret;
-        ret = alloc_pt_range(&ppgtt->pd, 0, ppgtt->num_pd_entries,
-                        ppgtt->base.dev);
-        if (ret) {
-                drm_mm_remove_node(&ppgtt->node);
-                return ret;
-        }
-        return 0;
 }
-static int gen6_ppgtt_setup_page_tables(struct i915_hw_ppgtt *ppgtt)
+static void gen6_scratch_va_range(struct i915_hw_ppgtt *ppgtt,
+                                  uint64_t start, uint64_t length)
 {
-        struct drm_device *dev = ppgtt->base.dev;
+        struct i915_page_table_entry *unused;
-        int i;
+        uint32_t pde, temp;
-        for (i = 0; i < ppgtt->num_pd_entries; i++) {
-                struct page *page;
-                dma_addr_t pt_addr;
-                page = ppgtt->pd.page_table[i]->page;
-                pt_addr = pci_map_page(dev->pdev, page, 0, 4096,
-                                       PCI_DMA_BIDIRECTIONAL);
-                if (pci_dma_mapping_error(dev->pdev, pt_addr)) {
-                        gen6_ppgtt_unmap_pages(ppgtt);
-                        return -EIO;
-                }
-                ppgtt->pd.page_table[i]->daddr = pt_addr;
+        gen6_for_each_pde(unused, &ppgtt->pd, start, length, temp, pde)
-        }
+                ppgtt->pd.page_table[pde] = ppgtt->scratch_pt;
-        return 0;
 }
-static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
+static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt, bool aliasing)
 {
        struct drm_device *dev = ppgtt->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1220,36 +1388,50 @@ static int gen6_ppgtt_init(struct i915_hw_ppgtt *ppgtt)
        if (ret)
                return ret;
-        ret = gen6_ppgtt_setup_page_tables(ppgtt);
+        if (aliasing) {
-        if (ret) {
+                /* preallocate all pts */
-                gen6_ppgtt_free(ppgtt);
+                ret = alloc_pt_range(&ppgtt->pd, 0, ppgtt->num_pd_entries,
-                return ret;
+                                ppgtt->base.dev);
+                if (ret) {
+                        gen6_ppgtt_cleanup(&ppgtt->base);
+                        return ret;
+                }
        }
+        ppgtt->base.allocate_va_range = gen6_alloc_va_range;
        ppgtt->base.clear_range = gen6_ppgtt_clear_range;
        ppgtt->base.insert_entries = gen6_ppgtt_insert_entries;
        ppgtt->base.cleanup = gen6_ppgtt_cleanup;
        ppgtt->base.start = 0;
-        ppgtt->base.total = ppgtt->num_pd_entries * I915_PPGTT_PT_ENTRIES * PAGE_SIZE;
+        ppgtt->base.total = ppgtt->num_pd_entries * GEN6_PTES * PAGE_SIZE;
        ppgtt->debug_dump = gen6_dump_ppgtt;
        ppgtt->pd.pd_offset =
-                ppgtt->node.start / PAGE_SIZE * sizeof(gen6_gtt_pte_t);
+                ppgtt->node.start / PAGE_SIZE * sizeof(gen6_pte_t);
+        ppgtt->pd_addr = (gen6_pte_t __iomem *)dev_priv->gtt.gsm +
+                ppgtt->pd.pd_offset / sizeof(gen6_pte_t);
+        if (aliasing)
+                ppgtt->base.clear_range(&ppgtt->base, 0, ppgtt->base.total, true);
+        else
+                gen6_scratch_va_range(ppgtt, 0, ppgtt->base.total);
-        ppgtt->base.clear_range(&ppgtt->base, 0, ppgtt->base.total, true);
+        gen6_write_page_range(dev_priv, &ppgtt->pd, 0, ppgtt->base.total);
        DRM_DEBUG_DRIVER("Allocated pde space (%lldM) at GTT entry: %llx\n",
                         ppgtt->node.size >> 20,
                         ppgtt->node.start / PAGE_SIZE);
-        gen6_write_pdes(ppgtt);
        DRM_DEBUG("Adding PPGTT at offset %x\n",
                  ppgtt->pd.pd_offset << 10);
        return 0;
 }
-static int __hw_ppgtt_init(struct drm_device *dev, struct i915_hw_ppgtt *ppgtt)
+static int __hw_ppgtt_init(struct drm_device *dev, struct i915_hw_ppgtt *ppgtt,
+                bool aliasing)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1257,7 +1439,7 @@ static int __hw_ppgtt_init(struct drm_device *dev, struct i915_hw_ppgtt *ppgtt)
        ppgtt->base.scratch = dev_priv->gtt.base.scratch;
        if (INTEL_INFO(dev)->gen < 8)
-                return gen6_ppgtt_init(ppgtt);
+                return gen6_ppgtt_init(ppgtt, aliasing);
        else
                return gen8_ppgtt_init(ppgtt, dev_priv->gtt.base.total);
 }
@@ -1266,7 +1448,7 @@ int i915_ppgtt_init(struct drm_device *dev, struct i915_hw_ppgtt *ppgtt)
        struct drm_i915_private *dev_priv = dev->dev_private;
        int ret = 0;
-        ret = __hw_ppgtt_init(dev, ppgtt);
+        ret = __hw_ppgtt_init(dev, ppgtt, false);
        if (ret == 0) {
                kref_init(&ppgtt->ref);
                drm_mm_init(&ppgtt->base.mm, ppgtt->base.start,
@@ -1513,15 +1695,20 @@ void i915_gem_restore_gtt_mappings(struct drm_device *dev)
                return;
        }
-        list_for_each_entry(vm, &dev_priv->vm_list, global_link) {
+        if (USES_PPGTT(dev)) {
-                /* TODO: Perhaps it shouldn't be gen6 specific */
+                list_for_each_entry(vm, &dev_priv->vm_list, global_link) {
-                if (i915_is_ggtt(vm)) {
+                        /* TODO: Perhaps it shouldn't be gen6 specific */
-                        if (dev_priv->mm.aliasing_ppgtt)
-                                gen6_write_pdes(dev_priv->mm.aliasing_ppgtt);
-                        continue;
-                }
-                gen6_write_pdes(container_of(vm, struct i915_hw_ppgtt, base));
+                        struct i915_hw_ppgtt *ppgtt =
+                                        container_of(vm, struct i915_hw_ppgtt,
+                                                     base);
+                        if (i915_is_ggtt(vm))
+                                ppgtt = dev_priv->mm.aliasing_ppgtt;
+                        gen6_write_page_range(dev_priv, &ppgtt->pd,
+                                              0, ppgtt->base.total);
+                }
        }
        i915_ggtt_flush(dev_priv);
@@ -1540,7 +1727,7 @@ int i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj)
        return 0;
 }
-static inline void gen8_set_pte(void __iomem *addr, gen8_gtt_pte_t pte)
+static inline void gen8_set_pte(void __iomem *addr, gen8_pte_t pte)
 {
 #ifdef writeq
        writeq(pte, addr);
@@ -1557,8 +1744,8 @@ static void gen8_ggtt_insert_entries(struct i915_address_space *vm,
 {
        struct drm_i915_private *dev_priv = vm->dev->dev_private;
        unsigned first_entry = start >> PAGE_SHIFT;
-        gen8_gtt_pte_t __iomem *gtt_entries =
+        gen8_pte_t __iomem *gtt_entries =
-                (gen8_gtt_pte_t __iomem *)dev_priv->gtt.gsm + first_entry;
+                (gen8_pte_t __iomem *)dev_priv->gtt.gsm + first_entry;
        int i = 0;
        struct sg_page_iter sg_iter;
        dma_addr_t addr = 0; /* shut up gcc */
@@ -1603,8 +1790,8 @@ static void gen6_ggtt_insert_entries(struct i915_address_space *vm,
 {
        struct drm_i915_private *dev_priv = vm->dev->dev_private;
        unsigned first_entry = start >> PAGE_SHIFT;
-        gen6_gtt_pte_t __iomem *gtt_entries =
+        gen6_pte_t __iomem *gtt_entries =
-                (gen6_gtt_pte_t __iomem *)dev_priv->gtt.gsm + first_entry;
+                (gen6_pte_t __iomem *)dev_priv->gtt.gsm + first_entry;
        int i = 0;
        struct sg_page_iter sg_iter;
        dma_addr_t addr = 0;
@@ -1642,8 +1829,8 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm,
        struct drm_i915_private *dev_priv = vm->dev->dev_private;
        unsigned first_entry = start >> PAGE_SHIFT;
        unsigned num_entries = length >> PAGE_SHIFT;
-        gen8_gtt_pte_t scratch_pte, __iomem *gtt_base =
+        gen8_pte_t scratch_pte, __iomem *gtt_base =
-                (gen8_gtt_pte_t __iomem *) dev_priv->gtt.gsm + first_entry;
+                (gen8_pte_t __iomem *) dev_priv->gtt.gsm + first_entry;
        const int max_entries = gtt_total_entries(dev_priv->gtt) - first_entry;
        int i;
@@ -1668,8 +1855,8 @@ static void gen6_ggtt_clear_range(struct i915_address_space *vm,
        struct drm_i915_private *dev_priv = vm->dev->dev_private;
        unsigned first_entry = start >> PAGE_SHIFT;
        unsigned num_entries = length >> PAGE_SHIFT;
-        gen6_gtt_pte_t scratch_pte, __iomem *gtt_base =
+        gen6_pte_t scratch_pte, __iomem *gtt_base =
-                (gen6_gtt_pte_t __iomem *) dev_priv->gtt.gsm + first_entry;
+                (gen6_pte_t __iomem *) dev_priv->gtt.gsm + first_entry;
        const int max_entries = gtt_total_entries(dev_priv->gtt) - first_entry;
        int i;
@@ -1726,11 +1913,15 @@ static void ggtt_bind_vma(struct i915_vma *vma,
        struct drm_device *dev = vma->vm->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj = vma->obj;
+        struct sg_table *pages = obj->pages;
        /* Currently applicable only to VLV */
        if (obj->gt_ro)
                flags |= PTE_READ_ONLY;
+        if (i915_is_ggtt(vma->vm))
+                pages = vma->ggtt_view.pages;
        /* If there is no aliasing PPGTT, or the caller needs a global mapping,
         * or we have a global mapping already but the cacheability flags have
         * changed, set the global PTEs.
@@ -1745,7 +1936,7 @@ static void ggtt_bind_vma(struct i915_vma *vma,
        if (!dev_priv->mm.aliasing_ppgtt || flags & GLOBAL_BIND) {
                if (!(vma->bound & GLOBAL_BIND) ||
                    (cache_level != obj->cache_level)) {
-                        vma->vm->insert_entries(vma->vm, vma->ggtt_view.pages,
+                        vma->vm->insert_entries(vma->vm, pages,
                                                vma->node.start,
                                                cache_level, flags);
                        vma->bound |= GLOBAL_BIND;
@@ -1756,8 +1947,7 @@ static void ggtt_bind_vma(struct i915_vma *vma,
            (!(vma->bound & LOCAL_BIND) ||
             (cache_level != obj->cache_level))) {
                struct i915_hw_ppgtt *appgtt = dev_priv->mm.aliasing_ppgtt;
-                appgtt->base.insert_entries(&appgtt->base,
+                appgtt->base.insert_entries(&appgtt->base, pages,
-                                            vma->ggtt_view.pages,
                                            vma->node.start,
                                            cache_level, flags);
                vma->bound |= LOCAL_BIND;
@@ -1893,9 +2083,11 @@ static int i915_gem_setup_global_gtt(struct drm_device *dev,
                if (!ppgtt)
                        return -ENOMEM;
-                ret = __hw_ppgtt_init(dev, ppgtt);
+                ret = __hw_ppgtt_init(dev, ppgtt, true);
-                if (ret != 0)
+                if (ret) {
+                        kfree(ppgtt);
                        return ret;
+                }
                dev_priv->mm.aliasing_ppgtt = ppgtt;
        }
@@ -2181,7 +2373,7 @@ static int gen8_gmch_probe(struct drm_device *dev,
                gtt_size = gen8_get_total_gtt_size(snb_gmch_ctl);
        }
-        *gtt_total = (gtt_size / sizeof(gen8_gtt_pte_t)) << PAGE_SHIFT;
+        *gtt_total = (gtt_size / sizeof(gen8_pte_t)) << PAGE_SHIFT;
        if (IS_CHERRYVIEW(dev))
                chv_setup_private_ppat(dev_priv);
@@ -2226,7 +2418,7 @@ static int gen6_gmch_probe(struct drm_device *dev,
        *stolen = gen6_get_stolen_size(snb_gmch_ctl);
        gtt_size = gen6_get_total_gtt_size(snb_gmch_ctl);
-        *gtt_total = (gtt_size / sizeof(gen6_gtt_pte_t)) << PAGE_SHIFT;
+        *gtt_total = (gtt_size / sizeof(gen6_pte_t)) << PAGE_SHIFT;
        ret = ggtt_probe_common(dev, gtt_size);
@@ -2331,11 +2523,16 @@ int i915_gem_gtt_init(struct drm_device *dev)
        return 0;
 }
-static struct i915_vma *__i915_gem_vma_create(struct drm_i915_gem_object *obj,
+static struct i915_vma *
-                                              struct i915_address_space *vm,
+__i915_gem_vma_create(struct drm_i915_gem_object *obj,
-                                              const struct i915_ggtt_view *view)
+                      struct i915_address_space *vm,
+                      const struct i915_ggtt_view *ggtt_view)
 {
-        struct i915_vma *vma = kzalloc(sizeof(*vma), GFP_KERNEL);
+        struct i915_vma *vma;
+        if (WARN_ON(i915_is_ggtt(vm) != !!ggtt_view))
+                return ERR_PTR(-EINVAL);
+        vma = kzalloc(sizeof(*vma), GFP_KERNEL);
        if (vma == NULL)
                return ERR_PTR(-ENOMEM);
@@ -2344,10 +2541,11 @@ static struct i915_vma *__i915_gem_vma_create(struct drm_i915_gem_object *obj,
        INIT_LIST_HEAD(&vma->exec_list);
        vma->vm = vm;
        vma->obj = obj;
-        vma->ggtt_view = *view;
        if (INTEL_INFO(vm->dev)->gen >= 6) {
                if (i915_is_ggtt(vm)) {
+                        vma->ggtt_view = *ggtt_view;
                        vma->unbind_vma = ggtt_unbind_vma;
                        vma->bind_vma = ggtt_bind_vma;
                } else {
@@ -2356,6 +2554,7 @@ static struct i915_vma *__i915_gem_vma_create(struct drm_i915_gem_object *obj,
                }
        } else {
                BUG_ON(!i915_is_ggtt(vm));
+                vma->ggtt_view = *ggtt_view;
                vma->unbind_vma = i915_ggtt_unbind_vma;
                vma->bind_vma = i915_ggtt_bind_vma;
        }
@@ -2368,38 +2567,170 @@ static struct i915_vma *__i915_gem_vma_create(struct drm_i915_gem_object *obj,
 }
 struct i915_vma *
-i915_gem_obj_lookup_or_create_vma_view(struct drm_i915_gem_object *obj,
+i915_gem_obj_lookup_or_create_vma(struct drm_i915_gem_object *obj,
-                                       struct i915_address_space *vm,
+                                  struct i915_address_space *vm)
+{
+        struct i915_vma *vma;
+        vma = i915_gem_obj_to_vma(obj, vm);
+        if (!vma)
+                vma = __i915_gem_vma_create(obj, vm,
+                                            i915_is_ggtt(vm) ? &i915_ggtt_view_normal : NULL);
+        return vma;
+}
+struct i915_vma *
+i915_gem_obj_lookup_or_create_ggtt_vma(struct drm_i915_gem_object *obj,
                                       const struct i915_ggtt_view *view)
 {
+        struct i915_address_space *ggtt = i915_obj_to_ggtt(obj);
        struct i915_vma *vma;
-        vma = i915_gem_obj_to_vma_view(obj, vm, view);
+        if (WARN_ON(!view))
+                return ERR_PTR(-EINVAL);
+        vma = i915_gem_obj_to_ggtt_view(obj, view);
+        if (IS_ERR(vma))
+                return vma;
        if (!vma)
-                vma = __i915_gem_vma_create(obj, vm, view);
+                vma = __i915_gem_vma_create(obj, ggtt, view);
        return vma;
+}
+static void
+rotate_pages(dma_addr_t *in, unsigned int width, unsigned int height,
+             struct sg_table *st)
+{
+        unsigned int column, row;
+        unsigned int src_idx;
+        struct scatterlist *sg = st->sgl;
+        st->nents = 0;
+        for (column = 0; column < width; column++) {
+                src_idx = width * (height - 1) + column;
+                for (row = 0; row < height; row++) {
+                        st->nents++;
+                        /* We don't need the pages, but need to initialize
+                         * the entries so the sg list can be happily traversed.
+                         * The only thing we need are DMA addresses.
+                         */
+                        sg_set_page(sg, NULL, PAGE_SIZE, 0);
+                        sg_dma_address(sg) = in[src_idx];
+                        sg_dma_len(sg) = PAGE_SIZE;
+                        sg = sg_next(sg);
+                        src_idx -= width;
+                }
+        }
 }
-static inline
+static struct sg_table *
-int i915_get_vma_pages(struct i915_vma *vma)
+intel_rotate_fb_obj_pages(struct i915_ggtt_view *ggtt_view,
+                          struct drm_i915_gem_object *obj)
 {
+        struct drm_device *dev = obj->base.dev;
+        struct intel_rotation_info *rot_info = &ggtt_view->rotation_info;
+        unsigned long size, pages, rot_pages;
+        struct sg_page_iter sg_iter;
+        unsigned long i;
+        dma_addr_t *page_addr_list;
+        struct sg_table *st;
+        unsigned int tile_pitch, tile_height;
+        unsigned int width_pages, height_pages;
+        int ret = -ENOMEM;
+        pages = obj->base.size / PAGE_SIZE;
+        /* Calculate tiling geometry. */
+        tile_height = intel_tile_height(dev, rot_info->pixel_format,
+                                        rot_info->fb_modifier);
+        tile_pitch = PAGE_SIZE / tile_height;
+        width_pages = DIV_ROUND_UP(rot_info->pitch, tile_pitch);
+        height_pages = DIV_ROUND_UP(rot_info->height, tile_height);
+        rot_pages = width_pages * height_pages;
+        size = rot_pages * PAGE_SIZE;
+        /* Allocate a temporary list of source pages for random access. */
+        page_addr_list = drm_malloc_ab(pages, sizeof(dma_addr_t));
+        if (!page_addr_list)
+                return ERR_PTR(ret);
+        /* Allocate target SG list. */
+        st = kmalloc(sizeof(*st), GFP_KERNEL);
+        if (!st)
+                goto err_st_alloc;
+        ret = sg_alloc_table(st, rot_pages, GFP_KERNEL);
+        if (ret)
+                goto err_sg_alloc;
+        /* Populate source page list from the object. */
+        i = 0;
+        for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0) {
+                page_addr_list[i] = sg_page_iter_dma_address(&sg_iter);
+                i++;
+        }
+        /* Rotate the pages. */
+        rotate_pages(page_addr_list, width_pages, height_pages, st);
+        DRM_DEBUG_KMS(
+                      "Created rotated page mapping for object size %lu (pitch=%u, height=%u, pixel_format=0x%x, %ux%u tiles, %lu pages).\n",
+                      size, rot_info->pitch, rot_info->height,
+                      rot_info->pixel_format, width_pages, height_pages,
+                      rot_pages);
+        drm_free_large(page_addr_list);
+        return st;
+err_sg_alloc:
+        kfree(st);
+err_st_alloc:
+        drm_free_large(page_addr_list);
+        DRM_DEBUG_KMS(
+                      "Failed to create rotated mapping for object size %lu! (%d) (pitch=%u, height=%u, pixel_format=0x%x, %ux%u tiles, %lu pages)\n",
+                      size, ret, rot_info->pitch, rot_info->height,
+                      rot_info->pixel_format, width_pages, height_pages,
+                      rot_pages);
+        return ERR_PTR(ret);
+}
+static inline int
+i915_get_ggtt_vma_pages(struct i915_vma *vma)
+{
+        int ret = 0;
        if (vma->ggtt_view.pages)
                return 0;
        if (vma->ggtt_view.type == I915_GGTT_VIEW_NORMAL)
                vma->ggtt_view.pages = vma->obj->pages;
+        else if (vma->ggtt_view.type == I915_GGTT_VIEW_ROTATED)
+                vma->ggtt_view.pages =
+                        intel_rotate_fb_obj_pages(&vma->ggtt_view, vma->obj);
        else
                WARN_ONCE(1, "GGTT view %u not implemented!\n",
                          vma->ggtt_view.type);
        if (!vma->ggtt_view.pages) {
-                DRM_ERROR("Failed to get pages for VMA view type %u!\n",
+                DRM_ERROR("Failed to get pages for GGTT view type %u!\n",
                          vma->ggtt_view.type);
-                return -EINVAL;
+                ret = -EINVAL;
+        } else if (IS_ERR(vma->ggtt_view.pages)) {
+                ret = PTR_ERR(vma->ggtt_view.pages);
+                vma->ggtt_view.pages = NULL;
+                DRM_ERROR("Failed to get pages for VMA view type %u (%d)!\n",
+                          vma->ggtt_view.type, ret);
        }
-        return 0;
+        return ret;
 }
 /**
@@ -2415,10 +2746,12 @@ int i915_get_vma_pages(struct i915_vma *vma)
 int i915_vma_bind(struct i915_vma *vma, enum i915_cache_level cache_level,
                  u32 flags)
 {
-        int ret = i915_get_vma_pages(vma);
+        if (i915_is_ggtt(vma->vm)) {
+                int ret = i915_get_ggtt_vma_pages(vma);
-        if (ret)
+                if (ret)
-                return ret;
+                        return ret;
+        }
        vma->bind_vma(vma, cache_level, flags);
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h
index c9e93f5070bc..fc03c99317c9 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
@@ -36,13 +36,13 @@
 struct drm_i915_file_private;
-typedef uint32_t gen6_gtt_pte_t;
+typedef uint32_t gen6_pte_t;
-typedef uint64_t gen8_gtt_pte_t;
+typedef uint64_t gen8_pte_t;
-typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
+typedef uint64_t gen8_pde_t;
 #define gtt_total_entries(gtt) ((gtt).base.total >> PAGE_SHIFT)
-#define I915_PPGTT_PT_ENTRIES           (PAGE_SIZE / sizeof(gen6_gtt_pte_t))
 /* gen6-hsw has bit 11-4 for physical addr bit 39-32 */
 #define GEN6_GTT_ADDR_ENCODE(addr)      ((addr) | (((addr) >> 28) & 0xff0))
 #define GEN6_PTE_ADDR_ENCODE(addr)      GEN6_GTT_ADDR_ENCODE(addr)
@@ -51,9 +51,16 @@ typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
 #define GEN6_PTE_UNCACHED               (1 << 1)
 #define GEN6_PTE_VALID                  (1 << 0)
-#define GEN6_PPGTT_PD_ENTRIES           512
+#define I915_PTES(pte_len)              (PAGE_SIZE / (pte_len))
-#define GEN6_PD_SIZE                    (GEN6_PPGTT_PD_ENTRIES * PAGE_SIZE)
+#define I915_PTE_MASK(pte_len)          (I915_PTES(pte_len) - 1)
+#define I915_PDES                       512
+#define I915_PDE_MASK                   (I915_PDES - 1)
+#define NUM_PTE(pde_shift)     (1 << (pde_shift - PAGE_SHIFT))
+#define GEN6_PTES                       I915_PTES(sizeof(gen6_pte_t))
+#define GEN6_PD_SIZE                    (I915_PDES * PAGE_SIZE)
 #define GEN6_PD_ALIGN                   (PAGE_SIZE * 16)
+#define GEN6_PDE_SHIFT                  22
 #define GEN6_PDE_VALID                  (1 << 0)
 #define GEN7_PTE_CACHE_L3_LLC           (3 << 1)
@@ -89,8 +96,7 @@ typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
 #define GEN8_PTE_SHIFT                  12
 #define GEN8_PTE_MASK                   0x1ff
 #define GEN8_LEGACY_PDPES               4
-#define GEN8_PTES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_gtt_pte_t))
+#define GEN8_PTES                       I915_PTES(sizeof(gen8_pte_t))
-#define GEN8_PDES_PER_PAGE              (PAGE_SIZE / sizeof(gen8_ppgtt_pde_t))
 #define PPAT_UNCACHED_INDEX             (_PAGE_PWT | _PAGE_PCD)
 #define PPAT_CACHED_PDE_INDEX           0 /* WB LLC */
@@ -111,15 +117,28 @@ typedef gen8_gtt_pte_t gen8_ppgtt_pde_t;
 enum i915_ggtt_view_type {
        I915_GGTT_VIEW_NORMAL = 0,
+        I915_GGTT_VIEW_ROTATED
+};
+struct intel_rotation_info {
+        unsigned int height;
+        unsigned int pitch;
+        uint32_t pixel_format;
+        uint64_t fb_modifier;
 };
 struct i915_ggtt_view {
        enum i915_ggtt_view_type type;
        struct sg_table *pages;
+        union {
+                struct intel_rotation_info rotation_info;
+        };
 };
 extern const struct i915_ggtt_view i915_ggtt_view_normal;
+extern const struct i915_ggtt_view i915_ggtt_view_rotated;
 enum i915_cache_level;
@@ -190,6 +209,8 @@ struct i915_vma {
 struct i915_page_table_entry {
        struct page *page;
        dma_addr_t daddr;
+        unsigned long *used_ptes;
 };
 struct i915_page_directory_entry {
@@ -199,7 +220,7 @@ struct i915_page_directory_entry {
                dma_addr_t daddr;
        };
-        struct i915_page_table_entry *page_table[GEN6_PPGTT_PD_ENTRIES]; /* PDEs */
+        struct i915_page_table_entry *page_table[I915_PDES]; /* PDEs */
 };
 struct i915_page_directory_pointer_entry {
@@ -243,9 +264,12 @@ struct i915_address_space {
        struct list_head inactive_list;
        /* FIXME: Need a more generic return type */
-        gen6_gtt_pte_t (*pte_encode)(dma_addr_t addr,
+        gen6_pte_t (*pte_encode)(dma_addr_t addr,
-                                     enum i915_cache_level level,
+                                 enum i915_cache_level level,
-                                     bool valid, u32 flags); /* Create a valid PTE */
+                                 bool valid, u32 flags); /* Create a valid PTE */
+        int (*allocate_va_range)(struct i915_address_space *vm,
+                                 uint64_t start,
+                                 uint64_t length);
        void (*clear_range)(struct i915_address_space *vm,
                            uint64_t start,
                            uint64_t length,
@@ -289,6 +313,7 @@ struct i915_hw_ppgtt {
        struct i915_address_space base;
        struct kref ref;
        struct drm_mm_node node;
+        unsigned long pd_dirty_rings;
        unsigned num_pd_entries;
        unsigned num_pd_pages; /* gen8+ */
        union {
@@ -296,14 +321,82 @@ struct i915_hw_ppgtt {
                struct i915_page_directory_entry pd;
        };
+        struct i915_page_table_entry *scratch_pt;
        struct drm_i915_file_private *file_priv;
+        gen6_pte_t __iomem *pd_addr;
        int (*enable)(struct i915_hw_ppgtt *ppgtt);
        int (*switch_mm)(struct i915_hw_ppgtt *ppgtt,
                         struct intel_engine_cs *ring);
        void (*debug_dump)(struct i915_hw_ppgtt *ppgtt, struct seq_file *m);
 };
+/* For each pde iterates over every pde between from start until start + length.
+ * If start, and start+length are not perfectly divisible, the macro will round
+ * down, and up as needed. The macro modifies pde, start, and length. Dev is
+ * only used to differentiate shift values. Temp is temp.  On gen6/7, start = 0,
+ * and length = 2G effectively iterates over every PDE in the system.
+ *
+ * XXX: temp is not actually needed, but it saves doing the ALIGN operation.
+ */
+#define gen6_for_each_pde(pt, pd, start, length, temp, iter) \
+        for (iter = gen6_pde_index(start); \
+             pt = (pd)->page_table[iter], length > 0 && iter < I915_PDES; \
+             iter++, \
+             temp = ALIGN(start+1, 1 << GEN6_PDE_SHIFT) - start, \
+             temp = min_t(unsigned, temp, length), \
+             start += temp, length -= temp)
+static inline uint32_t i915_pte_index(uint64_t address, uint32_t pde_shift)
+{
+        const uint32_t mask = NUM_PTE(pde_shift) - 1;
+        return (address >> PAGE_SHIFT) & mask;
+}
+/* Helper to counts the number of PTEs within the given length. This count
+ * does not cross a page table boundary, so the max value would be
+ * GEN6_PTES for GEN6, and GEN8_PTES for GEN8.
+*/
+static inline uint32_t i915_pte_count(uint64_t addr, size_t length,
+                                      uint32_t pde_shift)
+{
+        const uint64_t mask = ~((1 << pde_shift) - 1);
+        uint64_t end;
+        WARN_ON(length == 0);
+        WARN_ON(offset_in_page(addr|length));
+        end = addr + length;
+        if ((addr & mask) != (end & mask))
+                return NUM_PTE(pde_shift) - i915_pte_index(addr, pde_shift);
+        return i915_pte_index(end, pde_shift) - i915_pte_index(addr, pde_shift);
+}
+static inline uint32_t i915_pde_index(uint64_t addr, uint32_t shift)
+{
+        return (addr >> shift) & I915_PDE_MASK;
+}
+static inline uint32_t gen6_pte_index(uint32_t addr)
+{
+        return i915_pte_index(addr, GEN6_PDE_SHIFT);
+}
+static inline size_t gen6_pte_count(uint32_t addr, uint32_t length)
+{
+        return i915_pte_count(addr, length, GEN6_PDE_SHIFT);
+}
+static inline uint32_t gen6_pde_index(uint32_t addr)
+{
+        return i915_pde_index(addr, GEN6_PDE_SHIFT);
+}
 int i915_gem_gtt_init(struct drm_device *dev);
 void i915_gem_init_global_gtt(struct drm_device *dev);
 void i915_global_gtt_cleanup(struct drm_device *dev);
@@ -332,4 +425,14 @@ void i915_gem_restore_gtt_mappings(struct drm_device *dev);
 int __must_check i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj);
 void i915_gem_gtt_finish_object(struct drm_i915_gem_object *obj);
+static inline bool
+i915_ggtt_view_equal(const struct i915_ggtt_view *a,
+                     const struct i915_ggtt_view *b)
+{
+        if (WARN_ON(!a || !b))
+                return false;
+        return a->type == b->type;
+}
 #endif
diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
new file mode 100644
index 000000000000..f7929e769250
--- /dev/null
+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
@@ -0,0 +1,335 @@
+/*
+ * Copyright © 2008-2015 Intel Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ *
+ */
+#include <linux/oom.h>
+#include <linux/shmem_fs.h>
+#include <linux/slab.h>
+#include <linux/swap.h>
+#include <linux/pci.h>
+#include <linux/dma-buf.h>
+#include <drm/drmP.h>
+#include <drm/i915_drm.h>
+#include "i915_drv.h"
+#include "i915_trace.h"
+static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task)
+{
+        if (!mutex_is_locked(mutex))
+                return false;
+#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
+        return mutex->owner == task;
+#else
+        /* Since UP may be pre-empted, we cannot assume that we own the lock */
+        return false;
+#endif
+}
+/**
+ * i915_gem_shrink - Shrink buffer object caches
+ * @dev_priv: i915 device
+ * @target: amount of memory to make available, in pages
+ * @flags: control flags for selecting cache types
+ *
+ * This function is the main interface to the shrinker. It will try to release
+ * up to @target pages of main memory backing storage from buffer objects.
+ * Selection of the specific caches can be done with @flags. This is e.g. useful
+ * when purgeable objects should be removed from caches preferentially.
+ *
+ * Note that it's not guaranteed that released amount is actually available as
+ * free system memory - the pages might still be in-used to due to other reasons
+ * (like cpu mmaps) or the mm core has reused them before we could grab them.
+ * Therefore code that needs to explicitly shrink buffer objects caches (e.g. to
+ * avoid deadlocks in memory reclaim) must fall back to i915_gem_shrink_all().
+ *
+ * Also note that any kind of pinning (both per-vma address space pins and
+ * backing storage pins at the buffer object level) result in the shrinker code
+ * having to skip the object.
+ *
+ * Returns:
+ * The number of pages of backing storage actually released.
+ */
+unsigned long
+i915_gem_shrink(struct drm_i915_private *dev_priv,
+                long target, unsigned flags)
+{
+        const struct {
+                struct list_head *list;
+                unsigned int bit;
+        } phases[] = {
+                { &dev_priv->mm.unbound_list, I915_SHRINK_UNBOUND },
+                { &dev_priv->mm.bound_list, I915_SHRINK_BOUND },
+                { NULL, 0 },
+        }, *phase;
+        unsigned long count = 0;
+        /*
+         * As we may completely rewrite the (un)bound list whilst unbinding
+         * (due to retiring requests) we have to strictly process only
+         * one element of the list at the time, and recheck the list
+         * on every iteration.
+         *
+         * In particular, we must hold a reference whilst removing the
+         * object as we may end up waiting for and/or retiring the objects.
+         * This might release the final reference (held by the active list)
+         * and result in the object being freed from under us. This is
+         * similar to the precautions the eviction code must take whilst
+         * removing objects.
+         *
+         * Also note that although these lists do not hold a reference to
+         * the object we can safely grab one here: The final object
+         * unreferencing and the bound_list are both protected by the
+         * dev->struct_mutex and so we won't ever be able to observe an
+         * object on the bound_list with a reference count equals 0.
+         */
+        for (phase = phases; phase->list; phase++) {
+                struct list_head still_in_list;
+                if ((flags & phase->bit) == 0)
+                        continue;
+                INIT_LIST_HEAD(&still_in_list);
+                while (count < target && !list_empty(phase->list)) {
+                        struct drm_i915_gem_object *obj;
+                        struct i915_vma *vma, *v;
+                        obj = list_first_entry(phase->list,
+                                               typeof(*obj), global_list);
+                        list_move_tail(&obj->global_list, &still_in_list);
+                        if (flags & I915_SHRINK_PURGEABLE &&
+                            obj->madv != I915_MADV_DONTNEED)
+                                continue;
+                        drm_gem_object_reference(&obj->base);
+                        /* For the unbound phase, this should be a no-op! */
+                        list_for_each_entry_safe(vma, v,
+                                                 &obj->vma_list, vma_link)
+                                if (i915_vma_unbind(vma))
+                                        break;
+                        if (i915_gem_object_put_pages(obj) == 0)
+                                count += obj->base.size >> PAGE_SHIFT;
+                        drm_gem_object_unreference(&obj->base);
+                }
+                list_splice(&still_in_list, phase->list);
+        }
+        return count;
+}
+/**
+ * i915_gem_shrink - Shrink buffer object caches completely
+ * @dev_priv: i915 device
+ *
+ * This is a simple wraper around i915_gem_shrink() to aggressively shrink all
+ * caches completely. It also first waits for and retires all outstanding
+ * requests to also be able to release backing storage for active objects.
+ *
+ * This should only be used in code to intentionally quiescent the gpu or as a
+ * last-ditch effort when memory seems to have run out.
+ *
+ * Returns:
+ * The number of pages of backing storage actually released.
+ */
+unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
+{
+        i915_gem_evict_everything(dev_priv->dev);
+        return i915_gem_shrink(dev_priv, LONG_MAX,
+                               I915_SHRINK_BOUND | I915_SHRINK_UNBOUND);
+}
+static bool i915_gem_shrinker_lock(struct drm_device *dev, bool *unlock)
+{
+        if (!mutex_trylock(&dev->struct_mutex)) {
+                if (!mutex_is_locked_by(&dev->struct_mutex, current))
+                        return false;
+                if (to_i915(dev)->mm.shrinker_no_lock_stealing)
+                        return false;
+                *unlock = false;
+        } else
+                *unlock = true;
+        return true;
+}
+static int num_vma_bound(struct drm_i915_gem_object *obj)
+{
+        struct i915_vma *vma;
+        int count = 0;
+        list_for_each_entry(vma, &obj->vma_list, vma_link)
+                if (drm_mm_node_allocated(&vma->node))
+                        count++;
+        return count;
+}
+static unsigned long
+i915_gem_shrinker_count(struct shrinker *shrinker, struct shrink_control *sc)
+{
+        struct drm_i915_private *dev_priv =
+                container_of(shrinker, struct drm_i915_private, mm.shrinker);
+        struct drm_device *dev = dev_priv->dev;
+        struct drm_i915_gem_object *obj;
+        unsigned long count;
+        bool unlock;
+        if (!i915_gem_shrinker_lock(dev, &unlock))
+                return 0;
+        count = 0;
+        list_for_each_entry(obj, &dev_priv->mm.unbound_list, global_list)
+                if (obj->pages_pin_count == 0)
+                        count += obj->base.size >> PAGE_SHIFT;
+        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
+                if (!i915_gem_obj_is_pinned(obj) &&
+                    obj->pages_pin_count == num_vma_bound(obj))
+                        count += obj->base.size >> PAGE_SHIFT;
+        }
+        if (unlock)
+                mutex_unlock(&dev->struct_mutex);
+        return count;
+}
+static unsigned long
+i915_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)
+{
+        struct drm_i915_private *dev_priv =
+                container_of(shrinker, struct drm_i915_private, mm.shrinker);
+        struct drm_device *dev = dev_priv->dev;
+        unsigned long freed;
+        bool unlock;
+        if (!i915_gem_shrinker_lock(dev, &unlock))
+                return SHRINK_STOP;
+        freed = i915_gem_shrink(dev_priv,
+                                sc->nr_to_scan,
+                                I915_SHRINK_BOUND |
+                                I915_SHRINK_UNBOUND |
+                                I915_SHRINK_PURGEABLE);
+        if (freed < sc->nr_to_scan)
+                freed += i915_gem_shrink(dev_priv,
+                                         sc->nr_to_scan - freed,
+                                         I915_SHRINK_BOUND |
+                                         I915_SHRINK_UNBOUND);
+        if (unlock)
+                mutex_unlock(&dev->struct_mutex);
+        return freed;
+}
+static int
+i915_gem_shrinker_oom(struct notifier_block *nb, unsigned long event, void *ptr)
+{
+        struct drm_i915_private *dev_priv =
+                container_of(nb, struct drm_i915_private, mm.oom_notifier);
+        struct drm_device *dev = dev_priv->dev;
+        struct drm_i915_gem_object *obj;
+        unsigned long timeout = msecs_to_jiffies(5000) + 1;
+        unsigned long pinned, bound, unbound, freed_pages;
+        bool was_interruptible;
+        bool unlock;
+        while (!i915_gem_shrinker_lock(dev, &unlock) && --timeout) {
+                schedule_timeout_killable(1);
+                if (fatal_signal_pending(current))
+                        return NOTIFY_DONE;
+        }
+        if (timeout == 0) {
+                pr_err("Unable to purge GPU memory due lock contention.\n");
+                return NOTIFY_DONE;
+        }
+        was_interruptible = dev_priv->mm.interruptible;
+        dev_priv->mm.interruptible = false;
+        freed_pages = i915_gem_shrink_all(dev_priv);
+        dev_priv->mm.interruptible = was_interruptible;
+        /* Because we may be allocating inside our own driver, we cannot
+         * assert that there are no objects with pinned pages that are not
+         * being pointed to by hardware.
+         */
+        unbound = bound = pinned = 0;
+        list_for_each_entry(obj, &dev_priv->mm.unbound_list, global_list) {
+                if (!obj->base.filp) /* not backed by a freeable object */
+                        continue;
+                if (obj->pages_pin_count)
+                        pinned += obj->base.size;
+                else
+                        unbound += obj->base.size;
+        }
+        list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
+                if (!obj->base.filp)
+                        continue;
+                if (obj->pages_pin_count)
+                        pinned += obj->base.size;
+                else
+                        bound += obj->base.size;
+        }
+        if (unlock)
+                mutex_unlock(&dev->struct_mutex);
+        if (freed_pages || unbound || bound)
+                pr_info("Purging GPU memory, %lu bytes freed, %lu bytes still pinned.\n",
+                        freed_pages << PAGE_SHIFT, pinned);
+        if (unbound || bound)
+                pr_err("%lu and %lu bytes still available in the "
+                       "bound and unbound GPU page lists.\n",
+                       bound, unbound);
+        *(unsigned long *)ptr += freed_pages;
+        return NOTIFY_DONE;
+}
+/**
+ * i915_gem_shrinker_init - Initialize i915 shrinker
+ * @dev_priv: i915 device
+ *
+ * This function registers and sets up the i915 shrinker and OOM handler.
+ */
+void i915_gem_shrinker_init(struct drm_i915_private *dev_priv)
+{
+        dev_priv->mm.shrinker.scan_objects = i915_gem_shrinker_scan;
+        dev_priv->mm.shrinker.count_objects = i915_gem_shrinker_count;
+        dev_priv->mm.shrinker.seeks = DEFAULT_SEEKS;
+        register_shrinker(&dev_priv->mm.shrinker);
+        dev_priv->mm.oom_notifier.notifier_call = i915_gem_shrinker_oom;
+        register_oom_notifier(&dev_priv->mm.oom_notifier);
+}
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index a982849a5edd..1d4e60df8883 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -386,6 +386,11 @@ int i915_error_state_to_str(struct drm_i915_error_state_buf *m,
        if (INTEL_INFO(dev)->gen >= 6) {
                err_printf(m, "ERROR: 0x%08x\n", error->error);
+                if (INTEL_INFO(dev)->gen >= 8)
+                        err_printf(m, "FAULT_TLB_DATA: 0x%08x 0x%08x\n",
+                                   error->fault_data1, error->fault_data0);
                err_printf(m, "DONE_REG: 0x%08x\n", error->done_reg);
        }
@@ -555,7 +560,14 @@ static void i915_error_state_free(struct kref *error_ref)
        }
        i915_error_object_free(error->semaphore_obj);
+        for (i = 0; i < error->vm_count; i++)
+                kfree(error->active_bo[i]);
        kfree(error->active_bo);
+        kfree(error->active_bo_count);
+        kfree(error->pinned_bo);
+        kfree(error->pinned_bo_count);
        kfree(error->overlay);
        kfree(error->display);
        kfree(error);
@@ -1164,6 +1176,11 @@ static void i915_capture_reg_state(struct drm_i915_private *dev_priv,
        if (IS_GEN7(dev))
                error->err_int = I915_READ(GEN7_ERR_INT);
+        if (INTEL_INFO(dev)->gen >= 8) {
+                error->fault_data0 = I915_READ(GEN8_FAULT_TLB_DATA0);
+                error->fault_data1 = I915_READ(GEN8_FAULT_TLB_DATA1);
+        }
        if (IS_GEN6(dev)) {
                error->forcewake = I915_READ(FORCEWAKE);
                error->gab_ctl = I915_READ(GAB_CTL);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 49ad5fb82ace..14ecb4d13a1a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -277,6 +277,7 @@ void gen6_reset_rps_interrupts(struct drm_device *dev)
        I915_WRITE(reg, dev_priv->pm_rps_events);
        I915_WRITE(reg, dev_priv->pm_rps_events);
        POSTING_READ(reg);
+        dev_priv->rps.pm_iir = 0;
        spin_unlock_irq(&dev_priv->irq_lock);
 }
@@ -330,12 +331,10 @@ void gen6_disable_rps_interrupts(struct drm_device *dev)
        __gen6_disable_pm_irq(dev_priv, dev_priv->pm_rps_events);
        I915_WRITE(gen6_pm_ier(dev_priv), I915_READ(gen6_pm_ier(dev_priv)) &
                                ~dev_priv->pm_rps_events);
-        I915_WRITE(gen6_pm_iir(dev_priv), dev_priv->pm_rps_events);
-        I915_WRITE(gen6_pm_iir(dev_priv), dev_priv->pm_rps_events);
-        dev_priv->rps.pm_iir = 0;
        spin_unlock_irq(&dev_priv->irq_lock);
+        synchronize_irq(dev->irq);
 }
 /**
@@ -997,129 +996,73 @@ static void notify_ring(struct drm_device *dev,
        wake_up_all(&ring->irq_queue);
 }
-static u32 vlv_c0_residency(struct drm_i915_private *dev_priv,
+static void vlv_c0_read(struct drm_i915_private *dev_priv,
-                            struct intel_rps_ei *rps_ei)
+                        struct intel_rps_ei *ei)
 {
-        u32 cz_ts, cz_freq_khz;
+        ei->cz_clock = vlv_punit_read(dev_priv, PUNIT_REG_CZ_TIMESTAMP);
-        u32 render_count, media_count;
+        ei->render_c0 = I915_READ(VLV_RENDER_C0_COUNT);
-        u32 elapsed_render, elapsed_media, elapsed_time;
+        ei->media_c0 = I915_READ(VLV_MEDIA_C0_COUNT);
-        u32 residency = 0;
+}
-        cz_ts = vlv_punit_read(dev_priv, PUNIT_REG_CZ_TIMESTAMP);
-        cz_freq_khz = DIV_ROUND_CLOSEST(dev_priv->mem_freq * 1000, 4);
-        render_count = I915_READ(VLV_RENDER_C0_COUNT_REG);
-        media_count = I915_READ(VLV_MEDIA_C0_COUNT_REG);
-        if (rps_ei->cz_clock == 0) {
-                rps_ei->cz_clock = cz_ts;
-                rps_ei->render_c0 = render_count;
-                rps_ei->media_c0 = media_count;
-                return dev_priv->rps.cur_freq;
-        }
-        elapsed_time = cz_ts - rps_ei->cz_clock;
-        rps_ei->cz_clock = cz_ts;
-        elapsed_render = render_count - rps_ei->render_c0;
+static bool vlv_c0_above(struct drm_i915_private *dev_priv,
-        rps_ei->render_c0 = render_count;
+                         const struct intel_rps_ei *old,
+                         const struct intel_rps_ei *now,
+                         int threshold)
+{
+        u64 time, c0;
-        elapsed_media = media_count - rps_ei->media_c0;
+        if (old->cz_clock == 0)
-        rps_ei->media_c0 = media_count;
+                return false;
-        /* Convert all the counters into common unit of milli sec */
+        time = now->cz_clock - old->cz_clock;
-        elapsed_time /= VLV_CZ_CLOCK_TO_MILLI_SEC;
+        time *= threshold * dev_priv->mem_freq;
-        elapsed_render /=  cz_freq_khz;
-        elapsed_media /= cz_freq_khz;
-        /*
+        /* Workload can be split between render + media, e.g. SwapBuffers
-         * Calculate overall C0 residency percentage
+         * being blitted in X after being rendered in mesa. To account for
-         * only if elapsed time is non zero
+         * this we need to combine both engines into our activity counter.
         */
-        if (elapsed_time) {
+        c0 = now->render_c0 - old->render_c0;
-                residency =
+        c0 += now->media_c0 - old->media_c0;
-                        ((max(elapsed_render, elapsed_media) * 100)
+        c0 *= 100 * VLV_CZ_CLOCK_TO_MILLI_SEC * 4 / 1000;
-                                / elapsed_time);
-        }
-        return residency;
+        return c0 >= time;
 }
-/**
+void gen6_rps_reset_ei(struct drm_i915_private *dev_priv)
- * vlv_calc_delay_from_C0_counters - Increase/Decrease freq based on GPU
- * busy-ness calculated from C0 counters of render & media power wells
- * @dev_priv: DRM device private
- *
- */
-static int vlv_calc_delay_from_C0_counters(struct drm_i915_private *dev_priv)
 {
-        u32 residency_C0_up = 0, residency_C0_down = 0;
+        vlv_c0_read(dev_priv, &dev_priv->rps.down_ei);
-        int new_delay, adj;
+        dev_priv->rps.up_ei = dev_priv->rps.down_ei;
+}
-        dev_priv->rps.ei_interrupt_count++;
-        WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
-        if (dev_priv->rps.up_ei.cz_clock == 0) {
-                vlv_c0_residency(dev_priv, &dev_priv->rps.up_ei);
-                vlv_c0_residency(dev_priv, &dev_priv->rps.down_ei);
-                return dev_priv->rps.cur_freq;
-        }
+static u32 vlv_wa_c0_ei(struct drm_i915_private *dev_priv, u32 pm_iir)
+{
+        struct intel_rps_ei now;
+        u32 events = 0;
-        /*
+        if ((pm_iir & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) == 0)
-         * To down throttle, C0 residency should be less than down threshold
+                return 0;
-         * for continous EI intervals. So calculate down EI counters
-         * once in VLV_INT_COUNT_FOR_DOWN_EI
-         */
-        if (dev_priv->rps.ei_interrupt_count == VLV_INT_COUNT_FOR_DOWN_EI) {
-                dev_priv->rps.ei_interrupt_count = 0;
+        vlv_c0_read(dev_priv, &now);
+        if (now.cz_clock == 0)
+                return 0;
-                residency_C0_down = vlv_c0_residency(dev_priv,
+        if (pm_iir & GEN6_PM_RP_DOWN_EI_EXPIRED) {
-                                                     &dev_priv->rps.down_ei);
+                if (!vlv_c0_above(dev_priv,
-        } else {
+                                  &dev_priv->rps.down_ei, &now,
-                residency_C0_up = vlv_c0_residency(dev_priv,
+                                  VLV_RP_DOWN_EI_THRESHOLD))
-                                                   &dev_priv->rps.up_ei);
+                        events |= GEN6_PM_RP_DOWN_THRESHOLD;
+                dev_priv->rps.down_ei = now;
        }
-        new_delay = dev_priv->rps.cur_freq;
+        if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) {
+                if (vlv_c0_above(dev_priv,
-        adj = dev_priv->rps.last_adj;
+                                 &dev_priv->rps.up_ei, &now,
-        /* C0 residency is greater than UP threshold. Increase Frequency */
+                                 VLV_RP_UP_EI_THRESHOLD))
-        if (residency_C0_up >= VLV_RP_UP_EI_THRESHOLD) {
+                        events |= GEN6_PM_RP_UP_THRESHOLD;
-                if (adj > 0)
+                dev_priv->rps.up_ei = now;
-                        adj *= 2;
-                else
-                        adj = 1;
-                if (dev_priv->rps.cur_freq < dev_priv->rps.max_freq_softlimit)
-                        new_delay = dev_priv->rps.cur_freq + adj;
-                /*
-                 * For better performance, jump directly
-                 * to RPe if we're below it.
-                 */
-                if (new_delay < dev_priv->rps.efficient_freq)
-                        new_delay = dev_priv->rps.efficient_freq;
-        } else if (!dev_priv->rps.ei_interrupt_count &&
-                        (residency_C0_down < VLV_RP_DOWN_EI_THRESHOLD)) {
-                if (adj < 0)
-                        adj *= 2;
-                else
-                        adj = -1;
-                /*
-                 * This means, C0 residency is less than down threshold over
-                 * a period of VLV_INT_COUNT_FOR_DOWN_EI. So, reduce the freq
-                 */
-                if (dev_priv->rps.cur_freq > dev_priv->rps.min_freq_softlimit)
-                        new_delay = dev_priv->rps.cur_freq + adj;
        }
-        return new_delay;
+        return events;
 }
 static void gen6_pm_rps_work(struct work_struct *work)
@@ -1149,6 +1092,8 @@ static void gen6_pm_rps_work(struct work_struct *work)
        mutex_lock(&dev_priv->rps.hw_lock);
+        pm_iir |= vlv_wa_c0_ei(dev_priv, pm_iir);
        adj = dev_priv->rps.last_adj;
        if (pm_iir & GEN6_PM_RP_UP_THRESHOLD) {
                if (adj > 0)
@@ -1171,8 +1116,6 @@ static void gen6_pm_rps_work(struct work_struct *work)
                else
                        new_delay = dev_priv->rps.min_freq_softlimit;
                adj = 0;
-        } else if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) {
-                new_delay = vlv_calc_delay_from_C0_counters(dev_priv);
        } else if (pm_iir & GEN6_PM_RP_DOWN_THRESHOLD) {
                if (adj < 0)
                        adj *= 2;
@@ -4299,7 +4242,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
        /* Let's track the enabled rps events */
        if (IS_VALLEYVIEW(dev_priv) && !IS_CHERRYVIEW(dev_priv))
                /* WaGsvRC0ResidencyMethod:vlv */
-                dev_priv->pm_rps_events = GEN6_PM_RP_UP_EI_EXPIRED;
+                dev_priv->pm_rps_events = GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED;
        else
                dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS;
diff --git a/drivers/gpu/drm/i915/i915_params.c b/drivers/gpu/drm/i915/i915_params.c
index e2d20ffe6586..bb64415a1c3e 100644
--- a/drivers/gpu/drm/i915/i915_params.c
+++ b/drivers/gpu/drm/i915/i915_params.c
@@ -27,7 +27,6 @@
 struct i915_params i915 __read_mostly = {
        .modeset = -1,
        .panel_ignore_lid = 1,
-        .powersave = 1,
        .semaphores = -1,
        .lvds_downclock = 0,
        .lvds_channel_mode = 0,
@@ -44,6 +43,7 @@ struct i915_params i915 __read_mostly = {
        .enable_ips = 1,
        .fastboot = 0,
        .prefault_disable = 0,
+        .load_detect_test = 0,
        .reset = true,
        .invert_brightness = 0,
        .disable_display = 0,
@@ -65,10 +65,6 @@ MODULE_PARM_DESC(panel_ignore_lid,
        "Override lid status (0=autodetect, 1=autodetect disabled [default], "
        "-1=force lid closed, -2=force lid open)");
-module_param_named(powersave, i915.powersave, int, 0600);
-MODULE_PARM_DESC(powersave,
-        "Enable powersavings, fbc, downclocking, etc. (default: true)");
 module_param_named_unsafe(semaphores, i915.semaphores, int, 0400);
 MODULE_PARM_DESC(semaphores,
        "Use semaphores for inter-ring sync "
@@ -144,11 +140,16 @@ module_param_named(fastboot, i915.fastboot, bool, 0600);
 MODULE_PARM_DESC(fastboot,
        "Try to skip unnecessary mode sets at boot time (default: false)");
-module_param_named(prefault_disable, i915.prefault_disable, bool, 0600);
+module_param_named_unsafe(prefault_disable, i915.prefault_disable, bool, 0600);
 MODULE_PARM_DESC(prefault_disable,
        "Disable page prefaulting for pread/pwrite/reloc (default:false). "
        "For developers only.");
+module_param_named_unsafe(load_detect_test, i915.load_detect_test, bool, 0600);
+MODULE_PARM_DESC(load_detect_test,
+        "Force-enable the VGA load detect code for testing (default:false). "
+        "For developers only.");
 module_param_named(invert_brightness, i915.invert_brightness, int, 0600);
 MODULE_PARM_DESC(invert_brightness,
        "Invert backlight brightness "
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index cc8ebabc488d..b522eb6e59a4 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -673,7 +673,6 @@ enum skl_disp_power_wells {
 #define VLV_CZ_CLOCK_TO_MILLI_SEC               100000
 #define VLV_RP_UP_EI_THRESHOLD                  90
 #define VLV_RP_DOWN_EI_THRESHOLD                70
-#define VLV_INT_COUNT_FOR_DOWN_EI               5
 /* vlv2 north clock has */
 #define CCK_FUSE_REG                            0x8
@@ -1307,6 +1306,9 @@ enum skl_disp_power_wells {
 #define   ERR_INT_FIFO_UNDERRUN_A       (1<<0)
 #define   ERR_INT_FIFO_UNDERRUN(pipe)   (1<<(pipe*3))
+#define GEN8_FAULT_TLB_DATA0            0x04b10
+#define GEN8_FAULT_TLB_DATA1            0x04b14
 #define FPGA_DBG                0x42300
 #define   FPGA_DBG_RM_NOCLAIM   (1<<31)
@@ -6220,8 +6222,8 @@ enum skl_disp_power_wells {
 #define GEN6_GT_GFX_RC6p                        0x13810C
 #define GEN6_GT_GFX_RC6pp                       0x138110
-#define VLV_RENDER_C0_COUNT_REG         0x138118
+#define VLV_RENDER_C0_COUNT                     0x138118
-#define VLV_MEDIA_C0_COUNT_REG                  0x13811C
+#define VLV_MEDIA_C0_COUNT                      0x13811C
 #define GEN6_PCODE_MAILBOX                      0x138124
 #define   GEN6_PCODE_READY                      (1<<31)
diff --git a/drivers/gpu/drm/i915/i915_trace.h b/drivers/gpu/drm/i915/i915_trace.h
index f004d3d89b87..b3070a4501ab 100644
--- a/drivers/gpu/drm/i915/i915_trace.h
+++ b/drivers/gpu/drm/i915/i915_trace.h
@@ -156,6 +156,105 @@ TRACE_EVENT(i915_vma_unbind,
                      __entry->obj, __entry->offset, __entry->size, __entry->vm)
 );
+#define VM_TO_TRACE_NAME(vm) \
+        (i915_is_ggtt(vm) ? "G" : \
+                      "P")
+DECLARE_EVENT_CLASS(i915_va,
+        TP_PROTO(struct i915_address_space *vm, u64 start, u64 length, const char *name),
+        TP_ARGS(vm, start, length, name),
+        TP_STRUCT__entry(
+                __field(struct i915_address_space *, vm)
+                __field(u64, start)
+                __field(u64, end)
+                __string(name, name)
+        ),
+        TP_fast_assign(
+                __entry->vm = vm;
+                __entry->start = start;
+                __entry->end = start + length - 1;
+                __assign_str(name, name);
+        ),
+        TP_printk("vm=%p (%s), 0x%llx-0x%llx",
+                  __entry->vm, __get_str(name),  __entry->start, __entry->end)
+);
+DEFINE_EVENT(i915_va, i915_va_alloc,
+             TP_PROTO(struct i915_address_space *vm, u64 start, u64 length, const char *name),
+             TP_ARGS(vm, start, length, name)
+);
+DECLARE_EVENT_CLASS(i915_page_table_entry,
+        TP_PROTO(struct i915_address_space *vm, u32 pde, u64 start, u64 pde_shift),
+        TP_ARGS(vm, pde, start, pde_shift),
+        TP_STRUCT__entry(
+                __field(struct i915_address_space *, vm)
+                __field(u32, pde)
+                __field(u64, start)
+                __field(u64, end)
+        ),
+        TP_fast_assign(
+                __entry->vm = vm;
+                __entry->pde = pde;
+                __entry->start = start;
+                __entry->end = ((start + (1ULL << pde_shift)) & ~((1ULL << pde_shift)-1)) - 1;
+        ),
+        TP_printk("vm=%p, pde=%d (0x%llx-0x%llx)",
+                  __entry->vm, __entry->pde, __entry->start, __entry->end)
+);
+DEFINE_EVENT(i915_page_table_entry, i915_page_table_entry_alloc,
+             TP_PROTO(struct i915_address_space *vm, u32 pde, u64 start, u64 pde_shift),
+             TP_ARGS(vm, pde, start, pde_shift)
+);
+/* Avoid extra math because we only support two sizes. The format is defined by
+ * bitmap_scnprintf. Each 32 bits is 8 HEX digits followed by comma */
+#define TRACE_PT_SIZE(bits) \
+        ((((bits) == 1024) ? 288 : 144) + 1)
+DECLARE_EVENT_CLASS(i915_page_table_entry_update,
+        TP_PROTO(struct i915_address_space *vm, u32 pde,
+                 struct i915_page_table_entry *pt, u32 first, u32 count, u32 bits),
+        TP_ARGS(vm, pde, pt, first, count, bits),
+        TP_STRUCT__entry(
+                __field(struct i915_address_space *, vm)
+                __field(u32, pde)
+                __field(u32, first)
+                __field(u32, last)
+                __dynamic_array(char, cur_ptes, TRACE_PT_SIZE(bits))
+        ),
+        TP_fast_assign(
+                __entry->vm = vm;
+                __entry->pde = pde;
+                __entry->first = first;
+                __entry->last = first + count - 1;
+                scnprintf(__get_str(cur_ptes),
+                          TRACE_PT_SIZE(bits),
+                          "%*pb",
+                          bits,
+                          pt->used_ptes);
+        ),
+        TP_printk("vm=%p, pde=%d, updating %u:%u\t%s",
+                  __entry->vm, __entry->pde, __entry->last, __entry->first,
+                  __get_str(cur_ptes))
+);
+DEFINE_EVENT(i915_page_table_entry_update, i915_page_table_entry_map,
+        TP_PROTO(struct i915_address_space *vm, u32 pde,
+                 struct i915_page_table_entry *pt, u32 first, u32 count, u32 bits),
+        TP_ARGS(vm, pde, pt, first, count, bits)
+);
 TRACE_EVENT(i915_gem_object_change_domain,
            TP_PROTO(struct drm_i915_gem_object *obj, u32 old_read, u32 old_write),
            TP_ARGS(obj, old_read, old_write),
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index e66e17af0a56..6095a998bdac 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -690,7 +690,7 @@ intel_crt_detect(struct drm_connector *connector, bool force)
         * broken monitor (without edid) to work behind a broken kvm (that fails
         * to have the right resistors for HP detection) needs to fix this up.
         * For now just bail out. */
-        if (I915_HAS_HOTPLUG(dev)) {
+        if (I915_HAS_HOTPLUG(dev) && !i915.load_detect_test) {
                status = connector_status_disconnected;
                goto out;
        }
@@ -706,9 +706,11 @@ intel_crt_detect(struct drm_connector *connector, bool force)
        if (intel_get_load_detect_pipe(connector, NULL, &tmp, &ctx)) {
                if (intel_crt_detect_ddc(connector))
                        status = connector_status_connected;
-                else
+                else if (INTEL_INFO(dev)->gen < 4)
                        status = intel_crt_load_detect(crt);
-                intel_release_load_detect_pipe(connector, &tmp);
+                else
+                        status = connector_status_unknown;
+                intel_release_load_detect_pipe(connector, &tmp, &ctx);
        } else
                status = connector_status_unknown;
@@ -794,6 +796,7 @@ static const struct drm_connector_funcs intel_crt_connector_funcs = {
        .destroy = intel_crt_destroy,
        .set_property = intel_crt_set_property,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
        .atomic_get_property = intel_connector_atomic_get_property,
 };
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 8aee7d77ce9d..47b9307da24b 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -492,17 +492,23 @@ intel_ddi_get_crtc_encoder(struct drm_crtc *crtc)
 }
 static struct intel_encoder *
-intel_ddi_get_crtc_new_encoder(struct intel_crtc *crtc)
+intel_ddi_get_crtc_new_encoder(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
-        struct intel_encoder *intel_encoder, *ret = NULL;
+        struct intel_encoder *ret = NULL;
+        struct drm_atomic_state *state;
        int num_encoders = 0;
+        int i;
-        for_each_intel_encoder(dev, intel_encoder) {
+        state = crtc_state->base.state;
-                if (intel_encoder->new_crtc == crtc) {
-                        ret = intel_encoder;
+        for (i = 0; i < state->num_connector; i++) {
-                        num_encoders++;
+                if (!state->connectors[i] ||
-                }
+                    state->connector_states[i]->crtc != crtc_state->base.crtc)
+                        continue;
+                ret = to_intel_encoder(state->connector_states[i]->best_encoder);
+                num_encoders++;
        }
        WARN(num_encoders != 1, "%d encoders on crtc for pipe %c\n", num_encoders,
@@ -1216,7 +1222,7 @@ bool intel_ddi_pll_select(struct intel_crtc *intel_crtc,
 {
        struct drm_device *dev = intel_crtc->base.dev;
        struct intel_encoder *intel_encoder =
-                intel_ddi_get_crtc_new_encoder(intel_crtc);
+                intel_ddi_get_crtc_new_encoder(crtc_state);
        int clock = crtc_state->port_clock;
        if (IS_SKYLAKE(dev))
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 90b460cf2b57..75955fee6d24 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -83,7 +83,8 @@ static void ironlake_pch_clock_get(struct intel_crtc *crtc,
                                   struct intel_crtc_state *pipe_config);
 static int intel_set_mode(struct drm_crtc *crtc, struct drm_display_mode *mode,
-                          int x, int y, struct drm_framebuffer *old_fb);
+                          int x, int y, struct drm_framebuffer *old_fb,
+                          struct drm_atomic_state *state);
 static int intel_framebuffer_init(struct drm_device *dev,
                                  struct intel_framebuffer *ifb,
                                  struct drm_mode_fb_cmd2 *mode_cmd,
@@ -430,25 +431,41 @@ bool intel_pipe_has_type(struct intel_crtc *crtc, enum intel_output_type type)
 * intel_pipe_has_type() but looking at encoder->new_crtc instead of
 * encoder->crtc.
 */
-static bool intel_pipe_will_have_type(struct intel_crtc *crtc, int type)
+static bool intel_pipe_will_have_type(const struct intel_crtc_state *crtc_state,
+                                      int type)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
        struct intel_encoder *encoder;
+        int i, num_connectors = 0;
+        for (i = 0; i < state->num_connector; i++) {
+                if (!state->connectors[i])
+                        continue;
+                connector_state = state->connector_states[i];
+                if (connector_state->crtc != crtc_state->base.crtc)
+                        continue;
-        for_each_intel_encoder(dev, encoder)
+                num_connectors++;
-                if (encoder->new_crtc == crtc && encoder->type == type)
+                encoder = to_intel_encoder(connector_state->best_encoder);
+                if (encoder->type == type)
                        return true;
+        }
+        WARN_ON(num_connectors == 0);
        return false;
 }
-static const intel_limit_t *intel_ironlake_limit(struct intel_crtc *crtc,
+static const intel_limit_t *
-                                                int refclk)
+intel_ironlake_limit(struct intel_crtc_state *crtc_state, int refclk)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct drm_device *dev = crtc_state->base.crtc->dev;
        const intel_limit_t *limit;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS)) {
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS)) {
                if (intel_is_dual_link_lvds(dev)) {
                        if (refclk == 100000)
                                limit = &intel_limits_ironlake_dual_lvds_100m;
@@ -466,20 +483,21 @@ static const intel_limit_t *intel_ironlake_limit(struct intel_crtc *crtc,
        return limit;
 }
-static const intel_limit_t *intel_g4x_limit(struct intel_crtc *crtc)
+static const intel_limit_t *
+intel_g4x_limit(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct drm_device *dev = crtc_state->base.crtc->dev;
        const intel_limit_t *limit;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS)) {
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS)) {
                if (intel_is_dual_link_lvds(dev))
                        limit = &intel_limits_g4x_dual_channel_lvds;
                else
                        limit = &intel_limits_g4x_single_channel_lvds;
-        } else if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_HDMI) ||
+        } else if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_HDMI) ||
-                   intel_pipe_will_have_type(crtc, INTEL_OUTPUT_ANALOG)) {
+                   intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_ANALOG)) {
                limit = &intel_limits_g4x_hdmi;
-        } else if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_SDVO)) {
+        } else if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_SDVO)) {
                limit = &intel_limits_g4x_sdvo;
        } else /* The option is for other outputs */
                limit = &intel_limits_i9xx_sdvo;
@@ -487,17 +505,18 @@ static const intel_limit_t *intel_g4x_limit(struct intel_crtc *crtc)
        return limit;
 }
-static const intel_limit_t *intel_limit(struct intel_crtc *crtc, int refclk)
+static const intel_limit_t *
+intel_limit(struct intel_crtc_state *crtc_state, int refclk)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct drm_device *dev = crtc_state->base.crtc->dev;
        const intel_limit_t *limit;
        if (HAS_PCH_SPLIT(dev))
-                limit = intel_ironlake_limit(crtc, refclk);
+                limit = intel_ironlake_limit(crtc_state, refclk);
        else if (IS_G4X(dev)) {
-                limit = intel_g4x_limit(crtc);
+                limit = intel_g4x_limit(crtc_state);
        } else if (IS_PINEVIEW(dev)) {
-                if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS))
+                if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS))
                        limit = &intel_limits_pineview_lvds;
                else
                        limit = &intel_limits_pineview_sdvo;
@@ -506,14 +525,14 @@ static const intel_limit_t *intel_limit(struct intel_crtc *crtc, int refclk)
        } else if (IS_VALLEYVIEW(dev)) {
                limit = &intel_limits_vlv;
        } else if (!IS_GEN2(dev)) {
-                if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS))
+                if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS))
                        limit = &intel_limits_i9xx_lvds;
                else
                        limit = &intel_limits_i9xx_sdvo;
        } else {
-                if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS))
+                if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS))
                        limit = &intel_limits_i8xx_lvds;
-                else if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_DVO))
+                else if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_DVO))
                        limit = &intel_limits_i8xx_dvo;
                else
                        limit = &intel_limits_i8xx_dac;
@@ -600,15 +619,17 @@ static bool intel_PLL_is_valid(struct drm_device *dev,
 }
 static bool
-i9xx_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
+i9xx_find_best_dpll(const intel_limit_t *limit,
+                    struct intel_crtc_state *crtc_state,
                    int target, int refclk, intel_clock_t *match_clock,
                    intel_clock_t *best_clock)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
        struct drm_device *dev = crtc->base.dev;
        intel_clock_t clock;
        int err = target;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS)) {
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS)) {
                /*
                 * For LVDS just rely on its current settings for dual-channel.
                 * We haven't figured out how to reliably set up different
@@ -661,15 +682,17 @@ i9xx_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
 }
 static bool
-pnv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
+pnv_find_best_dpll(const intel_limit_t *limit,
+                   struct intel_crtc_state *crtc_state,
                   int target, int refclk, intel_clock_t *match_clock,
                   intel_clock_t *best_clock)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
        struct drm_device *dev = crtc->base.dev;
        intel_clock_t clock;
        int err = target;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS)) {
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS)) {
                /*
                 * For LVDS just rely on its current settings for dual-channel.
                 * We haven't figured out how to reliably set up different
@@ -720,10 +743,12 @@ pnv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
 }
 static bool
-g4x_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
+g4x_find_best_dpll(const intel_limit_t *limit,
+                   struct intel_crtc_state *crtc_state,
                   int target, int refclk, intel_clock_t *match_clock,
                   intel_clock_t *best_clock)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
        struct drm_device *dev = crtc->base.dev;
        intel_clock_t clock;
        int max_n;
@@ -732,7 +757,7 @@ g4x_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
        int err_most = (target >> 8) + (target >> 9);
        found = false;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS)) {
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS)) {
                if (intel_is_dual_link_lvds(dev))
                        clock.p2 = limit->p2.p2_fast;
                else
@@ -776,11 +801,53 @@ g4x_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
        return found;
 }
+/*
+ * Check if the calculated PLL configuration is more optimal compared to the
+ * best configuration and error found so far. Return the calculated error.
+ */
+static bool vlv_PLL_is_optimal(struct drm_device *dev, int target_freq,
+                               const intel_clock_t *calculated_clock,
+                               const intel_clock_t *best_clock,
+                               unsigned int best_error_ppm,
+                               unsigned int *error_ppm)
+{
+        /*
+         * For CHV ignore the error and consider only the P value.
+         * Prefer a bigger P value based on HW requirements.
+         */
+        if (IS_CHERRYVIEW(dev)) {
+                *error_ppm = 0;
+                return calculated_clock->p > best_clock->p;
+        }
+        if (WARN_ON_ONCE(!target_freq))
+                return false;
+        *error_ppm = div_u64(1000000ULL *
+                                abs(target_freq - calculated_clock->dot),
+                             target_freq);
+        /*
+         * Prefer a better P value over a better (smaller) error if the error
+         * is small. Ensure this preference for future configurations too by
+         * setting the error to 0.
+         */
+        if (*error_ppm < 100 && calculated_clock->p > best_clock->p) {
+                *error_ppm = 0;
+                return true;
+        }
+        return *error_ppm + 10 < best_error_ppm;
+}
 static bool
-vlv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
+vlv_find_best_dpll(const intel_limit_t *limit,
+                   struct intel_crtc_state *crtc_state,
                   int target, int refclk, intel_clock_t *match_clock,
                   intel_clock_t *best_clock)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
        struct drm_device *dev = crtc->base.dev;
        intel_clock_t clock;
        unsigned int bestppm = 1000000;
@@ -800,7 +867,7 @@ vlv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
                                clock.p = clock.p1 * clock.p2;
                                /* based on hardware requirement, prefer bigger m1,m2 values */
                                for (clock.m1 = limit->m1.min; clock.m1 <= limit->m1.max; clock.m1++) {
-                                        unsigned int ppm, diff;
+                                        unsigned int ppm;
                                        clock.m2 = DIV_ROUND_CLOSEST(target * clock.p * clock.n,
                                                                     refclk * clock.m1);
@@ -811,20 +878,15 @@ vlv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
                                                                &clock))
                                                continue;
-                                        diff = abs(clock.dot - target);
+                                        if (!vlv_PLL_is_optimal(dev, target,
-                                        ppm = div_u64(1000000ULL * diff, target);
+                                                                &clock,
+                                                                best_clock,
-                                        if (ppm < 100 && clock.p > best_clock->p) {
+                                                                bestppm, &ppm))
-                                                bestppm = 0;
+                                                continue;
-                                                *best_clock = clock;
-                                                found = true;
-                                        }
-                                        if (bestppm >= 10 && ppm < bestppm - 10) {
+                                        *best_clock = clock;
-                                                bestppm = ppm;
+                                        bestppm = ppm;
-                                                *best_clock = clock;
+                                        found = true;
-                                                found = true;
-                                        }
                                }
                        }
                }
@@ -834,16 +896,20 @@ vlv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
 }
 static bool
-chv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
+chv_find_best_dpll(const intel_limit_t *limit,
+                   struct intel_crtc_state *crtc_state,
                   int target, int refclk, intel_clock_t *match_clock,
                   intel_clock_t *best_clock)
 {
+        struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc);
        struct drm_device *dev = crtc->base.dev;
+        unsigned int best_error_ppm;
        intel_clock_t clock;
        uint64_t m2;
        int found = false;
        memset(best_clock, 0, sizeof(*best_clock));
+        best_error_ppm = 1000000;
        /*
         * Based on hardware doc, the n always set to 1, and m1 always
@@ -857,6 +923,7 @@ chv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
                for (clock.p2 = limit->p2.p2_fast;
                                clock.p2 >= limit->p2.p2_slow;
                                clock.p2 -= clock.p2 > 10 ? 2 : 1) {
+                        unsigned int error_ppm;
                        clock.p = clock.p1 * clock.p2;
@@ -873,12 +940,13 @@ chv_find_best_dpll(const intel_limit_t *limit, struct intel_crtc *crtc,
                        if (!intel_PLL_is_valid(dev, limit, &clock))
                                continue;
-                        /* based on hardware requirement, prefer bigger p
+                        if (!vlv_PLL_is_optimal(dev, target, &clock, best_clock,
-                         */
+                                                best_error_ppm, &error_ppm))
-                        if (clock.p > best_clock->p) {
+                                continue;
-                                *best_clock = clock;
-                                found = true;
+                        *best_clock = clock;
-                        }
+                        best_error_ppm = error_ppm;
+                        found = true;
                }
        }
@@ -2194,13 +2262,12 @@ static bool need_vtd_wa(struct drm_device *dev)
        return false;
 }
-int
+unsigned int
-intel_fb_align_height(struct drm_device *dev, int height,
+intel_tile_height(struct drm_device *dev, uint32_t pixel_format,
-                      uint32_t pixel_format,
+                  uint64_t fb_format_modifier)
-                      uint64_t fb_format_modifier)
 {
-        int tile_height;
+        unsigned int tile_height;
-        uint32_t bits_per_pixel;
+        uint32_t pixel_bytes;
        switch (fb_format_modifier) {
        case DRM_FORMAT_MOD_NONE:
@@ -2213,20 +2280,20 @@ intel_fb_align_height(struct drm_device *dev, int height,
                tile_height = 32;
                break;
        case I915_FORMAT_MOD_Yf_TILED:
-                bits_per_pixel = drm_format_plane_cpp(pixel_format, 0) * 8;
+                pixel_bytes = drm_format_plane_cpp(pixel_format, 0);
-                switch (bits_per_pixel) {
+                switch (pixel_bytes) {
                default:
-                case 8:
+                case 1:
                        tile_height = 64;
                        break;
-                case 16:
+                case 2:
-                case 32:
+                case 4:
                        tile_height = 32;
                        break;
-                case 64:
+                case 8:
                        tile_height = 16;
                        break;
-                case 128:
+                case 16:
                        WARN_ONCE(1,
                                  "128-bit pixels are not supported for display!");
                        tile_height = 16;
@@ -2239,17 +2306,58 @@ intel_fb_align_height(struct drm_device *dev, int height,
                break;
        }
-        return ALIGN(height, tile_height);
+        return tile_height;
+}
+unsigned int
+intel_fb_align_height(struct drm_device *dev, unsigned int height,
+                      uint32_t pixel_format, uint64_t fb_format_modifier)
+{
+        return ALIGN(height, intel_tile_height(dev, pixel_format,
+                                               fb_format_modifier));
+}
+static int
+intel_fill_fb_ggtt_view(struct i915_ggtt_view *view, struct drm_framebuffer *fb,
+                        const struct drm_plane_state *plane_state)
+{
+        struct intel_rotation_info *info = &view->rotation_info;
+        *view = i915_ggtt_view_normal;
+        if (!plane_state)
+                return 0;
+        if (!intel_rotation_90_or_270(plane_state->rotation))
+                return 0;
+        *view = i915_ggtt_view_rotated;
+        info->height = fb->height;
+        info->pixel_format = fb->pixel_format;
+        info->pitch = fb->pitches[0];
+        info->fb_modifier = fb->modifier[0];
+        if (!(info->fb_modifier == I915_FORMAT_MOD_Y_TILED ||
+              info->fb_modifier == I915_FORMAT_MOD_Yf_TILED)) {
+                DRM_DEBUG_KMS(
+                              "Y or Yf tiling is needed for 90/270 rotation!\n");
+                return -EINVAL;
+        }
+        return 0;
 }
 int
 intel_pin_and_fence_fb_obj(struct drm_plane *plane,
                           struct drm_framebuffer *fb,
+                           const struct drm_plane_state *plane_state,
                           struct intel_engine_cs *pipelined)
 {
        struct drm_device *dev = fb->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
+        struct i915_ggtt_view view;
        u32 alignment;
        int ret;
@@ -2286,6 +2394,10 @@ intel_pin_and_fence_fb_obj(struct drm_plane *plane,
                return -EINVAL;
        }
+        ret = intel_fill_fb_ggtt_view(&view, fb, plane_state);
+        if (ret)
+                return ret;
        /* Note that the w/a also requires 64 PTE of padding following the
         * bo. We currently fill all unused PTE with the shadow page and so
         * we should always have valid PTE following the scanout preventing
@@ -2304,7 +2416,8 @@ intel_pin_and_fence_fb_obj(struct drm_plane *plane,
        intel_runtime_pm_get(dev_priv);
        dev_priv->mm.interruptible = false;
-        ret = i915_gem_object_pin_to_display_plane(obj, alignment, pipelined);
+        ret = i915_gem_object_pin_to_display_plane(obj, alignment, pipelined,
+                                                   &view);
        if (ret)
                goto err_interruptible;
@@ -2324,19 +2437,27 @@ intel_pin_and_fence_fb_obj(struct drm_plane *plane,
        return 0;
 err_unpin:
-        i915_gem_object_unpin_from_display_plane(obj);
+        i915_gem_object_unpin_from_display_plane(obj, &view);
 err_interruptible:
        dev_priv->mm.interruptible = true;
        intel_runtime_pm_put(dev_priv);
        return ret;
 }
-static void intel_unpin_fb_obj(struct drm_i915_gem_object *obj)
+static void intel_unpin_fb_obj(struct drm_framebuffer *fb,
+                               const struct drm_plane_state *plane_state)
 {
+        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
+        struct i915_ggtt_view view;
+        int ret;
        WARN_ON(!mutex_is_locked(&obj->base.dev->struct_mutex));
+        ret = intel_fill_fb_ggtt_view(&view, fb, plane_state);
+        WARN_ONCE(ret, "Couldn't get view from plane state!");
        i915_gem_object_unpin_fence(obj);
-        i915_gem_object_unpin_from_display_plane(obj);
+        i915_gem_object_unpin_from_display_plane(obj, &view);
 }
 /* Computes the linear offset to the base tile and adjusts x, y. bytes per pixel
@@ -2414,8 +2535,8 @@ static int skl_format_to_fourcc(int format, bool rgb_order, bool alpha)
 }
 static bool
-intel_alloc_plane_obj(struct intel_crtc *crtc,
+intel_alloc_initial_plane_obj(struct intel_crtc *crtc,
-                      struct intel_initial_plane_config *plane_config)
+                              struct intel_initial_plane_config *plane_config)
 {
        struct drm_device *dev = crtc->base.dev;
        struct drm_i915_gem_object *obj = NULL;
@@ -2449,17 +2570,14 @@ intel_alloc_plane_obj(struct intel_crtc *crtc,
        mode_cmd.flags = DRM_MODE_FB_MODIFIERS;
        mutex_lock(&dev->struct_mutex);
        if (intel_framebuffer_init(dev, to_intel_framebuffer(fb),
                                   &mode_cmd, obj)) {
                DRM_DEBUG_KMS("intel fb init failed\n");
                goto out_unref_obj;
        }
-        obj->frontbuffer_bits = INTEL_FRONTBUFFER_PRIMARY(crtc->pipe);
        mutex_unlock(&dev->struct_mutex);
-        DRM_DEBUG_KMS("plane fb obj %p\n", obj);
+        DRM_DEBUG_KMS("initial plane fb obj %p\n", obj);
        return true;
 out_unref_obj:
@@ -2483,26 +2601,23 @@ update_state_fb(struct drm_plane *plane)
 }
 static void
-intel_find_plane_obj(struct intel_crtc *intel_crtc,
+intel_find_initial_plane_obj(struct intel_crtc *intel_crtc,
-                     struct intel_initial_plane_config *plane_config)
+                             struct intel_initial_plane_config *plane_config)
 {
        struct drm_device *dev = intel_crtc->base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_crtc *c;
        struct intel_crtc *i;
        struct drm_i915_gem_object *obj;
+        struct drm_plane *primary = intel_crtc->base.primary;
+        struct drm_framebuffer *fb;
        if (!plane_config->fb)
                return;
-        if (intel_alloc_plane_obj(intel_crtc, plane_config)) {
+        if (intel_alloc_initial_plane_obj(intel_crtc, plane_config)) {
-                struct drm_plane *primary = intel_crtc->base.primary;
+                fb = &plane_config->fb->base;
+                goto valid_fb;
-                primary->fb = &plane_config->fb->base;
-                primary->state->crtc = &intel_crtc->base;
-                update_state_fb(primary);
-                return;
        }
        kfree(plane_config->fb);
@@ -2520,24 +2635,29 @@ intel_find_plane_obj(struct intel_crtc *intel_crtc,
                if (!i->active)
                        continue;
-                obj = intel_fb_obj(c->primary->fb);
+                fb = c->primary->fb;
-                if (obj == NULL)
+                if (!fb)
                        continue;
+                obj = intel_fb_obj(fb);
                if (i915_gem_obj_ggtt_offset(obj) == plane_config->base) {
-                        struct drm_plane *primary = intel_crtc->base.primary;
+                        drm_framebuffer_reference(fb);
+                        goto valid_fb;
-                        if (obj->tiling_mode != I915_TILING_NONE)
-                                dev_priv->preserve_bios_swizzle = true;
-                        drm_framebuffer_reference(c->primary->fb);
-                        primary->fb = c->primary->fb;
-                        primary->state->crtc = &intel_crtc->base;
-                        update_state_fb(intel_crtc->base.primary);
-                        obj->frontbuffer_bits |= INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe);
-                        break;
                }
        }
+        return;
+valid_fb:
+        obj = intel_fb_obj(fb);
+        if (obj->tiling_mode != I915_TILING_NONE)
+                dev_priv->preserve_bios_swizzle = true;
+        primary->fb = fb;
+        primary->state->crtc = &intel_crtc->base;
+        primary->crtc = &intel_crtc->base;
+        update_state_fb(primary);
+        obj->frontbuffer_bits |= INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe);
 }
 static void i9xx_update_primary_plane(struct drm_crtc *crtc,
@@ -2805,6 +2925,17 @@ u32 intel_fb_stride_alignment(struct drm_device *dev, uint64_t fb_modifier,
        }
 }
+unsigned long intel_plane_obj_offset(struct intel_plane *intel_plane,
+                                     struct drm_i915_gem_object *obj)
+{
+        const struct i915_ggtt_view *view = &i915_ggtt_view_normal;
+        if (intel_rotation_90_or_270(intel_plane->base.state->rotation))
+                view = &i915_ggtt_view_rotated;
+        return i915_gem_obj_ggtt_offset_view(obj, view);
+}
 static void skylake_update_primary_plane(struct drm_crtc *crtc,
                                         struct drm_framebuffer *fb,
                                         int x, int y)
@@ -2815,6 +2946,7 @@ static void skylake_update_primary_plane(struct drm_crtc *crtc,
        struct drm_i915_gem_object *obj;
        int pipe = intel_crtc->pipe;
        u32 plane_ctl, stride_div;
+        unsigned long surf_addr;
        if (!intel_crtc->primary_enabled) {
                I915_WRITE(PLANE_CTL(pipe, 0), 0);
@@ -2881,16 +3013,16 @@ static void skylake_update_primary_plane(struct drm_crtc *crtc,
        obj = intel_fb_obj(fb);
        stride_div = intel_fb_stride_alignment(dev, fb->modifier[0],
                                               fb->pixel_format);
+        surf_addr = intel_plane_obj_offset(to_intel_plane(crtc->primary), obj);
        I915_WRITE(PLANE_CTL(pipe, 0), plane_ctl);
        I915_WRITE(PLANE_POS(pipe, 0), 0);
        I915_WRITE(PLANE_OFFSET(pipe, 0), (y << 16) | x);
        I915_WRITE(PLANE_SIZE(pipe, 0),
                   (intel_crtc->config->pipe_src_h - 1) << 16 |
                   (intel_crtc->config->pipe_src_w - 1));
        I915_WRITE(PLANE_STRIDE(pipe, 0), fb->pitches[0] / stride_div);
-        I915_WRITE(PLANE_SURF(pipe, 0), i915_gem_obj_ggtt_offset(obj));
+        I915_WRITE(PLANE_SURF(pipe, 0), surf_addr);
        POSTING_READ(PLANE_SURF(pipe, 0));
 }
@@ -4824,8 +4956,9 @@ static unsigned long get_crtc_power_domains(struct drm_crtc *crtc)
        return mask;
 }
-static void modeset_update_crtc_power_domains(struct drm_device *dev)
+static void modeset_update_crtc_power_domains(struct drm_atomic_state *state)
 {
+        struct drm_device *dev = state->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long pipe_domains[I915_MAX_PIPES] = { 0, };
        struct intel_crtc *crtc;
@@ -4847,7 +4980,7 @@ static void modeset_update_crtc_power_domains(struct drm_device *dev)
        }
        if (dev_priv->display.modeset_global_resources)
-                dev_priv->display.modeset_global_resources(dev);
+                dev_priv->display.modeset_global_resources(state);
        for_each_intel_crtc(dev, crtc) {
                enum intel_display_power_domain domain;
@@ -5095,8 +5228,9 @@ static void vlv_program_pfi_credits(struct drm_i915_private *dev_priv)
        WARN_ON(I915_READ(GCI_CONTROL) & PFI_CREDIT_RESEND);
 }
-static void valleyview_modeset_global_resources(struct drm_device *dev)
+static void valleyview_modeset_global_resources(struct drm_atomic_state *state)
 {
+        struct drm_device *dev = state->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        int max_pixclk = intel_mode_max_pixclk(dev_priv);
        int req_cdclk = valleyview_calc_cdclk(dev_priv, max_pixclk);
@@ -5687,7 +5821,7 @@ static int intel_crtc_compute_config(struct intel_crtc *crtc,
         * - LVDS dual channel mode
         * - Double wide pipe
         */
-        if ((intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS) &&
+        if ((intel_pipe_will_have_type(pipe_config, INTEL_OUTPUT_LVDS) &&
             intel_is_dual_link_lvds(dev)) || pipe_config->double_wide)
                pipe_config->pipe_src_w &= ~1;
@@ -5866,15 +6000,18 @@ static inline bool intel_panel_use_ssc(struct drm_i915_private *dev_priv)
                && !(dev_priv->quirks & QUIRK_LVDS_SSC_DISABLE);
 }
-static int i9xx_get_refclk(struct intel_crtc *crtc, int num_connectors)
+static int i9xx_get_refclk(const struct intel_crtc_state *crtc_state,
+                           int num_connectors)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct drm_device *dev = crtc_state->base.crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        int refclk;
+        WARN_ON(!crtc_state->base.state);
        if (IS_VALLEYVIEW(dev)) {
                refclk = 100000;
-        } else if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS) &&
+        } else if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS) &&
            intel_panel_use_ssc(dev_priv) && num_connectors < 2) {
                refclk = dev_priv->vbt.lvds_ssc_freq;
                DRM_DEBUG_KMS("using SSC reference clock of %d kHz\n", refclk);
@@ -5917,8 +6054,8 @@ static void i9xx_update_pll_dividers(struct intel_crtc *crtc,
        crtc_state->dpll_hw_state.fp0 = fp;
        crtc->lowfreq_avail = false;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS) &&
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS) &&
-            reduced_clock && i915.powersave) {
+            reduced_clock) {
                crtc_state->dpll_hw_state.fp1 = fp2;
                crtc->lowfreq_avail = true;
        } else {
@@ -6275,6 +6412,7 @@ void vlv_force_pll_on(struct drm_device *dev, enum pipe pipe,
        struct intel_crtc *crtc =
                to_intel_crtc(intel_get_crtc_for_pipe(dev, pipe));
        struct intel_crtc_state pipe_config = {
+                .base.crtc = &crtc->base,
                .pixel_multiplier = 1,
                .dpll = *dpll,
        };
@@ -6319,12 +6457,12 @@ static void i9xx_update_pll(struct intel_crtc *crtc,
        i9xx_update_pll_dividers(crtc, crtc_state, reduced_clock);
-        is_sdvo = intel_pipe_will_have_type(crtc, INTEL_OUTPUT_SDVO) ||
+        is_sdvo = intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_SDVO) ||
-                intel_pipe_will_have_type(crtc, INTEL_OUTPUT_HDMI);
+                intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_HDMI);
        dpll = DPLL_VGA_MODE_DIS;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS))
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS))
                dpll |= DPLLB_MODE_LVDS;
        else
                dpll |= DPLLB_MODE_DAC_SERIAL;
@@ -6367,7 +6505,7 @@ static void i9xx_update_pll(struct intel_crtc *crtc,
        if (crtc_state->sdvo_tv_clock)
                dpll |= PLL_REF_INPUT_TVCLKINBC;
-        else if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS) &&
+        else if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS) &&
                 intel_panel_use_ssc(dev_priv) && num_connectors < 2)
                dpll |= PLLB_REF_INPUT_SPREADSPECTRUMIN;
        else
@@ -6397,7 +6535,7 @@ static void i8xx_update_pll(struct intel_crtc *crtc,
        dpll = DPLL_VGA_MODE_DIS;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS)) {
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS)) {
                dpll |= (1 << (clock->p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
        } else {
                if (clock->p1 == 2)
@@ -6408,10 +6546,10 @@ static void i8xx_update_pll(struct intel_crtc *crtc,
                        dpll |= PLL_P2_DIVIDE_BY_4;
        }
-        if (!IS_I830(dev) && intel_pipe_will_have_type(crtc, INTEL_OUTPUT_DVO))
+        if (!IS_I830(dev) && intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_DVO))
                dpll |= DPLL_DVO_2X_MODE;
-        if (intel_pipe_will_have_type(crtc, INTEL_OUTPUT_LVDS) &&
+        if (intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS) &&
                 intel_panel_use_ssc(dev_priv) && num_connectors < 2)
                dpll |= PLLB_REF_INPUT_SPREADSPECTRUMIN;
        else
@@ -6625,11 +6763,20 @@ static int i9xx_crtc_compute_clock(struct intel_crtc *crtc,
        bool is_lvds = false, is_dsi = false;
        struct intel_encoder *encoder;
        const intel_limit_t *limit;
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
+        int i;
-        for_each_intel_encoder(dev, encoder) {
+        for (i = 0; i < state->num_connector; i++) {
-                if (encoder->new_crtc != crtc)
+                if (!state->connectors[i])
                        continue;
+                connector_state = state->connector_states[i];
+                if (connector_state->crtc != &crtc->base)
+                        continue;
+                encoder = to_intel_encoder(connector_state->best_encoder);
                switch (encoder->type) {
                case INTEL_OUTPUT_LVDS:
                        is_lvds = true;
@@ -6648,7 +6795,7 @@ static int i9xx_crtc_compute_clock(struct intel_crtc *crtc,
                return 0;
        if (!crtc_state->clock_set) {
-                refclk = i9xx_get_refclk(crtc, num_connectors);
+                refclk = i9xx_get_refclk(crtc_state, num_connectors);
                /*
                 * Returns a set of divisors for the desired target clock with
@@ -6656,8 +6803,8 @@ static int i9xx_crtc_compute_clock(struct intel_crtc *crtc,
                 * the clock equation: reflck * (5 * (m1 + 2) + (m2 + 2)) / (n +
                 * 2) / p1 / p2.
                 */
-                limit = intel_limit(crtc, refclk);
+                limit = intel_limit(crtc_state, refclk);
-                ok = dev_priv->display.find_dpll(limit, crtc,
+                ok = dev_priv->display.find_dpll(limit, crtc_state,
                                                 crtc_state->port_clock,
                                                 refclk, NULL, &clock);
                if (!ok) {
@@ -6673,7 +6820,7 @@ static int i9xx_crtc_compute_clock(struct intel_crtc *crtc,
                         * we will disable the LVDS downclock feature.
                         */
                        has_reduced_clock =
-                                dev_priv->display.find_dpll(limit, crtc,
+                                dev_priv->display.find_dpll(limit, crtc_state,
                                                            dev_priv->lvds_downclock,
                                                            refclk, &clock,
                                                            &reduced_clock);
@@ -6772,7 +6919,7 @@ i9xx_get_initial_plane_config(struct intel_crtc *crtc,
        u32 val, base, offset;
        int pipe = crtc->pipe, plane = crtc->plane;
        int fourcc, pixel_format;
-        int aligned_height;
+        unsigned int aligned_height;
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
@@ -7303,18 +7450,26 @@ void intel_init_pch_refclk(struct drm_device *dev)
                lpt_init_pch_refclk(dev);
 }
-static int ironlake_get_refclk(struct drm_crtc *crtc)
+static int ironlake_get_refclk(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc->dev;
+        struct drm_device *dev = crtc_state->base.crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
        struct intel_encoder *encoder;
-        int num_connectors = 0;
+        int num_connectors = 0, i;
        bool is_lvds = false;
-        for_each_intel_encoder(dev, encoder) {
+        for (i = 0; i < state->num_connector; i++) {
-                if (encoder->new_crtc != to_intel_crtc(crtc))
+                if (!state->connectors[i])
+                        continue;
+                connector_state = state->connector_states[i];
+                if (connector_state->crtc != crtc_state->base.crtc)
                        continue;
+                encoder = to_intel_encoder(connector_state->best_encoder);
                switch (encoder->type) {
                case INTEL_OUTPUT_LVDS:
                        is_lvds = true;
@@ -7501,22 +7656,21 @@ static bool ironlake_compute_clocks(struct drm_crtc *crtc,
 {
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
        int refclk;
        const intel_limit_t *limit;
        bool ret, is_lvds = false;
-        is_lvds = intel_pipe_will_have_type(intel_crtc, INTEL_OUTPUT_LVDS);
+        is_lvds = intel_pipe_will_have_type(crtc_state, INTEL_OUTPUT_LVDS);
-        refclk = ironlake_get_refclk(crtc);
+        refclk = ironlake_get_refclk(crtc_state);
        /*
         * Returns a set of divisors for the desired target clock with the given
         * refclk, or FALSE.  The returned values represent the clock equation:
         * reflck * (5 * (m1 + 2) + (m2 + 2)) / (n + 2) / p1 / p2.
         */
-        limit = intel_limit(intel_crtc, refclk);
+        limit = intel_limit(crtc_state, refclk);
-        ret = dev_priv->display.find_dpll(limit, intel_crtc,
+        ret = dev_priv->display.find_dpll(limit, crtc_state,
                                          crtc_state->port_clock,
                                          refclk, NULL, clock);
        if (!ret)
@@ -7530,7 +7684,7 @@ static bool ironlake_compute_clocks(struct drm_crtc *crtc,
                 * downclock feature.
                */
                *has_reduced_clock =
-                        dev_priv->display.find_dpll(limit, intel_crtc,
+                        dev_priv->display.find_dpll(limit, crtc_state,
                                                    dev_priv->lvds_downclock,
                                                    refclk, clock,
                                                    reduced_clock);
@@ -7563,16 +7717,24 @@ static uint32_t ironlake_compute_dpll(struct intel_crtc *intel_crtc,
        struct drm_crtc *crtc = &intel_crtc->base;
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_encoder *intel_encoder;
+        struct drm_atomic_state *state = crtc_state->base.state;
+        struct drm_connector_state *connector_state;
+        struct intel_encoder *encoder;
        uint32_t dpll;
-        int factor, num_connectors = 0;
+        int factor, num_connectors = 0, i;
        bool is_lvds = false, is_sdvo = false;
-        for_each_intel_encoder(dev, intel_encoder) {
+        for (i = 0; i < state->num_connector; i++) {
-                if (intel_encoder->new_crtc != to_intel_crtc(crtc))
+                if (!state->connectors[i])
                        continue;
-                switch (intel_encoder->type) {
+                connector_state = state->connector_states[i];
+                if (connector_state->crtc != crtc_state->base.crtc)
+                        continue;
+                encoder = to_intel_encoder(connector_state->best_encoder);
+                switch (encoder->type) {
                case INTEL_OUTPUT_LVDS:
                        is_lvds = true;
                        break;
@@ -7701,7 +7863,7 @@ static int ironlake_crtc_compute_clock(struct intel_crtc *crtc,
                }
        }
-        if (is_lvds && has_reduced_clock && i915.powersave)
+        if (is_lvds && has_reduced_clock)
                crtc->lowfreq_avail = true;
        else
                crtc->lowfreq_avail = false;
@@ -7810,7 +7972,7 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
        u32 val, base, offset, stride_mult, tiling;
        int pipe = crtc->pipe;
        int fourcc, pixel_format;
-        int aligned_height;
+        unsigned int aligned_height;
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
@@ -7918,7 +8080,7 @@ ironlake_get_initial_plane_config(struct intel_crtc *crtc,
        u32 val, base, offset;
        int pipe = crtc->pipe;
        int fourcc, pixel_format;
-        int aligned_height;
+        unsigned int aligned_height;
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
@@ -8802,6 +8964,8 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
        struct drm_device *dev = encoder->dev;
        struct drm_framebuffer *fb;
        struct drm_mode_config *config = &dev->mode_config;
+        struct drm_atomic_state *state = NULL;
+        struct drm_connector_state *connector_state;
        int ret, i = -1;
        DRM_DEBUG_KMS("[CONNECTOR:%d:%s], [ENCODER:%d:%s]\n",
@@ -8883,6 +9047,21 @@ retry:
        old->load_detect_temp = true;
        old->release_fb = NULL;
+        state = drm_atomic_state_alloc(dev);
+        if (!state)
+                return false;
+        state->acquire_ctx = ctx;
+        connector_state = drm_atomic_get_connector_state(state, connector);
+        if (IS_ERR(connector_state)) {
+                ret = PTR_ERR(connector_state);
+                goto fail;
+        }
+        connector_state->crtc = crtc;
+        connector_state->best_encoder = &intel_encoder->base;
        if (!mode)
                mode = &load_detect_mode;
@@ -8905,7 +9084,7 @@ retry:
                goto fail;
        }
-        if (intel_set_mode(crtc, mode, 0, 0, fb)) {
+        if (intel_set_mode(crtc, mode, 0, 0, fb, state)) {
                DRM_DEBUG_KMS("failed to set mode on load-detect pipe\n");
                if (old->release_fb)
                        old->release_fb->funcs->destroy(old->release_fb);
@@ -8924,6 +9103,11 @@ retry:
        else
                intel_crtc->new_config = NULL;
 fail_unlock:
+        if (state) {
+                drm_atomic_state_free(state);
+                state = NULL;
+        }
        if (ret == -EDEADLK) {
                drm_modeset_backoff(ctx);
                goto retry;
@@ -8933,24 +9117,44 @@ fail_unlock:
 }
 void intel_release_load_detect_pipe(struct drm_connector *connector,
-                                    struct intel_load_detect_pipe *old)
+                                    struct intel_load_detect_pipe *old,
+                                    struct drm_modeset_acquire_ctx *ctx)
 {
+        struct drm_device *dev = connector->dev;
        struct intel_encoder *intel_encoder =
                intel_attached_encoder(connector);
        struct drm_encoder *encoder = &intel_encoder->base;
        struct drm_crtc *crtc = encoder->crtc;
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        struct drm_atomic_state *state;
+        struct drm_connector_state *connector_state;
        DRM_DEBUG_KMS("[CONNECTOR:%d:%s], [ENCODER:%d:%s]\n",
                      connector->base.id, connector->name,
                      encoder->base.id, encoder->name);
        if (old->load_detect_temp) {
+                state = drm_atomic_state_alloc(dev);
+                if (!state)
+                        goto fail;
+                state->acquire_ctx = ctx;
+                connector_state = drm_atomic_get_connector_state(state, connector);
+                if (IS_ERR(connector_state))
+                        goto fail;
                to_intel_connector(connector)->new_encoder = NULL;
                intel_encoder->new_crtc = NULL;
                intel_crtc->new_enabled = false;
                intel_crtc->new_config = NULL;
-                intel_set_mode(crtc, NULL, 0, 0, NULL);
+                connector_state->best_encoder = NULL;
+                connector_state->crtc = NULL;
+                intel_set_mode(crtc, NULL, 0, 0, NULL, state);
+                drm_atomic_state_free(state);
                if (old->release_fb) {
                        drm_framebuffer_unregister_private(old->release_fb);
@@ -8963,6 +9167,11 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
        /* Switch crtc and encoder back off if necessary */
        if (old->dpms_mode != DRM_MODE_DPMS_ON)
                connector->funcs->dpms(connector, old->dpms_mode);
+        return;
+fail:
+        DRM_DEBUG_KMS("Couldn't release load detect pipe.\n");
+        drm_atomic_state_free(state);
 }
 static int i9xx_pll_refclk(struct drm_device *dev,
@@ -9201,6 +9410,8 @@ void intel_mark_busy(struct drm_device *dev)
        intel_runtime_pm_get(dev_priv);
        i915_update_gfx_val(dev_priv);
+        if (INTEL_INFO(dev)->gen >= 6)
+                gen6_rps_busy(dev_priv);
        dev_priv->mm.busy = true;
 }
@@ -9214,9 +9425,6 @@ void intel_mark_idle(struct drm_device *dev)
        dev_priv->mm.busy = false;
-        if (!i915.powersave)
-                goto out;
        for_each_crtc(dev, crtc) {
                if (!crtc->primary->fb)
                        continue;
@@ -9227,7 +9435,6 @@ void intel_mark_idle(struct drm_device *dev)
        if (INTEL_INFO(dev)->gen >= 6)
                gen6_rps_idle(dev->dev_private);
-out:
        intel_runtime_pm_put(dev_priv);
 }
@@ -9269,7 +9476,7 @@ static void intel_unpin_work_fn(struct work_struct *__work)
        enum pipe pipe = to_intel_crtc(work->crtc)->pipe;
        mutex_lock(&dev->struct_mutex);
-        intel_unpin_fb_obj(intel_fb_obj(work->old_fb));
+        intel_unpin_fb_obj(work->old_fb, work->crtc->primary->state);
        drm_gem_object_unreference(&work->pending_flip_obj->base);
        intel_fbc_update(dev);
@@ -9977,12 +10184,13 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
                ring = &dev_priv->ring[RCS];
        }
-        ret = intel_pin_and_fence_fb_obj(crtc->primary, fb, ring);
+        ret = intel_pin_and_fence_fb_obj(crtc->primary, fb,
+                                         crtc->primary->state, ring);
        if (ret)
                goto cleanup_pending;
-        work->gtt_offset =
+        work->gtt_offset = intel_plane_obj_offset(to_intel_plane(primary), obj)
-                i915_gem_obj_ggtt_offset(obj) + intel_crtc->dspaddr_offset;
+                                                  + intel_crtc->dspaddr_offset;
        if (use_mmio_flip(ring, obj)) {
                ret = intel_queue_mmio_flip(dev, crtc, fb, obj, ring,
@@ -10017,7 +10225,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        return 0;
 cleanup_unpin:
-        intel_unpin_fb_obj(obj);
+        intel_unpin_fb_obj(fb, crtc->primary->state);
 cleanup_pending:
        atomic_dec(&intel_crtc->unpin_work_count);
        mutex_unlock(&dev->struct_mutex);
@@ -10087,6 +10295,27 @@ static void intel_modeset_update_staged_output_state(struct drm_device *dev)
        }
 }
+/* Transitional helper to copy current connector/encoder state to
+ * connector->state. This is needed so that code that is partially
+ * converted to atomic does the right thing.
+ */
+static void intel_modeset_update_connector_atomic_state(struct drm_device *dev)
+{
+        struct intel_connector *connector;
+        for_each_intel_connector(dev, connector) {
+                if (connector->base.encoder) {
+                        connector->base.state->best_encoder =
+                                connector->base.encoder;
+                        connector->base.state->crtc =
+                                connector->base.encoder->crtc;
+                } else {
+                        connector->base.state->best_encoder = NULL;
+                        connector->base.state->crtc = NULL;
+                }
+        }
+}
 /**
 * intel_modeset_commit_output_state
 *
@@ -10110,6 +10339,8 @@ static void intel_modeset_commit_output_state(struct drm_device *dev)
                crtc->base.state->enable = crtc->new_enabled;
                crtc->base.enabled = crtc->new_enabled;
        }
+        intel_modeset_update_connector_atomic_state(dev);
 }
 static void
@@ -10144,8 +10375,9 @@ compute_baseline_pipe_bpp(struct intel_crtc *crtc,
                          struct intel_crtc_state *pipe_config)
 {
        struct drm_device *dev = crtc->base.dev;
+        struct drm_atomic_state *state;
        struct intel_connector *connector;
-        int bpp;
+        int bpp, i;
        switch (fb->pixel_format) {
        case DRM_FORMAT_C8:
@@ -10185,10 +10417,15 @@ compute_baseline_pipe_bpp(struct intel_crtc *crtc,
        pipe_config->pipe_bpp = bpp;
+        state = pipe_config->base.state;
        /* Clamp display bpp to EDID value */
-        for_each_intel_connector(dev, connector) {
+        for (i = 0; i < state->num_connector; i++) {
-                if (!connector->new_encoder ||
+                if (!state->connectors[i])
-                    connector->new_encoder->new_crtc != crtc)
+                        continue;
+                connector = to_intel_connector(state->connectors[i]);
+                if (state->connector_states[i]->crtc != &crtc->base)
                        continue;
                connected_sink_compute_bpp(connector, pipe_config);
@@ -10344,15 +10581,30 @@ static bool check_digital_port_conflicts(struct drm_device *dev)
        return true;
 }
+static void
+clear_intel_crtc_state(struct intel_crtc_state *crtc_state)
+{
+        struct drm_crtc_state tmp_state;
+        /* Clear only the intel specific part of the crtc state */
+        tmp_state = crtc_state->base;
+        memset(crtc_state, 0, sizeof *crtc_state);
+        crtc_state->base = tmp_state;
+}
 static struct intel_crtc_state *
 intel_modeset_pipe_config(struct drm_crtc *crtc,
                          struct drm_framebuffer *fb,
-                          struct drm_display_mode *mode)
+                          struct drm_display_mode *mode,
+                          struct drm_atomic_state *state)
 {
        struct drm_device *dev = crtc->dev;
        struct intel_encoder *encoder;
+        struct intel_connector *connector;
+        struct drm_connector_state *connector_state;
        struct intel_crtc_state *pipe_config;
        int plane_bpp, ret = -EINVAL;
+        int i;
        bool retry = true;
        if (!check_encoder_cloning(to_intel_crtc(crtc))) {
@@ -10365,9 +10617,11 @@ intel_modeset_pipe_config(struct drm_crtc *crtc,
                return ERR_PTR(-EINVAL);
        }
-        pipe_config = kzalloc(sizeof(*pipe_config), GFP_KERNEL);
+        pipe_config = intel_atomic_get_crtc_state(state, to_intel_crtc(crtc));
-        if (!pipe_config)
+        if (IS_ERR(pipe_config))
-                return ERR_PTR(-ENOMEM);
+                return pipe_config;
+        clear_intel_crtc_state(pipe_config);
        pipe_config->base.crtc = crtc;
        drm_mode_copy(&pipe_config->base.adjusted_mode, mode);
@@ -10424,11 +10678,17 @@ encoder_retry:
         * adjust it according to limitations or connector properties, and also
         * a chance to reject the mode entirely.
         */
-        for_each_intel_encoder(dev, encoder) {
+        for (i = 0; i < state->num_connector; i++) {
+                connector = to_intel_connector(state->connectors[i]);
+                if (!connector)
+                        continue;
-                if (&encoder->new_crtc->base != crtc)
+                connector_state = state->connector_states[i];
+                if (connector_state->crtc != crtc)
                        continue;
+                encoder = to_intel_encoder(connector_state->best_encoder);
                if (!(encoder->compute_config(encoder, pipe_config))) {
                        DRM_DEBUG_KMS("Encoder config failure\n");
                        goto fail;
@@ -10464,7 +10724,6 @@ encoder_retry:
        return pipe_config;
 fail:
-        kfree(pipe_config);
        return ERR_PTR(ret);
 }
@@ -11143,17 +11402,30 @@ static struct intel_crtc_state *
 intel_modeset_compute_config(struct drm_crtc *crtc,
                             struct drm_display_mode *mode,
                             struct drm_framebuffer *fb,
+                             struct drm_atomic_state *state,
                             unsigned *modeset_pipes,
                             unsigned *prepare_pipes,
                             unsigned *disable_pipes)
 {
+        struct drm_device *dev = crtc->dev;
        struct intel_crtc_state *pipe_config = NULL;
+        struct intel_crtc *intel_crtc;
+        int ret = 0;
+        ret = drm_atomic_add_affected_connectors(state, crtc);
+        if (ret)
+                return ERR_PTR(ret);
        intel_modeset_affected_pipes(crtc, modeset_pipes,
                                     prepare_pipes, disable_pipes);
-        if ((*modeset_pipes) == 0)
+        for_each_intel_crtc_masked(dev, *disable_pipes, intel_crtc) {
-                goto out;
+                pipe_config = intel_atomic_get_crtc_state(state, intel_crtc);
+                if (IS_ERR(pipe_config))
+                        return pipe_config;
+                pipe_config->base.enable = false;
+        }
        /*
         * Note this needs changes when we start tracking multiple modes
@@ -11161,15 +11433,21 @@ intel_modeset_compute_config(struct drm_crtc *crtc,
         * (i.e. one pipe_config for each crtc) rather than just the one
         * for this crtc.
         */
-        pipe_config = intel_modeset_pipe_config(crtc, fb, mode);
+        for_each_intel_crtc_masked(dev, *modeset_pipes, intel_crtc) {
-        if (IS_ERR(pipe_config)) {
+                /* FIXME: For now we still expect modeset_pipes has at most
-                goto out;
+                 * one bit set. */
+                if (WARN_ON(&intel_crtc->base != crtc))
+                        continue;
+                pipe_config = intel_modeset_pipe_config(crtc, fb, mode, state);
+                if (IS_ERR(pipe_config))
+                        return pipe_config;
+                intel_dump_pipe_config(to_intel_crtc(crtc), pipe_config,
+                                       "[modeset]");
        }
-        intel_dump_pipe_config(to_intel_crtc(crtc), pipe_config,
-                               "[modeset]");
-out:
+        return intel_atomic_get_crtc_state(state, to_intel_crtc(crtc));;
-        return pipe_config;
 }
 static int __intel_set_mode_setup_plls(struct drm_device *dev,
@@ -11213,6 +11491,7 @@ static int __intel_set_mode(struct drm_crtc *crtc,
        struct drm_device *dev = crtc->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_display_mode *saved_mode;
+        struct intel_crtc_state *crtc_state_copy = NULL;
        struct intel_crtc *intel_crtc;
        int ret = 0;
@@ -11220,6 +11499,12 @@ static int __intel_set_mode(struct drm_crtc *crtc,
        if (!saved_mode)
                return -ENOMEM;
+        crtc_state_copy = kmalloc(sizeof(*crtc_state_copy), GFP_KERNEL);
+        if (!crtc_state_copy) {
+                ret = -ENOMEM;
+                goto done;
+        }
        *saved_mode = crtc->mode;
        if (modeset_pipes)
@@ -11277,7 +11562,7 @@ static int __intel_set_mode(struct drm_crtc *crtc,
         * update the the output configuration. */
        intel_modeset_update_state(dev, prepare_pipes);
-        modeset_update_crtc_power_domains(dev);
+        modeset_update_crtc_power_domains(pipe_config->base.state);
        /* Set up the DPLL and any encoders state that needs to adjust or depend
         * on the DPLL.
@@ -11306,6 +11591,22 @@ done:
        if (ret && crtc->state->enable)
                crtc->mode = *saved_mode;
+        if (ret == 0 && pipe_config) {
+                struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+                /* The pipe_config will be freed with the atomic state, so
+                 * make a copy. */
+                memcpy(crtc_state_copy, intel_crtc->config,
+                       sizeof *crtc_state_copy);
+                intel_crtc->config = crtc_state_copy;
+                intel_crtc->base.state = &crtc_state_copy->base;
+                if (modeset_pipes)
+                        intel_crtc->new_config = intel_crtc->config;
+        } else {
+                kfree(crtc_state_copy);
+        }
        kfree(saved_mode);
        return ret;
 }
@@ -11331,27 +11632,81 @@ static int intel_set_mode_pipes(struct drm_crtc *crtc,
 static int intel_set_mode(struct drm_crtc *crtc,
                          struct drm_display_mode *mode,
-                          int x, int y, struct drm_framebuffer *fb)
+                          int x, int y, struct drm_framebuffer *fb,
+                          struct drm_atomic_state *state)
 {
        struct intel_crtc_state *pipe_config;
        unsigned modeset_pipes, prepare_pipes, disable_pipes;
+        int ret = 0;
-        pipe_config = intel_modeset_compute_config(crtc, mode, fb,
+        pipe_config = intel_modeset_compute_config(crtc, mode, fb, state,
                                                   &modeset_pipes,
                                                   &prepare_pipes,
                                                   &disable_pipes);
-        if (IS_ERR(pipe_config))
+        if (IS_ERR(pipe_config)) {
-                return PTR_ERR(pipe_config);
+                ret = PTR_ERR(pipe_config);
+                goto out;
+        }
+        ret = intel_set_mode_pipes(crtc, mode, x, y, fb, pipe_config,
+                                   modeset_pipes, prepare_pipes,
+                                   disable_pipes);
+        if (ret)
+                goto out;
-        return intel_set_mode_pipes(crtc, mode, x, y, fb, pipe_config,
+out:
-                                    modeset_pipes, prepare_pipes,
+        return ret;
-                                    disable_pipes);
 }
 void intel_crtc_restore_mode(struct drm_crtc *crtc)
 {
-        intel_set_mode(crtc, &crtc->mode, crtc->x, crtc->y, crtc->primary->fb);
+        struct drm_device *dev = crtc->dev;
+        struct drm_atomic_state *state;
+        struct intel_encoder *encoder;
+        struct intel_connector *connector;
+        struct drm_connector_state *connector_state;
+        state = drm_atomic_state_alloc(dev);
+        if (!state) {
+                DRM_DEBUG_KMS("[CRTC:%d] mode restore failed, out of memory",
+                              crtc->base.id);
+                return;
+        }
+        state->acquire_ctx = dev->mode_config.acquire_ctx;
+        /* The force restore path in the HW readout code relies on the staged
+         * config still keeping the user requested config while the actual
+         * state has been overwritten by the configuration read from HW. We
+         * need to copy the staged config to the atomic state, otherwise the
+         * mode set will just reapply the state the HW is already in. */
+        for_each_intel_encoder(dev, encoder) {
+                if (&encoder->new_crtc->base != crtc)
+                        continue;
+                for_each_intel_connector(dev, connector) {
+                        if (connector->new_encoder != encoder)
+                                continue;
+                        connector_state = drm_atomic_get_connector_state(state, &connector->base);
+                        if (IS_ERR(connector_state)) {
+                                DRM_DEBUG_KMS("Failed to add [CONNECTOR:%d:%s] to state: %ld\n",
+                                              connector->base.base.id,
+                                              connector->base.name,
+                                              PTR_ERR(connector_state));
+                                continue;
+                        }
+                        connector_state->crtc = crtc;
+                        connector_state->best_encoder = &encoder->base;
+                }
+        }
+        intel_set_mode(crtc, &crtc->mode, crtc->x, crtc->y, crtc->primary->fb,
+                       state);
+        drm_atomic_state_free(state);
 }
 #undef for_each_intel_crtc_masked
@@ -11520,9 +11875,11 @@ intel_set_config_compute_mode_changes(struct drm_mode_set *set,
 static int
 intel_modeset_stage_output_state(struct drm_device *dev,
                                 struct drm_mode_set *set,
-                                 struct intel_set_config *config)
+                                 struct intel_set_config *config,
+                                 struct drm_atomic_state *state)
 {
        struct intel_connector *connector;
+        struct drm_connector_state *connector_state;
        struct intel_encoder *encoder;
        struct intel_crtc *crtc;
        int ro;
@@ -11586,6 +11943,14 @@ intel_modeset_stage_output_state(struct drm_device *dev,
                }
                connector->new_encoder->new_crtc = to_intel_crtc(new_crtc);
+                connector_state =
+                        drm_atomic_get_connector_state(state, &connector->base);
+                if (IS_ERR(connector_state))
+                        return PTR_ERR(connector_state);
+                connector_state->crtc = new_crtc;
+                connector_state->best_encoder = &connector->new_encoder->base;
                DRM_DEBUG_KMS("[CONNECTOR:%d:%s] to [CRTC:%d]\n",
                        connector->base.base.id,
                        connector->base.name,
@@ -11618,9 +11983,17 @@ intel_modeset_stage_output_state(struct drm_device *dev,
        }
        /* Now we've also updated encoder->new_crtc for all encoders. */
        for_each_intel_connector(dev, connector) {
-                if (connector->new_encoder)
+                connector_state =
+                        drm_atomic_get_connector_state(state, &connector->base);
+                if (IS_ERR(connector_state))
+                        return PTR_ERR(connector_state);
+                if (connector->new_encoder) {
                        if (connector->new_encoder != connector->encoder)
                                connector->encoder = connector->new_encoder;
+                } else {
+                        connector_state->crtc = NULL;
+                }
        }
        for_each_intel_crtc(dev, crtc) {
                crtc->new_enabled = false;
@@ -11676,6 +12049,7 @@ static int intel_crtc_set_config(struct drm_mode_set *set)
 {
        struct drm_device *dev;
        struct drm_mode_set save_set;
+        struct drm_atomic_state *state = NULL;
        struct intel_set_config *config;
        struct intel_crtc_state *pipe_config;
        unsigned modeset_pipes, prepare_pipes, disable_pipes;
@@ -11720,12 +12094,20 @@ static int intel_crtc_set_config(struct drm_mode_set *set)
         * such cases. */
        intel_set_config_compute_mode_changes(set, config);
-        ret = intel_modeset_stage_output_state(dev, set, config);
+        state = drm_atomic_state_alloc(dev);
+        if (!state) {
+                ret = -ENOMEM;
+                goto out_config;
+        }
+        state->acquire_ctx = dev->mode_config.acquire_ctx;
+        ret = intel_modeset_stage_output_state(dev, set, config, state);
        if (ret)
                goto fail;
        pipe_config = intel_modeset_compute_config(set->crtc, set->mode,
-                                                   set->fb,
+                                                   set->fb, state,
                                                   &modeset_pipes,
                                                   &prepare_pipes,
                                                   &disable_pipes);
@@ -11745,10 +12127,6 @@ static int intel_crtc_set_config(struct drm_mode_set *set)
                 */
        }
-        /* set_mode will free it in the mode_changed case */
-        if (!config->mode_changed)
-                kfree(pipe_config);
        intel_update_pipe_size(to_intel_crtc(set->crtc));
        if (config->mode_changed) {
@@ -11794,6 +12172,8 @@ static int intel_crtc_set_config(struct drm_mode_set *set)
 fail:
                intel_set_config_restore_state(dev, config);
+                drm_atomic_state_clear(state);
                /*
                 * HACK: if the pipe was on, but we didn't have a framebuffer,
                 * force the pipe off to avoid oopsing in the modeset code
@@ -11806,11 +12186,15 @@ fail:
                /* Try to restore the config */
                if (config->mode_changed &&
                    intel_set_mode(save_set.crtc, save_set.mode,
-                                   save_set.x, save_set.y, save_set.fb))
+                                   save_set.x, save_set.y, save_set.fb,
+                                   state))
                        DRM_ERROR("failed to restore config after modeset failure\n");
        }
 out_config:
+        if (state)
+                drm_atomic_state_free(state);
        intel_set_config_free(config);
        return ret;
 }
@@ -11925,6 +12309,28 @@ static void intel_shared_dpll_init(struct drm_device *dev)
 }
 /**
+ * intel_wm_need_update - Check whether watermarks need updating
+ * @plane: drm plane
+ * @state: new plane state
+ *
+ * Check current plane state versus the new one to determine whether
+ * watermarks need to be recalculated.
+ *
+ * Returns true or false.
+ */
+bool intel_wm_need_update(struct drm_plane *plane,
+                          struct drm_plane_state *state)
+{
+        /* Update watermarks on tiling changes. */
+        if (!plane->state->fb || !state->fb ||
+            plane->state->fb->modifier[0] != state->fb->modifier[0] ||
+            plane->state->rotation != state->rotation)
+                return true;
+        return false;
+}
+/**
 * intel_prepare_plane_fb - Prepare fb for usage on plane
 * @plane: drm plane to prepare for
 * @fb: framebuffer to prepare for presentation
@@ -11973,7 +12379,7 @@ intel_prepare_plane_fb(struct drm_plane *plane,
                if (ret)
                        DRM_DEBUG_KMS("failed to attach phys object\n");
        } else {
-                ret = intel_pin_and_fence_fb_obj(plane, fb, NULL);
+                ret = intel_pin_and_fence_fb_obj(plane, fb, new_state, NULL);
        }
        if (ret == 0)
@@ -12005,7 +12411,7 @@ intel_cleanup_plane_fb(struct drm_plane *plane,
        if (plane->type != DRM_PLANE_TYPE_CURSOR ||
            !INTEL_INFO(dev)->cursor_needs_physical) {
                mutex_lock(&dev->struct_mutex);
-                intel_unpin_fb_obj(obj);
+                intel_unpin_fb_obj(fb, old_state);
                mutex_unlock(&dev->struct_mutex);
        }
 }
@@ -12070,10 +12476,7 @@ intel_check_primary_plane(struct drm_plane *plane,
                intel_crtc->atomic.update_fbc = true;
-                /* Update watermarks on tiling changes. */
+                if (intel_wm_need_update(plane, &state->base))
-                if (!plane->state->fb || !state->base.fb ||
-                    plane->state->fb->modifier[0] !=
-                    state->base.fb->modifier[0])
                        intel_crtc->atomic.update_wm = true;
        }
@@ -12089,8 +12492,6 @@ intel_commit_primary_plane(struct drm_plane *plane,
        struct drm_device *dev = plane->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_crtc *intel_crtc;
-        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
-        struct intel_plane *intel_plane = to_intel_plane(plane);
        struct drm_rect *src = &state->src;
        crtc = crtc ? crtc : plane->crtc;
@@ -12100,8 +12501,6 @@ intel_commit_primary_plane(struct drm_plane *plane,
        crtc->x = src->x1 >> 16;
        crtc->y = src->y1 >> 16;
-        intel_plane->obj = obj;
        if (intel_crtc->active) {
                if (state->visible) {
                        /* FIXME: kill this fastboot hack */
@@ -12365,7 +12764,6 @@ intel_commit_cursor_plane(struct drm_plane *plane,
        struct drm_crtc *crtc = state->base.crtc;
        struct drm_device *dev = plane->dev;
        struct intel_crtc *intel_crtc;
-        struct intel_plane *intel_plane = to_intel_plane(plane);
        struct drm_i915_gem_object *obj = intel_fb_obj(state->base.fb);
        uint32_t addr;
@@ -12376,8 +12774,6 @@ intel_commit_cursor_plane(struct drm_plane *plane,
        crtc->cursor_x = state->base.crtc_x;
        crtc->cursor_y = state->base.crtc_y;
-        intel_plane->obj = obj;
        if (intel_crtc->cursor_bo == obj)
                goto update;
@@ -12758,19 +13154,21 @@ static void intel_setup_outputs(struct drm_device *dev)
         * testing/debug of the plane operations (and only when a specific
         * kernel module option is given), that shouldn't really matter.
         *
+         * We are also relying on these states to convert the legacy mode set
+         * to use a drm_atomic_state struct. The states are kept consistent
+         * with actual state, so that it is safe to rely on that instead of
+         * the staged config.
+         *
         * Once atomic support for crtc's + connectors lands, this loop should
         * be removed since we'll be setting up real connector state, which
         * will contain Intel-specific properties.
         */
-        if (drm_core_check_feature(dev, DRIVER_ATOMIC)) {
+        list_for_each_entry(connector,
-                list_for_each_entry(connector,
+                            &dev->mode_config.connector_list,
-                                    &dev->mode_config.connector_list,
+                            head) {
-                                    head) {
+                if (!WARN_ON(connector->state)) {
-                        if (!WARN_ON(connector->state)) {
+                        connector->state = kzalloc(sizeof(*connector->state),
-                                connector->state =
+                                                   GFP_KERNEL);
-                                        kzalloc(sizeof(*connector->state),
-                                                GFP_KERNEL);
-                        }
                }
        }
@@ -12849,7 +13247,7 @@ static int intel_framebuffer_init(struct drm_device *dev,
                                  struct drm_mode_fb_cmd2 *mode_cmd,
                                  struct drm_i915_gem_object *obj)
 {
-        int aligned_height;
+        unsigned int aligned_height;
        int ret;
        u32 pitch_limit, stride_alignment;
@@ -12885,8 +13283,8 @@ static int intel_framebuffer_init(struct drm_device *dev,
        case I915_FORMAT_MOD_X_TILED:
                break;
        default:
-                DRM_ERROR("Unsupported fb modifier 0x%llx!\n",
+                DRM_DEBUG("Unsupported fb modifier 0x%llx!\n",
-                                mode_cmd->modifier[0]);
+                          mode_cmd->modifier[0]);
                return -EINVAL;
        }
@@ -13453,7 +13851,7 @@ void intel_modeset_init(struct drm_device *dev)
                         * If the fb is shared between multiple heads, we'll
                         * just get the first one.
                         */
-                        intel_find_plane_obj(crtc, &crtc->plane_config);
+                        intel_find_initial_plane_obj(crtc, &crtc->plane_config);
                }
        }
 }
@@ -13479,7 +13877,7 @@ static void intel_enable_pipe_a(struct drm_device *dev)
                return;
        if (intel_get_load_detect_pipe(crt, NULL, &load_detect_temp, ctx))
-                intel_release_load_detect_pipe(crt, &load_detect_temp);
+                intel_release_load_detect_pipe(crt, &load_detect_temp, ctx);
 }
 static bool
@@ -13823,6 +14221,8 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
                                       "[setup_hw_state]");
        }
+        intel_modeset_update_connector_atomic_state(dev);
        for (i = 0; i < dev_priv->num_shared_dpll; i++) {
                struct intel_shared_dpll *pll = &dev_priv->shared_dplls[i];
@@ -13851,8 +14251,7 @@ void intel_modeset_setup_hw_state(struct drm_device *dev,
                        struct drm_crtc *crtc =
                                dev_priv->pipe_to_crtc_mapping[pipe];
-                        intel_set_mode(crtc, &crtc->mode, crtc->x, crtc->y,
+                        intel_crtc_restore_mode(crtc);
-                                       crtc->primary->fb);
                }
        } else {
                intel_modeset_update_staged_output_state(dev);
@@ -13898,6 +14297,7 @@ void intel_modeset_gem_init(struct drm_device *dev)
                if (intel_pin_and_fence_fb_obj(c->primary,
                                               c->primary->fb,
+                                               c->primary->state,
                                               NULL)) {
                        DRM_ERROR("failed to pin boot fb on pipe %d\n",
                                  to_intel_crtc(c)->pipe);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index ca60060710d2..b70e635ccaf4 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -85,10 +85,12 @@ static const struct dp_link_dpll chv_dpll[] = {
                { .p1 = 2, .p2 = 1, .n = 1, .m1 = 2, .m2 = 0x6c00000 } }
 };
 /* Skylake supports following rates */
-static const uint32_t gen9_rates[] = { 162000, 216000, 270000, 324000,
+static const int gen9_rates[] = { 162000, 216000, 270000,
-                                        432000, 540000 };
+                                  324000, 432000, 540000 };
+static const int chv_rates[] = { 162000, 202500, 210000, 216000,
-static const uint32_t default_rates[] = { 162000, 270000, 540000 };
+                                 243000, 270000, 324000, 405000,
+                                 420000, 432000, 540000 };
+static const int default_rates[] = { 162000, 270000, 540000 };
 /**
 * is_edp - is the given port attached to an eDP panel (either CPU or PCH)
@@ -123,26 +125,15 @@ static void vlv_init_panel_power_sequencer(struct intel_dp *intel_dp);
 static void vlv_steal_power_sequencer(struct drm_device *dev,
                                      enum pipe pipe);
-int
+static int
-intel_dp_max_link_bw(struct intel_dp *intel_dp)
+intel_dp_max_link_bw(struct intel_dp  *intel_dp)
 {
        int max_link_bw = intel_dp->dpcd[DP_MAX_LINK_RATE];
-        struct drm_device *dev = intel_dp->attached_connector->base.dev;
        switch (max_link_bw) {
        case DP_LINK_BW_1_62:
        case DP_LINK_BW_2_7:
-                break;
+        case DP_LINK_BW_5_4:
-        case DP_LINK_BW_5_4: /* 1.2 capable displays may advertise higher bw */
-                if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0)
-                        /* WaDisableHBR2:skl */
-                        max_link_bw = DP_LINK_BW_2_7;
-                else if (((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) ||
-                     INTEL_INFO(dev)->gen >= 8) &&
-                    intel_dp->dpcd[DP_DPCD_REV] >= 0x12)
-                        max_link_bw = DP_LINK_BW_5_4;
-                else
-                        max_link_bw = DP_LINK_BW_2_7;
                break;
        default:
                WARN(1, "invalid max DP link bw val %x, using 1.62Gbps\n",
@@ -218,7 +209,7 @@ intel_dp_mode_valid(struct drm_connector *connector,
                target_clock = fixed_mode->clock;
        }
-        max_link_clock = drm_dp_bw_code_to_link_rate(intel_dp_max_link_bw(intel_dp));
+        max_link_clock = intel_dp_max_link_rate(intel_dp);
        max_lanes = intel_dp_max_lane_count(intel_dp);
        max_rate = intel_dp_max_data_rate(max_link_clock, max_lanes);
@@ -951,8 +942,9 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
        size_t txsize, rxsize;
        int ret;
-        txbuf[0] = msg->request << 4;
+        txbuf[0] = (msg->request << 4) |
-        txbuf[1] = msg->address >> 8;
+                ((msg->address >> 16) & 0xf);
+        txbuf[1] = (msg->address >> 8) & 0xff;
        txbuf[2] = msg->address & 0xff;
        txbuf[3] = msg->size - 1;
@@ -960,7 +952,7 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
        case DP_AUX_NATIVE_WRITE:
        case DP_AUX_I2C_WRITE:
                txsize = msg->size ? HEADER_SIZE + msg->size : BARE_ADDRESS_SIZE;
-                rxsize = 1;
+                rxsize = 2; /* 0 or 1 data bytes */
                if (WARN_ON(txsize > 20))
                        return -E2BIG;
@@ -971,8 +963,13 @@ intel_dp_aux_transfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
                if (ret > 0) {
                        msg->reply = rxbuf[0] >> 4;
-                        /* Return payload size. */
+                        if (ret > 1) {
-                        ret = msg->size;
+                                /* Number of bytes written in a short write. */
+                                ret = clamp_t(int, rxbuf[1], 0, msg->size);
+                        } else {
+                                /* Return payload size. */
+                                ret = msg->size;
+                        }
                }
                break;
@@ -1142,49 +1139,39 @@ hsw_dp_set_ddi_pll_sel(struct intel_crtc_state *pipe_config, int link_bw)
 }
 static int
-intel_read_sink_rates(struct intel_dp *intel_dp, uint32_t *sink_rates)
+intel_dp_sink_rates(struct intel_dp *intel_dp, const int **sink_rates)
 {
-        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        if (intel_dp->num_sink_rates) {
-        int i = 0;
+                *sink_rates = intel_dp->sink_rates;
-        uint16_t val;
+                return intel_dp->num_sink_rates;
+        }
-        if (INTEL_INFO(dev)->gen >= 9 && intel_dp->supported_rates[0]) {
-                /*
-                 * Receiver supports only main-link rate selection by
-                 * link rate table method, so read link rates from
-                 * supported_link_rates
-                 */
-                for (i = 0; i < DP_MAX_SUPPORTED_RATES; ++i) {
-                        val = le16_to_cpu(intel_dp->supported_rates[i]);
-                        if (val == 0)
-                                break;
-                        sink_rates[i] = val * 200;
+        *sink_rates = default_rates;
-                }
-                if (i <= 0)
+        return (intel_dp_max_link_bw(intel_dp) >> 3) + 1;
-                        DRM_ERROR("No rates in SUPPORTED_LINK_RATES");
-        }
-        return i;
 }
 static int
-intel_read_source_rates(struct intel_dp *intel_dp, uint32_t *source_rates)
+intel_dp_source_rates(struct drm_device *dev, const int **source_rates)
 {
-        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        if (INTEL_INFO(dev)->gen >= 9) {
-        int i;
+                *source_rates = gen9_rates;
-        int max_default_rate;
+                return ARRAY_SIZE(gen9_rates);
+        } else if (IS_CHERRYVIEW(dev)) {
-        if (INTEL_INFO(dev)->gen >= 9 && intel_dp->supported_rates[0]) {
+                *source_rates = chv_rates;
-                for (i = 0; i < ARRAY_SIZE(gen9_rates); ++i)
+                return ARRAY_SIZE(chv_rates);
-                        source_rates[i] = gen9_rates[i];
-        } else {
-                /* Index of the max_link_bw supported + 1 */
-                max_default_rate = (intel_dp_max_link_bw(intel_dp) >> 3) + 1;
-                for (i = 0; i < max_default_rate; ++i)
-                        source_rates[i] = default_rates[i];
        }
-        return i;
+        *source_rates = default_rates;
+        if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0)
+                /* WaDisableHBR2:skl */
+                return (DP_LINK_BW_2_7 >> 3) + 1;
+        else if (INTEL_INFO(dev)->gen >= 8 ||
+            (IS_HASWELL(dev) && !IS_HSW_ULX(dev)))
+                return (DP_LINK_BW_5_4 >> 3) + 1;
+        else
+                return (DP_LINK_BW_2_7 >> 3) + 1;
 }
 static void
@@ -1220,22 +1207,17 @@ intel_dp_set_clock(struct intel_encoder *encoder,
        }
 }
-static int intel_supported_rates(const uint32_t *source_rates, int source_len,
+static int intersect_rates(const int *source_rates, int source_len,
-const uint32_t *sink_rates, int sink_len, uint32_t *supported_rates)
+                           const int *sink_rates, int sink_len,
+                           int *common_rates)
 {
        int i = 0, j = 0, k = 0;
-        /* For panels with edp version less than 1.4 */
-        if (sink_len == 0) {
-                for (i = 0; i < source_len; ++i)
-                        supported_rates[i] = source_rates[i];
-                return source_len;
-        }
-        /* For edp1.4 panels, find the common rates between source and sink */
        while (i < source_len && j < sink_len) {
                if (source_rates[i] == sink_rates[j]) {
-                        supported_rates[k] = source_rates[i];
+                        if (WARN_ON(k >= DP_MAX_SUPPORTED_RATES))
+                                return k;
+                        common_rates[k] = source_rates[i];
                        ++k;
                        ++i;
                        ++j;
@@ -1248,7 +1230,62 @@ const uint32_t *sink_rates, int sink_len, uint32_t *supported_rates)
        return k;
 }
-static int rate_to_index(uint32_t find, const uint32_t *rates)
+static int intel_dp_common_rates(struct intel_dp *intel_dp,
+                                 int *common_rates)
+{
+        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        const int *source_rates, *sink_rates;
+        int source_len, sink_len;
+        sink_len = intel_dp_sink_rates(intel_dp, &sink_rates);
+        source_len = intel_dp_source_rates(dev, &source_rates);
+        return intersect_rates(source_rates, source_len,
+                               sink_rates, sink_len,
+                               common_rates);
+}
+static void snprintf_int_array(char *str, size_t len,
+                               const int *array, int nelem)
+{
+        int i;
+        str[0] = '\0';
+        for (i = 0; i < nelem; i++) {
+                int r = snprintf(str, len, "%d,", array[i]);
+                if (r >= len)
+                        return;
+                str += r;
+                len -= r;
+        }
+}
+static void intel_dp_print_rates(struct intel_dp *intel_dp)
+{
+        struct drm_device *dev = intel_dp_to_dev(intel_dp);
+        const int *source_rates, *sink_rates;
+        int source_len, sink_len, common_len;
+        int common_rates[DP_MAX_SUPPORTED_RATES];
+        char str[128]; /* FIXME: too big for stack? */
+        if ((drm_debug & DRM_UT_KMS) == 0)
+                return;
+        source_len = intel_dp_source_rates(dev, &source_rates);
+        snprintf_int_array(str, sizeof(str), source_rates, source_len);
+        DRM_DEBUG_KMS("source rates: %s\n", str);
+        sink_len = intel_dp_sink_rates(intel_dp, &sink_rates);
+        snprintf_int_array(str, sizeof(str), sink_rates, sink_len);
+        DRM_DEBUG_KMS("sink rates: %s\n", str);
+        common_len = intel_dp_common_rates(intel_dp, common_rates);
+        snprintf_int_array(str, sizeof(str), common_rates, common_len);
+        DRM_DEBUG_KMS("common rates: %s\n", str);
+}
+static int rate_to_index(int find, const int *rates)
 {
        int i = 0;
@@ -1259,6 +1296,24 @@ static int rate_to_index(uint32_t find, const uint32_t *rates)
        return i;
 }
+int
+intel_dp_max_link_rate(struct intel_dp *intel_dp)
+{
+        int rates[DP_MAX_SUPPORTED_RATES] = {};
+        int len;
+        len = intel_dp_common_rates(intel_dp, rates);
+        if (WARN_ON(len <= 0))
+                return 162000;
+        return rates[rate_to_index(0, rates) - 1];
+}
+int intel_dp_rate_select(struct intel_dp *intel_dp, int rate)
+{
+        return rate_to_index(rate, intel_dp->sink_rates);
+}
 bool
 intel_dp_compute_config(struct intel_encoder *encoder,
                        struct intel_crtc_state *pipe_config)
@@ -1268,7 +1323,7 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
        struct intel_dp *intel_dp = enc_to_intel_dp(&encoder->base);
        enum port port = dp_to_dig_port(intel_dp)->port;
-        struct intel_crtc *intel_crtc = encoder->new_crtc;
+        struct intel_crtc *intel_crtc = to_intel_crtc(pipe_config->base.crtc);
        struct intel_connector *intel_connector = intel_dp->attached_connector;
        int lane_count, clock;
        int min_lane_count = 1;
@@ -1278,22 +1333,15 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        int max_clock;
        int bpp, mode_rate;
        int link_avail, link_clock;
-        uint32_t sink_rates[8];
+        int common_rates[DP_MAX_SUPPORTED_RATES] = {};
-        uint32_t supported_rates[8] = {0};
+        int common_len;
-        uint32_t source_rates[8];
-        int source_len, sink_len, supported_len;
-        sink_len = intel_read_sink_rates(intel_dp, sink_rates);
-        source_len = intel_read_source_rates(intel_dp, source_rates);
+        common_len = intel_dp_common_rates(intel_dp, common_rates);
-        supported_len = intel_supported_rates(source_rates, source_len,
-                                sink_rates, sink_len, supported_rates);
        /* No common link rates between source and sink */
-        WARN_ON(supported_len <= 0);
+        WARN_ON(common_len <= 0);
-        max_clock = supported_len - 1;
+        max_clock = common_len - 1;
        if (HAS_PCH_SPLIT(dev) && !HAS_DDI(dev) && port != PORT_A)
                pipe_config->has_pch_encoder = true;
@@ -1318,7 +1366,7 @@ intel_dp_compute_config(struct intel_encoder *encoder,
        DRM_DEBUG_KMS("DP link computation with max lane count %i "
                      "max bw %d pixel clock %iKHz\n",
-                      max_lane_count, supported_rates[max_clock],
+                      max_lane_count, common_rates[max_clock],
                      adjusted_mode->crtc_clock);
        /* Walk through all bpp values. Luckily they're all nicely spaced with 2
@@ -1351,7 +1399,7 @@ intel_dp_compute_config(struct intel_encoder *encoder,
                                lane_count <= max_lane_count;
                                lane_count <<= 1) {
-                                link_clock = supported_rates[clock];
+                                link_clock = common_rates[clock];
                                link_avail = intel_dp_max_data_rate(link_clock,
                                                                    lane_count);
@@ -1382,17 +1430,18 @@ found:
        intel_dp->lane_count = lane_count;
-        intel_dp->link_bw =
+        if (intel_dp->num_sink_rates) {
-                drm_dp_link_rate_to_bw_code(supported_rates[clock]);
-        if (INTEL_INFO(dev)->gen >= 9 && intel_dp->supported_rates[0]) {
-                intel_dp->rate_select =
-                        rate_to_index(supported_rates[clock], sink_rates);
                intel_dp->link_bw = 0;
+                intel_dp->rate_select =
+                        intel_dp_rate_select(intel_dp, common_rates[clock]);
+        } else {
+                intel_dp->link_bw =
+                        drm_dp_link_rate_to_bw_code(common_rates[clock]);
+                intel_dp->rate_select = 0;
        }
        pipe_config->pipe_bpp = bpp;
-        pipe_config->port_clock = supported_rates[clock];
+        pipe_config->port_clock = common_rates[clock];
        DRM_DEBUG_KMS("DP link bw %02x lane count %d clock %d bpp %d\n",
                      intel_dp->link_bw, intel_dp->lane_count,
@@ -1415,7 +1464,7 @@ found:
        }
        if (IS_SKYLAKE(dev) && is_edp(intel_dp))
-                skl_edp_set_pll_config(pipe_config, supported_rates[clock]);
+                skl_edp_set_pll_config(pipe_config, common_rates[clock]);
        else if (IS_HASWELL(dev) || IS_BROADWELL(dev))
                hsw_dp_set_ddi_pll_sel(pipe_config, intel_dp->link_bw);
        else
@@ -3502,7 +3551,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
        if (drm_dp_enhanced_frame_cap(intel_dp->dpcd))
                link_config[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
        drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config, 2);
-        if (INTEL_INFO(dev)->gen >= 9 && intel_dp->supported_rates[0])
+        if (intel_dp->num_sink_rates)
                drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_RATE_SET,
                                &intel_dp->rate_select, 1);
@@ -3754,11 +3803,27 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
            (intel_dp->dpcd[DP_EDP_CONFIGURATION_CAP] & DP_DPCD_DISPLAY_CONTROL_CAPABLE) &&
            (intel_dp_dpcd_read_wake(&intel_dp->aux, DP_EDP_DPCD_REV, &rev, 1) == 1) &&
            (rev >= 0x03)) { /* eDp v1.4 or higher */
+                __le16 sink_rates[DP_MAX_SUPPORTED_RATES];
+                int i;
                intel_dp_dpcd_read_wake(&intel_dp->aux,
                                DP_SUPPORTED_LINK_RATES,
-                                intel_dp->supported_rates,
+                                sink_rates,
-                                sizeof(intel_dp->supported_rates));
+                                sizeof(sink_rates));
+                for (i = 0; i < ARRAY_SIZE(sink_rates); i++) {
+                        int val = le16_to_cpu(sink_rates[i]);
+                        if (val == 0)
+                                break;
+                        intel_dp->sink_rates[i] = val * 200;
+                }
+                intel_dp->num_sink_rates = i;
        }
+        intel_dp_print_rates(intel_dp);
        if (!(intel_dp->dpcd[DP_DOWNSTREAMPORT_PRESENT] &
              DP_DWN_STRM_PORT_PRESENT))
                return true; /* native DP sink */
@@ -4548,6 +4613,7 @@ static const struct drm_connector_funcs intel_dp_connector_funcs = {
        .atomic_get_property = intel_connector_atomic_get_property,
        .destroy = intel_dp_connector_destroy,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static const struct drm_connector_helper_funcs intel_dp_connector_helper_funcs = {
@@ -4934,7 +5000,7 @@ static void intel_dp_set_drrs_state(struct drm_device *dev, int refresh_rate)
        dig_port = dp_to_dig_port(intel_dp);
        encoder = &dig_port->base;
-        intel_crtc = encoder->new_crtc;
+        intel_crtc = to_intel_crtc(encoder->base.crtc);
        if (!intel_crtc) {
                DRM_DEBUG_KMS("DRRS: intel_crtc not initialized\n");
@@ -5272,8 +5338,6 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
        struct edid *edid;
        enum pipe pipe = INVALID_PIPE;
-        dev_priv->drrs.type = DRRS_NOT_SUPPORTED;
        if (!is_edp(intel_dp))
                return true;
diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
index be124928ca14..5329c855acce 100644
--- a/drivers/gpu/drm/i915/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/intel_dp_mst.c
@@ -36,11 +36,11 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
        struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base);
        struct intel_digital_port *intel_dig_port = intel_mst->primary;
        struct intel_dp *intel_dp = &intel_dig_port->dp;
-        struct drm_device *dev = encoder->base.dev;
+        struct drm_atomic_state *state;
-        int bpp;
+        int bpp, i;
-        int lane_count, slots;
+        int lane_count, slots, rate;
        struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
-        struct intel_connector *found = NULL, *intel_connector;
+        struct intel_connector *found = NULL;
        int mst_pbn;
        pipe_config->dp_encoder_is_mst = true;
@@ -52,15 +52,30 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
         * seem to suggest we should do otherwise.
         */
        lane_count = drm_dp_max_lane_count(intel_dp->dpcd);
-        intel_dp->link_bw = intel_dp_max_link_bw(intel_dp);
+        rate = intel_dp_max_link_rate(intel_dp);
+        if (intel_dp->num_sink_rates) {
+                intel_dp->link_bw = 0;
+                intel_dp->rate_select = intel_dp_rate_select(intel_dp, rate);
+        } else {
+                intel_dp->link_bw = drm_dp_link_rate_to_bw_code(rate);
+                intel_dp->rate_select = 0;
+        }
        intel_dp->lane_count = lane_count;
        pipe_config->pipe_bpp = 24;
-        pipe_config->port_clock = drm_dp_bw_code_to_link_rate(intel_dp->link_bw);
+        pipe_config->port_clock = rate;
-        for_each_intel_connector(dev, intel_connector) {
+        state = pipe_config->base.state;
-                if (intel_connector->new_encoder == encoder) {
-                        found = intel_connector;
+        for (i = 0; i < state->num_connector; i++) {
+                if (!state->connectors[i])
+                        continue;
+                if (state->connector_states[i]->best_encoder == &encoder->base) {
+                        found = to_intel_connector(state->connectors[i]);
                        break;
                }
        }
@@ -317,6 +332,7 @@ static const struct drm_connector_funcs intel_dp_mst_connector_funcs = {
        .atomic_get_property = intel_connector_atomic_get_property,
        .destroy = intel_dp_mst_connector_destroy,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static int intel_dp_mst_get_modes(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index c77128c67cf8..6036e3b73b7b 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -35,6 +35,7 @@
 #include <drm/drm_fb_helper.h>
 #include <drm/drm_dp_mst_helper.h>
 #include <drm/drm_rect.h>
+#include <drm/drm_atomic.h>
 #define DIV_ROUND_CLOSEST_ULL(ll, d)    \
 ({ unsigned long long _tmp = (ll)+(d)/2; do_div(_tmp, d); _tmp; })
@@ -56,8 +57,8 @@
                                ret__ = -ETIMEDOUT;                     \
                        break;                                          \
                }                                                       \
-                if (W && drm_can_sleep())  {                            \
+                if ((W) && drm_can_sleep()) {                           \
-                        msleep(W);                                      \
+                        usleep_range((W)*1000, (W)*2000);               \
                } else {                                                \
                        cpu_relax();                                    \
                }                                                       \
@@ -501,16 +502,19 @@ struct intel_plane_wm_parameters {
        bool enabled;
        bool scaled;
        u64 tiling;
+        unsigned int rotation;
 };
 struct intel_plane {
        struct drm_plane base;
        int plane;
        enum pipe pipe;
-        struct drm_i915_gem_object *obj;
        bool can_scale;
        int max_downscale;
+        /* FIXME convert to properties */
+        struct drm_intel_sprite_colorkey ckey;
        /* Since we need to change the watermarks before/after
         * enabling/disabling the planes, we need to store the parameters here
         * as the other pieces of the struct may not reflect the values we want
@@ -527,7 +531,6 @@ struct intel_plane {
        void (*update_plane)(struct drm_plane *plane,
                             struct drm_crtc *crtc,
                             struct drm_framebuffer *fb,
-                             struct drm_i915_gem_object *obj,
                             int crtc_x, int crtc_y,
                             unsigned int crtc_w, unsigned int crtc_h,
                             uint32_t x, uint32_t y,
@@ -538,10 +541,6 @@ struct intel_plane {
                           struct intel_plane_state *state);
        void (*commit_plane)(struct drm_plane *plane,
                             struct intel_plane_state *state);
-        int (*update_colorkey)(struct drm_plane *plane,
-                               struct drm_intel_sprite_colorkey *key);
-        void (*get_colorkey)(struct drm_plane *plane,
-                             struct drm_intel_sprite_colorkey *key);
 };
 struct intel_watermark_params {
@@ -564,6 +563,7 @@ struct cxsr_latency {
 };
 #define to_intel_crtc(x) container_of(x, struct intel_crtc, base)
+#define to_intel_crtc_state(x) container_of(x, struct intel_crtc_state, base)
 #define to_intel_connector(x) container_of(x, struct intel_connector, base)
 #define to_intel_encoder(x) container_of(x, struct intel_encoder, base)
 #define to_intel_framebuffer(x) container_of(x, struct intel_framebuffer, base)
@@ -627,7 +627,9 @@ struct intel_dp {
        uint8_t dpcd[DP_RECEIVER_CAP_SIZE];
        uint8_t psr_dpcd[EDP_PSR_RECEIVER_CAP_SIZE];
        uint8_t downstream_ports[DP_MAX_DOWNSTREAM_PORTS];
-        __le16 supported_rates[DP_MAX_SUPPORTED_RATES];
+        /* sink rates as reported by DP_SUPPORTED_LINK_RATES */
+        uint8_t num_sink_rates;
+        int sink_rates[DP_MAX_SUPPORTED_RATES];
        struct drm_dp_aux aux;
        uint8_t train_set[4];
        int panel_power_up_delay;
@@ -902,9 +904,10 @@ void intel_frontbuffer_flip(struct drm_device *dev,
        intel_frontbuffer_flush(dev, frontbuffer_bits);
 }
-int intel_fb_align_height(struct drm_device *dev, int height,
+unsigned int intel_fb_align_height(struct drm_device *dev,
-                          uint32_t pixel_format,
+                                   unsigned int height,
-                          uint64_t fb_format_modifier);
+                                   uint32_t pixel_format,
+                                   uint64_t fb_format_modifier);
 void intel_fb_obj_flush(struct drm_i915_gem_object *obj, bool retire);
 u32 intel_fb_stride_alignment(struct drm_device *dev, uint64_t fb_modifier,
@@ -956,9 +959,11 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
                                struct intel_load_detect_pipe *old,
                                struct drm_modeset_acquire_ctx *ctx);
 void intel_release_load_detect_pipe(struct drm_connector *connector,
-                                    struct intel_load_detect_pipe *old);
+                                    struct intel_load_detect_pipe *old,
+                                    struct drm_modeset_acquire_ctx *ctx);
 int intel_pin_and_fence_fb_obj(struct drm_plane *plane,
                               struct drm_framebuffer *fb,
+                               const struct drm_plane_state *plane_state,
                               struct intel_engine_cs *pipelined);
 struct drm_framebuffer *
 __intel_framebuffer_create(struct drm_device *dev,
@@ -983,6 +988,19 @@ int intel_plane_atomic_set_property(struct drm_plane *plane,
                                    struct drm_property *property,
                                    uint64_t val);
+unsigned int
+intel_tile_height(struct drm_device *dev, uint32_t pixel_format,
+                  uint64_t fb_format_modifier);
+static inline bool
+intel_rotation_90_or_270(unsigned int rotation)
+{
+        return rotation & (BIT(DRM_ROTATE_90) | BIT(DRM_ROTATE_270));
+}
+bool intel_wm_need_update(struct drm_plane *plane,
+                          struct drm_plane_state *state);
 /* shared dpll functions */
 struct intel_shared_dpll *intel_crtc_to_shared_dpll(struct intel_crtc *crtc);
 void assert_shared_dpll(struct drm_i915_private *dev_priv,
@@ -1037,6 +1055,9 @@ void intel_mode_from_pipe_config(struct drm_display_mode *mode,
 void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc);
 void intel_modeset_preclose(struct drm_device *dev, struct drm_file *file);
+unsigned long intel_plane_obj_offset(struct intel_plane *intel_plane,
+                                     struct drm_i915_gem_object *obj);
 /* intel_dp.c */
 void intel_dp_init(struct drm_device *dev, int output_reg, enum port port);
 bool intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
@@ -1060,7 +1081,8 @@ void intel_edp_panel_off(struct intel_dp *intel_dp);
 void intel_dp_add_properties(struct intel_dp *intel_dp, struct drm_connector *connector);
 void intel_dp_mst_suspend(struct drm_device *dev);
 void intel_dp_mst_resume(struct drm_device *dev);
-int intel_dp_max_link_bw(struct intel_dp *intel_dp);
+int intel_dp_max_link_rate(struct intel_dp *intel_dp);
+int intel_dp_rate_select(struct intel_dp *intel_dp, int rate);
 void intel_dp_hot_plug(struct intel_encoder *intel_encoder);
 void vlv_power_sequencer_reset(struct drm_i915_private *dev_priv);
 uint32_t intel_dp_pack_aux(const uint8_t *src, int src_bytes);
@@ -1239,6 +1261,8 @@ void intel_disable_gt_powersave(struct drm_device *dev);
 void intel_suspend_gt_powersave(struct drm_device *dev);
 void intel_reset_gt_powersave(struct drm_device *dev);
 void gen6_update_ring_freq(struct drm_device *dev);
+void gen6_rps_busy(struct drm_i915_private *dev_priv);
+void gen6_rps_reset_ei(struct drm_i915_private *dev_priv);
 void gen6_rps_idle(struct drm_i915_private *dev_priv);
 void gen6_rps_boost(struct drm_i915_private *dev_priv);
 void ilk_wm_get_hw_state(struct drm_device *dev);
@@ -1258,8 +1282,6 @@ void intel_flush_primary_plane(struct drm_i915_private *dev_priv,
 int intel_plane_restore(struct drm_plane *plane);
 int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
                              struct drm_file *file_priv);
-int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
-                              struct drm_file *file_priv);
 bool intel_pipe_update_start(struct intel_crtc *crtc,
                             uint32_t *start_vbl_count);
 void intel_pipe_update_end(struct intel_crtc *crtc, u32 start_vbl_count);
@@ -1282,6 +1304,17 @@ int intel_connector_atomic_get_property(struct drm_connector *connector,
 struct drm_crtc_state *intel_crtc_duplicate_state(struct drm_crtc *crtc);
 void intel_crtc_destroy_state(struct drm_crtc *crtc,
                               struct drm_crtc_state *state);
+static inline struct intel_crtc_state *
+intel_atomic_get_crtc_state(struct drm_atomic_state *state,
+                            struct intel_crtc *crtc)
+{
+        struct drm_crtc_state *crtc_state;
+        crtc_state = drm_atomic_get_crtc_state(state, &crtc->base);
+        if (IS_ERR(crtc_state))
+                return ERR_PTR(PTR_ERR(crtc_state));
+        return to_intel_crtc_state(crtc_state);
+}
 /* intel_atomic_plane.c */
 struct intel_plane_state *intel_create_plane_state(struct drm_plane *plane);
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index c8c8b24e300c..572251e9810b 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -975,6 +975,7 @@ static const struct drm_connector_funcs intel_dsi_connector_funcs = {
        .fill_modes = drm_helper_probe_single_connector_modes,
        .atomic_get_property = intel_connector_atomic_get_property,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 void intel_dsi_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index d8579510beb0..4ccd6c3f133d 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -393,6 +393,7 @@ static const struct drm_connector_funcs intel_dvo_connector_funcs = {
        .fill_modes = drm_helper_probe_single_connector_modes,
        .atomic_get_property = intel_connector_atomic_get_property,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static const struct drm_connector_helper_funcs intel_dvo_connector_helper_funcs = {
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index 9fcf446e95f5..4165ce0644f7 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -521,7 +521,7 @@ void intel_fbc_update(struct drm_device *dev)
                goto out_disable;
        }
-        if (!i915.enable_fbc || !i915.powersave) {
+        if (!i915.enable_fbc) {
                if (set_no_fbc_reason(dev_priv, FBC_MODULE_PARAM))
                        DRM_DEBUG_KMS("fbc disabled per module param\n");
                goto out_disable;
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 757c0d216f80..4e7e7da2e03b 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -151,7 +151,7 @@ static int intelfb_alloc(struct drm_fb_helper *helper,
        }
        /* Flush everything out, we'll be doing GTT only from now on */
-        ret = intel_pin_and_fence_fb_obj(NULL, fb, NULL);
+        ret = intel_pin_and_fence_fb_obj(NULL, fb, NULL, NULL);
        if (ret) {
                DRM_ERROR("failed to pin obj: %d\n", ret);
                goto out_fb;
diff --git a/drivers/gpu/drm/i915/intel_frontbuffer.c b/drivers/gpu/drm/i915/intel_frontbuffer.c
index 0a1bac8ac72b..a20cffb78c0f 100644
--- a/drivers/gpu/drm/i915/intel_frontbuffer.c
+++ b/drivers/gpu/drm/i915/intel_frontbuffer.c
@@ -110,9 +110,6 @@ static void intel_mark_fb_busy(struct drm_device *dev,
        struct drm_i915_private *dev_priv = dev->dev_private;
        enum pipe pipe;
-        if (!i915.powersave)
-                return;
        for_each_pipe(dev_priv, pipe) {
                if (!(frontbuffer_bits & INTEL_FRONTBUFFER_ALL_MASK(pipe)))
                        continue;
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 995c5b261f4f..cacbafdad3ab 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -951,19 +951,30 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
        return MODE_OK;
 }
-static bool hdmi_12bpc_possible(struct intel_crtc *crtc)
+static bool hdmi_12bpc_possible(struct intel_crtc_state *crtc_state)
 {
-        struct drm_device *dev = crtc->base.dev;
+        struct drm_device *dev = crtc_state->base.crtc->dev;
+        struct drm_atomic_state *state;
        struct intel_encoder *encoder;
+        struct drm_connector_state *connector_state;
        int count = 0, count_hdmi = 0;
+        int i;
        if (HAS_GMCH_DISPLAY(dev))
                return false;
-        for_each_intel_encoder(dev, encoder) {
+        state = crtc_state->base.state;
-                if (encoder->new_crtc != crtc)
+        for (i = 0; i < state->num_connector; i++) {
+                if (!state->connectors[i])
                        continue;
+                connector_state = state->connector_states[i];
+                if (connector_state->crtc != crtc_state->base.crtc)
+                        continue;
+                encoder = to_intel_encoder(connector_state->best_encoder);
                count_hdmi += encoder->type == INTEL_OUTPUT_HDMI;
                count++;
        }
@@ -1020,7 +1031,7 @@ bool intel_hdmi_compute_config(struct intel_encoder *encoder,
         */
        if (pipe_config->pipe_bpp > 8*3 && pipe_config->has_hdmi_sink &&
            clock_12bpc <= portclock_limit &&
-            hdmi_12bpc_possible(encoder->new_crtc)) {
+            hdmi_12bpc_possible(pipe_config)) {
                DRM_DEBUG_KMS("picking bpc to 12 for HDMI output\n");
                desired_bpp = 12*3;
@@ -1618,6 +1629,7 @@ static const struct drm_connector_funcs intel_hdmi_connector_funcs = {
        .atomic_get_property = intel_connector_atomic_get_property,
        .destroy = intel_hdmi_destroy,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static const struct drm_connector_helper_funcs intel_hdmi_connector_helper_funcs = {
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 24e8730dc189..06d2da336f7c 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -286,7 +286,7 @@ static bool intel_lvds_compute_config(struct intel_encoder *intel_encoder,
        struct intel_connector *intel_connector =
                &lvds_encoder->attached_connector->base;
        struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
-        struct intel_crtc *intel_crtc = lvds_encoder->base.new_crtc;
+        struct intel_crtc *intel_crtc = to_intel_crtc(pipe_config->base.crtc);
        unsigned int lvds_bpp;
        /* Should never happen!! */
@@ -535,6 +535,7 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = {
        .atomic_get_property = intel_connector_atomic_get_property,
        .destroy = intel_lvds_destroy,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index 823d1d97a000..dd92122ed95c 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -720,7 +720,8 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
        if (ret != 0)
                return ret;
-        ret = i915_gem_object_pin_to_display_plane(new_bo, 0, NULL);
+        ret = i915_gem_object_pin_to_display_plane(new_bo, 0, NULL,
+                                                   &i915_ggtt_view_normal);
        if (ret != 0)
                return ret;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 288c9d24098e..fa4ccb346389 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2840,6 +2840,7 @@ static void skl_compute_wm_pipe_parameters(struct drm_crtc *crtc,
                }
                p->plane[0].horiz_pixels = intel_crtc->config->pipe_src_w;
                p->plane[0].vert_pixels = intel_crtc->config->pipe_src_h;
+                p->plane[0].rotation = crtc->primary->state->rotation;
                fb = crtc->cursor->state->fb;
                if (fb) {
@@ -2897,7 +2898,21 @@ static bool skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
        if (p_params->tiling == I915_FORMAT_MOD_Y_TILED ||
            p_params->tiling == I915_FORMAT_MOD_Yf_TILED) {
-                uint32_t y_tile_minimum = plane_blocks_per_line * 4;
+                uint32_t min_scanlines = 4;
+                uint32_t y_tile_minimum;
+                if (intel_rotation_90_or_270(p_params->rotation)) {
+                        switch (p_params->bytes_per_pixel) {
+                        case 1:
+                                min_scanlines = 16;
+                                break;
+                        case 2:
+                                min_scanlines = 8;
+                                break;
+                        case 8:
+                                WARN(1, "Unsupported pixel depth for rotation");
+                        }
+                }
+                y_tile_minimum = plane_blocks_per_line * min_scanlines;
                selected_result = max(method2, y_tile_minimum);
        } else {
                if ((ddb_allocation / plane_blocks_per_line) >= 1)
@@ -3357,6 +3372,7 @@ skl_update_sprite_wm(struct drm_plane *plane, struct drm_crtc *crtc,
         */
        if (fb)
                intel_plane->wm.tiling = fb->modifier[0];
+        intel_plane->wm.rotation = plane->state->rotation;
        skl_update_wm(crtc);
 }
@@ -3855,9 +3871,9 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
                break;
        }
        /* Max/min bins are special */
-        if (val == dev_priv->rps.min_freq_softlimit)
+        if (val <= dev_priv->rps.min_freq_softlimit)
                new_power = LOW_POWER;
-        if (val == dev_priv->rps.max_freq_softlimit)
+        if (val >= dev_priv->rps.max_freq_softlimit)
                new_power = HIGH_POWER;
        if (new_power == dev_priv->rps.power)
                return;
@@ -3922,11 +3938,10 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
        u32 mask = 0;
        if (val > dev_priv->rps.min_freq_softlimit)
-                mask |= GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
+                mask |= GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
        if (val < dev_priv->rps.max_freq_softlimit)
-                mask |= GEN6_PM_RP_UP_THRESHOLD;
+                mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_UP_THRESHOLD;
-        mask |= dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED);
        mask &= dev_priv->pm_rps_events;
        return gen6_sanitize_rps_pm_mask(dev_priv, ~mask);
@@ -3940,8 +3955,8 @@ static void gen6_set_rps(struct drm_device *dev, u8 val)
        struct drm_i915_private *dev_priv = dev->dev_private;
        WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
-        WARN_ON(val > dev_priv->rps.max_freq_softlimit);
+        WARN_ON(val > dev_priv->rps.max_freq);
-        WARN_ON(val < dev_priv->rps.min_freq_softlimit);
+        WARN_ON(val < dev_priv->rps.min_freq);
        /* min/max delay may still have been modified so be sure to
         * write the limits value.
@@ -3979,8 +3994,8 @@ static void valleyview_set_rps(struct drm_device *dev, u8 val)
        struct drm_i915_private *dev_priv = dev->dev_private;
        WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
-        WARN_ON(val > dev_priv->rps.max_freq_softlimit);
+        WARN_ON(val > dev_priv->rps.max_freq);
-        WARN_ON(val < dev_priv->rps.min_freq_softlimit);
+        WARN_ON(val < dev_priv->rps.min_freq);
        if (WARN_ONCE(IS_CHERRYVIEW(dev) && (val & 1),
                      "Odd GPU freq value\n"))
@@ -4007,10 +4022,11 @@ static void valleyview_set_rps(struct drm_device *dev, u8 val)
 static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
 {
        struct drm_device *dev = dev_priv->dev;
+        u32 val = dev_priv->rps.idle_freq;
        /* CHV and latest VLV don't need to force the gfx clock */
        if (IS_CHERRYVIEW(dev) || dev->pdev->revision >= 0xd) {
-                valleyview_set_rps(dev_priv->dev, dev_priv->rps.min_freq_softlimit);
+                valleyview_set_rps(dev_priv->dev, val);
                return;
        }
@@ -4018,7 +4034,7 @@ static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
         * When we are idle.  Drop to min voltage state.
         */
-        if (dev_priv->rps.cur_freq <= dev_priv->rps.min_freq_softlimit)
+        if (dev_priv->rps.cur_freq <= val)
                return;
        /* Mask turbo interrupt so that they will not come in between */
@@ -4027,10 +4043,9 @@ static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
        vlv_force_gfx_clock(dev_priv, true);
-        dev_priv->rps.cur_freq = dev_priv->rps.min_freq_softlimit;
+        dev_priv->rps.cur_freq = val;
-        vlv_punit_write(dev_priv, PUNIT_REG_GPU_FREQ_REQ,
+        vlv_punit_write(dev_priv, PUNIT_REG_GPU_FREQ_REQ, val);
-                                        dev_priv->rps.min_freq_softlimit);
        if (wait_for(((vlv_punit_read(dev_priv, PUNIT_REG_GPU_FREQ_STS))
                                & GENFREQSTATUS) == 0, 100))
@@ -4038,8 +4053,19 @@ static void vlv_set_rps_idle(struct drm_i915_private *dev_priv)
        vlv_force_gfx_clock(dev_priv, false);
-        I915_WRITE(GEN6_PMINTRMSK,
+        I915_WRITE(GEN6_PMINTRMSK, gen6_rps_pm_mask(dev_priv, val));
-                   gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
+}
+void gen6_rps_busy(struct drm_i915_private *dev_priv)
+{
+        mutex_lock(&dev_priv->rps.hw_lock);
+        if (dev_priv->rps.enabled) {
+                if (dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED))
+                        gen6_rps_reset_ei(dev_priv);
+                I915_WRITE(GEN6_PMINTRMSK,
+                           gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
+        }
+        mutex_unlock(&dev_priv->rps.hw_lock);
 }
 void gen6_rps_idle(struct drm_i915_private *dev_priv)
@@ -4051,17 +4077,23 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv)
                if (IS_VALLEYVIEW(dev))
                        vlv_set_rps_idle(dev_priv);
                else
-                        gen6_set_rps(dev_priv->dev, dev_priv->rps.min_freq_softlimit);
+                        gen6_set_rps(dev_priv->dev, dev_priv->rps.idle_freq);
                dev_priv->rps.last_adj = 0;
+                I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
        }
        mutex_unlock(&dev_priv->rps.hw_lock);
 }
 void gen6_rps_boost(struct drm_i915_private *dev_priv)
 {
+        u32 val;
        mutex_lock(&dev_priv->rps.hw_lock);
-        if (dev_priv->rps.enabled) {
+        val = dev_priv->rps.max_freq_softlimit;
-                intel_set_rps(dev_priv->dev, dev_priv->rps.max_freq_softlimit);
+        if (dev_priv->rps.enabled &&
+            dev_priv->mm.busy &&
+            dev_priv->rps.cur_freq < val) {
+                intel_set_rps(dev_priv->dev, val);
                dev_priv->rps.last_adj = 0;
        }
        mutex_unlock(&dev_priv->rps.hw_lock);
@@ -4209,6 +4241,8 @@ static void gen6_init_rps_frequencies(struct drm_device *dev)
                                        dev_priv->rps.max_freq);
        }
+        dev_priv->rps.idle_freq = dev_priv->rps.min_freq;
        /* Preserve min/max settings in case of re-init */
        if (dev_priv->rps.max_freq_softlimit == 0)
                dev_priv->rps.max_freq_softlimit = dev_priv->rps.max_freq;
@@ -4375,7 +4409,7 @@ static void gen8_enable_rps(struct drm_device *dev)
        /* 6: Ring frequency + overclocking (our driver does this later */
        dev_priv->rps.power = HIGH_POWER; /* force a reset */
-        gen6_set_rps(dev_priv->dev, dev_priv->rps.min_freq_softlimit);
+        gen6_set_rps(dev_priv->dev, dev_priv->rps.idle_freq);
        intel_uncore_forcewake_put(dev_priv, FORCEWAKE_ALL);
 }
@@ -4469,7 +4503,7 @@ static void gen6_enable_rps(struct drm_device *dev)
        }
        dev_priv->rps.power = HIGH_POWER; /* force a reset */
-        gen6_set_rps(dev_priv->dev, dev_priv->rps.min_freq_softlimit);
+        gen6_set_rps(dev_priv->dev, dev_priv->rps.idle_freq);
        rc6vids = 0;
        ret = sandybridge_pcode_read(dev_priv, GEN6_PCODE_READ_RC6VIDS, &rc6vids);
@@ -4834,6 +4868,8 @@ static void valleyview_init_gt_powersave(struct drm_device *dev)
                         intel_gpu_freq(dev_priv, dev_priv->rps.min_freq),
                         dev_priv->rps.min_freq);
+        dev_priv->rps.idle_freq = dev_priv->rps.min_freq;
        /* Preserve min/max settings in case of re-init */
        if (dev_priv->rps.max_freq_softlimit == 0)
                dev_priv->rps.max_freq_softlimit = dev_priv->rps.max_freq;
@@ -4909,6 +4945,8 @@ static void cherryview_init_gt_powersave(struct drm_device *dev)
                   dev_priv->rps.min_freq) & 1,
                  "Odd GPU freq values\n");
+        dev_priv->rps.idle_freq = dev_priv->rps.min_freq;
        /* Preserve min/max settings in case of re-init */
        if (dev_priv->rps.max_freq_softlimit == 0)
                dev_priv->rps.max_freq_softlimit = dev_priv->rps.max_freq;
@@ -5686,6 +5724,13 @@ static void intel_gen6_powersave_work(struct work_struct *work)
                gen6_enable_rps(dev);
                __gen6_update_ring_freq(dev);
        }
+        WARN_ON(dev_priv->rps.max_freq < dev_priv->rps.min_freq);
+        WARN_ON(dev_priv->rps.idle_freq > dev_priv->rps.max_freq);
+        WARN_ON(dev_priv->rps.efficient_freq < dev_priv->rps.min_freq);
+        WARN_ON(dev_priv->rps.efficient_freq > dev_priv->rps.max_freq);
        dev_priv->rps.enabled = true;
        gen6_enable_rps_interrupts(dev);
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index b9f40c2e0af7..a8f9348259ae 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -532,8 +532,6 @@ static void intel_psr_exit(struct drm_device *dev)
                WARN_ON(!(val & EDP_PSR_ENABLE));
                I915_WRITE(EDP_PSR_CTL(dev), val & ~EDP_PSR_ENABLE);
-                dev_priv->psr.active = false;
        } else {
                val = I915_READ(VLV_PSRCTL(pipe));
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 9e554c2cfbb4..f5b7e1e7c5e0 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2194,6 +2194,7 @@ static const struct drm_connector_funcs intel_sdvo_connector_funcs = {
        .atomic_get_property = intel_connector_atomic_get_property,
        .destroy = intel_sdvo_destroy,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static const struct drm_connector_helper_funcs intel_sdvo_connector_helper_funcs = {
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index a82873631851..e9ff6fc61267 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -179,7 +179,7 @@ static void intel_update_primary_plane(struct intel_crtc *crtc)
 static void
 skl_update_plane(struct drm_plane *drm_plane, struct drm_crtc *crtc,
                 struct drm_framebuffer *fb,
-                 struct drm_i915_gem_object *obj, int crtc_x, int crtc_y,
+                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t x, uint32_t y,
                 uint32_t src_w, uint32_t src_h)
@@ -187,23 +187,16 @@ skl_update_plane(struct drm_plane *drm_plane, struct drm_crtc *crtc,
        struct drm_device *dev = drm_plane->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_plane *intel_plane = to_intel_plane(drm_plane);
+        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
        const int pipe = intel_plane->pipe;
        const int plane = intel_plane->plane + 1;
        u32 plane_ctl, stride_div;
        int pixel_size = drm_format_plane_cpp(fb->pixel_format, 0);
+        const struct drm_intel_sprite_colorkey *key = &intel_plane->ckey;
+        unsigned long surf_addr;
-        plane_ctl = I915_READ(PLANE_CTL(pipe, plane));
+        plane_ctl = PLANE_CTL_ENABLE |
+                PLANE_CTL_PIPE_CSC_ENABLE;
-        /* Mask out pixel format bits in case we change it */
-        plane_ctl &= ~PLANE_CTL_FORMAT_MASK;
-        plane_ctl &= ~PLANE_CTL_ORDER_RGBX;
-        plane_ctl &= ~PLANE_CTL_YUV422_ORDER_MASK;
-        plane_ctl &= ~PLANE_CTL_TILED_MASK;
-        plane_ctl &= ~PLANE_CTL_ALPHA_MASK;
-        plane_ctl &= ~PLANE_CTL_ROTATE_MASK;
-        /* Trickle feed has to be enabled */
-        plane_ctl &= ~PLANE_CTL_TRICKLE_FEED_DISABLE;
        switch (fb->pixel_format) {
        case DRM_FORMAT_RGB565:
@@ -264,9 +257,6 @@ skl_update_plane(struct drm_plane *drm_plane, struct drm_crtc *crtc,
        if (drm_plane->state->rotation == BIT(DRM_ROTATE_180))
                plane_ctl |= PLANE_CTL_ROTATE_180;
-        plane_ctl |= PLANE_CTL_ENABLE;
-        plane_ctl |= PLANE_CTL_PIPE_CSC_ENABLE;
        intel_update_sprite_watermarks(drm_plane, crtc, src_w, src_h,
                                       pixel_size, true,
                                       src_w != crtc_w || src_h != crtc_h);
@@ -280,12 +270,25 @@ skl_update_plane(struct drm_plane *drm_plane, struct drm_crtc *crtc,
        crtc_w--;
        crtc_h--;
+        if (key->flags) {
+                I915_WRITE(PLANE_KEYVAL(pipe, plane), key->min_value);
+                I915_WRITE(PLANE_KEYMAX(pipe, plane), key->max_value);
+                I915_WRITE(PLANE_KEYMSK(pipe, plane), key->channel_mask);
+        }
+        if (key->flags & I915_SET_COLORKEY_DESTINATION)
+                plane_ctl |= PLANE_CTL_KEY_ENABLE_DESTINATION;
+        else if (key->flags & I915_SET_COLORKEY_SOURCE)
+                plane_ctl |= PLANE_CTL_KEY_ENABLE_SOURCE;
+        surf_addr = intel_plane_obj_offset(intel_plane, obj);
        I915_WRITE(PLANE_OFFSET(pipe, plane), (y << 16) | x);
        I915_WRITE(PLANE_STRIDE(pipe, plane), fb->pitches[0] / stride_div);
        I915_WRITE(PLANE_POS(pipe, plane), (crtc_y << 16) | crtc_x);
        I915_WRITE(PLANE_SIZE(pipe, plane), (crtc_h << 16) | crtc_w);
        I915_WRITE(PLANE_CTL(pipe, plane), plane_ctl);
-        I915_WRITE(PLANE_SURF(pipe, plane), i915_gem_obj_ggtt_offset(obj));
+        I915_WRITE(PLANE_SURF(pipe, plane), surf_addr);
        POSTING_READ(PLANE_SURF(pipe, plane));
 }
@@ -298,73 +301,15 @@ skl_disable_plane(struct drm_plane *drm_plane, struct drm_crtc *crtc)
        const int pipe = intel_plane->pipe;
        const int plane = intel_plane->plane + 1;
-        I915_WRITE(PLANE_CTL(pipe, plane),
+        I915_WRITE(PLANE_CTL(pipe, plane), 0);
-                   I915_READ(PLANE_CTL(pipe, plane)) & ~PLANE_CTL_ENABLE);
        /* Activate double buffered register update */
-        I915_WRITE(PLANE_CTL(pipe, plane), 0);
+        I915_WRITE(PLANE_SURF(pipe, plane), 0);
-        POSTING_READ(PLANE_CTL(pipe, plane));
+        POSTING_READ(PLANE_SURF(pipe, plane));
        intel_update_sprite_watermarks(drm_plane, crtc, 0, 0, 0, false, false);
 }
-static int
-skl_update_colorkey(struct drm_plane *drm_plane,
-                    struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = drm_plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane = to_intel_plane(drm_plane);
-        const int pipe = intel_plane->pipe;
-        const int plane = intel_plane->plane;
-        u32 plane_ctl;
-        I915_WRITE(PLANE_KEYVAL(pipe, plane), key->min_value);
-        I915_WRITE(PLANE_KEYMAX(pipe, plane), key->max_value);
-        I915_WRITE(PLANE_KEYMSK(pipe, plane), key->channel_mask);
-        plane_ctl = I915_READ(PLANE_CTL(pipe, plane));
-        plane_ctl &= ~PLANE_CTL_KEY_ENABLE_MASK;
-        if (key->flags & I915_SET_COLORKEY_DESTINATION)
-                plane_ctl |= PLANE_CTL_KEY_ENABLE_DESTINATION;
-        else if (key->flags & I915_SET_COLORKEY_SOURCE)
-                plane_ctl |= PLANE_CTL_KEY_ENABLE_SOURCE;
-        I915_WRITE(PLANE_CTL(pipe, plane), plane_ctl);
-        POSTING_READ(PLANE_CTL(pipe, plane));
-        return 0;
-}
-static void
-skl_get_colorkey(struct drm_plane *drm_plane,
-                 struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = drm_plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane = to_intel_plane(drm_plane);
-        const int pipe = intel_plane->pipe;
-        const int plane = intel_plane->plane;
-        u32 plane_ctl;
-        key->min_value = I915_READ(PLANE_KEYVAL(pipe, plane));
-        key->max_value = I915_READ(PLANE_KEYMAX(pipe, plane));
-        key->channel_mask = I915_READ(PLANE_KEYMSK(pipe, plane));
-        plane_ctl = I915_READ(PLANE_CTL(pipe, plane));
-        switch (plane_ctl & PLANE_CTL_KEY_ENABLE_MASK) {
-        case PLANE_CTL_KEY_ENABLE_DESTINATION:
-                key->flags = I915_SET_COLORKEY_DESTINATION;
-                break;
-        case PLANE_CTL_KEY_ENABLE_SOURCE:
-                key->flags = I915_SET_COLORKEY_SOURCE;
-                break;
-        default:
-                key->flags = I915_SET_COLORKEY_NONE;
-        }
-}
 static void
 chv_update_csc(struct intel_plane *intel_plane, uint32_t format)
 {
@@ -407,7 +352,7 @@ chv_update_csc(struct intel_plane *intel_plane, uint32_t format)
 static void
 vlv_update_plane(struct drm_plane *dplane, struct drm_crtc *crtc,
                 struct drm_framebuffer *fb,
-                 struct drm_i915_gem_object *obj, int crtc_x, int crtc_y,
+                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t x, uint32_t y,
                 uint32_t src_w, uint32_t src_h)
@@ -416,19 +361,15 @@ vlv_update_plane(struct drm_plane *dplane, struct drm_crtc *crtc,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_plane *intel_plane = to_intel_plane(dplane);
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
        int pipe = intel_plane->pipe;
        int plane = intel_plane->plane;
        u32 sprctl;
        unsigned long sprsurf_offset, linear_offset;
        int pixel_size = drm_format_plane_cpp(fb->pixel_format, 0);
+        const struct drm_intel_sprite_colorkey *key = &intel_plane->ckey;
-        sprctl = I915_READ(SPCNTR(pipe, plane));
+        sprctl = SP_ENABLE;
-        /* Mask out pixel format bits in case we change it */
-        sprctl &= ~SP_PIXFORMAT_MASK;
-        sprctl &= ~SP_YUV_BYTE_ORDER_MASK;
-        sprctl &= ~SP_TILED;
-        sprctl &= ~SP_ROTATE_180;
        switch (fb->pixel_format) {
        case DRM_FORMAT_YUYV:
@@ -482,8 +423,6 @@ vlv_update_plane(struct drm_plane *dplane, struct drm_crtc *crtc,
        if (obj->tiling_mode != I915_TILING_NONE)
                sprctl |= SP_TILED;
-        sprctl |= SP_ENABLE;
        intel_update_sprite_watermarks(dplane, crtc, src_w, src_h,
                                       pixel_size, true,
                                       src_w != crtc_w || src_h != crtc_h);
@@ -511,6 +450,15 @@ vlv_update_plane(struct drm_plane *dplane, struct drm_crtc *crtc,
        intel_update_primary_plane(intel_crtc);
+        if (key->flags) {
+                I915_WRITE(SPKEYMINVAL(pipe, plane), key->min_value);
+                I915_WRITE(SPKEYMAXVAL(pipe, plane), key->max_value);
+                I915_WRITE(SPKEYMSK(pipe, plane), key->channel_mask);
+        }
+        if (key->flags & I915_SET_COLORKEY_SOURCE)
+                sprctl |= SP_SOURCE_KEY;
        if (IS_CHERRYVIEW(dev) && pipe == PIPE_B)
                chv_update_csc(intel_plane, fb->pixel_format);
@@ -544,8 +492,8 @@ vlv_disable_plane(struct drm_plane *dplane, struct drm_crtc *crtc)
        intel_update_primary_plane(intel_crtc);
-        I915_WRITE(SPCNTR(pipe, plane), I915_READ(SPCNTR(pipe, plane)) &
+        I915_WRITE(SPCNTR(pipe, plane), 0);
-                   ~SP_ENABLE);
        /* Activate double buffered register update */
        I915_WRITE(SPSURF(pipe, plane), 0);
@@ -554,61 +502,11 @@ vlv_disable_plane(struct drm_plane *dplane, struct drm_crtc *crtc)
        intel_update_sprite_watermarks(dplane, crtc, 0, 0, 0, false, false);
 }
-static int
-vlv_update_colorkey(struct drm_plane *dplane,
-                    struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = dplane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane = to_intel_plane(dplane);
-        int pipe = intel_plane->pipe;
-        int plane = intel_plane->plane;
-        u32 sprctl;
-        if (key->flags & I915_SET_COLORKEY_DESTINATION)
-                return -EINVAL;
-        I915_WRITE(SPKEYMINVAL(pipe, plane), key->min_value);
-        I915_WRITE(SPKEYMAXVAL(pipe, plane), key->max_value);
-        I915_WRITE(SPKEYMSK(pipe, plane), key->channel_mask);
-        sprctl = I915_READ(SPCNTR(pipe, plane));
-        sprctl &= ~SP_SOURCE_KEY;
-        if (key->flags & I915_SET_COLORKEY_SOURCE)
-                sprctl |= SP_SOURCE_KEY;
-        I915_WRITE(SPCNTR(pipe, plane), sprctl);
-        POSTING_READ(SPKEYMSK(pipe, plane));
-        return 0;
-}
-static void
-vlv_get_colorkey(struct drm_plane *dplane,
-                 struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = dplane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane = to_intel_plane(dplane);
-        int pipe = intel_plane->pipe;
-        int plane = intel_plane->plane;
-        u32 sprctl;
-        key->min_value = I915_READ(SPKEYMINVAL(pipe, plane));
-        key->max_value = I915_READ(SPKEYMAXVAL(pipe, plane));
-        key->channel_mask = I915_READ(SPKEYMSK(pipe, plane));
-        sprctl = I915_READ(SPCNTR(pipe, plane));
-        if (sprctl & SP_SOURCE_KEY)
-                key->flags = I915_SET_COLORKEY_SOURCE;
-        else
-                key->flags = I915_SET_COLORKEY_NONE;
-}
 static void
 ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
                 struct drm_framebuffer *fb,
-                 struct drm_i915_gem_object *obj, int crtc_x, int crtc_y,
+                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t x, uint32_t y,
                 uint32_t src_w, uint32_t src_h)
@@ -617,19 +515,14 @@ ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_plane *intel_plane = to_intel_plane(plane);
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        int pipe = intel_plane->pipe;
+        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
+        enum pipe pipe = intel_plane->pipe;
        u32 sprctl, sprscale = 0;
        unsigned long sprsurf_offset, linear_offset;
        int pixel_size = drm_format_plane_cpp(fb->pixel_format, 0);
+        const struct drm_intel_sprite_colorkey *key = &intel_plane->ckey;
-        sprctl = I915_READ(SPRCTL(pipe));
+        sprctl = SPRITE_ENABLE;
-        /* Mask out pixel format bits in case we change it */
-        sprctl &= ~SPRITE_PIXFORMAT_MASK;
-        sprctl &= ~SPRITE_RGB_ORDER_RGBX;
-        sprctl &= ~SPRITE_YUV_BYTE_ORDER_MASK;
-        sprctl &= ~SPRITE_TILED;
-        sprctl &= ~SPRITE_ROTATE_180;
        switch (fb->pixel_format) {
        case DRM_FORMAT_XBGR8888:
@@ -668,8 +561,6 @@ ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        else
                sprctl |= SPRITE_TRICKLE_FEED_DISABLE;
-        sprctl |= SPRITE_ENABLE;
        if (IS_HASWELL(dev) || IS_BROADWELL(dev))
                sprctl |= SPRITE_PIPE_CSC_ENABLE;
@@ -706,6 +597,17 @@ ivb_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        intel_update_primary_plane(intel_crtc);
+        if (key->flags) {
+                I915_WRITE(SPRKEYVAL(pipe), key->min_value);
+                I915_WRITE(SPRKEYMAX(pipe), key->max_value);
+                I915_WRITE(SPRKEYMSK(pipe), key->channel_mask);
+        }
+        if (key->flags & I915_SET_COLORKEY_DESTINATION)
+                sprctl |= SPRITE_DEST_KEY;
+        else if (key->flags & I915_SET_COLORKEY_SOURCE)
+                sprctl |= SPRITE_SOURCE_KEY;
        I915_WRITE(SPRSTRIDE(pipe), fb->pitches[0]);
        I915_WRITE(SPRPOS(pipe), (crtc_y << 16) | crtc_x);
@@ -747,73 +649,12 @@ ivb_disable_plane(struct drm_plane *plane, struct drm_crtc *crtc)
        I915_WRITE(SPRSURF(pipe), 0);
        intel_flush_primary_plane(dev_priv, intel_crtc->plane);
-        /*
-         * Avoid underruns when disabling the sprite.
-         * FIXME remove once watermark updates are done properly.
-         */
-        intel_crtc->atomic.wait_vblank = true;
-        intel_crtc->atomic.update_sprite_watermarks |= (1 << drm_plane_index(plane));
-}
-static int
-ivb_update_colorkey(struct drm_plane *plane,
-                    struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane;
-        u32 sprctl;
-        int ret = 0;
-        intel_plane = to_intel_plane(plane);
-        I915_WRITE(SPRKEYVAL(intel_plane->pipe), key->min_value);
-        I915_WRITE(SPRKEYMAX(intel_plane->pipe), key->max_value);
-        I915_WRITE(SPRKEYMSK(intel_plane->pipe), key->channel_mask);
-        sprctl = I915_READ(SPRCTL(intel_plane->pipe));
-        sprctl &= ~(SPRITE_SOURCE_KEY | SPRITE_DEST_KEY);
-        if (key->flags & I915_SET_COLORKEY_DESTINATION)
-                sprctl |= SPRITE_DEST_KEY;
-        else if (key->flags & I915_SET_COLORKEY_SOURCE)
-                sprctl |= SPRITE_SOURCE_KEY;
-        I915_WRITE(SPRCTL(intel_plane->pipe), sprctl);
-        POSTING_READ(SPRKEYMSK(intel_plane->pipe));
-        return ret;
-}
-static void
-ivb_get_colorkey(struct drm_plane *plane, struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane;
-        u32 sprctl;
-        intel_plane = to_intel_plane(plane);
-        key->min_value = I915_READ(SPRKEYVAL(intel_plane->pipe));
-        key->max_value = I915_READ(SPRKEYMAX(intel_plane->pipe));
-        key->channel_mask = I915_READ(SPRKEYMSK(intel_plane->pipe));
-        key->flags = 0;
-        sprctl = I915_READ(SPRCTL(intel_plane->pipe));
-        if (sprctl & SPRITE_DEST_KEY)
-                key->flags = I915_SET_COLORKEY_DESTINATION;
-        else if (sprctl & SPRITE_SOURCE_KEY)
-                key->flags = I915_SET_COLORKEY_SOURCE;
-        else
-                key->flags = I915_SET_COLORKEY_NONE;
 }
 static void
 ilk_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
                 struct drm_framebuffer *fb,
-                 struct drm_i915_gem_object *obj, int crtc_x, int crtc_y,
+                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t x, uint32_t y,
                 uint32_t src_w, uint32_t src_h)
@@ -822,19 +663,14 @@ ilk_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_plane *intel_plane = to_intel_plane(plane);
        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
        int pipe = intel_plane->pipe;
        unsigned long dvssurf_offset, linear_offset;
        u32 dvscntr, dvsscale;
        int pixel_size = drm_format_plane_cpp(fb->pixel_format, 0);
+        const struct drm_intel_sprite_colorkey *key = &intel_plane->ckey;
-        dvscntr = I915_READ(DVSCNTR(pipe));
+        dvscntr = DVS_ENABLE;
-        /* Mask out pixel format bits in case we change it */
-        dvscntr &= ~DVS_PIXFORMAT_MASK;
-        dvscntr &= ~DVS_RGB_ORDER_XBGR;
-        dvscntr &= ~DVS_YUV_BYTE_ORDER_MASK;
-        dvscntr &= ~DVS_TILED;
-        dvscntr &= ~DVS_ROTATE_180;
        switch (fb->pixel_format) {
        case DRM_FORMAT_XBGR8888:
@@ -870,7 +706,6 @@ ilk_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        if (IS_GEN6(dev))
                dvscntr |= DVS_TRICKLE_FEED_DISABLE; /* must disable */
-        dvscntr |= DVS_ENABLE;
        intel_update_sprite_watermarks(plane, crtc, src_w, src_h,
                                       pixel_size, true,
@@ -902,6 +737,17 @@ ilk_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
        intel_update_primary_plane(intel_crtc);
+        if (key->flags) {
+                I915_WRITE(DVSKEYVAL(pipe), key->min_value);
+                I915_WRITE(DVSKEYMAX(pipe), key->max_value);
+                I915_WRITE(DVSKEYMSK(pipe), key->channel_mask);
+        }
+        if (key->flags & I915_SET_COLORKEY_DESTINATION)
+                dvscntr |= DVS_DEST_KEY;
+        else if (key->flags & I915_SET_COLORKEY_SOURCE)
+                dvscntr |= DVS_SOURCE_KEY;
        I915_WRITE(DVSSTRIDE(pipe), fb->pitches[0]);
        I915_WRITE(DVSPOS(pipe), (crtc_y << 16) | crtc_x);
@@ -930,20 +776,14 @@ ilk_disable_plane(struct drm_plane *plane, struct drm_crtc *crtc)
        intel_update_primary_plane(intel_crtc);
-        I915_WRITE(DVSCNTR(pipe), I915_READ(DVSCNTR(pipe)) & ~DVS_ENABLE);
+        I915_WRITE(DVSCNTR(pipe), 0);
        /* Disable the scaler */
        I915_WRITE(DVSSCALE(pipe), 0);
        /* Flush double buffered register updates */
        I915_WRITE(DVSSURF(pipe), 0);
        intel_flush_primary_plane(dev_priv, intel_crtc->plane);
-        /*
-         * Avoid underruns when disabling the sprite.
-         * FIXME remove once watermark updates are done properly.
-         */
-        intel_crtc->atomic.wait_vblank = true;
-        intel_crtc->atomic.update_sprite_watermarks |= (1 << drm_plane_index(plane));
 }
 /**
@@ -1014,67 +854,9 @@ intel_pre_disable_primary(struct drm_crtc *crtc)
        hsw_disable_ips(intel_crtc);
 }
-static int
-ilk_update_colorkey(struct drm_plane *plane,
-                    struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane;
-        u32 dvscntr;
-        int ret = 0;
-        intel_plane = to_intel_plane(plane);
-        I915_WRITE(DVSKEYVAL(intel_plane->pipe), key->min_value);
-        I915_WRITE(DVSKEYMAX(intel_plane->pipe), key->max_value);
-        I915_WRITE(DVSKEYMSK(intel_plane->pipe), key->channel_mask);
-        dvscntr = I915_READ(DVSCNTR(intel_plane->pipe));
-        dvscntr &= ~(DVS_SOURCE_KEY | DVS_DEST_KEY);
-        if (key->flags & I915_SET_COLORKEY_DESTINATION)
-                dvscntr |= DVS_DEST_KEY;
-        else if (key->flags & I915_SET_COLORKEY_SOURCE)
-                dvscntr |= DVS_SOURCE_KEY;
-        I915_WRITE(DVSCNTR(intel_plane->pipe), dvscntr);
-        POSTING_READ(DVSKEYMSK(intel_plane->pipe));
-        return ret;
-}
-static void
-ilk_get_colorkey(struct drm_plane *plane, struct drm_intel_sprite_colorkey *key)
-{
-        struct drm_device *dev = plane->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_plane *intel_plane;
-        u32 dvscntr;
-        intel_plane = to_intel_plane(plane);
-        key->min_value = I915_READ(DVSKEYVAL(intel_plane->pipe));
-        key->max_value = I915_READ(DVSKEYMAX(intel_plane->pipe));
-        key->channel_mask = I915_READ(DVSKEYMSK(intel_plane->pipe));
-        key->flags = 0;
-        dvscntr = I915_READ(DVSCNTR(intel_plane->pipe));
-        if (dvscntr & DVS_DEST_KEY)
-                key->flags = I915_SET_COLORKEY_DESTINATION;
-        else if (dvscntr & DVS_SOURCE_KEY)
-                key->flags = I915_SET_COLORKEY_SOURCE;
-        else
-                key->flags = I915_SET_COLORKEY_NONE;
-}
 static bool colorkey_enabled(struct intel_plane *intel_plane)
 {
-        struct drm_intel_sprite_colorkey key;
+        return intel_plane->ckey.flags != I915_SET_COLORKEY_NONE;
-        intel_plane->get_colorkey(&intel_plane->base, &key);
-        return key.flags != I915_SET_COLORKEY_NONE;
 }
 static int
@@ -1257,11 +1039,18 @@ finish:
                if (!intel_crtc->primary_enabled && !state->hides_primary)
                        intel_crtc->atomic.post_enable_primary = true;
-                /* Update watermarks on tiling changes. */
+                if (intel_wm_need_update(plane, &state->base))
-                if (!plane->state->fb || !state->base.fb ||
-                    plane->state->fb->modifier[0] !=
-                    state->base.fb->modifier[0])
                        intel_crtc->atomic.update_wm = true;
+                if (!state->visible) {
+                        /*
+                         * Avoid underruns when disabling the sprite.
+                         * FIXME remove once watermark updates are done properly.
+                         */
+                        intel_crtc->atomic.wait_vblank = true;
+                        intel_crtc->atomic.update_sprite_watermarks |=
+                                (1 << drm_plane_index(plane));
+                }
        }
        return 0;
@@ -1275,7 +1064,6 @@ intel_commit_sprite_plane(struct drm_plane *plane,
        struct intel_crtc *intel_crtc;
        struct intel_plane *intel_plane = to_intel_plane(plane);
        struct drm_framebuffer *fb = state->base.fb;
-        struct drm_i915_gem_object *obj = intel_fb_obj(fb);
        int crtc_x, crtc_y;
        unsigned int crtc_w, crtc_h;
        uint32_t src_x, src_y, src_w, src_h;
@@ -1283,8 +1071,7 @@ intel_commit_sprite_plane(struct drm_plane *plane,
        crtc = crtc ? crtc : plane->crtc;
        intel_crtc = to_intel_crtc(crtc);
-        plane->fb = state->base.fb;
+        plane->fb = fb;
-        intel_plane->obj = obj;
        if (intel_crtc->active) {
                intel_crtc->primary_enabled = !state->hides_primary;
@@ -1298,7 +1085,7 @@ intel_commit_sprite_plane(struct drm_plane *plane,
                        src_y = state->src.y1;
                        src_w = drm_rect_width(&state->src);
                        src_h = drm_rect_height(&state->src);
-                        intel_plane->update_plane(plane, crtc, fb, obj,
+                        intel_plane->update_plane(plane, crtc, fb,
                                                  crtc_x, crtc_y, crtc_w, crtc_h,
                                                  src_x, src_y, src_w, src_h);
                } else {
@@ -1319,6 +1106,10 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
        if ((set->flags & (I915_SET_COLORKEY_DESTINATION | I915_SET_COLORKEY_SOURCE)) == (I915_SET_COLORKEY_DESTINATION | I915_SET_COLORKEY_SOURCE))
                return -EINVAL;
+        if (IS_VALLEYVIEW(dev) &&
+            set->flags & I915_SET_COLORKEY_DESTINATION)
+                return -EINVAL;
        drm_modeset_lock_all(dev);
        plane = drm_plane_find(dev, set->plane_id);
@@ -1328,31 +1119,15 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
        }
        intel_plane = to_intel_plane(plane);
-        ret = intel_plane->update_colorkey(plane, set);
+        intel_plane->ckey = *set;
-out_unlock:
-        drm_modeset_unlock_all(dev);
-        return ret;
-}
-int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
-                              struct drm_file *file_priv)
-{
-        struct drm_intel_sprite_colorkey *get = data;
-        struct drm_plane *plane;
-        struct intel_plane *intel_plane;
-        int ret = 0;
-        drm_modeset_lock_all(dev);
+        /*
+         * The only way this could fail would be due to
-        plane = drm_plane_find(dev, get->plane_id);
+         * the current plane state being unsupportable already,
-        if (!plane) {
+         * and we dont't consider that an error for the
-                ret = -ENOENT;
+         * colorkey ioctl. So just ignore any error.
-                goto out_unlock;
+         */
-        }
+        intel_plane_restore(plane);
-        intel_plane = to_intel_plane(plane);
-        intel_plane->get_colorkey(plane, get);
 out_unlock:
        drm_modeset_unlock_all(dev);
@@ -1445,8 +1220,6 @@ intel_plane_init(struct drm_device *dev, enum pipe pipe, int plane)
                intel_plane->max_downscale = 16;
                intel_plane->update_plane = ilk_update_plane;
                intel_plane->disable_plane = ilk_disable_plane;
-                intel_plane->update_colorkey = ilk_update_colorkey;
-                intel_plane->get_colorkey = ilk_get_colorkey;
                if (IS_GEN6(dev)) {
                        plane_formats = snb_plane_formats;
@@ -1470,16 +1243,12 @@ intel_plane_init(struct drm_device *dev, enum pipe pipe, int plane)
                if (IS_VALLEYVIEW(dev)) {
                        intel_plane->update_plane = vlv_update_plane;
                        intel_plane->disable_plane = vlv_disable_plane;
-                        intel_plane->update_colorkey = vlv_update_colorkey;
-                        intel_plane->get_colorkey = vlv_get_colorkey;
                        plane_formats = vlv_plane_formats;
                        num_plane_formats = ARRAY_SIZE(vlv_plane_formats);
                } else {
                        intel_plane->update_plane = ivb_update_plane;
                        intel_plane->disable_plane = ivb_disable_plane;
-                        intel_plane->update_colorkey = ivb_update_colorkey;
-                        intel_plane->get_colorkey = ivb_get_colorkey;
                        plane_formats = snb_plane_formats;
                        num_plane_formats = ARRAY_SIZE(snb_plane_formats);
@@ -1494,8 +1263,6 @@ intel_plane_init(struct drm_device *dev, enum pipe pipe, int plane)
                intel_plane->max_downscale = 1;
                intel_plane->update_plane = skl_update_plane;
                intel_plane->disable_plane = skl_disable_plane;
-                intel_plane->update_colorkey = skl_update_colorkey;
-                intel_plane->get_colorkey = skl_get_colorkey;
                plane_formats = skl_plane_formats;
                num_plane_formats = ARRAY_SIZE(skl_plane_formats);
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 892d23c8479d..bc1d9d740904 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1332,7 +1332,7 @@ intel_tv_detect(struct drm_connector *connector, bool force)
                if (intel_get_load_detect_pipe(connector, &mode, &tmp, &ctx)) {
                        type = intel_tv_detect_type(intel_tv, connector);
-                        intel_release_load_detect_pipe(connector, &tmp);
+                        intel_release_load_detect_pipe(connector, &tmp, &ctx);
                        status = type < 0 ?
                                connector_status_disconnected :
                                connector_status_connected;
@@ -1516,6 +1516,7 @@ static const struct drm_connector_funcs intel_tv_connector_funcs = {
        .atomic_get_property = intel_connector_atomic_get_property,
        .fill_modes = drm_helper_probe_single_connector_modes,
        .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+        .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
 };
 static const struct drm_connector_helper_funcs intel_tv_connector_helper_funcs = {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
index 29bd539af183..6efa8f38ff54 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
@@ -340,11 +340,13 @@ nvkm_devobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
                /* switch mmio to cpu's native endianness */
 #ifndef __BIG_ENDIAN
-                if (ioread32_native(map + 0x000004) != 0x00000000)
+                if (ioread32_native(map + 0x000004) != 0x00000000) {
 #else
-                if (ioread32_native(map + 0x000004) == 0x00000000)
+                if (ioread32_native(map + 0x000004) == 0x00000000) {
 #endif
                        iowrite32_native(0x01000001, map + 0x000004);
+                        ioread32_native(map);
+                }
                /* read boot0 and strapping information */
                boot0 = ioread32_native(map + 0x000000);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
index 539561ed3281..108d048da764 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/gm100.c
@@ -142,6 +142,49 @@ gm100_identify(struct nvkm_device *device)
                device->oclass[NVDEV_ENGINE_MSPPP  ] = &gf100_msppp_oclass;
 #endif
                break;
+        case 0x126:
+                device->cname = "GM206";
+                device->oclass[NVDEV_SUBDEV_VBIOS  ] = &nvkm_bios_oclass;
+                device->oclass[NVDEV_SUBDEV_GPIO   ] =  gk104_gpio_oclass;
+                device->oclass[NVDEV_SUBDEV_I2C    ] =  gm204_i2c_oclass;
+                device->oclass[NVDEV_SUBDEV_FUSE   ] = &gm107_fuse_oclass;
+#if 0
+                /* looks to be some non-trivial changes */
+                device->oclass[NVDEV_SUBDEV_CLK    ] = &gk104_clk_oclass;
+                /* priv ring says no to 0x10eb14 writes */
+                device->oclass[NVDEV_SUBDEV_THERM  ] = &gm107_therm_oclass;
+#endif
+                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
+                device->oclass[NVDEV_SUBDEV_DEVINIT] =  gm204_devinit_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  gk20a_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_BUS    ] =  gf100_bus_oclass;
+                device->oclass[NVDEV_SUBDEV_TIMER  ] = &gk20a_timer_oclass;
+                device->oclass[NVDEV_SUBDEV_FB     ] =  gm107_fb_oclass;
+                device->oclass[NVDEV_SUBDEV_LTC    ] =  gm107_ltc_oclass;
+                device->oclass[NVDEV_SUBDEV_IBUS   ] = &gk104_ibus_oclass;
+                device->oclass[NVDEV_SUBDEV_INSTMEM] =  nv50_instmem_oclass;
+                device->oclass[NVDEV_SUBDEV_MMU    ] = &gf100_mmu_oclass;
+                device->oclass[NVDEV_SUBDEV_BAR    ] = &gf100_bar_oclass;
+                device->oclass[NVDEV_SUBDEV_PMU    ] =  gk208_pmu_oclass;
+#if 0
+                device->oclass[NVDEV_SUBDEV_VOLT   ] = &nv40_volt_oclass;
+#endif
+                device->oclass[NVDEV_ENGINE_DMAOBJ ] =  gf110_dmaeng_oclass;
+#if 0
+                device->oclass[NVDEV_ENGINE_FIFO   ] =  gk208_fifo_oclass;
+                device->oclass[NVDEV_ENGINE_SW     ] =  gf100_sw_oclass;
+                device->oclass[NVDEV_ENGINE_GR     ] =  gm107_gr_oclass;
+#endif
+                device->oclass[NVDEV_ENGINE_DISP   ] =  gm204_disp_oclass;
+#if 0
+                device->oclass[NVDEV_ENGINE_CE0    ] = &gm204_ce0_oclass;
+                device->oclass[NVDEV_ENGINE_CE1    ] = &gm204_ce1_oclass;
+                device->oclass[NVDEV_ENGINE_CE2    ] = &gm204_ce2_oclass;
+                device->oclass[NVDEV_ENGINE_MSVLD  ] = &gk104_msvld_oclass;
+                device->oclass[NVDEV_ENGINE_MSPDEC ] = &gk104_mspdec_oclass;
+                device->oclass[NVDEV_ENGINE_MSPPP  ] = &gf100_msppp_oclass;
+#endif
+                break;
        default:
                nv_fatal(device, "unknown Maxwell chipset\n");
                return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
index b038b6eb51db..043e4296084c 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/nv04.c
@@ -502,72 +502,57 @@ nv04_fifo_intr(struct nvkm_subdev *subdev)
 {
        struct nvkm_device *device = nv_device(subdev);
        struct nv04_fifo_priv *priv = (void *)subdev;
-        uint32_t status, reassign;
+        u32 mask = nv_rd32(priv, NV03_PFIFO_INTR_EN_0);
-        int cnt = 0;
+        u32 stat = nv_rd32(priv, NV03_PFIFO_INTR_0) & mask;
+        u32 reassign, chid, get, sem;
        reassign = nv_rd32(priv, NV03_PFIFO_CACHES) & 1;
-        while ((status = nv_rd32(priv, NV03_PFIFO_INTR_0)) && (cnt++ < 100)) {
+        nv_wr32(priv, NV03_PFIFO_CACHES, 0);
-                uint32_t chid, get;
-                nv_wr32(priv, NV03_PFIFO_CACHES, 0);
-                chid = nv_rd32(priv, NV03_PFIFO_CACHE1_PUSH1) & priv->base.max;
-                get  = nv_rd32(priv, NV03_PFIFO_CACHE1_GET);
-                if (status & NV_PFIFO_INTR_CACHE_ERROR) {
+        chid = nv_rd32(priv, NV03_PFIFO_CACHE1_PUSH1) & priv->base.max;
-                        nv04_fifo_cache_error(device, priv, chid, get);
+        get  = nv_rd32(priv, NV03_PFIFO_CACHE1_GET);
-                        status &= ~NV_PFIFO_INTR_CACHE_ERROR;
-                }
-                if (status & NV_PFIFO_INTR_DMA_PUSHER) {
+        if (stat & NV_PFIFO_INTR_CACHE_ERROR) {
-                        nv04_fifo_dma_pusher(device, priv, chid);
+                nv04_fifo_cache_error(device, priv, chid, get);
-                        status &= ~NV_PFIFO_INTR_DMA_PUSHER;
+                stat &= ~NV_PFIFO_INTR_CACHE_ERROR;
-                }
+        }
-                if (status & NV_PFIFO_INTR_SEMAPHORE) {
+        if (stat & NV_PFIFO_INTR_DMA_PUSHER) {
-                        uint32_t sem;
+                nv04_fifo_dma_pusher(device, priv, chid);
+                stat &= ~NV_PFIFO_INTR_DMA_PUSHER;
+        }
-                        status &= ~NV_PFIFO_INTR_SEMAPHORE;
+        if (stat & NV_PFIFO_INTR_SEMAPHORE) {
-                        nv_wr32(priv, NV03_PFIFO_INTR_0,
+                stat &= ~NV_PFIFO_INTR_SEMAPHORE;
-                                NV_PFIFO_INTR_SEMAPHORE);
+                nv_wr32(priv, NV03_PFIFO_INTR_0, NV_PFIFO_INTR_SEMAPHORE);
-                        sem = nv_rd32(priv, NV10_PFIFO_CACHE1_SEMAPHORE);
+                sem = nv_rd32(priv, NV10_PFIFO_CACHE1_SEMAPHORE);
-                        nv_wr32(priv, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
+                nv_wr32(priv, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
-                        nv_wr32(priv, NV03_PFIFO_CACHE1_GET, get + 4);
+                nv_wr32(priv, NV03_PFIFO_CACHE1_GET, get + 4);
-                        nv_wr32(priv, NV04_PFIFO_CACHE1_PULL0, 1);
+                nv_wr32(priv, NV04_PFIFO_CACHE1_PULL0, 1);
-                }
+        }
-                if (device->card_type == NV_50) {
+        if (device->card_type == NV_50) {
-                        if (status & 0x00000010) {
+                if (stat & 0x00000010) {
-                                status &= ~0x00000010;
+                        stat &= ~0x00000010;
-                                nv_wr32(priv, 0x002100, 0x00000010);
+                        nv_wr32(priv, 0x002100, 0x00000010);
-                        }
-                        if (status & 0x40000000) {
-                                nv_wr32(priv, 0x002100, 0x40000000);
-                                nvkm_fifo_uevent(&priv->base);
-                                status &= ~0x40000000;
-                        }
                }
-                if (status) {
+                if (stat & 0x40000000) {
-                        nv_warn(priv, "unknown intr 0x%08x, ch %d\n",
+                        nv_wr32(priv, 0x002100, 0x40000000);
-                                status, chid);
+                        nvkm_fifo_uevent(&priv->base);
-                        nv_wr32(priv, NV03_PFIFO_INTR_0, status);
+                        stat &= ~0x40000000;
-                        status = 0;
                }
-                nv_wr32(priv, NV03_PFIFO_CACHES, reassign);
        }
-        if (status) {
+        if (stat) {
-                nv_error(priv, "still angry after %d spins, halt\n", cnt);
+                nv_warn(priv, "unknown intr 0x%08x\n", stat);
-                nv_wr32(priv, 0x002140, 0);
+                nv_mask(priv, NV03_PFIFO_INTR_EN_0, stat, 0x00000000);
-                nv_wr32(priv, 0x000140, 0);
+                nv_wr32(priv, NV03_PFIFO_INTR_0, stat);
        }
-        nv_wr32(priv, 0x000100, 0x00000100);
+        nv_wr32(priv, NV03_PFIFO_CACHES, reassign);
 }
 static int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
index 2e7ec389eea7..57e2c5b13123 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c
@@ -1032,9 +1032,9 @@ gf100_grctx_generate_bundle(struct gf100_grctx *info)
        const int s = 8;
        const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
        mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
        mmio_refn(info, 0x418808, 0x00000000, s, b);
-        mmio_refn(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s));
 }
 void
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
index b52300d8861a..5e9454ba158f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c
@@ -851,9 +851,9 @@ gk104_grctx_generate_bundle(struct gf100_grctx *info)
        const int s = 8;
        const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
        mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
        mmio_refn(info, 0x418808, 0x00000000, s, b);
-        mmio_refn(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x41880c, 0x80000000 | (impl->bundle_size >> s));
        mmio_wr32(info, 0x4064c8, (state_limit << 16) | token_limit);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
index 956f4dce960c..b2fae6e389e2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c
@@ -871,9 +871,9 @@ gm107_grctx_generate_bundle(struct gf100_grctx *info)
        const int s = 8;
        const int b = mmio_vram(info, impl->bundle_size, (1 << s), access);
        mmio_refn(info, 0x408004, 0x00000000, s, b);
-        mmio_refn(info, 0x408008, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x408008, 0x80000000 | (impl->bundle_size >> s));
        mmio_refn(info, 0x418e24, 0x00000000, s, b);
-        mmio_refn(info, 0x418e28, 0x80000000 | (impl->bundle_size >> s), 0, b);
+        mmio_wr32(info, 0x418e28, 0x80000000 | (impl->bundle_size >> s));
        mmio_wr32(info, 0x4064c8, (state_limit << 16) | token_limit);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
index d1a89b2bd5c1..c4e1f085ee10 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/i2c.c
@@ -74,7 +74,11 @@ dcb_i2c_parse(struct nvkm_bios *bios, u8 idx, struct dcb_i2c_entry *info)
        u16 ent = dcb_i2c_entry(bios, idx, &ver, &len);
        if (ent) {
                if (ver >= 0x41) {
-                        if (!(nv_ro32(bios, ent) & 0x80000000))
+                        u32 ent_value = nv_ro32(bios, ent);
+                        u8 i2c_port = (ent_value >> 27) & 0x1f;
+                        u8 dpaux_port = (ent_value >> 22) & 0x1f;
+                        /* value 0x1f means unused according to DCB 4.x spec */
+                        if (i2c_port == 0x1f && dpaux_port == 0x1f)
                                info->type = DCB_I2C_UNUSED;
                        else
                                info->type = DCB_I2C_PMGR;
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 4cdcaf8361e1..3db23007cdf4 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -153,7 +153,7 @@ void radeon_kfd_device_init(struct radeon_device *rdev)
                        .compute_vmid_bitmap = 0xFF00,
                        .first_compute_pipe = 1,
-                        .compute_pipe_count = 8 - 1,
+                        .compute_pipe_count = 4 - 1,
                };
                radeon_doorbell_get_kfd_info(rdev,
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 43e09942823e..318165d4855c 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
                else
                        rbo->placements[i].lpfn = 0;
        }
-        /*
-         * Use two-ended allocation depending on the buffer size to
-         * improve fragmentation quality.
-         * 512kb was measured as the most optimal number.
-         */
-        if (rbo->tbo.mem.size > 512 * 1024) {
-                for (i = 0; i < c; i++) {
-                        rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
-                }
-        }
 }
 int radeon_bo_create(struct radeon_device *rdev,
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7c669c328c4c..56ce8c2b5530 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1959,6 +1959,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb65a) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 204312bfab2c..9c4786759f16 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -586,6 +586,7 @@
 #define USB_VENDOR_ID_LOGITECH          0x046d
 #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
 #define USB_DEVICE_ID_LOGITECH_T651     0xb00c
+#define USB_DEVICE_ID_LOGITECH_C077     0xc007
 #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
 #define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST  0xc110
 #define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
@@ -898,6 +899,7 @@
 #define USB_VENDOR_ID_TIVO              0x150a
 #define USB_DEVICE_ID_TIVO_SLIDE_BT     0x1200
 #define USB_DEVICE_ID_TIVO_SLIDE        0x1201
+#define USB_DEVICE_ID_TIVO_SLIDE_PRO    0x1203
 #define USB_VENDOR_ID_TOPSEED           0x0766
 #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204
diff --git a/drivers/hid/hid-tivo.c b/drivers/hid/hid-tivo.c
index d790d8d71f7f..d98696927453 100644
--- a/drivers/hid/hid-tivo.c
+++ b/drivers/hid/hid-tivo.c
@@ -64,6 +64,7 @@ static const struct hid_device_id tivo_devices[] = {
        /* TiVo Slide Bluetooth remote, pairs with a Broadcom dongle */
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_BT) },
        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_TIVO, USB_DEVICE_ID_TIVO_SLIDE_PRO) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, tivo_devices);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 9be99a67bfe2..a82127753461 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -78,6 +78,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
        { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 046351cf17f3..bbe32d66e500 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -551,9 +551,13 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
           (features->type == CINTIQ && !(data[1] & 0x40)))
                return 1;
-        if (features->quirks & WACOM_QUIRK_MULTI_INPUT)
+        if (wacom->shared) {
                wacom->shared->stylus_in_proximity = true;
+                if (wacom->shared->touch_down)
+                        return 1;
+        }
        /* in Range while exiting */
        if (((data[1] & 0xfe) == 0x20) && wacom->reporting_data) {
                input_report_key(input, BTN_TOUCH, 0);
@@ -1043,27 +1047,28 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
        struct input_dev *input = wacom->input;
        unsigned char *data = wacom->data;
        int i;
-        int current_num_contacts = 0;
+        int current_num_contacts = data[61];
        int contacts_to_send = 0;
        int num_contacts_left = 4; /* maximum contacts per packet */
        int byte_per_packet = WACOM_BYTES_PER_24HDT_PACKET;
        int y_offset = 2;
+        static int contact_with_no_pen_down_count = 0;
        if (wacom->features.type == WACOM_27QHDT) {
                current_num_contacts = data[63];
                num_contacts_left = 10;
                byte_per_packet = WACOM_BYTES_PER_QHDTHID_PACKET;
                y_offset = 0;
-        } else {
-                current_num_contacts = data[61];
        }
        /*
         * First packet resets the counter since only the first
         * packet in series will have non-zero current_num_contacts.
         */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
        contacts_to_send = min(num_contacts_left, wacom->num_contacts_left);
@@ -1096,15 +1101,16 @@ static int wacom_24hdt_irq(struct wacom_wac *wacom)
                                input_report_abs(input, ABS_MT_WIDTH_MINOR, min(w, h));
                                input_report_abs(input, ABS_MT_ORIENTATION, w > h);
                        }
+                        contact_with_no_pen_down_count++;
                }
        }
        input_mt_report_pointer_emulation(input, true);
        wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left <= 0)
+        if (wacom->num_contacts_left <= 0) {
                wacom->num_contacts_left = 0;
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+        }
        return 1;
 }
@@ -1116,6 +1122,7 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
        int current_num_contacts = data[2];
        int contacts_to_send = 0;
        int x_offset = 0;
+        static int contact_with_no_pen_down_count = 0;
        /* MTTPC does not support Height and Width */
        if (wacom->features.type == MTTPC || wacom->features.type == MTTPC_B)
@@ -1125,8 +1132,10 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
         * First packet resets the counter since only the first
         * packet in series will have non-zero current_num_contacts.
         */
-        if (current_num_contacts)
+        if (current_num_contacts) {
                wacom->num_contacts_left = current_num_contacts;
+                contact_with_no_pen_down_count = 0;
+        }
        /* There are at most 5 contacts per packet */
        contacts_to_send = min(5, wacom->num_contacts_left);
@@ -1147,15 +1156,16 @@ static int wacom_mt_touch(struct wacom_wac *wacom)
                        int y = get_unaligned_le16(&data[offset + x_offset + 9]);
                        input_report_abs(input, ABS_MT_POSITION_X, x);
                        input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                }
        }
        input_mt_report_pointer_emulation(input, true);
        wacom->num_contacts_left -= contacts_to_send;
-        if (wacom->num_contacts_left < 0)
+        if (wacom->num_contacts_left <= 0) {
                wacom->num_contacts_left = 0;
+                wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
-        wacom->shared->touch_down = (wacom->num_contacts_left > 0);
+        }
        return 1;
 }
@@ -1193,29 +1203,25 @@ static int wacom_tpc_single_touch(struct wacom_wac *wacom, size_t len)
 {
        unsigned char *data = wacom->data;
        struct input_dev *input = wacom->input;
-        bool prox;
+        bool prox = !wacom->shared->stylus_in_proximity;
        int x = 0, y = 0;
        if (wacom->features.touch_max > 1 || len > WACOM_PKGLEN_TPC2FG)
                return 0;
-        if (!wacom->shared->stylus_in_proximity) {
+        if (len == WACOM_PKGLEN_TPC1FG) {
-                if (len == WACOM_PKGLEN_TPC1FG) {
+                prox = prox && (data[0] & 0x01);
-                        prox = data[0] & 0x01;
+                x = get_unaligned_le16(&data[1]);
-                        x = get_unaligned_le16(&data[1]);
+                y = get_unaligned_le16(&data[3]);
-                        y = get_unaligned_le16(&data[3]);
+        } else if (len == WACOM_PKGLEN_TPC1FG_B) {
-                } else if (len == WACOM_PKGLEN_TPC1FG_B) {
+                prox = prox && (data[2] & 0x01);
-                        prox = data[2] & 0x01;
+                x = get_unaligned_le16(&data[3]);
-                        x = get_unaligned_le16(&data[3]);
+                y = get_unaligned_le16(&data[5]);
-                        y = get_unaligned_le16(&data[5]);
+        } else {
-                } else {
+                prox = prox && (data[1] & 0x01);
-                        prox = data[1] & 0x01;
+                x = le16_to_cpup((__le16 *)&data[2]);
-                        x = le16_to_cpup((__le16 *)&data[2]);
+                y = le16_to_cpup((__le16 *)&data[4]);
-                        y = le16_to_cpup((__le16 *)&data[4]);
+        }
-                }
-        } else
-                /* force touch out when pen is in prox */
-                prox = 0;
        if (prox) {
                input_report_abs(input, ABS_X, x);
@@ -1613,6 +1619,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
        struct input_dev *pad_input = wacom->pad_input;
        unsigned char *data = wacom->data;
        int i;
+        int contact_with_no_pen_down_count = 0;
        if (data[0] != 0x02)
            return 0;
@@ -1640,6 +1647,7 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
                        }
                        input_report_abs(input, ABS_MT_POSITION_X, x);
                        input_report_abs(input, ABS_MT_POSITION_Y, y);
+                        contact_with_no_pen_down_count++;
                }
        }
@@ -1649,11 +1657,12 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
        input_report_key(pad_input, BTN_FORWARD, (data[1] & 0x04) != 0);
        input_report_key(pad_input, BTN_BACK, (data[1] & 0x02) != 0);
        input_report_key(pad_input, BTN_RIGHT, (data[1] & 0x01) != 0);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
        return 1;
 }
-static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
+static int wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data, int last_touch_count)
 {
        struct wacom_features *features = &wacom->features;
        struct input_dev *input = wacom->input;
@@ -1661,7 +1670,7 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
        int slot = input_mt_get_slot_by_key(input, data[0]);
        if (slot < 0)
-                return;
+                return 0;
        touch = touch && !wacom->shared->stylus_in_proximity;
@@ -1693,7 +1702,9 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
                input_report_abs(input, ABS_MT_POSITION_Y, y);
                input_report_abs(input, ABS_MT_TOUCH_MAJOR, width);
                input_report_abs(input, ABS_MT_TOUCH_MINOR, height);
+                last_touch_count++;
        }
+        return last_touch_count;
 }
 static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
@@ -1718,6 +1729,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
        unsigned char *data = wacom->data;
        int count = data[1] & 0x07;
        int i;
+        int contact_with_no_pen_down_count = 0;
        if (data[0] != 0x02)
            return 0;
@@ -1728,12 +1740,15 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
                int msg_id = data[offset];
                if (msg_id >= 2 && msg_id <= 17)
-                        wacom_bpt3_touch_msg(wacom, data + offset);
+                        contact_with_no_pen_down_count = 
+                            wacom_bpt3_touch_msg(wacom, data + offset,
+                                                 contact_with_no_pen_down_count);
                else if (msg_id == 128)
                        wacom_bpt3_button_msg(wacom, data + offset);
        }
        input_mt_report_pointer_emulation(input, true);
+        wacom->shared->touch_down = (contact_with_no_pen_down_count > 0);
        return 1;
 }
@@ -1759,6 +1774,9 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
                return 0;
        }
+        if (wacom->shared->touch_down)
+                return 0;
        prox = (data[1] & 0x20) == 0x20;
        /*
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 1793aea4a7d2..6eb738ca6d2f 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1793,11 +1793,11 @@ static void idetape_setup(ide_drive_t *drive, idetape_tape_t *tape, int minor)
        tape->best_dsc_rw_freq = clamp_t(unsigned long, t, IDETAPE_DSC_RW_MIN,
                                         IDETAPE_DSC_RW_MAX);
        printk(KERN_INFO "ide-tape: %s <-> %s: %dKBps, %d*%dkB buffer, "
-                "%lums tDSC%s\n",
+                "%ums tDSC%s\n",
                drive->name, tape->name, *(u16 *)&tape->caps[14],
                (*(u16 *)&tape->caps[16] * 512) / tape->buffer_size,
                tape->buffer_size / 1024,
-                tape->best_dsc_rw_freq * 1000 / HZ,
+                jiffies_to_msecs(tape->best_dsc_rw_freq),
                (drive->dev_flags & IDE_DFLAG_USING_DMA) ? ", DMA" : "");
        ide_proc_register_driver(drive, tape->driver);
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index c7619716c31d..59040265e361 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -64,6 +64,14 @@ enum {
 #define GUID_TBL_BLK_NUM_ENTRIES 8
 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
+/* Counters should be saturate once they reach their maximum value */
+#define ASSIGN_32BIT_COUNTER(counter, value) do {\
+        if ((value) > U32_MAX)                   \
+                counter = cpu_to_be32(U32_MAX); \
+        else                                     \
+                counter = cpu_to_be32(value);    \
+} while (0)
 struct mlx4_mad_rcv_buf {
        struct ib_grh grh;
        u8 payload[256];
@@ -806,10 +814,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
 static void edit_counter(struct mlx4_counter *cnt,
                                        struct ib_pma_portcounters *pma_cnt)
 {
-        pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
-        pma_cnt->port_rcv_data  = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
+                             (be64_to_cpu(cnt->tx_bytes) >> 2));
-        pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
-        pma_cnt->port_rcv_packets  = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
+                             (be64_to_cpu(cnt->rx_bytes) >> 2));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
+                             be64_to_cpu(cnt->tx_frames));
+        ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
+                             be64_to_cpu(cnt->rx_frames));
 }
 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ac6e2b710ea6..b972c0b41799 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2697,8 +2697,12 @@ static void handle_bonded_port_state_event(struct work_struct *work)
        spin_lock_bh(&ibdev->iboe.lock);
        for (i = 0; i < MLX4_MAX_PORTS; ++i) {
                struct net_device *curr_netdev = ibdev->iboe.netdevs[i];
+                enum ib_port_state curr_port_state;
-                enum ib_port_state curr_port_state =
+                if (!curr_netdev)
+                        continue;
+                curr_port_state =
                        (netif_running(curr_netdev) &&
                         netif_carrier_ok(curr_netdev)) ?
                        IB_PORT_ACTIVE : IB_PORT_DOWN;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f2cceb6493a0..dda605836546 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -67,9 +67,6 @@
 #define X_MAX_POSITIVE 8176
 #define Y_MAX_POSITIVE 8176
-/* maximum ABS_MT_POSITION displacement (in mm) */
-#define DMAX 10
 /*****************************************************************************
 *      Stuff we need even when we do not want native Synaptics support
 ****************************************************************************/
@@ -123,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
 static bool cr48_profile_sensor;
+#define ANY_BOARD_ID 0
 struct min_max_quirk {
        const char * const *pnp_ids;
+        struct {
+                unsigned long int min, max;
+        } board_id;
        int x_min, x_max, y_min, y_max;
 };
 static const struct min_max_quirk min_max_pnpid_table[] = {
        {
                (const char * const []){"LEN0033", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1024, 5052, 2258, 4832
        },
        {
-                (const char * const []){"LEN0035", "LEN0042", NULL},
+                (const char * const []){"LEN0042", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1232, 5710, 1156, 4696
        },
        {
                (const char * const []){"LEN0034", "LEN0036", "LEN0037",
                                        "LEN0039", "LEN2002", "LEN2004",
                                        NULL},
+                {ANY_BOARD_ID, 2961},
                1024, 5112, 2024, 4832
        },
        {
                (const char * const []){"LEN2001", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1024, 5022, 2508, 4832
        },
        {
                (const char * const []){"LEN2006", NULL},
+                {ANY_BOARD_ID, ANY_BOARD_ID},
                1264, 5675, 1171, 4688
        },
        { }
@@ -175,9 +181,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
        "LEN0041",
        "LEN0042", /* Yoga */
        "LEN0045",
-        "LEN0046",
        "LEN0047",
-        "LEN0048",
        "LEN0049",
        "LEN2000",
        "LEN2001", /* Edge E431 */
@@ -235,18 +239,39 @@ static int synaptics_model_id(struct psmouse *psmouse)
        return 0;
 }
+static int synaptics_more_extended_queries(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        unsigned char buf[3];
+        if (synaptics_send_cmd(psmouse, SYN_QUE_MEXT_CAPAB_10, buf))
+                return -1;
+        priv->ext_cap_10 = (buf[0]<<16) | (buf[1]<<8) | buf[2];
+        return 0;
+}
 /*
- * Read the board id from the touchpad
+ * Read the board id and the "More Extended Queries" from the touchpad
 * The board id is encoded in the "QUERY MODES" response
 */
-static int synaptics_board_id(struct psmouse *psmouse)
+static int synaptics_query_modes(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char bid[3];
+        /* firmwares prior 7.5 have no board_id encoded */
+        if (SYN_ID_FULL(priv->identity) < 0x705)
+                return 0;
        if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
                return -1;
        priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+        if (SYN_MEXT_CAP_BIT(bid[0]))
+                return synaptics_more_extended_queries(psmouse);
        return 0;
 }
@@ -346,7 +371,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
 {
        struct synaptics_data *priv = psmouse->private;
        unsigned char resp[3];
-        int i;
        if (SYN_ID_MAJOR(priv->identity) < 4)
                return 0;
@@ -358,17 +382,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
                }
        }
-        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
-                if (psmouse_matches_pnp_id(psmouse,
-                                           min_max_pnpid_table[i].pnp_ids)) {
-                        priv->x_min = min_max_pnpid_table[i].x_min;
-                        priv->x_max = min_max_pnpid_table[i].x_max;
-                        priv->y_min = min_max_pnpid_table[i].y_min;
-                        priv->y_max = min_max_pnpid_table[i].y_max;
-                        return 0;
-                }
-        }
        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
            SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
@@ -377,23 +390,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
                } else {
                        priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                        priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried max coordinates: x [..%d], y [..%d]\n",
+                                     priv->x_max, priv->y_max);
                }
        }
-        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
+        if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
-            SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
+            (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
+             /*
+              * Firmware v8.1 does not report proper number of extended
+              * capabilities, but has been proven to report correct min
+              * coordinates.
+              */
+             SYN_ID_FULL(priv->identity) == 0x801)) {
                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
                        psmouse_warn(psmouse,
                                     "device claims to have min coordinates query, but I'm not able to read it.\n");
                } else {
                        priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
                        priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
+                        psmouse_info(psmouse,
+                                     "queried min coordinates: x [%d..], y [%d..]\n",
+                                     priv->x_min, priv->y_min);
                }
        }
        return 0;
 }
+/*
+ * Apply quirk(s) if the hardware matches
+ */
+static void synaptics_apply_quirks(struct psmouse *psmouse)
+{
+        struct synaptics_data *priv = psmouse->private;
+        int i;
+        for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+                if (!psmouse_matches_pnp_id(psmouse,
+                                            min_max_pnpid_table[i].pnp_ids))
+                        continue;
+                if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
+                    priv->board_id < min_max_pnpid_table[i].board_id.min)
+                        continue;
+                if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
+                    priv->board_id > min_max_pnpid_table[i].board_id.max)
+                        continue;
+                priv->x_min = min_max_pnpid_table[i].x_min;
+                priv->x_max = min_max_pnpid_table[i].x_max;
+                priv->y_min = min_max_pnpid_table[i].y_min;
+                priv->y_max = min_max_pnpid_table[i].y_max;
+                psmouse_info(psmouse,
+                             "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
+                             priv->x_min, priv->x_max,
+                             priv->y_min, priv->y_max);
+                break;
+        }
+}
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
        if (synaptics_identify(psmouse))
@@ -402,13 +461,15 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
                return -1;
        if (synaptics_firmware_id(psmouse))
                return -1;
-        if (synaptics_board_id(psmouse))
+        if (synaptics_query_modes(psmouse))
                return -1;
        if (synaptics_capability(psmouse))
                return -1;
        if (synaptics_resolution(psmouse))
                return -1;
+        synaptics_apply_quirks(psmouse);
        return 0;
 }
@@ -516,18 +577,22 @@ static int synaptics_is_pt_packet(unsigned char *buf)
        return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4;
 }
-static void synaptics_pass_pt_packet(struct serio *ptport, unsigned char *packet)
+static void synaptics_pass_pt_packet(struct psmouse *psmouse,
+                                     struct serio *ptport,
+                                     unsigned char *packet)
 {
+        struct synaptics_data *priv = psmouse->private;
        struct psmouse *child = serio_get_drvdata(ptport);
        if (child && child->state == PSMOUSE_ACTIVATED) {
-                serio_interrupt(ptport, packet[1], 0);
+                serio_interrupt(ptport, packet[1] | priv->pt_buttons, 0);
                serio_interrupt(ptport, packet[4], 0);
                serio_interrupt(ptport, packet[5], 0);
                if (child->pktsize == 4)
                        serio_interrupt(ptport, packet[2], 0);
-        } else
+        } else {
                serio_interrupt(ptport, packet[1], 0);
+        }
 }
 static void synaptics_pt_activate(struct psmouse *psmouse)
@@ -605,6 +670,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
        }
 }
+static void synaptics_parse_ext_buttons(const unsigned char buf[],
+                                        struct synaptics_data *priv,
+                                        struct synaptics_hw_state *hw)
+{
+        unsigned int ext_bits =
+                (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
+        hw->ext_buttons = buf[4] & ext_mask;
+        hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
+}
 static bool is_forcepad;
 static int synaptics_parse_hw_state(const unsigned char buf[],
@@ -691,28 +768,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
                        hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
                }
-                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+                if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
                    ((buf[0] ^ buf[3]) & 0x02)) {
-                        switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+                        synaptics_parse_ext_buttons(buf, priv, hw);
-                        default:
-                                /*
-                                 * if nExtBtn is greater than 8 it should be
-                                 * considered invalid and treated as 0
-                                 */
-                                break;
-                        case 8:
-                                hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
-                        case 6:
-                                hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
-                        case 4:
-                                hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
-                        case 2:
-                                hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
-                                hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
-                        }
                }
        } else {
                hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
@@ -774,12 +832,54 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
        }
 }
+static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+                                         const struct synaptics_hw_state *hw)
+{
+        struct input_dev *dev = psmouse->dev;
+        struct synaptics_data *priv = psmouse->private;
+        int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
+        char buf[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+        int i;
+        if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
+                return;
+        /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+        if (SYN_ID_FULL(priv->identity) == 0x801 &&
+            !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+                return;
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10)) {
+                for (i = 0; i < ext_bits; i++) {
+                        input_report_key(dev, BTN_0 + 2 * i,
+                                hw->ext_buttons & (1 << i));
+                        input_report_key(dev, BTN_1 + 2 * i,
+                                hw->ext_buttons & (1 << (i + ext_bits)));
+                }
+                return;
+        }
+        /*
+         * This generation of touchpads has the trackstick buttons
+         * physically wired to the touchpad. Re-route them through
+         * the pass-through interface.
+         */
+        if (!priv->pt_port)
+                return;
+        /* The trackstick expects at most 3 buttons */
+        priv->pt_buttons = SYN_CAP_EXT_BUTTON_STICK_L(hw->ext_buttons)      |
+                           SYN_CAP_EXT_BUTTON_STICK_R(hw->ext_buttons) << 1 |
+                           SYN_CAP_EXT_BUTTON_STICK_M(hw->ext_buttons) << 2;
+        synaptics_pass_pt_packet(psmouse, priv->pt_port, buf);
+}
 static void synaptics_report_buttons(struct psmouse *psmouse,
                                     const struct synaptics_hw_state *hw)
 {
        struct input_dev *dev = psmouse->dev;
        struct synaptics_data *priv = psmouse->private;
-        int i;
        input_report_key(dev, BTN_LEFT, hw->left);
        input_report_key(dev, BTN_RIGHT, hw->right);
@@ -792,8 +892,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
                input_report_key(dev, BTN_BACK, hw->down);
        }
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+        synaptics_report_ext_buttons(psmouse, hw);
-                input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
 }
 static void synaptics_report_mt_data(struct psmouse *psmouse,
@@ -813,7 +912,7 @@ static void synaptics_report_mt_data(struct psmouse *psmouse,
                pos[i].y = synaptics_invert_y(hw[i]->y);
        }
-        input_mt_assign_slots(dev, slot, pos, nsemi, DMAX * priv->x_res);
+        input_mt_assign_slots(dev, slot, pos, nsemi, 0);
        for (i = 0; i < nsemi; i++) {
                input_mt_slot(dev, slot[i]);
@@ -1014,7 +1113,8 @@ static psmouse_ret_t synaptics_process_byte(struct psmouse *psmouse)
                if (SYN_CAP_PASS_THROUGH(priv->capabilities) &&
                    synaptics_is_pt_packet(psmouse->packet)) {
                        if (priv->pt_port)
-                                synaptics_pass_pt_packet(priv->pt_port, psmouse->packet);
+                                synaptics_pass_pt_packet(psmouse, priv->pt_port,
+                                                         psmouse->packet);
                } else
                        synaptics_process_packet(psmouse);
@@ -1116,8 +1216,9 @@ static void set_input_params(struct psmouse *psmouse,
                __set_bit(BTN_BACK, dev->keybit);
        }
-        for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+        if (!SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
-                __set_bit(BTN_0 + i, dev->keybit);
+                for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+                        __set_bit(BTN_0 + i, dev->keybit);
        __clear_bit(EV_REL, dev->evbit);
        __clear_bit(REL_X, dev->relbit);
@@ -1125,7 +1226,8 @@ static void set_input_params(struct psmouse *psmouse,
        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
                __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit);
-                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids))
+                if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+                    !SYN_CAP_EXT_BUTTONS_STICK(priv->ext_cap_10))
                        __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit);
                /* Clickpads report only left button */
                __clear_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index aedc3299b14e..ee4bd0d12b26 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -22,6 +22,7 @@
 #define SYN_QUE_EXT_CAPAB_0C            0x0c
 #define SYN_QUE_EXT_MAX_COORDS          0x0d
 #define SYN_QUE_EXT_MIN_COORDS          0x0f
+#define SYN_QUE_MEXT_CAPAB_10           0x10
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -53,6 +54,7 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_MEXT_CAP_BIT(m)             ((m) & (1 << 1))
 /*
 * The following describes response for the 0x0c query.
@@ -89,6 +91,30 @@
 #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
 #define SYN_CAP_IMAGE_SENSOR(ex0c)      ((ex0c) & 0x000800)
+/*
+ * The following descibes response for the 0x10 query.
+ *
+ * byte mask    name                    meaning
+ * ---- ----    -------                 ------------
+ * 1    0x01    ext buttons are stick   buttons exported in the extended
+ *                                      capability are actually meant to be used
+ *                                      by the tracktick (pass-through).
+ * 1    0x02    SecurePad               the touchpad is a SecurePad, so it
+ *                                      contains a built-in fingerprint reader.
+ * 1    0xe0    more ext count          how many more extented queries are
+ *                                      available after this one.
+ * 2    0xff    SecurePad width         the width of the SecurePad fingerprint
+ *                                      reader.
+ * 3    0xff    SecurePad height        the height of the SecurePad fingerprint
+ *                                      reader.
+ */
+#define SYN_CAP_EXT_BUTTONS_STICK(ex10) ((ex10) & 0x010000)
+#define SYN_CAP_SECUREPAD(ex10)         ((ex10) & 0x020000)
+#define SYN_CAP_EXT_BUTTON_STICK_L(eb)  (!!((eb) & 0x01))
+#define SYN_CAP_EXT_BUTTON_STICK_M(eb)  (!!((eb) & 0x02))
+#define SYN_CAP_EXT_BUTTON_STICK_R(eb)  (!!((eb) & 0x04))
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
 #define SYN_MODE_RATE(m)                ((m) & (1 << 6))
@@ -143,6 +169,7 @@ struct synaptics_data {
        unsigned long int capabilities;         /* Capabilities */
        unsigned long int ext_cap;              /* Extended Capabilities */
        unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
+        unsigned long int ext_cap_10;           /* Ext Caps from 0x10 query */
        unsigned long int identity;             /* Identification */
        unsigned int x_res, y_res;              /* X/Y resolution in units/mm */
        unsigned int x_max, y_max;              /* Max coordinates (from FW) */
@@ -156,6 +183,7 @@ struct synaptics_data {
        bool disable_gesture;                   /* disable gestures */
        struct serio *pt_port;                  /* Pass-through serio port */
+        unsigned char pt_buttons;               /* Pass-through buttons */
        /*
         * Last received Advanced Gesture Mode (AGM) packet. An AGM packet
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6a7447c304ac..358a574d9e8b 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1609,7 +1609,7 @@ icn_setup(char *line)
        if (ints[0] > 1)
                membase = (unsigned long)ints[2];
        if (str && *str) {
-                strcpy(sid, str);
+                strlcpy(sid, str, sizeof(sid));
                icn_id = sid;
                if ((p = strchr(sid, ','))) {
                        *p++ = 0;
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 37de0173b6d2..74adcd2c967e 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -289,9 +289,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
        struct request_queue *q = bdev_get_queue(where->bdev);
        unsigned short logical_block_size = queue_logical_block_size(q);
        sector_t num_sectors;
+        unsigned int uninitialized_var(special_cmd_max_sectors);
-        /* Reject unsupported discard requests */
+        /*
-        if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
+         * Reject unsupported discard and write same requests.
+         */
+        if (rw & REQ_DISCARD)
+                special_cmd_max_sectors = q->limits.max_discard_sectors;
+        else if (rw & REQ_WRITE_SAME)
+                special_cmd_max_sectors = q->limits.max_write_same_sectors;
+        if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
                dec_count(io, region, -EOPNOTSUPP);
                return;
        }
@@ -317,7 +324,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                store_io_and_region_in_bio(bio, io, region);
                if (rw & REQ_DISCARD) {
-                        num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+                        num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
                        bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
                        remaining -= num_sectors;
                } else if (rw & REQ_WRITE_SAME) {
@@ -326,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                         */
                        dp->get_page(dp, &page, &len, &offset);
                        bio_add_page(bio, page, logical_block_size, offset);
-                        num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
+                        num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
                        bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
                        offset = 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 8b204ae216ab..f83a0f3fc365 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -20,6 +20,8 @@
 #include <linux/log2.h>
 #include <linux/dm-kcopyd.h>
+#include "dm.h"
 #include "dm-exception-store.h"
 #define DM_MSG_PREFIX "snapshots"
@@ -291,12 +293,23 @@ struct origin {
 };
 /*
+ * This structure is allocated for each origin target
+ */
+struct dm_origin {
+        struct dm_dev *dev;
+        struct dm_target *ti;
+        unsigned split_boundary;
+        struct list_head hash_list;
+};
+/*
 * Size of the hash table for origin volumes. If we make this
 * the size of the minors list then it should be nearly perfect
 */
 #define ORIGIN_HASH_SIZE 256
 #define ORIGIN_MASK      0xFF
 static struct list_head *_origins;
+static struct list_head *_dm_origins;
 static struct rw_semaphore _origins_lock;
 static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
@@ -310,12 +323,22 @@ static int init_origin_hash(void)
        _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
                           GFP_KERNEL);
        if (!_origins) {
-                DMERR("unable to allocate memory");
+                DMERR("unable to allocate memory for _origins");
                return -ENOMEM;
        }
        for (i = 0; i < ORIGIN_HASH_SIZE; i++)
                INIT_LIST_HEAD(_origins + i);
+        _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+                              GFP_KERNEL);
+        if (!_dm_origins) {
+                DMERR("unable to allocate memory for _dm_origins");
+                kfree(_origins);
+                return -ENOMEM;
+        }
+        for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+                INIT_LIST_HEAD(_dm_origins + i);
        init_rwsem(&_origins_lock);
        return 0;
@@ -324,6 +347,7 @@ static int init_origin_hash(void)
 static void exit_origin_hash(void)
 {
        kfree(_origins);
+        kfree(_dm_origins);
 }
 static unsigned origin_hash(struct block_device *bdev)
@@ -350,6 +374,30 @@ static void __insert_origin(struct origin *o)
        list_add_tail(&o->hash_list, sl);
 }
+static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
+{
+        struct list_head *ol;
+        struct dm_origin *o;
+        ol = &_dm_origins[origin_hash(origin)];
+        list_for_each_entry (o, ol, hash_list)
+                if (bdev_equal(o->dev->bdev, origin))
+                        return o;
+        return NULL;
+}
+static void __insert_dm_origin(struct dm_origin *o)
+{
+        struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
+        list_add_tail(&o->hash_list, sl);
+}
+static void __remove_dm_origin(struct dm_origin *o)
+{
+        list_del(&o->hash_list);
+}
 /*
 * _origins_lock must be held when calling this function.
 * Returns number of snapshots registered using the supplied cow device, plus:
@@ -1840,9 +1888,40 @@ static int snapshot_preresume(struct dm_target *ti)
 static void snapshot_resume(struct dm_target *ti)
 {
        struct dm_snapshot *s = ti->private;
-        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+        struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
+        struct dm_origin *o;
+        struct mapped_device *origin_md = NULL;
+        bool must_restart_merging = false;
        down_read(&_origins_lock);
+        o = __lookup_dm_origin(s->origin->bdev);
+        if (o)
+                origin_md = dm_table_get_md(o->ti->table);
+        if (!origin_md) {
+                (void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
+                if (snap_merging)
+                        origin_md = dm_table_get_md(snap_merging->ti->table);
+        }
+        if (origin_md == dm_table_get_md(ti->table))
+                origin_md = NULL;
+        if (origin_md) {
+                if (dm_hold(origin_md))
+                        origin_md = NULL;
+        }
+        up_read(&_origins_lock);
+        if (origin_md) {
+                dm_internal_suspend_fast(origin_md);
+                if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
+                        must_restart_merging = true;
+                        stop_merge(snap_merging);
+                }
+        }
+        down_read(&_origins_lock);
        (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
        if (snap_src && snap_dest) {
                down_write(&snap_src->lock);
@@ -1851,8 +1930,16 @@ static void snapshot_resume(struct dm_target *ti)
                up_write(&snap_dest->lock);
                up_write(&snap_src->lock);
        }
        up_read(&_origins_lock);
+        if (origin_md) {
+                if (must_restart_merging)
+                        start_merge(snap_merging);
+                dm_internal_resume_fast(origin_md);
+                dm_put(origin_md);
+        }
        /* Now we have correct chunk size, reregister */
        reregister_snapshot(s);
@@ -2133,11 +2220,6 @@ static int origin_write_extent(struct dm_snapshot *merging_snap,
 * Origin: maps a linear range of a device, with hooks for snapshotting.
 */
-struct dm_origin {
-        struct dm_dev *dev;
-        unsigned split_boundary;
-};
 /*
 * Construct an origin mapping: <dev_path>
 * The context for an origin is merely a 'struct dm_dev *'
@@ -2166,6 +2248,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                goto bad_open;
        }
+        o->ti = ti;
        ti->private = o;
        ti->num_flush_bios = 1;
@@ -2180,6 +2263,7 @@ bad_alloc:
 static void origin_dtr(struct dm_target *ti)
 {
        struct dm_origin *o = ti->private;
        dm_put_device(ti, o->dev);
        kfree(o);
 }
@@ -2216,6 +2300,19 @@ static void origin_resume(struct dm_target *ti)
        struct dm_origin *o = ti->private;
        o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
+        down_write(&_origins_lock);
+        __insert_dm_origin(o);
+        up_write(&_origins_lock);
+}
+static void origin_postsuspend(struct dm_target *ti)
+{
+        struct dm_origin *o = ti->private;
+        down_write(&_origins_lock);
+        __remove_dm_origin(o);
+        up_write(&_origins_lock);
 }
 static void origin_status(struct dm_target *ti, status_type_t type,
@@ -2258,12 +2355,13 @@ static int origin_iterate_devices(struct dm_target *ti,
 static struct target_type origin_target = {
        .name    = "snapshot-origin",
-        .version = {1, 8, 1},
+        .version = {1, 9, 0},
        .module  = THIS_MODULE,
        .ctr     = origin_ctr,
        .dtr     = origin_dtr,
        .map     = origin_map,
        .resume  = origin_resume,
+        .postsuspend = origin_postsuspend,
        .status  = origin_status,
        .merge   = origin_merge,
        .iterate_devices = origin_iterate_devices,
@@ -2271,7 +2369,7 @@ static struct target_type origin_target = {
 static struct target_type snapshot_target = {
        .name    = "snapshot",
-        .version = {1, 12, 0},
+        .version = {1, 13, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
@@ -2285,7 +2383,7 @@ static struct target_type snapshot_target = {
 static struct target_type merge_target = {
        .name    = dm_snapshot_merge_target_name,
-        .version = {1, 2, 0},
+        .version = {1, 3, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 654773cb1eee..921aafd12aee 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2358,17 +2358,6 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                return DM_MAPIO_REMAPPED;
        case -ENODATA:
-                if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
-                        /*
-                         * This block isn't provisioned, and we have no way
-                         * of doing so.
-                         */
-                        handle_unserviceable_bio(tc->pool, bio);
-                        cell_defer_no_holder(tc, virt_cell);
-                        return DM_MAPIO_SUBMITTED;
-                }
-                /* fall through */
        case -EWOULDBLOCK:
                thin_defer_cell(tc, virt_cell);
                return DM_MAPIO_SUBMITTED;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 73f28802dc7a..8001fe9e3434 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
        dm_get(md);
        atomic_inc(&md->open_count);
 out:
        spin_unlock(&_minor_lock);
@@ -442,16 +441,20 @@ out:
 static void dm_blk_close(struct gendisk *disk, fmode_t mode)
 {
-        struct mapped_device *md = disk->private_data;
+        struct mapped_device *md;
        spin_lock(&_minor_lock);
+        md = disk->private_data;
+        if (WARN_ON(!md))
+                goto out;
        if (atomic_dec_and_test(&md->open_count) &&
            (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))
                queue_work(deferred_remove_workqueue, &deferred_remove_work);
        dm_put(md);
+out:
        spin_unlock(&_minor_lock);
 }
@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md)
        int minor = MINOR(disk_devt(md->disk));
        unlock_fs(md);
-        bdput(md->bdev);
        destroy_workqueue(md->wq);
        if (md->kworker_task)
@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md)
                mempool_destroy(md->rq_pool);
        if (md->bs)
                bioset_free(md->bs);
-        blk_integrity_unregister(md->disk);
-        del_gendisk(md->disk);
        cleanup_srcu_struct(&md->io_barrier);
        free_table_devices(&md->table_devices);
-        free_minor(minor);
+        dm_stats_cleanup(&md->stats);
        spin_lock(&_minor_lock);
        md->disk->private_data = NULL;
        spin_unlock(&_minor_lock);
+        if (blk_get_integrity(md->disk))
+                blk_integrity_unregister(md->disk);
+        del_gendisk(md->disk);
        put_disk(md->disk);
        blk_cleanup_queue(md->queue);
-        dm_stats_cleanup(&md->stats);
+        bdput(md->bdev);
+        free_minor(minor);
        module_put(THIS_MODULE);
        kfree(md);
 }
@@ -2616,6 +2621,19 @@ void dm_get(struct mapped_device *md)
        BUG_ON(test_bit(DMF_FREEING, &md->flags));
 }
+int dm_hold(struct mapped_device *md)
+{
+        spin_lock(&_minor_lock);
+        if (test_bit(DMF_FREEING, &md->flags)) {
+                spin_unlock(&_minor_lock);
+                return -EBUSY;
+        }
+        dm_get(md);
+        spin_unlock(&_minor_lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dm_hold);
 const char *dm_device_name(struct mapped_device *md)
 {
        return md->name;
@@ -2629,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
        might_sleep();
-        spin_lock(&_minor_lock);
        map = dm_get_live_table(md, &srcu_idx);
+        spin_lock(&_minor_lock);
        idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
        set_bit(DMF_FREEING, &md->flags);
        spin_unlock(&_minor_lock);
@@ -2638,10 +2657,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
        if (dm_request_based(md))
                flush_kthread_worker(&md->kworker);
+        /*
+         * Take suspend_lock so that presuspend and postsuspend methods
+         * do not race with internal suspend.
+         */
+        mutex_lock(&md->suspend_lock);
        if (!dm_suspended_md(md)) {
                dm_table_presuspend_targets(map);
                dm_table_postsuspend_targets(map);
        }
+        mutex_unlock(&md->suspend_lock);
        /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
        dm_put_live_table(md, srcu_idx);
@@ -3115,6 +3140,7 @@ void dm_internal_suspend_fast(struct mapped_device *md)
        flush_workqueue(md->wq);
        dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
 }
+EXPORT_SYMBOL_GPL(dm_internal_suspend_fast);
 void dm_internal_resume_fast(struct mapped_device *md)
 {
@@ -3126,6 +3152,7 @@ void dm_internal_resume_fast(struct mapped_device *md)
 done:
        mutex_unlock(&md->suspend_lock);
 }
+EXPORT_SYMBOL_GPL(dm_internal_resume_fast);
 /*-----------------------------------------------------------------
 * Event notification.
diff --git a/drivers/md/md.c b/drivers/md/md.c
index cadf9cc02b25..717daad71fb1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5080,7 +5080,8 @@ int md_run(struct mddev *mddev)
        }
        if (err) {
                mddev_detach(mddev);
-                pers->free(mddev, mddev->private);
+                if (mddev->private)
+                        pers->free(mddev, mddev->private);
                module_put(pers->owner);
                bitmap_destroy(mddev);
                return err;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index a13f738a7b39..3ed9f42ddca6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -467,8 +467,6 @@ static int raid0_run(struct mddev *mddev)
        dump_zones(mddev);
        ret = md_integrity_register(mddev);
-        if (ret)
-                raid0_free(mddev, conf);
        return ret;
 }
diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
index f38ec424872e..5615522f8d62 100644
--- a/drivers/mfd/kempld-core.c
+++ b/drivers/mfd/kempld-core.c
@@ -739,7 +739,7 @@ static int __init kempld_init(void)
                for (id = kempld_dmi_table;
                     id->matches[0].slot != DMI_NONE; id++)
                        if (strstr(id->ident, force_device_id))
-                                if (id->callback && id->callback(id))
+                                if (id->callback && !id->callback(id))
                                        break;
                if (id->matches[0].slot == DMI_NONE)
                        return -ENODEV;
diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
index ede50244f265..dbd907d7170e 100644
--- a/drivers/mfd/rtsx_usb.c
+++ b/drivers/mfd/rtsx_usb.c
@@ -196,18 +196,27 @@ EXPORT_SYMBOL_GPL(rtsx_usb_ep0_write_register);
 int rtsx_usb_ep0_read_register(struct rtsx_ucr *ucr, u16 addr, u8 *data)
 {
        u16 value;
+        u8 *buf;
+        int ret;
        if (!data)
                return -EINVAL;
-        *data = 0;
+        buf = kzalloc(sizeof(u8), GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
        addr |= EP0_READ_REG_CMD << EP0_OP_SHIFT;
        value = swab16(addr);
-        return usb_control_msg(ucr->pusb_dev,
+        ret = usb_control_msg(ucr->pusb_dev,
                        usb_rcvctrlpipe(ucr->pusb_dev, 0), RTSX_USB_REQ_REG_OP,
                        USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                        value, 0, data, 1, 100);
+                        value, 0, buf, 1, 100);
+        *data = *buf;
+        kfree(buf);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(rtsx_usb_ep0_read_register);
@@ -288,18 +297,27 @@ static int rtsx_usb_get_status_with_bulk(struct rtsx_ucr *ucr, u16 *status)
 int rtsx_usb_get_card_status(struct rtsx_ucr *ucr, u16 *status)
 {
        int ret;
+        u16 *buf;
        if (!status)
                return -EINVAL;
-        if (polling_pipe == 0)
+        if (polling_pipe == 0) {
+                buf = kzalloc(sizeof(u16), GFP_KERNEL);
+                if (!buf)
+                        return -ENOMEM;
                ret = usb_control_msg(ucr->pusb_dev,
                                usb_rcvctrlpipe(ucr->pusb_dev, 0),
                                RTSX_USB_REQ_POLL,
                                USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                0, 0, status, 2, 100);
+                                0, 0, buf, 2, 100);
-        else
+                *status = *buf;
+                kfree(buf);
+        } else {
                ret = rtsx_usb_get_status_with_bulk(ucr, status);
+        }
        /* usb_control_msg may return positive when success */
        if (ret < 0)
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index e9f1d8d84613..c53f14a7ce54 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -124,7 +124,7 @@ int mmc_pwrseq_simple_alloc(struct mmc_host *host, struct device *dev)
                    PTR_ERR(pwrseq->reset_gpios[i]) != -ENOSYS) {
                        ret = PTR_ERR(pwrseq->reset_gpios[i]);
-                        while (--i)
+                        while (i--)
                                gpiod_put(pwrseq->reset_gpios[i]);
                        goto clk_put;
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index da4c79259f67..16e34b37d134 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -425,9 +425,10 @@ retry:
                                        ubi_warn(ubi, "corrupted VID header at PEB %d, LEB %d:%d",
                                                 pnum, vol_id, lnum);
                                        err = -EBADMSG;
-                                } else
+                                } else {
                                        err = -EINVAL;
                                        ubi_ro_mode(ubi);
+                                }
                        }
                        goto out_free;
                } else if (err == UBI_IO_BITFLIPS)
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index 98d73aab52fe..58808f651452 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -131,7 +131,7 @@ config CAN_RCAR
 config CAN_XILINXCAN
        tristate "Xilinx CAN"
-        depends on ARCH_ZYNQ || MICROBLAZE || COMPILE_TEST
+        depends on ARCH_ZYNQ || ARM64 || MICROBLAZE || COMPILE_TEST
        depends on COMMON_CLK && HAS_IOMEM
        ---help---
          Xilinx CAN driver. This driver supports both soft AXI CAN IP and
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index a316fa4b91ab..e97a08ce0b90 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -14,6 +14,7 @@
 * Copyright (C) 2015 Valeo S.A.
 */
+#include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/completion.h>
 #include <linux/module.h>
@@ -467,10 +468,11 @@ struct kvaser_usb {
 struct kvaser_usb_net_priv {
        struct can_priv can;
-        atomic_t active_tx_urbs;
+        spinlock_t tx_contexts_lock;
-        struct usb_anchor tx_submitted;
+        int active_tx_contexts;
        struct kvaser_usb_tx_urb_context tx_contexts[MAX_TX_URBS];
+        struct usb_anchor tx_submitted;
        struct completion start_comp, stop_comp;
        struct kvaser_usb *dev;
@@ -694,6 +696,7 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
        struct kvaser_usb_net_priv *priv;
        struct sk_buff *skb;
        struct can_frame *cf;
+        unsigned long flags;
        u8 channel, tid;
        channel = msg->u.tx_acknowledge_header.channel;
@@ -737,12 +740,15 @@ static void kvaser_usb_tx_acknowledge(const struct kvaser_usb *dev,
        stats->tx_packets++;
        stats->tx_bytes += context->dlc;
-        can_get_echo_skb(priv->netdev, context->echo_index);
-        context->echo_index = MAX_TX_URBS;
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
-        atomic_dec(&priv->active_tx_urbs);
+        can_get_echo_skb(priv->netdev, context->echo_index);
+        context->echo_index = MAX_TX_URBS;
+        --priv->active_tx_contexts;
        netif_wake_queue(priv->netdev);
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
 }
 static void kvaser_usb_simple_msg_callback(struct urb *urb)
@@ -803,17 +809,6 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv,
        return 0;
 }
-static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
-{
-        int i;
-        usb_kill_anchored_urbs(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-        for (i = 0; i < MAX_TX_URBS; i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
-}
 static void kvaser_usb_rx_error_update_can_state(struct kvaser_usb_net_priv *priv,
                                                 const struct kvaser_usb_error_summary *es,
                                                 struct can_frame *cf)
@@ -1515,6 +1510,24 @@ error:
        return err;
 }
+static void kvaser_usb_reset_tx_urb_contexts(struct kvaser_usb_net_priv *priv)
+{
+        int i;
+        priv->active_tx_contexts = 0;
+        for (i = 0; i < MAX_TX_URBS; i++)
+                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
+}
+/* This method might sleep. Do not call it in the atomic context
+ * of URB completions.
+ */
+static void kvaser_usb_unlink_tx_urbs(struct kvaser_usb_net_priv *priv)
+{
+        usb_kill_anchored_urbs(&priv->tx_submitted);
+        kvaser_usb_reset_tx_urb_contexts(priv);
+}
 static void kvaser_usb_unlink_all_urbs(struct kvaser_usb *dev)
 {
        int i;
@@ -1634,6 +1647,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        struct kvaser_msg *msg;
        int i, err, ret = NETDEV_TX_OK;
        u8 *msg_tx_can_flags = NULL;            /* GCC */
+        unsigned long flags;
        if (can_dropped_invalid_skb(netdev, skb))
                return NETDEV_TX_OK;
@@ -1687,12 +1701,21 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        if (cf->can_id & CAN_RTR_FLAG)
                *msg_tx_can_flags |= MSG_FLAG_REMOTE_FRAME;
+        spin_lock_irqsave(&priv->tx_contexts_lock, flags);
        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++) {
                if (priv->tx_contexts[i].echo_index == MAX_TX_URBS) {
                        context = &priv->tx_contexts[i];
+                        context->echo_index = i;
+                        can_put_echo_skb(skb, netdev, context->echo_index);
+                        ++priv->active_tx_contexts;
+                        if (priv->active_tx_contexts >= MAX_TX_URBS)
+                                netif_stop_queue(netdev);
                        break;
                }
        }
+        spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
        /* This should never happen; it implies a flow control bug */
        if (!context) {
@@ -1704,7 +1727,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
        }
        context->priv = priv;
-        context->echo_index = i;
        context->dlc = cf->can_dlc;
        msg->u.tx_can.tid = context->echo_index;
@@ -1716,18 +1738,17 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
                          kvaser_usb_write_bulk_callback, context);
        usb_anchor_urb(urb, &priv->tx_submitted);
-        can_put_echo_skb(skb, netdev, context->echo_index);
-        atomic_inc(&priv->active_tx_urbs);
-        if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
-                netif_stop_queue(netdev);
        err = usb_submit_urb(urb, GFP_ATOMIC);
        if (unlikely(err)) {
+                spin_lock_irqsave(&priv->tx_contexts_lock, flags);
                can_free_echo_skb(netdev, context->echo_index);
+                context->echo_index = MAX_TX_URBS;
+                --priv->active_tx_contexts;
+                netif_wake_queue(netdev);
+                spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
-                atomic_dec(&priv->active_tx_urbs);
                usb_unanchor_urb(urb);
                stats->tx_dropped++;
@@ -1854,7 +1875,7 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        struct kvaser_usb *dev = usb_get_intfdata(intf);
        struct net_device *netdev;
        struct kvaser_usb_net_priv *priv;
-        int i, err;
+        int err;
        err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
        if (err)
@@ -1868,19 +1889,17 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
        priv = netdev_priv(netdev);
+        init_usb_anchor(&priv->tx_submitted);
        init_completion(&priv->start_comp);
        init_completion(&priv->stop_comp);
-        init_usb_anchor(&priv->tx_submitted);
-        atomic_set(&priv->active_tx_urbs, 0);
-        for (i = 0; i < ARRAY_SIZE(priv->tx_contexts); i++)
-                priv->tx_contexts[i].echo_index = MAX_TX_URBS;
        priv->dev = dev;
        priv->netdev = netdev;
        priv->channel = channel;
+        spin_lock_init(&priv->tx_contexts_lock);
+        kvaser_usb_reset_tx_urb_contexts(priv);
        priv->can.state = CAN_STATE_STOPPED;
        priv->can.clock.freq = CAN_USB_CLOCK;
        priv->can.bittiming_const = &kvaser_usb_bittiming_const;
diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 11d6e6561df1..15a8190a6f75 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
        struct pcnet32_private *lp;
        int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
        int chip_version;
        char *chipname;
        struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        }
        /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
        chip_version = (chip_version >> 12) & 0xffff;
        switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                chipname = "PCnet/FAST III 79C973";     /* PCI */
                fdx = 1;
                mii = 1;
+                sram = 1;
                break;
        case 0x2626:
                chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                chipname = "PCnet/FAST III 79C975";     /* PCI */
                fdx = 1;
                mii = 1;
+                sram = 1;
                break;
        case 0x2628:
                chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                dxsuflo = 1;
        }
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
        dev = alloc_etherdev(sizeof(*lp));
        if (!dev) {
                ret = -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index bef750a09027..996e215fc324 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12769,7 +12769,7 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
                NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6 |
                NETIF_F_RXCSUM | NETIF_F_LRO | NETIF_F_GRO |
                NETIF_F_RXHASH | NETIF_F_HW_VLAN_CTAG_TX;
-        if (!CHIP_IS_E1x(bp)) {
+        if (!chip_is_e1x) {
                dev->hw_features |= NETIF_F_GSO_GRE | NETIF_F_GSO_UDP_TUNNEL |
                                    NETIF_F_GSO_IPIP | NETIF_F_GSO_SIT;
                dev->hw_enc_features =
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 853c38997c82..1abdfa123c6c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -1120,7 +1120,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
                }
                /* Installed successfully, update the cached header too. */
-                memcpy(card_fw, fs_fw, sizeof(*card_fw));
+                *card_fw = *fs_fw;
                card_fw_usable = 1;
                *reset = 0;     /* already reset as part of load_fw */
        }
diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c
index 3b42556f7f8d..ed41559bae77 100644
--- a/drivers/net/ethernet/dec/tulip/tulip_core.c
+++ b/drivers/net/ethernet/dec/tulip/tulip_core.c
@@ -589,7 +589,7 @@ static void tulip_tx_timeout(struct net_device *dev)
                               (unsigned int)tp->rx_ring[i].buffer1,
                               (unsigned int)tp->rx_ring[i].buffer2,
                               buf[0], buf[1], buf[2]);
-                        for (j = 0; buf[j] != 0xee && j < 1600; j++)
+                        for (j = 0; ((j < 1600) && buf[j] != 0xee); j++)
                                if (j < 100)
                                        pr_cont(" %02x", buf[j]);
                        pr_cont(" j=%d\n", j);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 27de37aa90af..27b9fe99a9bd 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -354,6 +354,7 @@ struct be_vf_cfg {
        u16 vlan_tag;
        u32 tx_rate;
        u32 plink_tracking;
+        u32 privileges;
 };
 enum vf_state {
@@ -423,6 +424,7 @@ struct be_adapter {
        u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
        u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
        struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
        struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 36916cfa70f9..7f05f309e935 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1902,15 +1902,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
        int num_eqs, i = 0;
-        if (lancer_chip(adapter) && num > 8) {
+        while (num) {
-                while (num) {
+                num_eqs = min(num, 8);
-                        num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
-                        i += num_eqs;
+                num -= num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
        }
        return 0;
@@ -1918,7 +1914,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_vlan_config *req;
@@ -1936,6 +1932,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
        be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                               OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                               wrb, NULL);
+        req->hdr.domain = domain;
        req->interface_id = if_id;
        req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index db761e8e42a3..a7634a3f052a 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2256,7 +2256,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0a816859aca5..e6b790f0d9dc 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1171,7 +1171,7 @@ static int be_vid_config(struct be_adapter *adapter)
        for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                vids[num++] = cpu_to_le16(i);
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
        if (status) {
                dev_err(dev, "Setting HW VLAN filtering failed\n");
                /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1380,11 +1380,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
        return 0;
 }
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
        struct be_adapter *adapter = netdev_priv(netdev);
        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
        if (!sriov_enabled(adapter))
                return -EPERM;
@@ -1394,24 +1450,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
        if (vlan || qos) {
                vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
+                status = be_set_vf_tvt(adapter, vf, vlan);
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
        } else {
-                /* Reset Transparent Vlan Tagging. */
+                status = be_clear_vf_tvt(adapter, vf);
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
        }
        if (status) {
                dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
-                        vf, status);
+                        status);
                return be_cmd_status(status);
        }
        vf_cfg->vlan_tag = vlan;
        return 0;
 }
@@ -2772,14 +2823,12 @@ void be_detect_error(struct be_adapter *adapter)
                        }
                }
        } else {
-                pci_read_config_dword(adapter->pdev,
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
-                pci_read_config_dword(adapter->pdev,
+                ue_lo_mask = ioread32(adapter->pcicfg +
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
+                                      PCICFG_UE_STATUS_LOW_MASK);
-                pci_read_config_dword(adapter->pdev,
+                ue_hi_mask = ioread32(adapter->pcicfg +
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
+                                      PCICFG_UE_STATUS_HI_MASK);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
                ue_lo = (ue_lo & ~ue_lo_mask);
                ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3339,7 +3388,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                        u32 cap_flags, u32 vf)
 {
        u32 en_flags;
-        int status;
        en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                   BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3347,10 +3395,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
        en_flags &= cap_flags;
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
-                                  if_handle, vf);
-        return status;
 }
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3368,8 +3413,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                if (!BE3_chip(adapter)) {
                        status = be_cmd_get_profile_config(adapter, &res,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
                                cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                }
                status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3403,7 +3453,6 @@ static int be_vf_setup(struct be_adapter *adapter)
        struct device *dev = &adapter->pdev->dev;
        struct be_vf_cfg *vf_cfg;
        int status, old_vfs, vf;
-        u32 privileges;
        old_vfs = pci_num_vf(adapter->pdev);
@@ -3433,15 +3482,18 @@ static int be_vf_setup(struct be_adapter *adapter)
        for_all_vfs(adapter, vf_cfg, vf) {
                /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                        status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                          BE_PRIV_FILTMGMT,
                                                          vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                         vf);
+                        }
                }
                /* Allow full available bandwidth */
@@ -4820,24 +4872,37 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
        u8 __iomem *addr;
        if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                if (!adapter->csr)
                        return -ENOMEM;
        }
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
        if (!addr)
                goto pci_map_err;
        adapter->db = addr;
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
        be_roce_map_pci_bars(adapter);
        return 0;
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
        be_unmap_pci_bars(adapter);
        return -ENOMEM;
 }
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 99492b7e3713..78e1ce09b1ab 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1189,13 +1189,12 @@ static void
 fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
 {
        struct  fec_enet_private *fep;
-        struct bufdesc *bdp, *bdp_t;
+        struct bufdesc *bdp;
        unsigned short status;
        struct  sk_buff *skb;
        struct fec_enet_priv_tx_q *txq;
        struct netdev_queue *nq;
        int     index = 0;
-        int     i, bdnum;
        int     entries_free;
        fep = netdev_priv(ndev);
@@ -1216,29 +1215,18 @@ fec_enet_tx_queue(struct net_device *ndev, u16 queue_id)
                if (bdp == txq->cur_tx)
                        break;
-                bdp_t = bdp;
+                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp, fep);
-                bdnum = 1;
-                index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                skb = txq->tx_skbuff[index];
-                while (!skb) {
-                        bdp_t = fec_enet_get_nextdesc(bdp_t, fep, queue_id);
-                        index = fec_enet_get_bd_index(txq->tx_bd_base, bdp_t, fep);
-                        skb = txq->tx_skbuff[index];
-                        bdnum++;
-                }
-                if (skb_shinfo(skb)->nr_frags &&
-                    (status = bdp_t->cbd_sc) & BD_ENET_TX_READY)
-                        break;
-                for (i = 0; i < bdnum; i++) {
+                skb = txq->tx_skbuff[index];
-                        if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
-                                dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
-                                                 bdp->cbd_datlen, DMA_TO_DEVICE);
-                        bdp->cbd_bufaddr = 0;
-                        if (i < bdnum - 1)
-                                bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
-                }
                txq->tx_skbuff[index] = NULL;
+                if (!IS_TSO_HEADER(txq, bdp->cbd_bufaddr))
+                        dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
+                                        bdp->cbd_datlen, DMA_TO_DEVICE);
+                bdp->cbd_bufaddr = 0;
+                if (!skb) {
+                        bdp = fec_enet_get_nextdesc(bdp, fep, queue_id);
+                        continue;
+                }
                /* Check for errors. */
                if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
@@ -1479,8 +1467,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                        vlan_packet_rcvd = true;
-                        skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
+                        memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
-                                                       data, (2 * ETH_ALEN));
                        skb_pull(skb, VLAN_HLEN);
                }
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 072426a72745..cd7675ac5bf9 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1136,6 +1136,8 @@ restart_poll:
        ibmveth_replenish_task(adapter);
        if (frames_processed < budget) {
+                napi_complete(napi);
                /* We think we are done - reenable interrupts,
                 * then check once more to make sure we are done.
                 */
@@ -1144,8 +1146,6 @@ restart_poll:
                BUG_ON(lpar_rc != H_SUCCESS);
-                napi_complete(napi);
                if (ibmveth_rxq_pending_buffer(adapter) &&
                    napi_reschedule(napi)) {
                        lpar_rc = h_vio_signal(adapter->vdev->unit_address,
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 2a210c4efb89..ebce5bb24df9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1698,8 +1698,6 @@ int mlx4_en_start_port(struct net_device *dev)
        /* Schedule multicast task to populate multicast list */
        queue_work(mdev->workqueue, &priv->rx_mode_task);
-        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
 #ifdef CONFIG_MLX4_EN_VXLAN
        if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                vxlan_get_rx_port(dev);
@@ -2853,6 +2851,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
                queue_delayed_work(mdev->workqueue, &priv->service_task,
                                   SERVICE_TASK_DELAY);
+        mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
        return 0;
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2a8268e6be15..ebbe244e80dd 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -453,7 +453,7 @@ struct mlx4_en_port_stats {
        unsigned long rx_chksum_none;
        unsigned long rx_chksum_complete;
        unsigned long tx_chksum_offload;
-#define NUM_PORT_STATS          9
+#define NUM_PORT_STATS          10
 };
 struct mlx4_en_perf_stats {
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5d093dc0f5f5..8678e39aba08 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2248,10 +2248,9 @@ static int smc_drv_probe(struct platform_device *pdev)
        const struct of_device_id *match = NULL;
        struct smc_local *lp;
        struct net_device *ndev;
-        struct resource *res;
+        struct resource *res, *ires;
        unsigned int __iomem *addr;
        unsigned long irq_flags = SMC_IRQ_FLAGS;
-        unsigned long irq_resflags;
        int ret;
        ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2343,19 +2342,16 @@ static int smc_drv_probe(struct platform_device *pdev)
                goto out_free_netdev;
        }
-        ndev->irq = platform_get_irq(pdev, 0);
+        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (ndev->irq <= 0) {
+        if (!ires) {
                ret = -ENODEV;
                goto out_release_io;
        }
-        /*
-         * If this platform does not specify any special irqflags, or if
+        ndev->irq = ires->start;
-         * the resource supplies a trigger, override the irqflags with
-         * the trigger flags from the resource.
+        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
-         */
+                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
-        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
-        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
-                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
        ret = smc_request_attrib(pdev, ndev);
        if (ret)
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index a495931a66a1..0e0fbb5842b3 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -498,9 +498,9 @@ static int w5100_napi_poll(struct napi_struct *napi, int budget)
        }
        if (rx_count < budget) {
+                napi_complete(napi);
                w5100_write(priv, W5100_IMR, IR_S0);
                mmiowb();
-                napi_complete(napi);
        }
        return rx_count;
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index 09322d9db578..4b310002258d 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -418,9 +418,9 @@ static int w5300_napi_poll(struct napi_struct *napi, int budget)
        }
        if (rx_count < budget) {
+                napi_complete(napi);
                w5300_write(priv, W5300_IMR, IR_S0);
                mmiowb();
-                napi_complete(napi);
        }
        return rx_count;
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index 3eed708a6182..1762ad3910b2 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -46,8 +46,7 @@ enum cx82310_status {
 };
 #define CMD_PACKET_SIZE 64
-/* first command after power on can take around 8 seconds */
+#define CMD_TIMEOUT     100
-#define CMD_TIMEOUT     15000
 #define CMD_REPLY_RETRY 5
 #define CX82310_MTU     1514
@@ -78,8 +77,9 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
        ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, CMD_EP), buf,
                           CMD_PACKET_SIZE, &actual_len, CMD_TIMEOUT);
        if (ret < 0) {
-                dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                if (cmd != CMD_GET_LINK_STATUS)
-                        cmd, ret);
+                        dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                                cmd, ret);
                goto end;
        }
@@ -90,8 +90,10 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
                                           buf, CMD_PACKET_SIZE, &actual_len,
                                           CMD_TIMEOUT);
                        if (ret < 0) {
-                                dev_err(&dev->udev->dev,
+                                if (cmd != CMD_GET_LINK_STATUS)
-                                        "reply receive error %d\n", ret);
+                                        dev_err(&dev->udev->dev,
+                                                "reply receive error %d\n",
+                                                ret);
                                goto end;
                        }
                        if (actual_len > 0)
@@ -134,6 +136,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        int ret;
        char buf[15];
        struct usb_device *udev = dev->udev;
+        u8 link[3];
+        int timeout = 50;
        /* avoid ADSL modems - continue only if iProduct is "USB NET CARD" */
        if (usb_string(udev, udev->descriptor.iProduct, buf, sizeof(buf)) > 0
@@ -160,6 +164,20 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
        if (!dev->partial_data)
                return -ENOMEM;
+        /* wait for firmware to become ready (indicated by the link being up) */
+        while (--timeout) {
+                ret = cx82310_cmd(dev, CMD_GET_LINK_STATUS, true, NULL, 0,
+                                  link, sizeof(link));
+                /* the command can time out during boot - it's not an error */
+                if (!ret && link[0] == 1 && link[2] == 1)
+                        break;
+                msleep(500);
+        };
+        if (!timeout) {
+                dev_err(&udev->dev, "firmware not ready in time\n");
+                return -ETIMEDOUT;
+        }
        /* enable ethernet mode (?) */
        ret = cx82310_cmd(dev, CMD_ETHERNET_MODE, true, "\x01", 1, NULL, 0);
        if (ret) {
@@ -300,9 +318,18 @@ static const struct driver_info	cx82310_info = {
        .tx_fixup       = cx82310_tx_fixup,
 };
+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
+        .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
+                       USB_DEVICE_ID_MATCH_DEV_INFO, \
+        .idVendor = (vend), \
+        .idProduct = (prod), \
+        .bDeviceClass = (cl), \
+        .bDeviceSubClass = (sc), \
+        .bDeviceProtocol = (pr)
 static const struct usb_device_id products[] = {
        {
-                USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
+                USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
                .driver_info = (unsigned long) &cx82310_info
        },
        { },
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f1ff3666f090..59b0e9754ae3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1448,8 +1448,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
 {
        int i;
-        for (i = 0; i < vi->max_queue_pairs; i++)
+        for (i = 0; i < vi->max_queue_pairs; i++) {
+                napi_hash_del(&vi->rq[i].napi);
                netif_napi_del(&vi->rq[i].napi);
+        }
        kfree(vi->rq);
        kfree(vi->sq);
@@ -1948,11 +1950,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
        cancel_delayed_work_sync(&vi->refill);
        if (netif_running(vi->dev)) {
-                for (i = 0; i < vi->max_queue_pairs; i++) {
+                for (i = 0; i < vi->max_queue_pairs; i++)
                        napi_disable(&vi->rq[i].napi);
-                        napi_hash_del(&vi->rq[i].napi);
-                        netif_napi_del(&vi->rq[i].napi);
-                }
        }
        remove_vq_common(vi);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 1e0a775ea882..f8528a4cf54f 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1218,7 +1218,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                        goto drop;
                flags &= ~VXLAN_HF_RCO;
-                vni &= VXLAN_VID_MASK;
+                vni &= VXLAN_VNI_MASK;
        }
        /* For backwards compatibility, only allow reserved fields to be
@@ -1239,7 +1239,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                flags &= ~VXLAN_GBP_USED_BITS;
        }
-        if (flags || (vni & ~VXLAN_VID_MASK)) {
+        if (flags || vni & ~VXLAN_VNI_MASK) {
                /* If there are any unprocessed flags remaining treat
                 * this as a malformed packet. This behavior diverges from
                 * VXLAN RFC (RFC7348) which stipulates that bits in reserved
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ccbdb05b28cd..75345c1e8c34 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -5370,6 +5370,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
        case 0x432a: /* BCM4321 */
        case 0x432d: /* BCM4322 */
        case 0x4352: /* BCM43222 */
+        case 0x435a: /* BCM43228 */
        case 0x4333: /* BCM4331 */
        case 0x43a2: /* BCM4360 */
        case 0x43b3: /* BCM4352 */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf7090198..8eff2753abad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
        void *dcmd_buf = NULL, *wr_pointer;
        u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
-        brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
+        if (len < sizeof(*cmdhdr)) {
-                  cmdhdr->len);
+                brcmf_err("vendor command too short: %d\n", len);
+                return -EINVAL;
+        }
        vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
        ifp = vif->ifp;
-        len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+        brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+        if (cmdhdr->offset > len) {
+                brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+                return -EINVAL;
+        }
+        len -= cmdhdr->offset;
        ret_len = cmdhdr->len;
        if (ret_len > 0 || len > 0) {
                if (len > BRCMF_DCMD_MAXLEN) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index c3817fae16c0..06f6cc08f451 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
        .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION,  \
        .base_params = &iwl1000_base_params,                    \
        .eeprom_params = &iwl1000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl1000_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
        .base_params = &iwl1000_base_params,                    \
        .eeprom_params = &iwl1000_eeprom_params,                \
        .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl100_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 21e5d0843a62..890b95f497d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
        .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,          \
        .base_params = &iwl2000_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl2000_2bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
        .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
        .base_params = &iwl2030_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl2030_2bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
        .base_params = &iwl2000_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
        .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl105_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
        .base_params = &iwl2030_base_params,                    \
        .eeprom_params = &iwl20x0_eeprom_params,                \
        .led_mode = IWL_LED_RF_STATE,                           \
-        .rx_with_siso_diversity = true
+        .rx_with_siso_diversity = true,                         \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl135_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 332bbede39e5..724194e23414 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
        .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION,  \
        .base_params = &iwl5000_base_params,                    \
        .eeprom_params = &iwl5000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl5300_agn_cfg = {
        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
        .base_params = &iwl5000_base_params,                    \
        .eeprom_params = &iwl5000_eeprom_params,                \
        .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl5150_agn_cfg = {
        .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8f2c3c8c6b84..21b2630763dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
        .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,  \
        .base_params = &iwl6000_g2_base_params,                 \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6005_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
        .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
        .base_params = &iwl6000_g2_base_params,                 \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6030_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
        .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
        .base_params = &iwl6000_g2_base_params,                 \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_RF_STATE
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6035_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
        .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION,  \
        .base_params = &iwl6000_base_params,                    \
        .eeprom_params = &iwl6000_eeprom_params,                \
-        .led_mode = IWL_LED_BLINK
+        .led_mode = IWL_LED_BLINK,                              \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6000i_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
        .base_params = &iwl6050_base_params,                    \
        .eeprom_params = &iwl6000_eeprom_params,                \
        .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6050_2agn_cfg = {
        .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
        .base_params = &iwl6050_base_params,                    \
        .eeprom_params = &iwl6000_eeprom_params,                \
        .led_mode = IWL_LED_BLINK,                              \
-        .internal_wimax_coex = true
+        .internal_wimax_coex = true,                            \
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
 const struct iwl_cfg iwl6150_bgn_cfg = {
        .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 1ec4d55155f7..7810c41cf9a7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
        if (!vif->bss_conf.assoc)
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
-        if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+        if (mvmvif->phy_ctxt &&
+            IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
                               mvmvif->phy_ctxt->id))
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index d530ef3da107..542ee74f290a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
        if (!vif->bss_conf.assoc)
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
-        if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+        if (mvmvif->phy_ctxt &&
+            data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
                smps_mode = IEEE80211_SMPS_AUTOMATIC;
        IWL_DEBUG_COEX(data->mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 1ff7ec08532d..09654e73a533 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -405,7 +405,10 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                        &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
-                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                if ((mvm->fw->ucode_capa.capa[0] &
+                     IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+                    (mvm->fw->ucode_capa.api[0] &
+                     IWL_UCODE_TLV_API_LQ_SS_PARAMS))
                        hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
                                IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
        }
@@ -2215,7 +2218,19 @@ static void iwl_mvm_mac_cancel_hw_scan(struct ieee80211_hw *hw,
        mutex_lock(&mvm->mutex);
-        iwl_mvm_cancel_scan(mvm);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a hw_scan when it's already stopped.  This can
+         * happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_scan_completed() and the userspace called
+         * cancel scan scan before ieee80211_scan_work() could run.
+         * To handle that, simply return if the scan is not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if ((mvm->scan_status == IWL_MVM_SCAN_OS) ||
+            (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN))
+                iwl_mvm_cancel_scan(mvm);
        mutex_unlock(&mvm->mutex);
 }
@@ -2559,12 +2574,29 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
        int ret;
        mutex_lock(&mvm->mutex);
+        /* Due to a race condition, it's possible that mac80211 asks
+         * us to stop a sched_scan when it's already stopped.  This
+         * can happen, for instance, if we stopped the scan ourselves,
+         * called ieee80211_sched_scan_stopped() and the userspace called
+         * stop sched scan scan before ieee80211_sched_scan_stopped_work()
+         * could run.  To handle this, simply return if the scan is
+         * not running.
+        */
+        /* FIXME: for now, we ignore this race for UMAC scans, since
+         * they don't set the scan_status.
+         */
+        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
+            !(mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN)) {
+                mutex_unlock(&mvm->mutex);
+                return 0;
+        }
        ret = iwl_mvm_scan_offload_stop(mvm, false);
        mutex_unlock(&mvm->mutex);
        iwl_mvm_wait_for_async_handlers(mvm);
        return ret;
 }
 static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 194bd1f939ca..efa9688a4cf1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -134,9 +134,12 @@ enum rs_column_mode {
 #define MAX_NEXT_COLUMNS 7
 #define MAX_COLUMN_CHECKS 3
+struct rs_tx_column;
 typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
                                     struct ieee80211_sta *sta,
-                                     struct iwl_scale_tbl_info *tbl);
+                                     struct iwl_scale_tbl_info *tbl,
+                                     const struct rs_tx_column *next_col);
 struct rs_tx_column {
        enum rs_column_mode mode;
@@ -147,13 +150,15 @@ struct rs_tx_column {
 };
 static bool rs_ant_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                         struct iwl_scale_tbl_info *tbl)
+                         struct iwl_scale_tbl_info *tbl,
+                         const struct rs_tx_column *next_col)
 {
-        return iwl_mvm_bt_coex_is_ant_avail(mvm, tbl->rate.ant);
+        return iwl_mvm_bt_coex_is_ant_avail(mvm, next_col->ant);
 }
 static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          struct iwl_scale_tbl_info *tbl)
+                          struct iwl_scale_tbl_info *tbl,
+                          const struct rs_tx_column *next_col)
 {
        if (!sta->ht_cap.ht_supported)
                return false;
@@ -171,7 +176,8 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 }
 static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          struct iwl_scale_tbl_info *tbl)
+                          struct iwl_scale_tbl_info *tbl,
+                          const struct rs_tx_column *next_col)
 {
        if (!sta->ht_cap.ht_supported)
                return false;
@@ -180,7 +186,8 @@ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 }
 static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                         struct iwl_scale_tbl_info *tbl)
+                         struct iwl_scale_tbl_info *tbl,
+                         const struct rs_tx_column *next_col)
 {
        struct rs_rate *rate = &tbl->rate;
        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
@@ -1590,7 +1597,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
                        allow_func = next_col->checks[j];
-                        if (allow_func && !allow_func(mvm, sta, tbl))
+                        if (allow_func && !allow_func(mvm, sta, tbl, next_col))
                                break;
                }
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 7e9aa3cb3254..c47c8051da77 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -1128,8 +1128,10 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                return 0;
-        if (iwl_mvm_is_radio_killed(mvm))
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ret = 0;
                goto out;
+        }
        if (mvm->scan_status != IWL_MVM_SCAN_SCHED &&
            (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN) ||
@@ -1148,16 +1150,14 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
                IWL_DEBUG_SCAN(mvm, "Send stop %sscan failed %d\n",
                               sched ? "offloaded " : "", ret);
                iwl_remove_notification(&mvm->notif_wait, &wait_scan_done);
-                return ret;
+                goto out;
        }
        IWL_DEBUG_SCAN(mvm, "Successfully sent stop %sscan\n",
                       sched ? "offloaded " : "");
        ret = iwl_wait_notification(&mvm->notif_wait, &wait_scan_done, 1 * HZ);
-        if (ret)
+out:
-                return ret;
        /*
         * Clear the scan status so the next scan requests will succeed. This
         * also ensures the Rx handler doesn't do anything, as the scan was
@@ -1167,7 +1167,6 @@ int iwl_mvm_scan_offload_stop(struct iwl_mvm *mvm, bool notify)
        if (mvm->scan_status == IWL_MVM_SCAN_OS)
                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-out:
        mvm->scan_status = IWL_MVM_SCAN_NONE;
        if (notify) {
@@ -1177,7 +1176,7 @@ out:
                        ieee80211_scan_completed(mvm->hw, true);
        }
-        return 0;
+        return ret;
 }
 static void iwl_mvm_unified_scan_fill_tx_cmd(struct iwl_mvm *mvm,
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 54fafbf9a711..f8d6f306dd76 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
         * request
         */
        list_for_each_entry(te_data, &mvm->time_event_list, list) {
-                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
+                if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
-                    te_data->running) {
                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
                        is_p2p = true;
                        goto remove_te;
@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
         * request
         */
        list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
-                if (te_data->running) {
+                mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-                        mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+                goto remove_te;
-                        goto remove_te;
-                }
        }
 remove_te:
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 1d4677460711..074f716020aa 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1386,8 +1386,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                }
                return true;
-        } else if (0x86DD == ether_type) {
+        } else if (ETH_P_IPV6 == ether_type) {
-                return true;
+                /* TODO: Handle any IPv6 cases that need special handling.
+                 * For now, always return false
+                 */
+                goto end;
        }
 end:
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index cab9f5257f57..997cf0901ac2 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -96,6 +96,7 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 static void make_tx_response(struct xenvif_queue *queue,
                             struct xen_netif_tx_request *txp,
                             s8       st);
+static void push_tx_responses(struct xenvif_queue *queue);
 static inline int tx_work_todo(struct xenvif_queue *queue);
@@ -655,15 +656,10 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
        unsigned long flags;
        do {
-                int notify;
                spin_lock_irqsave(&queue->response_lock, flags);
                make_tx_response(queue, txp, XEN_NETIF_RSP_ERROR);
-                RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+                push_tx_responses(queue);
                spin_unlock_irqrestore(&queue->response_lock, flags);
-                if (notify)
-                        notify_remote_via_irq(queue->tx_irq);
                if (cons == end)
                        break;
                txp = RING_GET_REQUEST(&queue->tx, cons++);
@@ -1657,7 +1653,6 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
 {
        struct pending_tx_info *pending_tx_info;
        pending_ring_idx_t index;
-        int notify;
        unsigned long flags;
        pending_tx_info = &queue->pending_tx_info[pending_idx];
@@ -1673,12 +1668,9 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
        index = pending_index(queue->pending_prod++);
        queue->pending_ring[index] = pending_idx;
-        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        push_tx_responses(queue);
        spin_unlock_irqrestore(&queue->response_lock, flags);
-        if (notify)
-                notify_remote_via_irq(queue->tx_irq);
 }
@@ -1699,6 +1691,15 @@ static void make_tx_response(struct xenvif_queue *queue,
        queue->tx.rsp_prod_pvt = ++i;
 }
+static void push_tx_responses(struct xenvif_queue *queue)
+{
+        int notify;
+        RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
+        if (notify)
+                notify_remote_via_irq(queue->tx_irq);
+}
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                             u16      id,
                                             s8       st,
diff --git a/drivers/of/base.c b/drivers/of/base.c
index adb8764861c0..8f165b112e03 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -715,13 +715,8 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
 {
        struct device_node *child;
        int len;
-        const char *end;
-        end = strchr(path, ':');
+        len = strcspn(path, "/:");
-        if (!end)
-                end = strchrnul(path, '/');
-        len = end - path;
        if (!len)
                return NULL;
@@ -1893,10 +1888,8 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
                        name = of_get_property(of_chosen, "linux,stdout-path", NULL);
                if (IS_ENABLED(CONFIG_PPC) && !name)
                        name = of_get_property(of_aliases, "stdout", NULL);
-                if (name) {
+                if (name)
                        of_stdout = of_find_node_opts_by_path(name, &of_stdout_options);
-                        add_preferred_console("stdout-path", 0, NULL);
-                }
        }
        if (!of_aliases)
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 0d7765807f49..1a7980692f25 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
        struct device_node *p;
        const __be32 *intspec, *tmp, *addr;
        u32 intsize, intlen;
-        int i, res = -EINVAL;
+        int i, res;
        pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
        /* Get size of interrupt specifier */
        tmp = of_get_property(p, "#interrupt-cells", NULL);
-        if (tmp == NULL)
+        if (tmp == NULL) {
+                res = -EINVAL;
                goto out;
+        }
        intsize = be32_to_cpu(*tmp);
        pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
        /* Check index */
-        if ((index + 1) * intsize > intlen)
+        if ((index + 1) * intsize > intlen) {
+                res = -EINVAL;
                goto out;
+        }
        /* Copy intspec into irq structure */
        intspec += index * intsize;
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index aba8946cac46..52c45c7df07f 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -97,6 +97,11 @@ static void __init of_selftest_find_node_by_name(void)
                 "option path test, subcase #1 failed\n");
        of_node_put(np);
+        np = of_find_node_opts_by_path("/testcase-data/testcase-device1:test/option", &options);
+        selftest(np && !strcmp("test/option", options),
+                 "option path test, subcase #2 failed\n");
+        of_node_put(np);
        np = of_find_node_opts_by_path("/testcase-data:testoption", NULL);
        selftest(np, "NULL option path test failed\n");
        of_node_put(np);
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index 3bb49252a098..45f67c63d385 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -69,8 +69,7 @@ config YENTA
        tristate "CardBus yenta-compatible bridge support"
        depends on PCI
        select CARDBUS if !EXPERT
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
+        select PCCARD_NONSTATIC if PCMCIA != n
-        select PCCARD_PCI if PCMCIA !=n && !ISA
        ---help---
          This option enables support for CardBus host bridges.  Virtually
          all modern PCMCIA bridges are CardBus compatible.  A "bridge" is
@@ -110,8 +109,7 @@ config YENTA_TOSHIBA
 config PD6729
        tristate "Cirrus PD6729 compatible bridge support"
        depends on PCMCIA && PCI
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
+        select PCCARD_NONSTATIC
-        select PCCARD_PCI if PCMCIA !=n && !ISA
        help
          This provides support for the Cirrus PD6729 PCI-to-PCMCIA bridge
          device, found in some older laptops and PCMCIA card readers.
@@ -119,8 +117,7 @@ config PD6729
 config I82092
        tristate "i82092 compatible bridge support"
        depends on PCMCIA && PCI
-        select PCCARD_NONSTATIC if PCMCIA != n && ISA
+        select PCCARD_NONSTATIC
-        select PCCARD_PCI if PCMCIA !=n && !ISA
        help
          This provides support for the Intel I82092AA PCI-to-PCMCIA bridge device,
          found in some older laptops and more commonly in evaluation boards for the
@@ -291,9 +288,6 @@ config ELECTRA_CF
          Say Y here to support the CompactFlash controller on the
          PA Semi Electra eval board.
-config PCCARD_PCI
-        bool
 config PCCARD_NONSTATIC
        bool
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index f1a7ca04d89e..27e94b30cf96 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_PCMCIA)				+= pcmcia.o
 pcmcia_rsrc-y                                   += rsrc_mgr.o
 pcmcia_rsrc-$(CONFIG_PCCARD_NONSTATIC)          += rsrc_nonstatic.o
 pcmcia_rsrc-$(CONFIG_PCCARD_IODYN)              += rsrc_iodyn.o
-pcmcia_rsrc-$(CONFIG_PCCARD_PCI)                += rsrc_pci.o
 obj-$(CONFIG_PCCARD)                            += pcmcia_rsrc.o
diff --git a/drivers/pcmcia/rsrc_pci.c b/drivers/pcmcia/rsrc_pci.c
deleted file mode 100644
index 1f67b3ba70fb..000000000000
--- a/drivers/pcmcia/rsrc_pci.c
+++ /dev/null
@@ -1,173 +0,0 @@
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/pci.h>
-#include <pcmcia/ss.h>
-#include <pcmcia/cistpl.h>
-#include "cs_internal.h"
-struct pcmcia_align_data {
-        unsigned long   mask;
-        unsigned long   offset;
-};
-static resource_size_t pcmcia_align(void *align_data,
-                                const struct resource *res,
-                                resource_size_t size, resource_size_t align)
-{
-        struct pcmcia_align_data *data = align_data;
-        resource_size_t start;
-        start = (res->start & ~data->mask) + data->offset;
-        if (start < res->start)
-                start += data->mask + 1;
-        return start;
-}
-static struct resource *find_io_region(struct pcmcia_socket *s,
-                                        unsigned long base, int num,
-                                        unsigned long align)
-{
-        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_IO,
-                                                dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        int ret;
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-        ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num, 1,
-                                             base, 0, pcmcia_align, &data);
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-static int res_pci_find_io(struct pcmcia_socket *s, unsigned int attr,
-                        unsigned int *base, unsigned int num,
-                        unsigned int align, struct resource **parent)
-{
-        int i, ret = 0;
-        /* Check for an already-allocated window that must conflict with
-         * what was asked for.  It is a hack because it does not catch all
-         * potential conflicts, just the most obvious ones.
-         */
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                if (!s->io[i].res)
-                        continue;
-                if (!*base)
-                        continue;
-                if ((s->io[i].res->start & (align-1)) == *base)
-                        return -EBUSY;
-        }
-        for (i = 0; i < MAX_IO_WIN; i++) {
-                struct resource *res = s->io[i].res;
-                unsigned int try;
-                if (res && (res->flags & IORESOURCE_BITS) !=
-                        (attr & IORESOURCE_BITS))
-                        continue;
-                if (!res) {
-                        if (align == 0)
-                                align = 0x10000;
-                        res = s->io[i].res = find_io_region(s, *base, num,
-                                                                align);
-                        if (!res)
-                                return -EINVAL;
-                        *base = res->start;
-                        s->io[i].res->flags =
-                                ((res->flags & ~IORESOURCE_BITS) |
-                                        (attr & IORESOURCE_BITS));
-                        s->io[i].InUse = num;
-                        *parent = res;
-                        return 0;
-                }
-                /* Try to extend top of window */
-                try = res->end + 1;
-                if ((*base == 0) || (*base == try)) {
-                        ret = adjust_resource(s->io[i].res, res->start,
-                                              resource_size(res) + num);
-                        if (ret)
-                                continue;
-                        *base = try;
-                        s->io[i].InUse += num;
-                        *parent = res;
-                        return 0;
-                }
-                /* Try to extend bottom of window */
-                try = res->start - num;
-                if ((*base == 0) || (*base == try)) {
-                        ret = adjust_resource(s->io[i].res,
-                                              res->start - num,
-                                              resource_size(res) + num);
-                        if (ret)
-                                continue;
-                        *base = try;
-                        s->io[i].InUse += num;
-                        *parent = res;
-                        return 0;
-                }
-        }
-        return -EINVAL;
-}
-static struct resource *res_pci_find_mem(u_long base, u_long num,
-                u_long align, int low, struct pcmcia_socket *s)
-{
-        struct resource *res = pcmcia_make_resource(0, num, IORESOURCE_MEM,
-                                                dev_name(&s->dev));
-        struct pcmcia_align_data data;
-        unsigned long min;
-        int ret;
-        if (align < 0x20000)
-                align = 0x20000;
-        data.mask = align - 1;
-        data.offset = base & data.mask;
-        min = 0;
-        if (!low)
-                min = 0x100000UL;
-        ret = pci_bus_alloc_resource(s->cb_dev->bus,
-                        res, num, 1, min, 0,
-                        pcmcia_align, &data);
-        if (ret != 0) {
-                kfree(res);
-                res = NULL;
-        }
-        return res;
-}
-static int res_pci_init(struct pcmcia_socket *s)
-{
-        if (!s->cb_dev || !(s->features & SS_CAP_PAGE_REGS)) {
-                dev_err(&s->dev, "not supported by res_pci\n");
-                return -EOPNOTSUPP;
-        }
-        return 0;
-}
-struct pccard_resource_ops pccard_nonstatic_ops = {
-        .validate_mem = NULL,
-        .find_io = res_pci_find_io,
-        .find_mem = res_pci_find_mem,
-        .init = res_pci_init,
-        .exit = NULL,
-};
-EXPORT_SYMBOL(pccard_nonstatic_ops);
diff --git a/drivers/phy/phy-armada375-usb2.c b/drivers/phy/phy-armada375-usb2.c
index 7c99ca256f05..8ccc3952c13d 100644
--- a/drivers/phy/phy-armada375-usb2.c
+++ b/drivers/phy/phy-armada375-usb2.c
@@ -37,7 +37,7 @@ static int armada375_usb_phy_init(struct phy *phy)
        struct armada375_cluster_phy *cluster_phy;
        u32 reg;
-        cluster_phy = dev_get_drvdata(phy->dev.parent);
+        cluster_phy = phy_get_drvdata(phy);
        if (!cluster_phy)
                return -ENODEV;
@@ -131,6 +131,7 @@ static int armada375_usb_phy_probe(struct platform_device *pdev)
        cluster_phy->reg = usb_cluster_base;
        dev_set_drvdata(dev, cluster_phy);
+        phy_set_drvdata(phy, cluster_phy);
        phy_provider = devm_of_phy_provider_register(&pdev->dev,
                                                     armada375_usb_phy_xlate);
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index a12d35338313..3791838f4bd4 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -52,7 +52,9 @@ static void devm_phy_consume(struct device *dev, void *res)
 static int devm_phy_match(struct device *dev, void *res, void *match_data)
 {
-        return res == match_data;
+        struct phy **phy = res;
+        return *phy == match_data;
 }
 /**
@@ -223,6 +225,7 @@ int phy_init(struct phy *phy)
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
        if (phy->init_count == 0 && phy->ops->init) {
@@ -231,8 +234,6 @@ int phy_init(struct phy *phy)
                        dev_err(&phy->dev, "phy init failed --> %d\n", ret);
                        goto out;
                }
-        } else {
-                ret = 0; /* Override possible ret == -ENOTSUPP */
        }
        ++phy->init_count;
@@ -253,6 +254,7 @@ int phy_exit(struct phy *phy)
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
        if (phy->init_count == 1 && phy->ops->exit) {
@@ -287,6 +289,7 @@ int phy_power_on(struct phy *phy)
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
+        ret = 0; /* Override possible ret == -ENOTSUPP */
        mutex_lock(&phy->mutex);
        if (phy->power_count == 0 && phy->ops->power_on) {
@@ -295,8 +298,6 @@ int phy_power_on(struct phy *phy)
                        dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
                        goto out;
                }
-        } else {
-                ret = 0; /* Override possible ret == -ENOTSUPP */
        }
        ++phy->power_count;
        mutex_unlock(&phy->mutex);
diff --git a/drivers/phy/phy-exynos-dp-video.c b/drivers/phy/phy-exynos-dp-video.c
index f86cbe68ddaf..179cbf9451aa 100644
--- a/drivers/phy/phy-exynos-dp-video.c
+++ b/drivers/phy/phy-exynos-dp-video.c
@@ -30,28 +30,13 @@ struct exynos_dp_video_phy {
        const struct exynos_dp_video_phy_drvdata *drvdata;
 };
-static void exynos_dp_video_phy_pwr_isol(struct exynos_dp_video_phy *state,
-                                                        unsigned int on)
-{
-        unsigned int val;
-        if (IS_ERR(state->regs))
-                return;
-        val = on ? 0 : EXYNOS5_PHY_ENABLE;
-        regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
-                           EXYNOS5_PHY_ENABLE, val);
-}
 static int exynos_dp_video_phy_power_on(struct phy *phy)
 {
        struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
        /* Disable power isolation on DP-PHY */
-        exynos_dp_video_phy_pwr_isol(state, 0);
+        return regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
+                                  EXYNOS5_PHY_ENABLE, EXYNOS5_PHY_ENABLE);
-        return 0;
 }
 static int exynos_dp_video_phy_power_off(struct phy *phy)
@@ -59,9 +44,8 @@ static int exynos_dp_video_phy_power_off(struct phy *phy)
        struct exynos_dp_video_phy *state = phy_get_drvdata(phy);
        /* Enable power isolation on DP-PHY */
-        exynos_dp_video_phy_pwr_isol(state, 1);
+        return regmap_update_bits(state->regs, state->drvdata->phy_ctrl_offset,
+                                  EXYNOS5_PHY_ENABLE, 0);
-        return 0;
 }
 static struct phy_ops exynos_dp_video_phy_ops = {
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
index f017b2f2a54e..df7519a39ba0 100644
--- a/drivers/phy/phy-exynos-mipi-video.c
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -43,7 +43,6 @@ struct exynos_mipi_video_phy {
        } phys[EXYNOS_MIPI_PHYS_NUM];
        spinlock_t slock;
        void __iomem *regs;
-        struct mutex mutex;
        struct regmap *regmap;
 };
@@ -59,8 +58,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
        else
                reset = EXYNOS4_MIPI_PHY_SRESETN;
-        if (state->regmap) {
+        spin_lock(&state->slock);
-                mutex_lock(&state->mutex);
+        if (!IS_ERR(state->regmap)) {
                regmap_read(state->regmap, offset, &val);
                if (on)
                        val |= reset;
@@ -72,11 +72,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
                else if (!(val & EXYNOS4_MIPI_PHY_RESET_MASK))
                        val &= ~EXYNOS4_MIPI_PHY_ENABLE;
                regmap_write(state->regmap, offset, val);
-                mutex_unlock(&state->mutex);
        } else {
                addr = state->regs + EXYNOS_MIPI_PHY_CONTROL(id / 2);
-                spin_lock(&state->slock);
                val = readl(addr);
                if (on)
                        val |= reset;
@@ -90,9 +88,9 @@ static int __set_phy_state(struct exynos_mipi_video_phy *state,
                        val &= ~EXYNOS4_MIPI_PHY_ENABLE;
                writel(val, addr);
-                spin_unlock(&state->slock);
        }
+        spin_unlock(&state->slock);
        return 0;
 }
@@ -158,7 +156,6 @@ static int exynos_mipi_video_phy_probe(struct platform_device *pdev)
        dev_set_drvdata(dev, state);
        spin_lock_init(&state->slock);
-        mutex_init(&state->mutex);
        for (i = 0; i < EXYNOS_MIPI_PHYS_NUM; i++) {
                struct phy *phy = devm_phy_create(dev, NULL,
diff --git a/drivers/phy/phy-exynos4210-usb2.c b/drivers/phy/phy-exynos4210-usb2.c
index 236a52ad94eb..f30bbb0fb3b2 100644
--- a/drivers/phy/phy-exynos4210-usb2.c
+++ b/drivers/phy/phy-exynos4210-usb2.c
@@ -250,7 +250,6 @@ static const struct samsung_usb2_common_phy exynos4210_phys[] = {
                .power_on       = exynos4210_power_on,
                .power_off      = exynos4210_power_off,
        },
-        {},
 };
 const struct samsung_usb2_phy_config exynos4210_usb2_phy_config = {
diff --git a/drivers/phy/phy-exynos4x12-usb2.c b/drivers/phy/phy-exynos4x12-usb2.c
index 0b9de88579b1..765da90a536f 100644
--- a/drivers/phy/phy-exynos4x12-usb2.c
+++ b/drivers/phy/phy-exynos4x12-usb2.c
@@ -361,7 +361,6 @@ static const struct samsung_usb2_common_phy exynos4x12_phys[] = {
                .power_on       = exynos4x12_power_on,
                .power_off      = exynos4x12_power_off,
        },
-        {},
 };
 const struct samsung_usb2_phy_config exynos3250_usb2_phy_config = {
diff --git a/drivers/phy/phy-exynos5-usbdrd.c b/drivers/phy/phy-exynos5-usbdrd.c
index 04374018425f..e2a0be750ad9 100644
--- a/drivers/phy/phy-exynos5-usbdrd.c
+++ b/drivers/phy/phy-exynos5-usbdrd.c
@@ -531,7 +531,7 @@ static struct phy *exynos5_usbdrd_phy_xlate(struct device *dev,
 {
        struct exynos5_usbdrd_phy *phy_drd = dev_get_drvdata(dev);
-        if (WARN_ON(args->args[0] > EXYNOS5_DRDPHYS_NUM))
+        if (WARN_ON(args->args[0] >= EXYNOS5_DRDPHYS_NUM))
                return ERR_PTR(-ENODEV);
        return phy_drd->phys[args->args[0]].phy;
diff --git a/drivers/phy/phy-exynos5250-usb2.c b/drivers/phy/phy-exynos5250-usb2.c
index 1c139aa0d074..2ed1735a076a 100644
--- a/drivers/phy/phy-exynos5250-usb2.c
+++ b/drivers/phy/phy-exynos5250-usb2.c
@@ -391,7 +391,6 @@ static const struct samsung_usb2_common_phy exynos5250_phys[] = {
                .power_on       = exynos5250_power_on,
                .power_off      = exynos5250_power_off,
        },
-        {},
 };
 const struct samsung_usb2_phy_config exynos5250_usb2_phy_config = {
diff --git a/drivers/phy/phy-hix5hd2-sata.c b/drivers/phy/phy-hix5hd2-sata.c
index 34915b4202f1..d6b22659cac1 100644
--- a/drivers/phy/phy-hix5hd2-sata.c
+++ b/drivers/phy/phy-hix5hd2-sata.c
@@ -147,6 +147,9 @@ static int hix5hd2_sata_phy_probe(struct platform_device *pdev)
                return -ENOMEM;
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
        priv->base = devm_ioremap(dev, res->start, resource_size(res));
        if (!priv->base)
                return -ENOMEM;
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index 9b2848e6115d..933435214acc 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -228,6 +228,7 @@ struct miphy28lp_dev {
        struct regmap *regmap;
        struct mutex miphy_mutex;
        struct miphy28lp_phy **phys;
+        int nphys;
 };
 struct miphy_initval {
@@ -1116,7 +1117,7 @@ static struct phy *miphy28lp_xlate(struct device *dev,
                return ERR_PTR(-EINVAL);
        }
-        for (index = 0; index < of_get_child_count(dev->of_node); index++)
+        for (index = 0; index < miphy_dev->nphys; index++)
                if (phynode == miphy_dev->phys[index]->phy->dev.of_node) {
                        miphy_phy = miphy_dev->phys[index];
                        break;
@@ -1138,6 +1139,7 @@ static struct phy *miphy28lp_xlate(struct device *dev,
 static struct phy_ops miphy28lp_ops = {
        .init = miphy28lp_init,
+        .owner = THIS_MODULE,
 };
 static int miphy28lp_probe_resets(struct device_node *node,
@@ -1200,16 +1202,15 @@ static int miphy28lp_probe(struct platform_device *pdev)
        struct miphy28lp_dev *miphy_dev;
        struct phy_provider *provider;
        struct phy *phy;
-        int chancount, port = 0;
+        int ret, port = 0;
-        int ret;
        miphy_dev = devm_kzalloc(&pdev->dev, sizeof(*miphy_dev), GFP_KERNEL);
        if (!miphy_dev)
                return -ENOMEM;
-        chancount = of_get_child_count(np);
+        miphy_dev->nphys = of_get_child_count(np);
-        miphy_dev->phys = devm_kzalloc(&pdev->dev, sizeof(phy) * chancount,
+        miphy_dev->phys = devm_kcalloc(&pdev->dev, miphy_dev->nphys,
-                                       GFP_KERNEL);
+                                       sizeof(*miphy_dev->phys), GFP_KERNEL);
        if (!miphy_dev->phys)
                return -ENOMEM;
diff --git a/drivers/phy/phy-miphy365x.c b/drivers/phy/phy-miphy365x.c
index 6c80154e8bff..51b459db9137 100644
--- a/drivers/phy/phy-miphy365x.c
+++ b/drivers/phy/phy-miphy365x.c
@@ -150,6 +150,7 @@ struct miphy365x_dev {
        struct regmap *regmap;
        struct mutex miphy_mutex;
        struct miphy365x_phy **phys;
+        int nphys;
 };
 /*
@@ -485,7 +486,7 @@ static struct phy *miphy365x_xlate(struct device *dev,
                return ERR_PTR(-EINVAL);
        }
-        for (index = 0; index < of_get_child_count(dev->of_node); index++)
+        for (index = 0; index < miphy_dev->nphys; index++)
                if (phynode == miphy_dev->phys[index]->phy->dev.of_node) {
                        miphy_phy = miphy_dev->phys[index];
                        break;
@@ -541,16 +542,15 @@ static int miphy365x_probe(struct platform_device *pdev)
        struct miphy365x_dev *miphy_dev;
        struct phy_provider *provider;
        struct phy *phy;
-        int chancount, port = 0;
+        int ret, port = 0;
-        int ret;
        miphy_dev = devm_kzalloc(&pdev->dev, sizeof(*miphy_dev), GFP_KERNEL);
        if (!miphy_dev)
                return -ENOMEM;
-        chancount = of_get_child_count(np);
+        miphy_dev->nphys = of_get_child_count(np);
-        miphy_dev->phys = devm_kzalloc(&pdev->dev, sizeof(phy) * chancount,
+        miphy_dev->phys = devm_kcalloc(&pdev->dev, miphy_dev->nphys,
-                                       GFP_KERNEL);
+                                       sizeof(*miphy_dev->phys), GFP_KERNEL);
        if (!miphy_dev->phys)
                return -ENOMEM;
diff --git a/drivers/phy/phy-omap-control.c b/drivers/phy/phy-omap-control.c
index efe724f97e02..93252e053a31 100644
--- a/drivers/phy/phy-omap-control.c
+++ b/drivers/phy/phy-omap-control.c
@@ -360,7 +360,7 @@ static void __exit omap_control_phy_exit(void)
 }
 module_exit(omap_control_phy_exit);
-MODULE_ALIAS("platform: omap_control_phy");
+MODULE_ALIAS("platform:omap_control_phy");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP Control Module PHY Driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 6f4aef3db248..4757e765696a 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -296,10 +296,11 @@ static int omap_usb2_probe(struct platform_device *pdev)
                        dev_warn(&pdev->dev,
                                 "found usb_otg_ss_refclk960m, please fix DTS\n");
                }
-        } else {
-                clk_prepare(phy->optclk);
        }
+        if (!IS_ERR(phy->optclk))
+                clk_prepare(phy->optclk);
        usb_add_phy_dev(&phy->phy);
        return 0;
@@ -383,7 +384,7 @@ static struct platform_driver omap_usb2_driver = {
 module_platform_driver(omap_usb2_driver);
-MODULE_ALIAS("platform: omap_usb2");
+MODULE_ALIAS("platform:omap_usb2");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("OMAP USB2 phy driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-rockchip-usb.c b/drivers/phy/phy-rockchip-usb.c
index 22011c3b6a4b..7d4c33643768 100644
--- a/drivers/phy/phy-rockchip-usb.c
+++ b/drivers/phy/phy-rockchip-usb.c
@@ -61,8 +61,6 @@ static int rockchip_usb_phy_power_off(struct phy *_phy)
                return ret;
        clk_disable_unprepare(phy->clk);
-        if (ret)
-                return ret;
        return 0;
 }
@@ -78,8 +76,10 @@ static int rockchip_usb_phy_power_on(struct phy *_phy)
        /* Power up usb phy analog blocks by set siddq 0 */
        ret = rockchip_usb_phy_power(phy, 0);
-        if (ret)
+        if (ret) {
+                clk_disable_unprepare(phy->clk);
                return ret;
+        }
        return 0;
 }
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 95c88f929f27..2ba610b72ca2 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -165,15 +165,11 @@ static int ti_pipe3_dpll_wait_lock(struct ti_pipe3 *phy)
                cpu_relax();
                val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
                if (val & PLL_LOCK)
-                        break;
+                        return 0;
        } while (!time_after(jiffies, timeout));
-        if (!(val & PLL_LOCK)) {
+        dev_err(phy->dev, "DPLL failed to lock\n");
-                dev_err(phy->dev, "DPLL failed to lock\n");
+        return -EBUSY;
-                return -EBUSY;
-        }
-        return 0;
 }
 static int ti_pipe3_dpll_program(struct ti_pipe3 *phy)
@@ -608,7 +604,7 @@ static struct platform_driver ti_pipe3_driver = {
 module_platform_driver(ti_pipe3_driver);
-MODULE_ALIAS("platform: ti_pipe3");
+MODULE_ALIAS("platform:ti_pipe3");
 MODULE_AUTHOR("Texas Instruments Inc.");
 MODULE_DESCRIPTION("TI PIPE3 phy driver");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 8e87f54671f3..bc42d6a8939f 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -666,7 +666,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
        twl->dev                = &pdev->dev;
        twl->irq                = platform_get_irq(pdev, 0);
        twl->vbus_supplied      = false;
-        twl->linkstat           = -EINVAL;
        twl->linkstat           = OMAP_MUSB_UNKNOWN;
        twl->phy.dev            = twl->dev;
diff --git a/drivers/phy/phy-xgene.c b/drivers/phy/phy-xgene.c
index 29214a36ea28..2263cd010032 100644
--- a/drivers/phy/phy-xgene.c
+++ b/drivers/phy/phy-xgene.c
@@ -1704,7 +1704,6 @@ static int xgene_phy_probe(struct platform_device *pdev)
        for (i = 0; i < MAX_LANE; i++)
                ctx->sata_param.speed[i] = 2; /* Default to Gen3 */
-        ctx->dev = &pdev->dev;
        platform_set_drvdata(pdev, ctx);
        ctx->phy = devm_phy_create(ctx->dev, NULL, &xgene_phy_ops);
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 5afe03e28b91..2062c224e32f 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -66,6 +66,10 @@
 #define BYT_DIR_MASK            (BIT(1) | BIT(2))
 #define BYT_TRIG_MASK           (BIT(26) | BIT(25) | BIT(24))
+#define BYT_CONF0_RESTORE_MASK  (BYT_DIRECT_IRQ_EN | BYT_TRIG_MASK | \
+                                 BYT_PIN_MUX)
+#define BYT_VAL_RESTORE_MASK    (BYT_DIR_MASK | BYT_LEVEL)
 #define BYT_NGPIO_SCORE         102
 #define BYT_NGPIO_NCORE         28
 #define BYT_NGPIO_SUS           44
@@ -134,12 +138,18 @@ static struct pinctrl_gpio_range byt_ranges[] = {
        },
 };
+struct byt_gpio_pin_context {
+        u32 conf0;
+        u32 val;
+};
 struct byt_gpio {
        struct gpio_chip                chip;
        struct platform_device          *pdev;
        spinlock_t                      lock;
        void __iomem                    *reg_base;
        struct pinctrl_gpio_range       *range;
+        struct byt_gpio_pin_context     *saved_context;
 };
 #define to_byt_gpio(c)  container_of(c, struct byt_gpio, chip)
@@ -158,40 +168,62 @@ static void __iomem *byt_gpio_reg(struct gpio_chip *chip, unsigned offset,
        return vg->reg_base + reg_offset + reg;
 }
-static bool is_special_pin(struct byt_gpio *vg, unsigned offset)
+static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned offset)
+{
+        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        unsigned long flags;
+        u32 value;
+        spin_lock_irqsave(&vg->lock, flags);
+        value = readl(reg);
+        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
+}
+static u32 byt_get_gpio_mux(struct byt_gpio *vg, unsigned offset)
 {
        /* SCORE pin 92-93 */
        if (!strcmp(vg->range->name, BYT_SCORE_ACPI_UID) &&
                offset >= 92 && offset <= 93)
-                return true;
+                return 1;
        /* SUS pin 11-21 */
        if (!strcmp(vg->range->name, BYT_SUS_ACPI_UID) &&
                offset >= 11 && offset <= 21)
-                return true;
+                return 1;
-        return false;
+        return 0;
 }
 static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 {
        struct byt_gpio *vg = to_byt_gpio(chip);
        void __iomem *reg = byt_gpio_reg(chip, offset, BYT_CONF0_REG);
-        u32 value;
+        u32 value, gpio_mux;
-        bool special;
        /*
         * In most cases, func pin mux 000 means GPIO function.
         * But, some pins may have func pin mux 001 represents
-         * GPIO function. Only allow user to export pin with
+         * GPIO function.
-         * func pin mux preset as GPIO function by BIOS/FW.
+         *
+         * Because there are devices out there where some pins were not
+         * configured correctly we allow changing the mux value from
+         * request (but print out warning about that).
         */
        value = readl(reg) & BYT_PIN_MUX;
-        special = is_special_pin(vg, offset);
+        gpio_mux = byt_get_gpio_mux(vg, offset);
-        if ((special && value != 1) || (!special && value)) {
+        if (WARN_ON(gpio_mux != value)) {
-                dev_err(&vg->pdev->dev,
+                unsigned long flags;
-                        "pin %u cannot be used as GPIO.\n", offset);
-                return -EINVAL;
+                spin_lock_irqsave(&vg->lock, flags);
+                value = readl(reg) & ~BYT_PIN_MUX;
+                value |= gpio_mux;
+                writel(value, reg);
+                spin_unlock_irqrestore(&vg->lock, flags);
+                dev_warn(&vg->pdev->dev,
+                         "pin %u forcibly re-configured as GPIO\n", offset);
        }
        pm_runtime_get(&vg->pdev->dev);
@@ -202,14 +234,8 @@ static int byt_gpio_request(struct gpio_chip *chip, unsigned offset)
 static void byt_gpio_free(struct gpio_chip *chip, unsigned offset)
 {
        struct byt_gpio *vg = to_byt_gpio(chip);
-        void __iomem *reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
-        u32 value;
-        /* clear interrupt triggering */
-        value = readl(reg);
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
-        writel(value, reg);
+        byt_gpio_clear_triggering(vg, offset);
        pm_runtime_put(&vg->pdev->dev);
 }
@@ -236,23 +262,13 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
        value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
                   BYT_TRIG_LVL);
-        switch (type) {
-        case IRQ_TYPE_LEVEL_HIGH:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_RISING:
-                value |= BYT_TRIG_POS;
-                break;
-        case IRQ_TYPE_LEVEL_LOW:
-                value |= BYT_TRIG_LVL;
-        case IRQ_TYPE_EDGE_FALLING:
-                value |= BYT_TRIG_NEG;
-                break;
-        case IRQ_TYPE_EDGE_BOTH:
-                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
-                break;
-        }
        writel(value, reg);
+        if (type & IRQ_TYPE_EDGE_BOTH)
+                __irq_set_handler_locked(d->irq, handle_edge_irq);
+        else if (type & IRQ_TYPE_LEVEL_MASK)
+                __irq_set_handler_locked(d->irq, handle_level_irq);
        spin_unlock_irqrestore(&vg->lock, flags);
        return 0;
@@ -410,58 +426,80 @@ static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
        struct irq_data *data = irq_desc_get_irq_data(desc);
        struct byt_gpio *vg = to_byt_gpio(irq_desc_get_handler_data(desc));
        struct irq_chip *chip = irq_data_get_irq_chip(data);
-        u32 base, pin, mask;
+        u32 base, pin;
        void __iomem *reg;
-        u32 pending;
+        unsigned long pending;
        unsigned virq;
-        int looplimit = 0;
        /* check from GPIO controller which pin triggered the interrupt */
        for (base = 0; base < vg->chip.ngpio; base += 32) {
                reg = byt_gpio_reg(&vg->chip, base, BYT_INT_STAT_REG);
+                pending = readl(reg);
-                while ((pending = readl(reg))) {
+                for_each_set_bit(pin, &pending, 32) {
-                        pin = __ffs(pending);
-                        mask = BIT(pin);
-                        /* Clear before handling so we can't lose an edge */
-                        writel(mask, reg);
                        virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
                        generic_handle_irq(virq);
-                        /* In case bios or user sets triggering incorretly a pin
-                         * might remain in "interrupt triggered" state.
-                         */
-                        if (looplimit++ > 32) {
-                                dev_err(&vg->pdev->dev,
-                                        "Gpio %d interrupt flood, disabling\n",
-                                        base + pin);
-                                reg = byt_gpio_reg(&vg->chip, base + pin,
-                                                   BYT_CONF0_REG);
-                                mask = readl(reg);
-                                mask &= ~(BYT_TRIG_NEG | BYT_TRIG_POS |
-                                          BYT_TRIG_LVL);
-                                writel(mask, reg);
-                                mask = readl(reg); /* flush */
-                                break;
-                        }
                }
        }
        chip->irq_eoi(data);
 }
+static void byt_irq_ack(struct irq_data *d)
+{
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        void __iomem *reg;
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
+        writel(BIT(offset % 32), reg);
+}
 static void byt_irq_unmask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        unsigned offset = irqd_to_hwirq(d);
+        unsigned long flags;
+        void __iomem *reg;
+        u32 value;
+        spin_lock_irqsave(&vg->lock, flags);
+        reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+        value = readl(reg);
+        switch (irqd_get_trigger_type(d)) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_RISING:
+                value |= BYT_TRIG_POS;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                value |= BYT_TRIG_LVL;
+        case IRQ_TYPE_EDGE_FALLING:
+                value |= BYT_TRIG_NEG;
+                break;
+        case IRQ_TYPE_EDGE_BOTH:
+                value |= (BYT_TRIG_NEG | BYT_TRIG_POS);
+                break;
+        }
+        writel(value, reg);
+        spin_unlock_irqrestore(&vg->lock, flags);
 }
 static void byt_irq_mask(struct irq_data *d)
 {
+        struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+        struct byt_gpio *vg = to_byt_gpio(gc);
+        byt_gpio_clear_triggering(vg, irqd_to_hwirq(d));
 }
 static struct irq_chip byt_irqchip = {
        .name = "BYT-GPIO",
+        .irq_ack = byt_irq_ack,
        .irq_mask = byt_irq_mask,
        .irq_unmask = byt_irq_unmask,
        .irq_set_type = byt_irq_type,
@@ -472,6 +510,21 @@ static void byt_gpio_irq_init_hw(struct byt_gpio *vg)
 {
        void __iomem *reg;
        u32 base, value;
+        int i;
+        /*
+         * Clear interrupt triggers for all pins that are GPIOs and
+         * do not use direct IRQ mode. This will prevent spurious
+         * interrupts from misconfigured pins.
+         */
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                value = readl(byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG));
+                if ((value & BYT_PIN_MUX) == byt_get_gpio_mux(vg, i) &&
+                    !(value & BYT_DIRECT_IRQ_EN)) {
+                        byt_gpio_clear_triggering(vg, i);
+                        dev_dbg(&vg->pdev->dev, "disabling GPIO %d\n", i);
+                }
+        }
        /* clear interrupt status trigger registers */
        for (base = 0; base < vg->chip.ngpio; base += 32) {
@@ -541,6 +594,11 @@ static int byt_gpio_probe(struct platform_device *pdev)
        gc->can_sleep = false;
        gc->dev = dev;
+#ifdef CONFIG_PM_SLEEP
+        vg->saved_context = devm_kcalloc(&pdev->dev, gc->ngpio,
+                                       sizeof(*vg->saved_context), GFP_KERNEL);
+#endif
        ret = gpiochip_add(gc);
        if (ret) {
                dev_err(&pdev->dev, "failed adding byt-gpio chip\n");
@@ -569,6 +627,69 @@ static int byt_gpio_probe(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
+static int byt_gpio_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg) & BYT_CONF0_RESTORE_MASK;
+                vg->saved_context[i].conf0 = value;
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg) & BYT_VAL_RESTORE_MASK;
+                vg->saved_context[i].val = value;
+        }
+        return 0;
+}
+static int byt_gpio_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct byt_gpio *vg = platform_get_drvdata(pdev);
+        int i;
+        for (i = 0; i < vg->chip.ngpio; i++) {
+                void __iomem *reg;
+                u32 value;
+                reg = byt_gpio_reg(&vg->chip, i, BYT_CONF0_REG);
+                value = readl(reg);
+                if ((value & BYT_CONF0_RESTORE_MASK) !=
+                     vg->saved_context[i].conf0) {
+                        value &= ~BYT_CONF0_RESTORE_MASK;
+                        value |= vg->saved_context[i].conf0;
+                        writel(value, reg);
+                        dev_info(dev, "restored pin %d conf0 %#08x", i, value);
+                }
+                reg = byt_gpio_reg(&vg->chip, i, BYT_VAL_REG);
+                value = readl(reg);
+                if ((value & BYT_VAL_RESTORE_MASK) !=
+                     vg->saved_context[i].val) {
+                        u32 v;
+                        v = value & ~BYT_VAL_RESTORE_MASK;
+                        v |= vg->saved_context[i].val;
+                        if (v != value) {
+                                writel(v, reg);
+                                dev_dbg(dev, "restored pin %d val %#08x\n",
+                                        i, v);
+                        }
+                }
+        }
+        return 0;
+}
+#endif
 static int byt_gpio_runtime_suspend(struct device *dev)
 {
        return 0;
@@ -580,8 +701,9 @@ static int byt_gpio_runtime_resume(struct device *dev)
 }
 static const struct dev_pm_ops byt_gpio_pm_ops = {
-        .runtime_suspend = byt_gpio_runtime_suspend,
+        SET_LATE_SYSTEM_SLEEP_PM_OPS(byt_gpio_suspend, byt_gpio_resume)
-        .runtime_resume = byt_gpio_runtime_resume,
+        SET_RUNTIME_PM_OPS(byt_gpio_runtime_suspend, byt_gpio_runtime_resume,
+                           NULL)
 };
 static const struct acpi_device_id byt_gpio_acpi_match[] = {
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 3034fd03bced..82f691eeeec4 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1226,6 +1226,7 @@ static int chv_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 static int chv_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
                                     int value)
 {
+        chv_gpio_set(chip, offset, value);
        return pinctrl_gpio_direction_output(chip->base + offset);
 }
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index f4cd0b9b2438..a4814066ea08 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1477,28 +1477,25 @@ static void gpio_irq_ack(struct irq_data *d)
        /* the interrupt is already cleared before by reading ISR */
 }
-static unsigned int gpio_irq_startup(struct irq_data *d)
+static int gpio_irq_request_res(struct irq_data *d)
 {
        struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
        unsigned        pin = d->hwirq;
        int ret;
        ret = gpiochip_lock_as_irq(&at91_gpio->chip, pin);
-        if (ret) {
+        if (ret)
                dev_err(at91_gpio->chip.dev, "unable to lock pind %lu IRQ\n",
                        d->hwirq);
-                return ret;
-        }
+        return ret;
-        gpio_irq_unmask(d);
-        return 0;
 }
-static void gpio_irq_shutdown(struct irq_data *d)
+static void gpio_irq_release_res(struct irq_data *d)
 {
        struct at91_gpio_chip *at91_gpio = irq_data_get_irq_chip_data(d);
        unsigned        pin = d->hwirq;
-        gpio_irq_mask(d);
        gpiochip_unlock_as_irq(&at91_gpio->chip, pin);
 }
@@ -1577,8 +1574,8 @@ void at91_pinctrl_gpio_resume(void)
 static struct irq_chip gpio_irqchip = {
        .name           = "GPIO",
        .irq_ack        = gpio_irq_ack,
-        .irq_startup    = gpio_irq_startup,
+        .irq_request_resources = gpio_irq_request_res,
-        .irq_shutdown   = gpio_irq_shutdown,
+        .irq_release_resources = gpio_irq_release_res,
        .irq_disable    = gpio_irq_mask,
        .irq_mask       = gpio_irq_mask,
        .irq_unmask     = gpio_irq_unmask,
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
index 24c5d88f943f..3c68a8e5e0dd 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c
@@ -1011,6 +1011,7 @@ static const struct sunxi_pinctrl_desc sun4i_a10_pinctrl_data = {
        .pins = sun4i_a10_pins,
        .npins = ARRAY_SIZE(sun4i_a10_pins),
        .irq_banks = 1,
+        .irq_read_needs_mux = true,
 };
 static int sun4i_a10_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 3d0744337736..f8e171b76693 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -29,6 +29,7 @@
 #include <linux/slab.h>
 #include "../core.h"
+#include "../../gpio/gpiolib.h"
 #include "pinctrl-sunxi.h"
 static struct irq_chip sunxi_pinctrl_edge_irq_chip;
@@ -464,10 +465,19 @@ static int sunxi_pinctrl_gpio_direction_input(struct gpio_chip *chip,
 static int sunxi_pinctrl_gpio_get(struct gpio_chip *chip, unsigned offset)
 {
        struct sunxi_pinctrl *pctl = dev_get_drvdata(chip->dev);
        u32 reg = sunxi_data_reg(offset);
        u8 index = sunxi_data_offset(offset);
-        u32 val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        u32 set_mux = pctl->desc->irq_read_needs_mux &&
+                        test_bit(FLAG_USED_AS_IRQ, &chip->desc[offset].flags);
+        u32 val;
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_INPUT);
+        val = (readl(pctl->membase + reg) >> index) & DATA_PINS_MASK;
+        if (set_mux)
+                sunxi_pmx_set(pctl->pctl_dev, offset, SUN4I_FUNC_IRQ);
        return val;
 }
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
index 5a51523a3459..e248e81a0f9e 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
@@ -77,6 +77,9 @@
 #define IRQ_LEVEL_LOW           0x03
 #define IRQ_EDGE_BOTH           0x04
+#define SUN4I_FUNC_INPUT        0
+#define SUN4I_FUNC_IRQ          6
 struct sunxi_desc_function {
        const char      *name;
        u8              muxval;
@@ -94,6 +97,7 @@ struct sunxi_pinctrl_desc {
        int                             npins;
        unsigned                        pin_base;
        unsigned                        irq_banks;
+        bool                            irq_read_needs_mux;
 };
 struct sunxi_pinctrl_function {
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 97b5e4ee1ca4..63d4033eb683 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -73,7 +73,7 @@
 #define TIME_WINDOW_MAX_MSEC 40000
 #define TIME_WINDOW_MIN_MSEC 250
+#define ENERGY_UNIT_SCALE    1000 /* scale from driver unit to powercap unit */
 enum unit_type {
        ARBITRARY_UNIT, /* no translation */
        POWER_UNIT,
@@ -158,6 +158,7 @@ struct rapl_domain {
        struct rapl_power_limit rpl[NR_POWER_LIMITS];
        u64 attr_map; /* track capabilities */
        unsigned int state;
+        unsigned int domain_energy_unit;
        int package_id;
 };
 #define power_zone_to_rapl_domain(_zone) \
@@ -190,6 +191,7 @@ struct rapl_defaults {
        void (*set_floor_freq)(struct rapl_domain *rd, bool mode);
        u64 (*compute_time_window)(struct rapl_package *rp, u64 val,
                                bool to_raw);
+        unsigned int dram_domain_energy_unit;
 };
 static struct rapl_defaults *rapl_defaults;
@@ -227,7 +229,8 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
 static int rapl_write_data_raw(struct rapl_domain *rd,
                        enum rapl_primitives prim,
                        unsigned long long value);
-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
+                        enum unit_type type, u64 value,
                        int to_raw);
 static void package_power_limit_irq_save(int package_id);
@@ -305,7 +308,9 @@ static int get_energy_counter(struct powercap_zone *power_zone, u64 *energy_raw)
 static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
 {
-        *energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+        struct rapl_domain *rd = power_zone_to_rapl_domain(pcd_dev);
+        *energy = rapl_unit_xlate(rd, 0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
        return 0;
 }
@@ -639,6 +644,11 @@ static void rapl_init_domains(struct rapl_package *rp)
                        rd->msrs[4] = MSR_DRAM_POWER_INFO;
                        rd->rpl[0].prim_id = PL1_ENABLE;
                        rd->rpl[0].name = pl1_name;
+                        rd->domain_energy_unit =
+                                rapl_defaults->dram_domain_energy_unit;
+                        if (rd->domain_energy_unit)
+                                pr_info("DRAM domain energy unit %dpj\n",
+                                        rd->domain_energy_unit);
                        break;
                }
                if (mask) {
@@ -648,11 +658,13 @@ static void rapl_init_domains(struct rapl_package *rp)
        }
 }
-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
+                        enum unit_type type, u64 value,
                        int to_raw)
 {
        u64 units = 1;
        struct rapl_package *rp;
+        u64 scale = 1;
        rp = find_package_by_id(package);
        if (!rp)
@@ -663,7 +675,12 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
                units = rp->power_unit;
                break;
        case ENERGY_UNIT:
-                units = rp->energy_unit;
+                scale = ENERGY_UNIT_SCALE;
+                /* per domain unit takes precedence */
+                if (rd && rd->domain_energy_unit)
+                        units = rd->domain_energy_unit;
+                else
+                        units = rp->energy_unit;
                break;
        case TIME_UNIT:
                return rapl_defaults->compute_time_window(rp, value, to_raw);
@@ -673,11 +690,11 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
        };
        if (to_raw)
-                return div64_u64(value, units);
+                return div64_u64(value, units) * scale;
        value *= units;
-        return value;
+        return div64_u64(value, scale);
 }
 /* in the order of enum rapl_primitives */
@@ -773,7 +790,7 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
        final = value & rp->mask;
        final = final >> rp->shift;
        if (xlate)
-                *data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
+                *data = rapl_unit_xlate(rd, rd->package_id, rp->unit, final, 0);
        else
                *data = final;
@@ -799,7 +816,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
                        "failed to read msr 0x%x on cpu %d\n", msr, cpu);
                return -EIO;
        }
-        value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
+        value = rapl_unit_xlate(rd, rd->package_id, rp->unit, value, 1);
        msr_val &= ~rp->mask;
        msr_val |= value << rp->shift;
        if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
@@ -818,7 +835,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
 * calculate units differ on different CPUs.
 * We convert the units to below format based on CPUs.
 * i.e.
- * energy unit: microJoules : Represented in microJoules by default
+ * energy unit: picoJoules  : Represented in picoJoules by default
 * power unit : microWatts  : Represented in milliWatts by default
 * time unit  : microseconds: Represented in seconds by default
 */
@@ -834,7 +851,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
        }
        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit = 1000000 / (1 << value);
+        rp->energy_unit = ENERGY_UNIT_SCALE * 1000000 / (1 << value);
        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
        rp->power_unit = 1000000 / (1 << value);
@@ -842,7 +859,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
        value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
        rp->time_unit = 1000000 / (1 << value);
-        pr_debug("Core CPU package %d energy=%duJ, time=%dus, power=%duW\n",
+        pr_debug("Core CPU package %d energy=%dpJ, time=%dus, power=%duW\n",
                rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
        return 0;
@@ -859,7 +876,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
                return -ENODEV;
        }
        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit = 1 << value;
+        rp->energy_unit = ENERGY_UNIT_SCALE * 1 << value;
        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
        rp->power_unit = (1 << value) * 1000;
@@ -867,7 +884,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
        value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
        rp->time_unit = 1000000 / (1 << value);
-        pr_debug("Atom package %d energy=%duJ, time=%dus, power=%duW\n",
+        pr_debug("Atom package %d energy=%dpJ, time=%dus, power=%duW\n",
                rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
        return 0;
@@ -1017,6 +1034,13 @@ static const struct rapl_defaults rapl_defaults_core = {
        .compute_time_window = rapl_compute_time_window_core,
 };
+static const struct rapl_defaults rapl_defaults_hsw_server = {
+        .check_unit = rapl_check_unit_core,
+        .set_floor_freq = set_floor_freq_default,
+        .compute_time_window = rapl_compute_time_window_core,
+        .dram_domain_energy_unit = 15300,
+};
 static const struct rapl_defaults rapl_defaults_atom = {
        .check_unit = rapl_check_unit_atom,
        .set_floor_freq = set_floor_freq_atom,
@@ -1037,7 +1061,7 @@ static const struct x86_cpu_id rapl_ids[] = {
        RAPL_CPU(0x3a, rapl_defaults_core),/* Ivy Bridge */
        RAPL_CPU(0x3c, rapl_defaults_core),/* Haswell */
        RAPL_CPU(0x3d, rapl_defaults_core),/* Broadwell */
-        RAPL_CPU(0x3f, rapl_defaults_core),/* Haswell */
+        RAPL_CPU(0x3f, rapl_defaults_hsw_server),/* Haswell servers */
        RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
        RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
        RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 1245dca79009..a4a8a6dc60c4 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1839,10 +1839,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
        }
        if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, true);
+                if (!rdev->ena_gpio_state) {
-                if (ret < 0)
+                        ret = regulator_ena_gpio_ctrl(rdev, true);
-                        return ret;
+                        if (ret < 0)
-                rdev->ena_gpio_state = 1;
+                                return ret;
+                        rdev->ena_gpio_state = 1;
+                }
        } else if (rdev->desc->ops->enable) {
                ret = rdev->desc->ops->enable(rdev);
                if (ret < 0)
@@ -1939,10 +1941,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
        trace_regulator_disable(rdev_get_name(rdev));
        if (rdev->ena_pin) {
-                ret = regulator_ena_gpio_ctrl(rdev, false);
+                if (rdev->ena_gpio_state) {
-                if (ret < 0)
+                        ret = regulator_ena_gpio_ctrl(rdev, false);
-                        return ret;
+                        if (ret < 0)
-                rdev->ena_gpio_state = 0;
+                                return ret;
+                        rdev->ena_gpio_state = 0;
+                }
        } else if (rdev->desc->ops->disable) {
                ret = rdev->desc->ops->disable(rdev);
@@ -3626,12 +3630,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
                                 config->ena_gpio, ret);
                        goto wash;
                }
-                if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-                        rdev->ena_gpio_state = 1;
-                if (config->ena_gpio_invert)
-                        rdev->ena_gpio_state = !rdev->ena_gpio_state;
        }
        /* set regulator constraints */
@@ -3800,9 +3798,11 @@ int regulator_suspend_finish(void)
        list_for_each_entry(rdev, &regulator_list, list) {
                mutex_lock(&rdev->mutex);
                if (rdev->use_count > 0  || rdev->constraints->always_on) {
-                        error = _regulator_do_enable(rdev);
+                        if (!_regulator_is_enabled(rdev)) {
-                        if (error)
+                                error = _regulator_do_enable(rdev);
-                                ret = error;
+                                if (error)
+                                        ret = error;
+                        }
                } else {
                        if (!have_full_constraints())
                                goto unlock;
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index 9205f433573c..18198316b6cf 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
        if (!pmic)
                return -ENOMEM;
+        if (of_device_is_compatible(node, "ti,tps659038-pmic"))
+                palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
+                                                        TPS659038_REGEN2_CTRL;
        pmic->dev = &pdev->dev;
        pmic->palmas = palmas;
        palmas->pmic = pmic;
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index e2cffe01b807..fb991ec76423 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 92f6af6da699..73354ee27877 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -951,6 +951,7 @@ static int rpmsg_probe(struct virtio_device *vdev)
        void *bufs_va;
        int err = 0, i;
        size_t total_buf_space;
+        bool notify;
        vrp = kzalloc(sizeof(*vrp), GFP_KERNEL);
        if (!vrp)
@@ -1030,8 +1031,22 @@ static int rpmsg_probe(struct virtio_device *vdev)
                }
        }
+        /*
+         * Prepare to kick but don't notify yet - we can't do this before
+         * device is ready.
+         */
+        notify = virtqueue_kick_prepare(vrp->rvq);
+        /* From this point on, we can notify and get callbacks. */
+        virtio_device_ready(vdev);
        /* tell the remote processor it can start sending messages */
-        virtqueue_kick(vrp->rvq);
+        /*
+         * this might be concurrent with callbacks, but we are only
+         * doing notify, not a full kick here, so that's ok.
+         */
+        if (notify)
+                virtqueue_notify(vrp->rvq);
        dev_info(&vdev->dev, "rpmsg host is online\n");
diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
index b4f7744f6751..b283a1a573b3 100644
--- a/drivers/rtc/rtc-at91rm9200.c
+++ b/drivers/rtc/rtc-at91rm9200.c
@@ -324,7 +324,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
                ret = IRQ_HANDLED;
        }
-        spin_lock(&suspended_lock);
+        spin_unlock(&suspended_lock);
        return ret;
 }
diff --git a/drivers/rtc/rtc-mrst.c b/drivers/rtc/rtc-mrst.c
index e2436d140175..3a6fd3a8a2ec 100644
--- a/drivers/rtc/rtc-mrst.c
+++ b/drivers/rtc/rtc-mrst.c
@@ -413,8 +413,8 @@ static void rtc_mrst_do_remove(struct device *dev)
        mrst->dev = NULL;
 }
-#ifdef  CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
-static int mrst_suspend(struct device *dev, pm_message_t mesg)
+static int mrst_suspend(struct device *dev)
 {
        struct mrst_rtc *mrst = dev_get_drvdata(dev);
        unsigned char   tmp;
@@ -453,7 +453,7 @@ static int mrst_suspend(struct device *dev, pm_message_t mesg)
 */
 static inline int mrst_poweroff(struct device *dev)
 {
-        return mrst_suspend(dev, PMSG_HIBERNATE);
+        return mrst_suspend(dev);
 }
 static int mrst_resume(struct device *dev)
@@ -490,9 +490,11 @@ static int mrst_resume(struct device *dev)
        return 0;
 }
+static SIMPLE_DEV_PM_OPS(mrst_pm_ops, mrst_suspend, mrst_resume);
+#define MRST_PM_OPS (&mrst_pm_ops)
 #else
-#define mrst_suspend    NULL
+#define MRST_PM_OPS NULL
-#define mrst_resume     NULL
 static inline int mrst_poweroff(struct device *dev)
 {
@@ -529,9 +531,8 @@ static struct platform_driver vrtc_mrst_platform_driver = {
        .remove         = vrtc_mrst_platform_remove,
        .shutdown       = vrtc_mrst_platform_shutdown,
        .driver = {
-                .name           = (char *) driver_name,
+                .name   = driver_name,
-                .suspend        = mrst_suspend,
+                .pm     = MRST_PM_OPS,
-                .resume         = mrst_resume,
        }
 };
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 9219953ee949..d9afc51af7d3 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -6815,7 +6815,8 @@ static struct ata_port_operations ipr_sata_ops = {
 };
 static struct ata_port_info sata_port_info = {
-        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA,
+        .flags          = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+                          ATA_FLAG_SAS_HOST,
        .pio_mask       = ATA_PIO4_ONLY,
        .mwdma_mask     = ATA_MWDMA2,
        .udma_mask      = ATA_UDMA6,
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 932d9cc98d2f..9c706d8c1441 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -547,7 +547,8 @@ static struct ata_port_operations sas_sata_ops = {
 };
 static struct ata_port_info sata_port_info = {
-        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ,
+        .flags = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA | ATA_FLAG_NCQ |
+                 ATA_FLAG_SAS_HOST,
        .pio_mask = ATA_PIO4,
        .mwdma_mask = ATA_MWDMA2,
        .udma_mask = ATA_UDMA6,
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 99f43b7fc9ab..ab4879e12ea7 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1596,7 +1596,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
        /*
         * Finally register the new FC Nexus with TCM
         */
-        __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+        transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
        return 0;
 }
diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
index 3ce39d10fafb..4f8c798e0633 100644
--- a/drivers/spi/spi-dw-mid.c
+++ b/drivers/spi/spi-dw-mid.c
@@ -108,7 +108,8 @@ static void dw_spi_dma_tx_done(void *arg)
 {
        struct dw_spi *dws = arg;
-        if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
+        clear_bit(TX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(RX_BUSY, &dws->dma_chan_busy))
                return;
        dw_spi_xfer_done(dws);
 }
@@ -156,7 +157,8 @@ static void dw_spi_dma_rx_done(void *arg)
 {
        struct dw_spi *dws = arg;
-        if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
+        clear_bit(RX_BUSY, &dws->dma_chan_busy);
+        if (test_bit(TX_BUSY, &dws->dma_chan_busy))
                return;
        dw_spi_xfer_done(dws);
 }
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index ff9cdbdb6672..2b2c359f5a50 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -498,7 +498,7 @@ static int spi_qup_probe(struct platform_device *pdev)
        struct resource *res;
        struct device *dev;
        void __iomem *base;
-        u32 max_freq, iomode;
+        u32 max_freq, iomode, num_cs;
        int ret, irq, size;
        dev = &pdev->dev;
@@ -550,10 +550,11 @@ static int spi_qup_probe(struct platform_device *pdev)
        }
        /* use num-cs unless not present or out of range */
-        if (of_property_read_u16(dev->of_node, "num-cs",
+        if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
-                        &master->num_chipselect) ||
+            num_cs > SPI_NUM_CHIPSELECTS)
-                        (master->num_chipselect > SPI_NUM_CHIPSELECTS))
                master->num_chipselect = SPI_NUM_CHIPSELECTS;
+        else
+                master->num_chipselect = num_cs;
        master->bus_num = pdev->id;
        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index c64a3e59fce3..57a195041dc7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1105,13 +1105,14 @@ void spi_finalize_current_message(struct spi_master *master)
                                "failed to unprepare message: %d\n", ret);
                }
        }
+        trace_spi_message_done(mesg);
        master->cur_msg_prepared = false;
        mesg->state = NULL;
        if (mesg->complete)
                mesg->complete(mesg->context);
-        trace_spi_message_done(mesg);
 }
 EXPORT_SYMBOL_GPL(spi_finalize_current_message);
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 4324282afe49..03b2a90b9ac0 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -330,16 +330,6 @@ static void device_init_registers(struct vnt_private *pDevice)
        /* zonetype initial */
        pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
-        /* Get RFType */
-        pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE);
-        /* force change RevID for VT3253 emu */
-        if ((pDevice->byRFType & RF_EMU) != 0)
-                        pDevice->byRevId = 0x80;
-        pDevice->byRFType &= RF_MASK;
-        pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType);
        if (!pDevice->bZoneRegExist)
                pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
@@ -1187,12 +1177,14 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
 {
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
        PSTxDesc head_td;
-        u32 dma_idx = TYPE_AC0DMA;
+        u32 dma_idx;
        unsigned long flags;
        spin_lock_irqsave(&priv->lock, flags);
-        if (!ieee80211_is_data(hdr->frame_control))
+        if (ieee80211_is_data(hdr->frame_control))
+                dma_idx = TYPE_AC0DMA;
+        else
                dma_idx = TYPE_TXDMA0;
        if (AVAIL_TD(priv, dma_idx) < 1) {
@@ -1206,6 +1198,9 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
        head_td->pTDInfo->skb = skb;
+        if (dma_idx == TYPE_AC0DMA)
+                head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
        priv->iTDUsed[dma_idx]++;
        /* Take ownership */
@@ -1234,13 +1229,10 @@ static int vnt_tx_packet(struct vnt_private *priv, struct sk_buff *skb)
        head_td->buff_addr = cpu_to_le32(head_td->pTDInfo->skb_dma);
-        if (dma_idx == TYPE_AC0DMA) {
+        if (head_td->pTDInfo->byFlags & TD_FLAGS_NETIF_SKB)
-                head_td->pTDInfo->byFlags = TD_FLAGS_NETIF_SKB;
                MACvTransmitAC0(priv->PortOffset);
-        } else {
+        else
                MACvTransmit0(priv->PortOffset);
-        }
        spin_unlock_irqrestore(&priv->lock, flags);
@@ -1778,6 +1770,12 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
        MACvInitialize(priv->PortOffset);
        MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr);
+        /* Get RFType */
+        priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE);
+        priv->byRFType &= RF_MASK;
+        dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType);
        device_get_options(priv);
        device_set_options(priv);
        /* Mask out the options cannot be set to the chip */
diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
index 941b2adca95a..7626f635f160 100644
--- a/drivers/staging/vt6655/rf.c
+++ b/drivers/staging/vt6655/rf.c
@@ -794,6 +794,7 @@ bool RFbSetPower(
                break;
        case RATE_6M:
        case RATE_9M:
+        case RATE_12M:
        case RATE_18M:
                byPwr = priv->abyOFDMPwrTbl[uCH];
                if (priv->byRFType == RF_UW2452)
diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
index c42cde59f598..c4286ccac320 100644
--- a/drivers/staging/vt6656/rf.c
+++ b/drivers/staging/vt6656/rf.c
@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
                break;
        case RATE_6M:
        case RATE_9M:
+        case RATE_12M:
        case RATE_18M:
        case RATE_24M:
        case RATE_36M:
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 50bad55a0c42..2accb6e47beb 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4256,11 +4256,17 @@ int iscsit_close_connection(
        pr_debug("Closing iSCSI connection CID %hu on SID:"
                " %u\n", conn->cid, sess->sid);
        /*
-         * Always up conn_logout_comp just in case the RX Thread is sleeping
+         * Always up conn_logout_comp for the traditional TCP case just in case
-         * and the logout response never got sent because the connection
+         * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
-         * failed.
+         * response never got sent because the connection failed.
+         *
+         * However for iser-target, isert_wait4logout() is using conn_logout_comp
+         * to signal logout response TX interrupt completion.  Go ahead and skip
+         * this for iser since isert_rx_opcode() does not wait on logout failure,
+         * and to avoid iscsi_conn pointer dereference in iser-target code.
         */
-        complete(&conn->conn_logout_comp);
+        if (conn->conn_transport->transport_type == ISCSI_TCP)
+                complete(&conn->conn_logout_comp);
        iscsi_release_thread_set(conn);
diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
index 1c197bad6132..bdd8731a4daa 100644
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -22,7 +22,6 @@
 #include <target/target_core_fabric.h>
 #include <target/iscsi/iscsi_target_core.h>
-#include <target/iscsi/iscsi_transport.h>
 #include "iscsi_target_seq_pdu_list.h"
 #include "iscsi_target_tq.h"
 #include "iscsi_target_erl0.h"
@@ -940,8 +939,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
        if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
                spin_unlock_bh(&conn->state_lock);
-                if (conn->conn_transport->transport_type == ISCSI_TCP)
+                iscsit_close_connection(conn);
-                        iscsit_close_connection(conn);
                return;
        }
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index 6b3c32954689..c36bd7c29136 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -953,11 +953,8 @@ static int tcm_loop_make_nexus(
                transport_free_session(tl_nexus->se_sess);
                goto out;
        }
-        /*
+        /* Now, register the SAS I_T Nexus as active. */
-         * Now, register the SAS I_T Nexus as active with the call to
+        transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
-         * transport_register_session()
-         */
-        __transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
                        tl_nexus->se_sess, tl_nexus);
        tl_tpg->tl_nexus = tl_nexus;
        pr_debug("TCM_Loop_ConfigFS: Established I_T Nexus to emulated"
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 58f49ff69b14..79b4ec3ca2db 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -650,6 +650,18 @@ static u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
        return aligned_max_sectors;
 }
+bool se_dev_check_wce(struct se_device *dev)
+{
+        bool wce = false;
+        if (dev->transport->get_write_cache)
+                wce = dev->transport->get_write_cache(dev);
+        else if (dev->dev_attrib.emulate_write_cache > 0)
+                wce = true;
+        return wce;
+}
 int se_dev_set_max_unmap_lba_count(
        struct se_device *dev,
        u32 max_unmap_lba_count)
@@ -767,6 +779,16 @@ int se_dev_set_emulate_fua_write(struct se_device *dev, int flag)
                pr_err("Illegal value %d\n", flag);
                return -EINVAL;
        }
+        if (flag &&
+            dev->transport->get_write_cache) {
+                pr_err("emulate_fua_write not supported for this device\n");
+                return -EINVAL;
+        }
+        if (dev->export_count) {
+                pr_err("emulate_fua_write cannot be changed with active"
+                       " exports: %d\n", dev->export_count);
+                return -EINVAL;
+        }
        dev->dev_attrib.emulate_fua_write = flag;
        pr_debug("dev[%p]: SE Device Forced Unit Access WRITEs: %d\n",
                        dev, dev->dev_attrib.emulate_fua_write);
@@ -801,7 +823,11 @@ int se_dev_set_emulate_write_cache(struct se_device *dev, int flag)
                pr_err("emulate_write_cache not supported for this device\n");
                return -EINVAL;
        }
+        if (dev->export_count) {
+                pr_err("emulate_write_cache cannot be changed with active"
+                       " exports: %d\n", dev->export_count);
+                return -EINVAL;
+        }
        dev->dev_attrib.emulate_write_cache = flag;
        pr_debug("dev[%p]: SE Device WRITE_CACHE_EMULATION flag: %d\n",
                        dev, dev->dev_attrib.emulate_write_cache);
@@ -1534,8 +1560,6 @@ int target_configure_device(struct se_device *dev)
        ret = dev->transport->configure_device(dev);
        if (ret)
                goto out;
-        dev->dev_flags |= DF_CONFIGURED;
        /*
         * XXX: there is not much point to have two different values here..
         */
@@ -1597,6 +1621,8 @@ int target_configure_device(struct se_device *dev)
        list_add_tail(&dev->g_dev_node, &g_device_list);
        mutex_unlock(&g_device_mutex);
+        dev->dev_flags |= DF_CONFIGURED;
        return 0;
 out_free_alua:
diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
index 1045dcd7bf65..f6c954c4635f 100644
--- a/drivers/target/target_core_pscsi.c
+++ b/drivers/target/target_core_pscsi.c
@@ -1121,7 +1121,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
        struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
        struct scsi_device *sd = pdv->pdv_sd;
-        return sd->type;
+        return (sd) ? sd->type : TYPE_NO_LUN;
 }
 static sector_t pscsi_get_blocks(struct se_device *dev)
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 9a2f9d3a6e70..3e7297411110 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -708,8 +708,7 @@ sbc_check_dpofua(struct se_device *dev, struct se_cmd *cmd, unsigned char *cdb)
                }
        }
        if (cdb[1] & 0x8) {
-                if (!dev->dev_attrib.emulate_fua_write ||
+                if (!dev->dev_attrib.emulate_fua_write || !se_dev_check_wce(dev)) {
-                    !dev->dev_attrib.emulate_write_cache) {
                        pr_err("Got CDB: 0x%02x with FUA bit set, but device"
                               " does not advertise support for FUA write\n",
                               cdb[0]);
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 460e93109473..6c8bd6bc175c 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -454,19 +454,6 @@ check_scsi_name:
 }
 EXPORT_SYMBOL(spc_emulate_evpd_83);
-static bool
-spc_check_dev_wce(struct se_device *dev)
-{
-        bool wce = false;
-        if (dev->transport->get_write_cache)
-                wce = dev->transport->get_write_cache(dev);
-        else if (dev->dev_attrib.emulate_write_cache > 0)
-                wce = true;
-        return wce;
-}
 /* Extended INQUIRY Data VPD Page */
 static sense_reason_t
 spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
@@ -490,7 +477,7 @@ spc_emulate_evpd_86(struct se_cmd *cmd, unsigned char *buf)
        buf[5] = 0x07;
        /* If WriteCache emulation is enabled, set V_SUP */
-        if (spc_check_dev_wce(dev))
+        if (se_dev_check_wce(dev))
                buf[6] = 0x01;
        /* If an LBA map is present set R_SUP */
        spin_lock(&cmd->se_dev->t10_alua.lba_map_lock);
@@ -897,7 +884,7 @@ static int spc_modesense_caching(struct se_cmd *cmd, u8 pc, u8 *p)
        if (pc == 1)
                goto out;
-        if (spc_check_dev_wce(dev))
+        if (se_dev_check_wce(dev))
                p[2] = 0x04; /* Write Cache Enable */
        p[12] = 0x20; /* Disabled Read Ahead */
@@ -1009,7 +996,7 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
             (cmd->se_deve->lun_flags & TRANSPORT_LUNFLAGS_READ_ONLY)))
                spc_modesense_write_protect(&buf[length], type);
-        if ((spc_check_dev_wce(dev)) &&
+        if ((se_dev_check_wce(dev)) &&
            (dev->dev_attrib.emulate_fua_write > 0))
                spc_modesense_dpofua(&buf[length], type);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 0adc0f650213..ac3cbabdbdf0 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
        list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
 out:
        spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+        if (ret && ack_kref)
+                target_put_sess_cmd(se_sess, se_cmd);
        return ret;
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 97b486c3dda1..583e755d8091 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -359,7 +359,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
                ep = fc_seq_exch(seq);
                if (ep) {
                        lport = ep->lp;
-                        if (lport && (ep->xid <= lport->lro_xid))
+                        if (lport && (ep->xid <= lport->lro_xid)) {
                                /*
                                 * "ddp_done" trigger invalidation of HW
                                 * specific DDP context
@@ -374,6 +374,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
                                 * identified using ep->xid)
                                 */
                                cmd->was_ddp_setup = 0;
+                        }
                }
        }
 }
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 2ab229ddee38..6ae5b8560e4d 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -119,7 +119,10 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
                        dw8250_force_idle(p);
                        writeb(value, p->membase + (UART_LCR << p->regshift));
                }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
        }
 }
@@ -163,7 +166,10 @@ static void dw8250_serial_outq(struct uart_port *p, int offset, int value)
                        __raw_writeq(value & 0xff,
                                     p->membase + (UART_LCR << p->regshift));
                }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
        }
 }
 #endif /* CONFIG_64BIT */
@@ -187,7 +193,10 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
                        dw8250_force_idle(p);
                        writel(value, p->membase + (UART_LCR << p->regshift));
                }
-                dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                /*
+                 * FIXME: this deadlocks if port->lock is already held
+                 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
+                 */
        }
 }
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index ff451048c1ac..4bfb7ac0239f 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -929,6 +929,13 @@ __acquires(hwep->lock)
        return retval;
 }
+static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
+{
+        dev_warn(&ci->gadget.dev,
+                "connect the device to an alternate port if you want HNP\n");
+        return isr_setup_status_phase(ci);
+}
 /**
 * isr_setup_packet_handler: setup packet handler
 * @ci: UDC descriptor
@@ -1061,6 +1068,10 @@ __acquires(ci->lock)
                                                        ci);
                                }
                                break;
+                        case USB_DEVICE_A_ALT_HNP_SUPPORT:
+                                if (ci_otg_is_fsm_mode(ci))
+                                        err = otg_a_alt_hnp_support(ci);
+                                break;
                        default:
                                goto delegate;
                        }
diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
index c6b35b77dab7..61d538aa2346 100644
--- a/drivers/usb/common/usb-otg-fsm.c
+++ b/drivers/usb/common/usb-otg-fsm.c
@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                break;
        case OTG_STATE_B_PERIPHERAL:
                otg_chrg_vbus(fsm, 0);
-                otg_loc_conn(fsm, 1);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_GADGET);
+                otg_loc_conn(fsm, 1);
                break;
        case OTG_STATE_B_WAIT_ACON:
                otg_chrg_vbus(fsm, 0);
@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
                break;
        case OTG_STATE_A_PERIPHERAL:
-                otg_loc_conn(fsm, 1);
                otg_loc_sof(fsm, 0);
                otg_set_protocol(fsm, PROTO_GADGET);
                otg_drv_vbus(fsm, 1);
+                otg_loc_conn(fsm, 1);
                otg_add_timer(fsm, A_BIDL_ADIS);
                break;
        case OTG_STATE_A_WAIT_VFALL:
diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c
index 02e3e2d4ea56..6cf047878dba 100644
--- a/drivers/usb/dwc2/core_intr.c
+++ b/drivers/usb/dwc2/core_intr.c
@@ -377,6 +377,9 @@ static void dwc2_handle_disconnect_intr(struct dwc2_hsotg *hsotg)
                dwc2_is_host_mode(hsotg) ? "Host" : "Device",
                dwc2_op_state_str(hsotg));
+        if (hsotg->op_state == OTG_STATE_A_HOST)
+                dwc2_hcd_disconnect(hsotg);
        /* Change to L3 (OFF) state */
        hsotg->lx_state = DWC2_L3;
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index 298b46112b1a..39f49f1ad22f 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -289,8 +289,7 @@ static void disable_loopback(struct f_loopback *loop)
        struct usb_composite_dev        *cdev;
        cdev = loop->function.config->cdev;
-        disable_endpoints(cdev, loop->in_ep, loop->out_ep, NULL, NULL, NULL,
+        disable_endpoints(cdev, loop->in_ep, loop->out_ep, NULL, NULL);
-                        NULL);
        VDBG(cdev, "%s disabled\n", loop->function.name);
 }
diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
index e3dae47baef3..3a5ae9900b1e 100644
--- a/drivers/usb/gadget/function/f_sourcesink.c
+++ b/drivers/usb/gadget/function/f_sourcesink.c
@@ -23,15 +23,6 @@
 #include "gadget_chips.h"
 #include "u_f.h"
-#define USB_MS_TO_SS_INTERVAL(x) USB_MS_TO_HS_INTERVAL(x)
-enum eptype {
-        EP_CONTROL = 0,
-        EP_BULK,
-        EP_ISOC,
-        EP_INTERRUPT,
-};
 /*
 * SOURCE/SINK FUNCTION ... a primary testing vehicle for USB peripheral
 * controller drivers.
@@ -64,8 +55,6 @@ struct f_sourcesink {
        struct usb_ep           *out_ep;
        struct usb_ep           *iso_in_ep;
        struct usb_ep           *iso_out_ep;
-        struct usb_ep           *int_in_ep;
-        struct usb_ep           *int_out_ep;
        int                     cur_alt;
 };
@@ -79,10 +68,6 @@ static unsigned isoc_interval;
 static unsigned isoc_maxpacket;
 static unsigned isoc_mult;
 static unsigned isoc_maxburst;
-static unsigned int_interval; /* In ms */
-static unsigned int_maxpacket;
-static unsigned int_mult;
-static unsigned int_maxburst;
 static unsigned buflen;
 /*-------------------------------------------------------------------------*/
@@ -107,16 +92,6 @@ static struct usb_interface_descriptor source_sink_intf_alt1 = {
        /* .iInterface          = DYNAMIC */
 };
-static struct usb_interface_descriptor source_sink_intf_alt2 = {
-        .bLength =              USB_DT_INTERFACE_SIZE,
-        .bDescriptorType =      USB_DT_INTERFACE,
-        .bAlternateSetting =    2,
-        .bNumEndpoints =        2,
-        .bInterfaceClass =      USB_CLASS_VENDOR_SPEC,
-        /* .iInterface          = DYNAMIC */
-};
 /* full speed support: */
 static struct usb_endpoint_descriptor fs_source_desc = {
@@ -155,26 +130,6 @@ static struct usb_endpoint_descriptor fs_iso_sink_desc = {
        .bInterval =            4,
 };
-static struct usb_endpoint_descriptor fs_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_IN,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(64),
-        .bInterval =            GZERO_INT_INTERVAL,
-};
-static struct usb_endpoint_descriptor fs_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bEndpointAddress =     USB_DIR_OUT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(64),
-        .bInterval =            GZERO_INT_INTERVAL,
-};
 static struct usb_descriptor_header *fs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &source_sink_intf_alt0,
        (struct usb_descriptor_header *) &fs_sink_desc,
@@ -185,10 +140,6 @@ static struct usb_descriptor_header *fs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &fs_source_desc,
        (struct usb_descriptor_header *) &fs_iso_sink_desc,
        (struct usb_descriptor_header *) &fs_iso_source_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define FS_ALT_IFC_2_OFFSET     8
-        (struct usb_descriptor_header *) &fs_int_sink_desc,
-        (struct usb_descriptor_header *) &fs_int_source_desc,
        NULL,
 };
@@ -228,24 +179,6 @@ static struct usb_endpoint_descriptor hs_iso_sink_desc = {
        .bInterval =            4,
 };
-static struct usb_endpoint_descriptor hs_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_HS_INTERVAL(GZERO_INT_INTERVAL),
-};
-static struct usb_endpoint_descriptor hs_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_HS_INTERVAL(GZERO_INT_INTERVAL),
-};
 static struct usb_descriptor_header *hs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &source_sink_intf_alt0,
        (struct usb_descriptor_header *) &hs_source_desc,
@@ -256,10 +189,6 @@ static struct usb_descriptor_header *hs_source_sink_descs[] = {
        (struct usb_descriptor_header *) &hs_sink_desc,
        (struct usb_descriptor_header *) &hs_iso_source_desc,
        (struct usb_descriptor_header *) &hs_iso_sink_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define HS_ALT_IFC_2_OFFSET     8
-        (struct usb_descriptor_header *) &hs_int_source_desc,
-        (struct usb_descriptor_header *) &hs_int_sink_desc,
        NULL,
 };
@@ -335,42 +264,6 @@ static struct usb_ss_ep_comp_descriptor ss_iso_sink_comp_desc = {
        .wBytesPerInterval =    cpu_to_le16(1024),
 };
-static struct usb_endpoint_descriptor ss_int_source_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
-};
-static struct usb_ss_ep_comp_descriptor ss_int_source_comp_desc = {
-        .bLength =              USB_DT_SS_EP_COMP_SIZE,
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-        .bMaxBurst =            0,
-        .bmAttributes =         0,
-        .wBytesPerInterval =    cpu_to_le16(1024),
-};
-static struct usb_endpoint_descriptor ss_int_sink_desc = {
-        .bLength =              USB_DT_ENDPOINT_SIZE,
-        .bDescriptorType =      USB_DT_ENDPOINT,
-        .bmAttributes =         USB_ENDPOINT_XFER_INT,
-        .wMaxPacketSize =       cpu_to_le16(1024),
-        .bInterval =            USB_MS_TO_SS_INTERVAL(GZERO_INT_INTERVAL),
-};
-static struct usb_ss_ep_comp_descriptor ss_int_sink_comp_desc = {
-        .bLength =              USB_DT_SS_EP_COMP_SIZE,
-        .bDescriptorType =      USB_DT_SS_ENDPOINT_COMP,
-        .bMaxBurst =            0,
-        .bmAttributes =         0,
-        .wBytesPerInterval =    cpu_to_le16(1024),
-};
 static struct usb_descriptor_header *ss_source_sink_descs[] = {
        (struct usb_descriptor_header *) &source_sink_intf_alt0,
        (struct usb_descriptor_header *) &ss_source_desc,
@@ -387,12 +280,6 @@ static struct usb_descriptor_header *ss_source_sink_descs[] = {
        (struct usb_descriptor_header *) &ss_iso_source_comp_desc,
        (struct usb_descriptor_header *) &ss_iso_sink_desc,
        (struct usb_descriptor_header *) &ss_iso_sink_comp_desc,
-        (struct usb_descriptor_header *) &source_sink_intf_alt2,
-#define SS_ALT_IFC_2_OFFSET     14
-        (struct usb_descriptor_header *) &ss_int_source_desc,
-        (struct usb_descriptor_header *) &ss_int_source_comp_desc,
-        (struct usb_descriptor_header *) &ss_int_sink_desc,
-        (struct usb_descriptor_header *) &ss_int_sink_comp_desc,
        NULL,
 };
@@ -414,21 +301,6 @@ static struct usb_gadget_strings *sourcesink_strings[] = {
 };
 /*-------------------------------------------------------------------------*/
-static const char *get_ep_string(enum eptype ep_type)
-{
-        switch (ep_type) {
-        case EP_ISOC:
-                return "ISOC-";
-        case EP_INTERRUPT:
-                return "INTERRUPT-";
-        case EP_CONTROL:
-                return "CTRL-";
-        case EP_BULK:
-                return "BULK-";
-        default:
-                return "UNKNOWN-";
-        }
-}
 static inline struct usb_request *ss_alloc_ep_req(struct usb_ep *ep, int len)
 {
@@ -456,8 +328,7 @@ static void disable_ep(struct usb_composite_dev *cdev, struct usb_ep *ep)
 void disable_endpoints(struct usb_composite_dev *cdev,
                struct usb_ep *in, struct usb_ep *out,
-                struct usb_ep *iso_in, struct usb_ep *iso_out,
+                struct usb_ep *iso_in, struct usb_ep *iso_out)
-                struct usb_ep *int_in, struct usb_ep *int_out)
 {
        disable_ep(cdev, in);
        disable_ep(cdev, out);
@@ -465,10 +336,6 @@ void disable_endpoints(struct usb_composite_dev *cdev,
                disable_ep(cdev, iso_in);
        if (iso_out)
                disable_ep(cdev, iso_out);
-        if (int_in)
-                disable_ep(cdev, int_in);
-        if (int_out)
-                disable_ep(cdev, int_out);
 }
 static int
@@ -485,7 +352,6 @@ sourcesink_bind(struct usb_configuration *c, struct usb_function *f)
                return id;
        source_sink_intf_alt0.bInterfaceNumber = id;
        source_sink_intf_alt1.bInterfaceNumber = id;
-        source_sink_intf_alt2.bInterfaceNumber = id;
        /* allocate bulk endpoints */
        ss->in_ep = usb_ep_autoconfig(cdev->gadget, &fs_source_desc);
@@ -546,55 +412,14 @@ no_iso:
        if (isoc_maxpacket > 1024)
                isoc_maxpacket = 1024;
-        /* sanity check the interrupt module parameters */
-        if (int_interval < 1)
-                int_interval = 1;
-        if (int_interval > 4096)
-                int_interval = 4096;
-        if (int_mult > 2)
-                int_mult = 2;
-        if (int_maxburst > 15)
-                int_maxburst = 15;
-        /* fill in the FS interrupt descriptors from the module parameters */
-        fs_int_source_desc.wMaxPacketSize = int_maxpacket > 64 ?
-                                                64 : int_maxpacket;
-        fs_int_source_desc.bInterval = int_interval > 255 ?
-                                                255 : int_interval;
-        fs_int_sink_desc.wMaxPacketSize = int_maxpacket > 64 ?
-                                                64 : int_maxpacket;
-        fs_int_sink_desc.bInterval = int_interval > 255 ?
-                                                255 : int_interval;
-        /* allocate int endpoints */
-        ss->int_in_ep = usb_ep_autoconfig(cdev->gadget, &fs_int_source_desc);
-        if (!ss->int_in_ep)
-                goto no_int;
-        ss->int_in_ep->driver_data = cdev;      /* claim */
-        ss->int_out_ep = usb_ep_autoconfig(cdev->gadget, &fs_int_sink_desc);
-        if (ss->int_out_ep) {
-                ss->int_out_ep->driver_data = cdev;     /* claim */
-        } else {
-                ss->int_in_ep->driver_data = NULL;
-                ss->int_in_ep = NULL;
-no_int:
-                fs_source_sink_descs[FS_ALT_IFC_2_OFFSET] = NULL;
-                hs_source_sink_descs[HS_ALT_IFC_2_OFFSET] = NULL;
-                ss_source_sink_descs[SS_ALT_IFC_2_OFFSET] = NULL;
-        }
-        if (int_maxpacket > 1024)
-                int_maxpacket = 1024;
        /* support high speed hardware */
        hs_source_desc.bEndpointAddress = fs_source_desc.bEndpointAddress;
        hs_sink_desc.bEndpointAddress = fs_sink_desc.bEndpointAddress;
        /*
-         * Fill in the HS isoc and interrupt descriptors from the module
+         * Fill in the HS isoc descriptors from the module parameters.
-         * parameters. We assume that the user knows what they are doing and
+         * We assume that the user knows what they are doing and won't
-         * won't give parameters that their UDC doesn't support.
+         * give parameters that their UDC doesn't support.
         */
        hs_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
        hs_iso_source_desc.wMaxPacketSize |= isoc_mult << 11;
@@ -607,17 +432,6 @@ no_int:
        hs_iso_sink_desc.bInterval = isoc_interval;
        hs_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
-        hs_int_source_desc.wMaxPacketSize = int_maxpacket;
-        hs_int_source_desc.wMaxPacketSize |= int_mult << 11;
-        hs_int_source_desc.bInterval = USB_MS_TO_HS_INTERVAL(int_interval);
-        hs_int_source_desc.bEndpointAddress =
-                fs_int_source_desc.bEndpointAddress;
-        hs_int_sink_desc.wMaxPacketSize = int_maxpacket;
-        hs_int_sink_desc.wMaxPacketSize |= int_mult << 11;
-        hs_int_sink_desc.bInterval = USB_MS_TO_HS_INTERVAL(int_interval);
-        hs_int_sink_desc.bEndpointAddress = fs_int_sink_desc.bEndpointAddress;
        /* support super speed hardware */
        ss_source_desc.bEndpointAddress =
                fs_source_desc.bEndpointAddress;
@@ -625,9 +439,9 @@ no_int:
                fs_sink_desc.bEndpointAddress;
        /*
-         * Fill in the SS isoc and interrupt descriptors from the module
+         * Fill in the SS isoc descriptors from the module parameters.
-         * parameters. We assume that the user knows what they are doing and
+         * We assume that the user knows what they are doing and won't
-         * won't give parameters that their UDC doesn't support.
+         * give parameters that their UDC doesn't support.
         */
        ss_iso_source_desc.wMaxPacketSize = isoc_maxpacket;
        ss_iso_source_desc.bInterval = isoc_interval;
@@ -646,37 +460,17 @@ no_int:
                isoc_maxpacket * (isoc_mult + 1) * (isoc_maxburst + 1);
        ss_iso_sink_desc.bEndpointAddress = fs_iso_sink_desc.bEndpointAddress;
-        ss_int_source_desc.wMaxPacketSize = int_maxpacket;
-        ss_int_source_desc.bInterval = USB_MS_TO_SS_INTERVAL(int_interval);
-        ss_int_source_comp_desc.bmAttributes = int_mult;
-        ss_int_source_comp_desc.bMaxBurst = int_maxburst;
-        ss_int_source_comp_desc.wBytesPerInterval =
-                int_maxpacket * (int_mult + 1) * (int_maxburst + 1);
-        ss_int_source_desc.bEndpointAddress =
-                fs_int_source_desc.bEndpointAddress;
-        ss_int_sink_desc.wMaxPacketSize = int_maxpacket;
-        ss_int_sink_desc.bInterval = USB_MS_TO_SS_INTERVAL(int_interval);
-        ss_int_sink_comp_desc.bmAttributes = int_mult;
-        ss_int_sink_comp_desc.bMaxBurst = int_maxburst;
-        ss_int_sink_comp_desc.wBytesPerInterval =
-                int_maxpacket * (int_mult + 1) * (int_maxburst + 1);
-        ss_int_sink_desc.bEndpointAddress = fs_int_sink_desc.bEndpointAddress;
        ret = usb_assign_descriptors(f, fs_source_sink_descs,
                        hs_source_sink_descs, ss_source_sink_descs);
        if (ret)
                return ret;
-        DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s, "
+        DBG(cdev, "%s speed %s: IN/%s, OUT/%s, ISO-IN/%s, ISO-OUT/%s\n",
-                        "INT-IN/%s, INT-OUT/%s\n",
            (gadget_is_superspeed(c->cdev->gadget) ? "super" :
             (gadget_is_dualspeed(c->cdev->gadget) ? "dual" : "full")),
                        f->name, ss->in_ep->name, ss->out_ep->name,
                        ss->iso_in_ep ? ss->iso_in_ep->name : "<none>",
-                        ss->iso_out_ep ? ss->iso_out_ep->name : "<none>",
+                        ss->iso_out_ep ? ss->iso_out_ep->name : "<none>");
-                        ss->int_in_ep ? ss->int_in_ep->name : "<none>",
-                        ss->int_out_ep ? ss->int_out_ep->name : "<none>");
        return 0;
 }
@@ -807,15 +601,14 @@ static void source_sink_complete(struct usb_ep *ep, struct usb_request *req)
 }
 static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
-                enum eptype ep_type, int speed)
+                bool is_iso, int speed)
 {
        struct usb_ep           *ep;
        struct usb_request      *req;
        int                     i, size, status;
        for (i = 0; i < 8; i++) {
-                switch (ep_type) {
+                if (is_iso) {
-                case EP_ISOC:
                        switch (speed) {
                        case USB_SPEED_SUPER:
                                size = isoc_maxpacket * (isoc_mult + 1) *
@@ -831,28 +624,9 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
                        }
                        ep = is_in ? ss->iso_in_ep : ss->iso_out_ep;
                        req = ss_alloc_ep_req(ep, size);
-                        break;
+                } else {
-                case EP_INTERRUPT:
-                        switch (speed) {
-                        case USB_SPEED_SUPER:
-                                size = int_maxpacket * (int_mult + 1) *
-                                                (int_maxburst + 1);
-                                break;
-                        case USB_SPEED_HIGH:
-                                size = int_maxpacket * (int_mult + 1);
-                                break;
-                        default:
-                                size = int_maxpacket > 1023 ?
-                                                1023 : int_maxpacket;
-                                break;
-                        }
-                        ep = is_in ? ss->int_in_ep : ss->int_out_ep;
-                        req = ss_alloc_ep_req(ep, size);
-                        break;
-                default:
                        ep = is_in ? ss->in_ep : ss->out_ep;
                        req = ss_alloc_ep_req(ep, 0);
-                        break;
                }
                if (!req)
@@ -870,12 +644,12 @@ static int source_sink_start_ep(struct f_sourcesink *ss, bool is_in,
                        cdev = ss->function.config->cdev;
                        ERROR(cdev, "start %s%s %s --> %d\n",
-                                get_ep_string(ep_type), is_in ? "IN" : "OUT",
+                              is_iso ? "ISO-" : "", is_in ? "IN" : "OUT",
-                                ep->name, status);
+                              ep->name, status);
                        free_ep_req(ep, req);
                }
-                if (!(ep_type == EP_ISOC))
+                if (!is_iso)
                        break;
        }
@@ -888,7 +662,7 @@ static void disable_source_sink(struct f_sourcesink *ss)
        cdev = ss->function.config->cdev;
        disable_endpoints(cdev, ss->in_ep, ss->out_ep, ss->iso_in_ep,
-                        ss->iso_out_ep, ss->int_in_ep, ss->int_out_ep);
+                        ss->iso_out_ep);
        VDBG(cdev, "%s disabled\n", ss->function.name);
 }
@@ -900,62 +674,6 @@ enable_source_sink(struct usb_composite_dev *cdev, struct f_sourcesink *ss,
        int                                     speed = cdev->gadget->speed;
        struct usb_ep                           *ep;
-        if (alt == 2) {
-                /* Configure for periodic interrupt endpoint */
-                ep = ss->int_in_ep;
-                if (ep) {
-                        result = config_ep_by_speed(cdev->gadget,
-                                        &(ss->function), ep);
-                        if (result)
-                                return result;
-                        result = usb_ep_enable(ep);
-                        if (result < 0)
-                                return result;
-                        ep->driver_data = ss;
-                        result = source_sink_start_ep(ss, true, EP_INTERRUPT,
-                                        speed);
-                        if (result < 0) {
-fail1:
-                                ep = ss->int_in_ep;
-                                if (ep) {
-                                        usb_ep_disable(ep);
-                                        ep->driver_data = NULL;
-                                }
-                                return result;
-                        }
-                }
-                /*
-                 * one interrupt endpoint reads (sinks) anything OUT (from the
-                 * host)
-                 */
-                ep = ss->int_out_ep;
-                if (ep) {
-                        result = config_ep_by_speed(cdev->gadget,
-                                        &(ss->function), ep);
-                        if (result)
-                                goto fail1;
-                        result = usb_ep_enable(ep);
-                        if (result < 0)
-                                goto fail1;
-                        ep->driver_data = ss;
-                        result = source_sink_start_ep(ss, false, EP_INTERRUPT,
-                                        speed);
-                        if (result < 0) {
-                                ep = ss->int_out_ep;
-                                usb_ep_disable(ep);
-                                ep->driver_data = NULL;
-                                goto fail1;
-                        }
-                }
-                goto out;
-        }
        /* one bulk endpoint writes (sources) zeroes IN (to the host) */
        ep = ss->in_ep;
        result = config_ep_by_speed(cdev->gadget, &(ss->function), ep);
@@ -966,7 +684,7 @@ fail1:
                return result;
        ep->driver_data = ss;
-        result = source_sink_start_ep(ss, true, EP_BULK, speed);
+        result = source_sink_start_ep(ss, true, false, speed);
        if (result < 0) {
 fail:
                ep = ss->in_ep;
@@ -985,7 +703,7 @@ fail:
                goto fail;
        ep->driver_data = ss;
-        result = source_sink_start_ep(ss, false, EP_BULK, speed);
+        result = source_sink_start_ep(ss, false, false, speed);
        if (result < 0) {
 fail2:
                ep = ss->out_ep;
@@ -1008,7 +726,7 @@ fail2:
                        goto fail2;
                ep->driver_data = ss;
-                result = source_sink_start_ep(ss, true, EP_ISOC, speed);
+                result = source_sink_start_ep(ss, true, true, speed);
                if (result < 0) {
 fail3:
                        ep = ss->iso_in_ep;
@@ -1031,14 +749,13 @@ fail3:
                        goto fail3;
                ep->driver_data = ss;
-                result = source_sink_start_ep(ss, false, EP_ISOC, speed);
+                result = source_sink_start_ep(ss, false, true, speed);
                if (result < 0) {
                        usb_ep_disable(ep);
                        ep->driver_data = NULL;
                        goto fail3;
                }
        }
 out:
        ss->cur_alt = alt;
@@ -1054,8 +771,6 @@ static int sourcesink_set_alt(struct usb_function *f,
        if (ss->in_ep->driver_data)
                disable_source_sink(ss);
-        else if (alt == 2 && ss->int_in_ep->driver_data)
-                disable_source_sink(ss);
        return enable_source_sink(cdev, ss, alt);
 }
@@ -1168,10 +883,6 @@ static struct usb_function *source_sink_alloc_func(
        isoc_maxpacket = ss_opts->isoc_maxpacket;
        isoc_mult = ss_opts->isoc_mult;
        isoc_maxburst = ss_opts->isoc_maxburst;
-        int_interval = ss_opts->int_interval;
-        int_maxpacket = ss_opts->int_maxpacket;
-        int_mult = ss_opts->int_mult;
-        int_maxburst = ss_opts->int_maxburst;
        buflen = ss_opts->bulk_buflen;
        ss->function.name = "source/sink";
@@ -1468,182 +1179,6 @@ static struct f_ss_opts_attribute f_ss_opts_bulk_buflen =
                        f_ss_opts_bulk_buflen_show,
                        f_ss_opts_bulk_buflen_store);
-static ssize_t f_ss_opts_int_interval_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_interval);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_interval_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u32 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou32(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 4096) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_interval = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_interval =
-        __CONFIGFS_ATTR(int_interval, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_interval_show,
-                        f_ss_opts_int_interval_store);
-static ssize_t f_ss_opts_int_maxpacket_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_maxpacket);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_maxpacket_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u16 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou16(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 1024) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_maxpacket = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_maxpacket =
-        __CONFIGFS_ATTR(int_maxpacket, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_maxpacket_show,
-                        f_ss_opts_int_maxpacket_store);
-static ssize_t f_ss_opts_int_mult_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_mult);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_mult_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u8 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou8(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 2) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_mult = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_mult =
-        __CONFIGFS_ATTR(int_mult, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_mult_show,
-                        f_ss_opts_int_mult_store);
-static ssize_t f_ss_opts_int_maxburst_show(struct f_ss_opts *opts, char *page)
-{
-        int result;
-        mutex_lock(&opts->lock);
-        result = sprintf(page, "%u", opts->int_maxburst);
-        mutex_unlock(&opts->lock);
-        return result;
-}
-static ssize_t f_ss_opts_int_maxburst_store(struct f_ss_opts *opts,
-                                       const char *page, size_t len)
-{
-        int ret;
-        u8 num;
-        mutex_lock(&opts->lock);
-        if (opts->refcnt) {
-                ret = -EBUSY;
-                goto end;
-        }
-        ret = kstrtou8(page, 0, &num);
-        if (ret)
-                goto end;
-        if (num > 15) {
-                ret = -EINVAL;
-                goto end;
-        }
-        opts->int_maxburst = num;
-        ret = len;
-end:
-        mutex_unlock(&opts->lock);
-        return ret;
-}
-static struct f_ss_opts_attribute f_ss_opts_int_maxburst =
-        __CONFIGFS_ATTR(int_maxburst, S_IRUGO | S_IWUSR,
-                        f_ss_opts_int_maxburst_show,
-                        f_ss_opts_int_maxburst_store);
 static struct configfs_attribute *ss_attrs[] = {
        &f_ss_opts_pattern.attr,
        &f_ss_opts_isoc_interval.attr,
@@ -1651,10 +1186,6 @@ static struct configfs_attribute *ss_attrs[] = {
        &f_ss_opts_isoc_mult.attr,
        &f_ss_opts_isoc_maxburst.attr,
        &f_ss_opts_bulk_buflen.attr,
-        &f_ss_opts_int_interval.attr,
-        &f_ss_opts_int_maxpacket.attr,
-        &f_ss_opts_int_mult.attr,
-        &f_ss_opts_int_maxburst.attr,
        NULL,
 };
@@ -1684,8 +1215,6 @@ static struct usb_function_instance *source_sink_alloc_inst(void)
        ss_opts->isoc_interval = GZERO_ISOC_INTERVAL;
        ss_opts->isoc_maxpacket = GZERO_ISOC_MAXPACKET;
        ss_opts->bulk_buflen = GZERO_BULK_BUFLEN;
-        ss_opts->int_interval = GZERO_INT_INTERVAL;
-        ss_opts->int_maxpacket = GZERO_INT_MAXPACKET;
        config_group_init_type_name(&ss_opts->func_inst.group, "",
                                    &ss_func_type);
diff --git a/drivers/usb/gadget/function/g_zero.h b/drivers/usb/gadget/function/g_zero.h
index 2ce28b9d97cc..15f180904f8a 100644
--- a/drivers/usb/gadget/function/g_zero.h
+++ b/drivers/usb/gadget/function/g_zero.h
@@ -10,8 +10,6 @@
 #define GZERO_QLEN              32
 #define GZERO_ISOC_INTERVAL     4
 #define GZERO_ISOC_MAXPACKET    1024
-#define GZERO_INT_INTERVAL      1 /* Default interrupt interval = 1 ms */
-#define GZERO_INT_MAXPACKET     1024
 struct usb_zero_options {
        unsigned pattern;
@@ -19,10 +17,6 @@ struct usb_zero_options {
        unsigned isoc_maxpacket;
        unsigned isoc_mult;
        unsigned isoc_maxburst;
-        unsigned int_interval; /* In ms */
-        unsigned int_maxpacket;
-        unsigned int_mult;
-        unsigned int_maxburst;
        unsigned bulk_buflen;
        unsigned qlen;
 };
@@ -34,10 +28,6 @@ struct f_ss_opts {
        unsigned isoc_maxpacket;
        unsigned isoc_mult;
        unsigned isoc_maxburst;
-        unsigned int_interval; /* In ms */
-        unsigned int_maxpacket;
-        unsigned int_mult;
-        unsigned int_maxburst;
        unsigned bulk_buflen;
        /*
@@ -72,7 +62,6 @@ int lb_modinit(void);
 void free_ep_req(struct usb_ep *ep, struct usb_request *req);
 void disable_endpoints(struct usb_composite_dev *cdev,
                struct usb_ep *in, struct usb_ep *out,
-                struct usb_ep *iso_in, struct usb_ep *iso_out,
+                struct usb_ep *iso_in, struct usb_ep *iso_out);
-                struct usb_ep *int_in, struct usb_ep *int_out);
 #endif /* __G_ZERO_H */
diff --git a/drivers/usb/gadget/legacy/tcm_usb_gadget.c b/drivers/usb/gadget/legacy/tcm_usb_gadget.c
index 3a494168661e..6e0a019aad54 100644
--- a/drivers/usb/gadget/legacy/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/legacy/tcm_usb_gadget.c
@@ -1740,10 +1740,9 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
                goto err_session;
        }
        /*
-         * Now register the TCM vHost virtual I_T Nexus as active with the
+         * Now register the TCM vHost virtual I_T Nexus as active.
-         * call to __transport_register_session()
         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                        tv_nexus->tvn_se_sess, tv_nexus);
        tpg->tpg_nexus = tv_nexus;
        mutex_unlock(&tpg->tpg_mutex);
diff --git a/drivers/usb/gadget/legacy/zero.c b/drivers/usb/gadget/legacy/zero.c
index ff97ac93ac03..5ee95152493c 100644
--- a/drivers/usb/gadget/legacy/zero.c
+++ b/drivers/usb/gadget/legacy/zero.c
@@ -68,8 +68,6 @@ static struct usb_zero_options gzero_options = {
        .isoc_maxpacket = GZERO_ISOC_MAXPACKET,
        .bulk_buflen = GZERO_BULK_BUFLEN,
        .qlen = GZERO_QLEN,
-        .int_interval = GZERO_INT_INTERVAL,
-        .int_maxpacket = GZERO_INT_MAXPACKET,
 };
 /*-------------------------------------------------------------------------*/
@@ -268,21 +266,6 @@ module_param_named(isoc_maxburst, gzero_options.isoc_maxburst, uint,
                S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(isoc_maxburst, "0 - 15 (ss only)");
-module_param_named(int_interval, gzero_options.int_interval, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_interval, "1 - 16");
-module_param_named(int_maxpacket, gzero_options.int_maxpacket, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_maxpacket, "0 - 1023 (fs), 0 - 1024 (hs/ss)");
-module_param_named(int_mult, gzero_options.int_mult, uint, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_mult, "0 - 2 (hs/ss only)");
-module_param_named(int_maxburst, gzero_options.int_maxburst, uint,
-                S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(int_maxburst, "0 - 15 (ss only)");
 static struct usb_function *func_lb;
 static struct usb_function_instance *func_inst_lb;
@@ -318,10 +301,6 @@ static int __init zero_bind(struct usb_composite_dev *cdev)
        ss_opts->isoc_maxpacket = gzero_options.isoc_maxpacket;
        ss_opts->isoc_mult = gzero_options.isoc_mult;
        ss_opts->isoc_maxburst = gzero_options.isoc_maxburst;
-        ss_opts->int_interval = gzero_options.int_interval;
-        ss_opts->int_maxpacket = gzero_options.int_maxpacket;
-        ss_opts->int_mult = gzero_options.int_mult;
-        ss_opts->int_maxburst = gzero_options.int_maxburst;
        ss_opts->bulk_buflen = gzero_options.bulk_buflen;
        func_ss = usb_get_function(func_inst_ss);
diff --git a/drivers/usb/host/ehci-atmel.c b/drivers/usb/host/ehci-atmel.c
index 663f7908b15c..be0964a801e8 100644
--- a/drivers/usb/host/ehci-atmel.c
+++ b/drivers/usb/host/ehci-atmel.c
@@ -34,7 +34,6 @@ static const char hcd_name[] = "ehci-atmel";
 struct atmel_ehci_priv {
        struct clk *iclk;
-        struct clk *fclk;
        struct clk *uclk;
        bool clocked;
 };
@@ -51,12 +50,9 @@ static void atmel_start_clock(struct atmel_ehci_priv *atmel_ehci)
 {
        if (atmel_ehci->clocked)
                return;
-        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-                clk_set_rate(atmel_ehci->uclk, 48000000);
+        clk_prepare_enable(atmel_ehci->uclk);
-                clk_prepare_enable(atmel_ehci->uclk);
-        }
        clk_prepare_enable(atmel_ehci->iclk);
-        clk_prepare_enable(atmel_ehci->fclk);
        atmel_ehci->clocked = true;
 }
@@ -64,10 +60,9 @@ static void atmel_stop_clock(struct atmel_ehci_priv *atmel_ehci)
 {
        if (!atmel_ehci->clocked)
                return;
-        clk_disable_unprepare(atmel_ehci->fclk);
        clk_disable_unprepare(atmel_ehci->iclk);
-        if (IS_ENABLED(CONFIG_COMMON_CLK))
+        clk_disable_unprepare(atmel_ehci->uclk);
-                clk_disable_unprepare(atmel_ehci->uclk);
        atmel_ehci->clocked = false;
 }
@@ -146,20 +141,13 @@ static int ehci_atmel_drv_probe(struct platform_device *pdev)
                retval = -ENOENT;
                goto fail_request_resource;
        }
-        atmel_ehci->fclk = devm_clk_get(&pdev->dev, "uhpck");
-        if (IS_ERR(atmel_ehci->fclk)) {
+        atmel_ehci->uclk = devm_clk_get(&pdev->dev, "usb_clk");
-                dev_err(&pdev->dev, "Error getting function clock\n");
+        if (IS_ERR(atmel_ehci->uclk)) {
-                retval = -ENOENT;
+                dev_err(&pdev->dev, "failed to get uclk\n");
+                retval = PTR_ERR(atmel_ehci->uclk);
                goto fail_request_resource;
        }
-        if (IS_ENABLED(CONFIG_COMMON_CLK)) {
-                atmel_ehci->uclk = devm_clk_get(&pdev->dev, "usb_clk");
-                if (IS_ERR(atmel_ehci->uclk)) {
-                        dev_err(&pdev->dev, "failed to get uclk\n");
-                        retval = PTR_ERR(atmel_ehci->uclk);
-                        goto fail_request_resource;
-                }
-        }
        ehci = hcd_to_ehci(hcd);
        /* registers start at offset 0x0 */
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5fb66db89e05..73485fa4372f 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1729,7 +1729,7 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
        if (!command)
                return;
-        ep->ep_state |= EP_HALTED | EP_RECENTLY_HALTED;
+        ep->ep_state |= EP_HALTED;
        ep->stopped_stream = stream_id;
        xhci_queue_reset_ep(xhci, command, slot_id, ep_index);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b06d1a53652d..ec8ac1674854 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1338,12 +1338,6 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                goto exit;
        }
-        /* Reject urb if endpoint is in soft reset, queue must stay empty */
-        if (xhci->devs[slot_id]->eps[ep_index].ep_state & EP_CONFIG_PENDING) {
-                xhci_warn(xhci, "Can't enqueue URB while ep is in soft reset\n");
-                ret = -EINVAL;
-        }
        if (usb_endpoint_xfer_isoc(&urb->ep->desc))
                size = urb->number_of_packets;
        else
@@ -2954,36 +2948,23 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
        }
 }
-/* Called after clearing a halted device. USB core should have sent the control
+/* Called when clearing halted device. The core should have sent the control
 * message to clear the device halt condition. The host side of the halt should
- * already be cleared with a reset endpoint command issued immediately when the
+ * already be cleared with a reset endpoint command issued when the STALL tx
- * STALL tx event was received.
+ * event was received.
+ *
+ * Context: in_interrupt
 */
 void xhci_endpoint_reset(struct usb_hcd *hcd,
                struct usb_host_endpoint *ep)
 {
        struct xhci_hcd *xhci;
-        struct usb_device *udev;
-        struct xhci_virt_device *virt_dev;
-        struct xhci_virt_ep *virt_ep;
-        struct xhci_input_control_ctx *ctrl_ctx;
-        struct xhci_command *command;
-        unsigned int ep_index, ep_state;
-        unsigned long flags;
-        u32 ep_flag;
        xhci = hcd_to_xhci(hcd);
-        udev = (struct usb_device *) ep->hcpriv;
-        if (!ep->hcpriv)
-                return;
-        virt_dev = xhci->devs[udev->slot_id];
-        ep_index = xhci_get_endpoint_index(&ep->desc);
-        virt_ep = &virt_dev->eps[ep_index];
-        ep_state = virt_ep->ep_state;
        /*
-         * Implement the config ep command in xhci 4.6.8 additional note:
+         * We might need to implement the config ep cmd in xhci 4.8.1 note:
         * The Reset Endpoint Command may only be issued to endpoints in the
         * Halted state. If software wishes reset the Data Toggle or Sequence
         * Number of an endpoint that isn't in the Halted state, then software
@@ -2991,72 +2972,9 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
         * for the target endpoint. that is in the Stopped state.
         */
-        if (ep_state & SET_DEQ_PENDING || ep_state & EP_RECENTLY_HALTED) {
+        /* For now just print debug to follow the situation */
-                virt_ep->ep_state &= ~EP_RECENTLY_HALTED;
+        xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
-                xhci_dbg(xhci, "ep recently halted, no toggle reset needed\n");
+                 ep->desc.bEndpointAddress);
-                return;
-        }
-        /* Only interrupt and bulk ep's use Data toggle, USB2 spec 5.5.4-> */
-        if (usb_endpoint_xfer_control(&ep->desc) ||
-            usb_endpoint_xfer_isoc(&ep->desc))
-                return;
-        ep_flag = xhci_get_endpoint_flag(&ep->desc);
-        if (ep_flag == SLOT_FLAG || ep_flag == EP0_FLAG)
-                return;
-        command = xhci_alloc_command(xhci, true, true, GFP_NOWAIT);
-        if (!command) {
-                xhci_err(xhci, "Could not allocate xHCI command structure.\n");
-                return;
-        }
-        spin_lock_irqsave(&xhci->lock, flags);
-        /* block ringing ep doorbell */
-        virt_ep->ep_state |= EP_CONFIG_PENDING;
-        /*
-         * Make sure endpoint ring is empty before resetting the toggle/seq.
-         * Driver is required to synchronously cancel all transfer request.
-         *
-         * xhci 4.6.6 says we can issue a configure endpoint command on a
-         * running endpoint ring as long as it's idle (queue empty)
-         */
-        if (!list_empty(&virt_ep->ring->td_list)) {
-                dev_err(&udev->dev, "EP not empty, refuse reset\n");
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                goto cleanup;
-        }
-        xhci_dbg(xhci, "Reset toggle/seq for slot %d, ep_index: %d\n",
-                 udev->slot_id, ep_index);
-        ctrl_ctx = xhci_get_input_control_ctx(command->in_ctx);
-        if (!ctrl_ctx) {
-                xhci_err(xhci, "Could not get input context, bad type. virt_dev: %p, in_ctx %p\n",
-                         virt_dev, virt_dev->in_ctx);
-                spin_unlock_irqrestore(&xhci->lock, flags);
-                goto cleanup;
-        }
-        xhci_setup_input_ctx_for_config_ep(xhci, command->in_ctx,
-                                           virt_dev->out_ctx, ctrl_ctx,
-                                           ep_flag, ep_flag);
-        xhci_endpoint_copy(xhci, command->in_ctx, virt_dev->out_ctx, ep_index);
-        xhci_queue_configure_endpoint(xhci, command, command->in_ctx->dma,
-                                     udev->slot_id, false);
-        xhci_ring_cmd_db(xhci);
-        spin_unlock_irqrestore(&xhci->lock, flags);
-        wait_for_completion(command->completion);
-cleanup:
-        virt_ep->ep_state &= ~EP_CONFIG_PENDING;
-        xhci_free_command(xhci, command);
 }
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 265ab1771d24..8e421b89632d 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -865,8 +865,6 @@ struct xhci_virt_ep {
 #define EP_HAS_STREAMS          (1 << 4)
 /* Transitioning the endpoint to not using streams, don't enqueue URBs */
 #define EP_GETTING_NO_STREAMS   (1 << 5)
-#define EP_RECENTLY_HALTED      (1 << 6)
-#define EP_CONFIG_PENDING       (1 << 7)
        /* ----  Related to URB cancellation ---- */
        struct list_head        cancelled_td_list;
        struct xhci_td          *stopped_td;
diff --git a/drivers/usb/isp1760/isp1760-core.c b/drivers/usb/isp1760/isp1760-core.c
index b9827556455f..bfa402cf3a27 100644
--- a/drivers/usb/isp1760/isp1760-core.c
+++ b/drivers/usb/isp1760/isp1760-core.c
@@ -151,8 +151,7 @@ int isp1760_register(struct resource *mem, int irq, unsigned long irqflags,
        }
        if (IS_ENABLED(CONFIG_USB_ISP1761_UDC) && !udc_disabled) {
-                ret = isp1760_udc_register(isp, irq, irqflags | IRQF_SHARED |
+                ret = isp1760_udc_register(isp, irq, irqflags);
-                                           IRQF_DISABLED);
                if (ret < 0) {
                        isp1760_hcd_unregister(&isp->hcd);
                        return ret;
diff --git a/drivers/usb/isp1760/isp1760-udc.c b/drivers/usb/isp1760/isp1760-udc.c
index 9612d7990565..f32c292cc868 100644
--- a/drivers/usb/isp1760/isp1760-udc.c
+++ b/drivers/usb/isp1760/isp1760-udc.c
@@ -1191,6 +1191,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
                             struct usb_gadget_driver *driver)
 {
        struct isp1760_udc *udc = gadget_to_udc(gadget);
+        unsigned long flags;
        /* The hardware doesn't support low speed. */
        if (driver->max_speed < USB_SPEED_FULL) {
@@ -1198,7 +1199,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
                return -EINVAL;
        }
-        spin_lock(&udc->lock);
+        spin_lock_irqsave(&udc->lock, flags);
        if (udc->driver) {
                dev_err(udc->isp->dev, "UDC already has a gadget driver\n");
@@ -1208,7 +1209,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
        udc->driver = driver;
-        spin_unlock(&udc->lock);
+        spin_unlock_irqrestore(&udc->lock, flags);
        dev_dbg(udc->isp->dev, "starting UDC with driver %s\n",
                driver->function);
@@ -1232,6 +1233,7 @@ static int isp1760_udc_start(struct usb_gadget *gadget,
 static int isp1760_udc_stop(struct usb_gadget *gadget)
 {
        struct isp1760_udc *udc = gadget_to_udc(gadget);
+        unsigned long flags;
        dev_dbg(udc->isp->dev, "%s\n", __func__);
@@ -1239,9 +1241,9 @@ static int isp1760_udc_stop(struct usb_gadget *gadget)
        isp1760_udc_write(udc, DC_MODE, 0);
-        spin_lock(&udc->lock);
+        spin_lock_irqsave(&udc->lock, flags);
        udc->driver = NULL;
-        spin_unlock(&udc->lock);
+        spin_unlock_irqrestore(&udc->lock, flags);
        return 0;
 }
@@ -1411,7 +1413,7 @@ static int isp1760_udc_init(struct isp1760_udc *udc)
                return -ENODEV;
        }
-        if (chipid != 0x00011582) {
+        if (chipid != 0x00011582 && chipid != 0x00158210) {
                dev_err(udc->isp->dev, "udc: invalid chip ID 0x%08x\n", chipid);
                return -ENODEV;
        }
@@ -1451,8 +1453,8 @@ int isp1760_udc_register(struct isp1760_device *isp, int irq,
        sprintf(udc->irqname, "%s (udc)", devname);
-        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | IRQF_DISABLED |
+        ret = request_irq(irq, isp1760_udc_irq, IRQF_SHARED | irqflags,
-                          irqflags, udc->irqname, udc);
+                          udc->irqname, udc);
        if (ret < 0)
                goto error;
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 14e1628483d9..39db8b603627 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -79,7 +79,8 @@ config USB_MUSB_TUSB6010
 config USB_MUSB_OMAP2PLUS
        tristate "OMAP2430 and onwards"
-        depends on ARCH_OMAP2PLUS && USB && OMAP_CONTROL_PHY
+        depends on ARCH_OMAP2PLUS && USB
+        depends on OMAP_CONTROL_PHY || !OMAP_CONTROL_PHY
        select GENERIC_PHY
 config USB_MUSB_AM35X
diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
index 403fab772724..7b3035ff9434 100644
--- a/drivers/usb/phy/phy-am335x-control.c
+++ b/drivers/usb/phy/phy-am335x-control.c
@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
                return NULL;
        dev = bus_find_device(&platform_bus_type, NULL, node, match);
+        if (!dev)
+                return NULL;
        ctrl_usb = dev_get_drvdata(dev);
        if (!ctrl_usb)
                return NULL;
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 82570425fdfe..c85ea530085f 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                US_FL_NO_ATA_1X),
+/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+                "Initio Corporation",
+                "",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
 /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
                "JMicron",
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 8d4f3f1ff799..71df240a467a 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1956,10 +1956,9 @@ static int vhost_scsi_make_nexus(struct vhost_scsi_tpg *tpg,
                goto out;
        }
        /*
-         * Now register the TCM vhost virtual I_T Nexus as active with the
+         * Now register the TCM vhost virtual I_T Nexus as active.
-         * call to __transport_register_session()
         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                        tv_nexus->tvn_se_sess, tv_nexus);
        tpg->tpg_nexus = tv_nexus;
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 0413157f3b49..6a356e344f82 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/balloon_compaction.h>
 #include <linux/oom.h>
+#include <linux/wait.h>
 /*
 * Balloon device works in 4K page units.  So each page is pointed to by
@@ -334,17 +335,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
 static int balloon(void *_vballoon)
 {
        struct virtio_balloon *vb = _vballoon;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        set_freezable();
        while (!kthread_should_stop()) {
                s64 diff;
                try_to_freeze();
-                wait_event_interruptible(vb->config_change,
-                                         (diff = towards_target(vb)) != 0
+                add_wait_queue(&vb->config_change, &wait);
-                                         || vb->need_stats_update
+                for (;;) {
-                                         || kthread_should_stop()
+                        if ((diff = towards_target(vb)) != 0 ||
-                                         || freezing(current));
+                            vb->need_stats_update ||
+                            kthread_should_stop() ||
+                            freezing(current))
+                                break;
+                        wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+                }
+                remove_wait_queue(&vb->config_change, &wait);
                if (vb->need_stats_update)
                        stats_handle_request(vb);
                if (diff > 0)
@@ -499,6 +508,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
        if (err < 0)
                goto out_oom_notify;
+        virtio_device_ready(vdev);
        vb->thread = kthread_run(balloon, vb, "vballoon");
        if (IS_ERR(vb->thread)) {
                err = PTR_ERR(vb->thread);
diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index cad569890908..6010d7ec0a0f 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -156,22 +156,95 @@ static void vm_get(struct virtio_device *vdev, unsigned offset,
                   void *buf, unsigned len)
 {
        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        u8 *ptr = buf;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
-        int i;
+        u8 b;
+        __le16 w;
+        __le32 l;
-        for (i = 0; i < len; i++)
+        if (vm_dev->version == 1) {
-                ptr[i] = readb(vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+                u8 *ptr = buf;
+                int i;
+                for (i = 0; i < len; i++)
+                        ptr[i] = readb(base + offset + i);
+                return;
+        }
+        switch (len) {
+        case 1:
+                b = readb(base + offset);
+                memcpy(buf, &b, sizeof b);
+                break;
+        case 2:
+                w = cpu_to_le16(readw(base + offset));
+                memcpy(buf, &w, sizeof w);
+                break;
+        case 4:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                break;
+        case 8:
+                l = cpu_to_le32(readl(base + offset));
+                memcpy(buf, &l, sizeof l);
+                l = cpu_to_le32(ioread32(base + offset + sizeof l));
+                memcpy(buf + sizeof l, &l, sizeof l);
+                break;
+        default:
+                BUG();
+        }
 }
 static void vm_set(struct virtio_device *vdev, unsigned offset,
                   const void *buf, unsigned len)
 {
        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
-        const u8 *ptr = buf;
+        void __iomem *base = vm_dev->base + VIRTIO_MMIO_CONFIG;
-        int i;
+        u8 b;
+        __le16 w;
+        __le32 l;
-        for (i = 0; i < len; i++)
+        if (vm_dev->version == 1) {
-                writeb(ptr[i], vm_dev->base + VIRTIO_MMIO_CONFIG + offset + i);
+                const u8 *ptr = buf;
+                int i;
+                for (i = 0; i < len; i++)
+                        writeb(ptr[i], base + offset + i);
+                return;
+        }
+        switch (len) {
+        case 1:
+                memcpy(&b, buf, sizeof b);
+                writeb(b, base + offset);
+                break;
+        case 2:
+                memcpy(&w, buf, sizeof w);
+                writew(le16_to_cpu(w), base + offset);
+                break;
+        case 4:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                break;
+        case 8:
+                memcpy(&l, buf, sizeof l);
+                writel(le32_to_cpu(l), base + offset);
+                memcpy(&l, buf + sizeof l, sizeof l);
+                writel(le32_to_cpu(l), base + offset + sizeof l);
+                break;
+        default:
+                BUG();
+        }
+}
+static u32 vm_generation(struct virtio_device *vdev)
+{
+        struct virtio_mmio_device *vm_dev = to_virtio_mmio_device(vdev);
+        if (vm_dev->version == 1)
+                return 0;
+        else
+                return readl(vm_dev->base + VIRTIO_MMIO_CONFIG_GENERATION);
 }
 static u8 vm_get_status(struct virtio_device *vdev)
@@ -440,6 +513,7 @@ static const char *vm_bus_name(struct virtio_device *vdev)
 static const struct virtio_config_ops virtio_mmio_config_ops = {
        .get            = vm_get,
        .set            = vm_set,
+        .generation     = vm_generation,
        .get_status     = vm_get_status,
        .set_status     = vm_set_status,
        .reset          = vm_reset,
diff --git a/drivers/watchdog/imgpdc_wdt.c b/drivers/watchdog/imgpdc_wdt.c
index c8def68d9e4c..0deaa4f971f5 100644
--- a/drivers/watchdog/imgpdc_wdt.c
+++ b/drivers/watchdog/imgpdc_wdt.c
@@ -42,10 +42,10 @@
 #define PDC_WDT_MIN_TIMEOUT             1
 #define PDC_WDT_DEF_TIMEOUT             64
-static int heartbeat;
+static int heartbeat = PDC_WDT_DEF_TIMEOUT;
 module_param(heartbeat, int, 0);
-MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds. "
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds "
-        "(default = " __MODULE_STRING(PDC_WDT_DEF_TIMEOUT) ")");
+        "(default=" __MODULE_STRING(PDC_WDT_DEF_TIMEOUT) ")");
 static bool nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, bool, 0);
@@ -191,6 +191,7 @@ static int pdc_wdt_probe(struct platform_device *pdev)
        pdc_wdt->wdt_dev.ops = &pdc_wdt_ops;
        pdc_wdt->wdt_dev.max_timeout = 1 << PDC_WDT_CONFIG_DELAY_MASK;
        pdc_wdt->wdt_dev.parent = &pdev->dev;
+        watchdog_set_drvdata(&pdc_wdt->wdt_dev, pdc_wdt);
        ret = watchdog_init_timeout(&pdc_wdt->wdt_dev, heartbeat, &pdev->dev);
        if (ret < 0) {
@@ -232,7 +233,6 @@ static int pdc_wdt_probe(struct platform_device *pdev)
        watchdog_set_nowayout(&pdc_wdt->wdt_dev, nowayout);
        platform_set_drvdata(pdev, pdc_wdt);
-        watchdog_set_drvdata(&pdc_wdt->wdt_dev, pdc_wdt);
        ret = watchdog_register_device(&pdc_wdt->wdt_dev);
        if (ret)
diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
index a87f6df6e85f..938b987de551 100644
--- a/drivers/watchdog/mtk_wdt.c
+++ b/drivers/watchdog/mtk_wdt.c
@@ -133,7 +133,7 @@ static int mtk_wdt_start(struct watchdog_device *wdt_dev)
        u32 reg;
        struct mtk_wdt_dev *mtk_wdt = watchdog_get_drvdata(wdt_dev);
        void __iomem *wdt_base = mtk_wdt->wdt_base;
-        u32 ret;
+        int ret;
        ret = mtk_wdt_set_timeout(wdt_dev, wdt_dev->timeout);
        if (ret < 0)
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 9faca6a60bb0..42bd55a6c237 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1659,11 +1659,8 @@ static int scsiback_make_nexus(struct scsiback_tpg *tpg,
                         name);
                goto out;
        }
-        /*
+        /* Now register the TCM pvscsi virtual I_T Nexus as active. */
-         * Now register the TCM pvscsi virtual I_T Nexus as active with the
+        transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
-         * call to __transport_register_session()
-         */
-        __transport_register_session(se_tpg, tv_nexus->tvn_se_sess->se_node_acl,
                        tv_nexus->tvn_se_sess, tv_nexus);
        tpg->tpg_nexus = tv_nexus;
diff --git a/fs/affs/file.c b/fs/affs/file.c
index d2468bf95669..a91795e01a7f 100644
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -699,8 +699,10 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
        boff = tmp % bsize;
        if (boff) {
                bh = affs_bread_ino(inode, bidx, 0);
-                if (IS_ERR(bh))
+                if (IS_ERR(bh)) {
-                        return PTR_ERR(bh);
+                        written = PTR_ERR(bh);
+                        goto err_first_bh;
+                }
                tmp = min(bsize - boff, to - from);
                BUG_ON(boff + tmp > bsize || tmp > bsize);
                memcpy(AFFS_DATA(bh) + boff, data + from, tmp);
@@ -712,14 +714,16 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
                bidx++;
        } else if (bidx) {
                bh = affs_bread_ino(inode, bidx - 1, 0);
-                if (IS_ERR(bh))
+                if (IS_ERR(bh)) {
-                        return PTR_ERR(bh);
+                        written = PTR_ERR(bh);
+                        goto err_first_bh;
+                }
        }
        while (from + bsize <= to) {
                prev_bh = bh;
                bh = affs_getemptyblk_ino(inode, bidx);
                if (IS_ERR(bh))
-                        goto out;
+                        goto err_bh;
                memcpy(AFFS_DATA(bh), data + from, bsize);
                if (buffer_new(bh)) {
                        AFFS_DATA_HEAD(bh)->ptype = cpu_to_be32(T_DATA);
@@ -751,7 +755,7 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping,
                prev_bh = bh;
                bh = affs_bread_ino(inode, bidx, 1);
                if (IS_ERR(bh))
-                        goto out;
+                        goto err_bh;
                tmp = min(bsize, to - from);
                BUG_ON(tmp > bsize);
                memcpy(AFFS_DATA(bh), data + from, tmp);
@@ -790,12 +794,13 @@ done:
        if (tmp > inode->i_size)
                inode->i_size = AFFS_I(inode)->mmu_private = tmp;
+err_first_bh:
        unlock_page(page);
        page_cache_release(page);
        return written;
-out:
+err_bh:
        bh = prev_bh;
        if (!written)
                written = PTR_ERR(bh);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 84c3b00f3de8..f9c89cae39ee 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3387,6 +3387,8 @@ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root);
+int btrfs_setup_space_cache(struct btrfs_trans_handle *trans,
+                            struct btrfs_root *root);
 int btrfs_extent_readonly(struct btrfs_root *root, u64 bytenr);
 int btrfs_free_block_groups(struct btrfs_fs_info *info);
 int btrfs_read_block_groups(struct btrfs_root *root);
@@ -3909,6 +3911,9 @@ int btrfs_prealloc_file_range_trans(struct inode *inode,
                                    loff_t actual_len, u64 *alloc_hint);
 int btrfs_inode_check_errors(struct inode *inode);
 extern const struct dentry_operations btrfs_dentry_operations;
+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+void btrfs_test_inode_set_ops(struct inode *inode);
+#endif
 /* ioctl.c */
 long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index f79f38542a73..639f2663ed3f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3921,7 +3921,7 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
        }
        if (btrfs_super_sys_array_size(sb) < sizeof(struct btrfs_disk_key)
                        + sizeof(struct btrfs_chunk)) {
-                printk(KERN_ERR "BTRFS: system chunk array too small %u < %lu\n",
+                printk(KERN_ERR "BTRFS: system chunk array too small %u < %zu\n",
                                btrfs_super_sys_array_size(sb),
                                sizeof(struct btrfs_disk_key)
                                + sizeof(struct btrfs_chunk));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 6f080451fcb1..8b353ad02f03 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3325,6 +3325,32 @@ out:
        return ret;
 }
+int btrfs_setup_space_cache(struct btrfs_trans_handle *trans,
+                            struct btrfs_root *root)
+{
+        struct btrfs_block_group_cache *cache, *tmp;
+        struct btrfs_transaction *cur_trans = trans->transaction;
+        struct btrfs_path *path;
+        if (list_empty(&cur_trans->dirty_bgs) ||
+            !btrfs_test_opt(root, SPACE_CACHE))
+                return 0;
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+        /* Could add new block groups, use _safe just in case */
+        list_for_each_entry_safe(cache, tmp, &cur_trans->dirty_bgs,
+                                 dirty_list) {
+                if (cache->disk_cache_state == BTRFS_DC_CLEAR)
+                        cache_save_setup(cache, trans, path);
+        }
+        btrfs_free_path(path);
+        return 0;
+}
 int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans,
                                   struct btrfs_root *root)
 {
@@ -5110,7 +5136,11 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
        num_bytes = ALIGN(num_bytes, root->sectorsize);
        spin_lock(&BTRFS_I(inode)->lock);
-        BTRFS_I(inode)->outstanding_extents++;
+        nr_extents = (unsigned)div64_u64(num_bytes +
+                                         BTRFS_MAX_EXTENT_SIZE - 1,
+                                         BTRFS_MAX_EXTENT_SIZE);
+        BTRFS_I(inode)->outstanding_extents += nr_extents;
+        nr_extents = 0;
        if (BTRFS_I(inode)->outstanding_extents >
            BTRFS_I(inode)->reserved_extents)
@@ -5255,6 +5285,9 @@ void btrfs_delalloc_release_metadata(struct inode *inode, u64 num_bytes)
        if (dropped > 0)
                to_free += btrfs_calc_trans_metadata_size(root, dropped);
+        if (btrfs_test_is_dummy_root(root))
+                return;
        trace_btrfs_space_reservation(root->fs_info, "delalloc",
                                      btrfs_ino(inode), to_free, 0);
        if (root->fs_info->quota_enabled) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index c7233ff1d533..d688cfe5d496 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4968,6 +4968,12 @@ static int release_extent_buffer(struct extent_buffer *eb)
                /* Should be safe to release our pages at this point */
                btrfs_release_extent_buffer_page(eb);
+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+                if (unlikely(test_bit(EXTENT_BUFFER_DUMMY, &eb->bflags))) {
+                        __free_extent_buffer(eb);
+                        return 1;
+                }
+#endif
                call_rcu(&eb->rcu_head, btrfs_release_extent_buffer_rcu);
                return 1;
        }
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index da828cf5e8f8..d2e732d7af52 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -108,6 +108,13 @@ static struct extent_map *create_pinned_em(struct inode *inode, u64 start,
 static int btrfs_dirty_inode(struct inode *inode);
+#ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+void btrfs_test_inode_set_ops(struct inode *inode)
+{
+        BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
+}
+#endif
 static int btrfs_init_inode_security(struct btrfs_trans_handle *trans,
                                     struct inode *inode,  struct inode *dir,
                                     const struct qstr *qstr)
@@ -1542,30 +1549,17 @@ static void btrfs_split_extent_hook(struct inode *inode,
                u64 new_size;
                /*
-                 * We need the largest size of the remaining extent to see if we
+                 * See the explanation in btrfs_merge_extent_hook, the same
-                 * need to add a new outstanding extent.  Think of the following
+                 * applies here, just in reverse.
-                 * case
-                 *
-                 * [MEAX_EXTENT_SIZEx2 - 4k][4k]
-                 *
-                 * The new_size would just be 4k and we'd think we had enough
-                 * outstanding extents for this if we only took one side of the
-                 * split, same goes for the other direction.  We need to see if
-                 * the larger size still is the same amount of extents as the
-                 * original size, because if it is we need to add a new
-                 * outstanding extent.  But if we split up and the larger size
-                 * is less than the original then we are good to go since we've
-                 * already accounted for the extra extent in our original
-                 * accounting.
                 */
                new_size = orig->end - split + 1;
-                if ((split - orig->start) > new_size)
+                num_extents = div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
-                        new_size = split - orig->start;
-                num_extents = div64_u64(size + BTRFS_MAX_EXTENT_SIZE - 1,
                                        BTRFS_MAX_EXTENT_SIZE);
-                if (div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
+                new_size = split - orig->start;
-                              BTRFS_MAX_EXTENT_SIZE) < num_extents)
+                num_extents += div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
+                                        BTRFS_MAX_EXTENT_SIZE);
+                if (div64_u64(size + BTRFS_MAX_EXTENT_SIZE - 1,
+                              BTRFS_MAX_EXTENT_SIZE) >= num_extents)
                        return;
        }
@@ -1591,8 +1585,10 @@ static void btrfs_merge_extent_hook(struct inode *inode,
        if (!(other->state & EXTENT_DELALLOC))
                return;
-        old_size = other->end - other->start + 1;
+        if (new->start > other->start)
-        new_size = old_size + (new->end - new->start + 1);
+                new_size = new->end - other->start + 1;
+        else
+                new_size = other->end - new->start + 1;
        /* we're not bigger than the max, unreserve the space and go */
        if (new_size <= BTRFS_MAX_EXTENT_SIZE) {
@@ -1603,13 +1599,32 @@ static void btrfs_merge_extent_hook(struct inode *inode,
        }
        /*
-         * If we grew by another max_extent, just return, we want to keep that
+         * We have to add up either side to figure out how many extents were
-         * reserved amount.
+         * accounted for before we merged into one big extent.  If the number of
+         * extents we accounted for is <= the amount we need for the new range
+         * then we can return, otherwise drop.  Think of it like this
+         *
+         * [ 4k][MAX_SIZE]
+         *
+         * So we've grown the extent by a MAX_SIZE extent, this would mean we
+         * need 2 outstanding extents, on one side we have 1 and the other side
+         * we have 1 so they are == and we can return.  But in this case
+         *
+         * [MAX_SIZE+4k][MAX_SIZE+4k]
+         *
+         * Each range on their own accounts for 2 extents, but merged together
+         * they are only 3 extents worth of accounting, so we need to drop in
+         * this case.
         */
+        old_size = other->end - other->start + 1;
        num_extents = div64_u64(old_size + BTRFS_MAX_EXTENT_SIZE - 1,
                                BTRFS_MAX_EXTENT_SIZE);
+        old_size = new->end - new->start + 1;
+        num_extents += div64_u64(old_size + BTRFS_MAX_EXTENT_SIZE - 1,
+                                 BTRFS_MAX_EXTENT_SIZE);
        if (div64_u64(new_size + BTRFS_MAX_EXTENT_SIZE - 1,
-                      BTRFS_MAX_EXTENT_SIZE) > num_extents)
+                      BTRFS_MAX_EXTENT_SIZE) >= num_extents)
                return;
        spin_lock(&BTRFS_I(inode)->lock);
@@ -1686,6 +1701,10 @@ static void btrfs_set_bit_hook(struct inode *inode,
                        spin_unlock(&BTRFS_I(inode)->lock);
                }
+                /* For sanity tests */
+                if (btrfs_test_is_dummy_root(root))
+                        return;
                __percpu_counter_add(&root->fs_info->delalloc_bytes, len,
                                     root->fs_info->delalloc_batch);
                spin_lock(&BTRFS_I(inode)->lock);
@@ -1741,6 +1760,10 @@ static void btrfs_clear_bit_hook(struct inode *inode,
                    root != root->fs_info->tree_root)
                        btrfs_delalloc_release_metadata(inode, len);
+                /* For sanity tests. */
+                if (btrfs_test_is_dummy_root(root))
+                        return;
                if (root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID
                    && do_list && !(state->state & EXTENT_NORESERVE))
                        btrfs_free_reserved_data_space(inode, len);
@@ -7213,7 +7236,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
        u64 start = iblock << inode->i_blkbits;
        u64 lockstart, lockend;
        u64 len = bh_result->b_size;
-        u64 orig_len = len;
+        u64 *outstanding_extents = NULL;
        int unlock_bits = EXTENT_LOCKED;
        int ret = 0;
@@ -7225,6 +7248,16 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
        lockstart = start;
        lockend = start + len - 1;
+        if (current->journal_info) {
+                /*
+                 * Need to pull our outstanding extents and set journal_info to NULL so
+                 * that anything that needs to check if there's a transction doesn't get
+                 * confused.
+                 */
+                outstanding_extents = current->journal_info;
+                current->journal_info = NULL;
+        }
        /*
         * If this errors out it's because we couldn't invalidate pagecache for
         * this range and we need to fallback to buffered.
@@ -7348,11 +7381,20 @@ unlock:
                if (start + len > i_size_read(inode))
                        i_size_write(inode, start + len);
-                if (len < orig_len) {
+                /*
+                 * If we have an outstanding_extents count still set then we're
+                 * within our reservation, otherwise we need to adjust our inode
+                 * counter appropriately.
+                 */
+                if (*outstanding_extents) {
+                        (*outstanding_extents)--;
+                } else {
                        spin_lock(&BTRFS_I(inode)->lock);
                        BTRFS_I(inode)->outstanding_extents++;
                        spin_unlock(&BTRFS_I(inode)->lock);
                }
+                current->journal_info = outstanding_extents;
                btrfs_free_reserved_data_space(inode, len);
        }
@@ -7376,6 +7418,8 @@ unlock:
 unlock_err:
        clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, lockend,
                         unlock_bits, 1, 0, &cached_state, GFP_NOFS);
+        if (outstanding_extents)
+                current->journal_info = outstanding_extents;
        return ret;
 }
@@ -8075,6 +8119,7 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
 {
        struct file *file = iocb->ki_filp;
        struct inode *inode = file->f_mapping->host;
+        u64 outstanding_extents = 0;
        size_t count = 0;
        int flags = 0;
        bool wakeup = true;
@@ -8112,6 +8157,16 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
                ret = btrfs_delalloc_reserve_space(inode, count);
                if (ret)
                        goto out;
+                outstanding_extents = div64_u64(count +
+                                                BTRFS_MAX_EXTENT_SIZE - 1,
+                                                BTRFS_MAX_EXTENT_SIZE);
+                /*
+                 * We need to know how many extents we reserved so that we can
+                 * do the accounting properly if we go over the number we
+                 * originally calculated.  Abuse current->journal_info for this.
+                 */
+                current->journal_info = &outstanding_extents;
        } else if (test_bit(BTRFS_INODE_READDIO_NEED_LOCK,
                                     &BTRFS_I(inode)->runtime_flags)) {
                inode_dio_done(inode);
@@ -8124,6 +8179,7 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
                        iter, offset, btrfs_get_blocks_direct, NULL,
                        btrfs_submit_direct, flags);
        if (rw & WRITE) {
+                current->journal_info = NULL;
                if (ret < 0 && ret != -EIOCBQUEUED)
                        btrfs_delalloc_release_space(inode, count);
                else if (ret >= 0 && (size_t)ret < count)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 97159a8e91d4..058c79eecbfb 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1259,7 +1259,7 @@ static int comp_oper(struct btrfs_qgroup_operation *oper1,
        if (oper1->seq < oper2->seq)
                return -1;
        if (oper1->seq > oper2->seq)
-                return -1;
+                return 1;
        if (oper1->ref_root < oper2->ref_root)
                return -1;
        if (oper1->ref_root > oper2->ref_root)
diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
index a116b55ce788..054fc0d97131 100644
--- a/fs/btrfs/tests/inode-tests.c
+++ b/fs/btrfs/tests/inode-tests.c
@@ -911,6 +911,197 @@ out:
        return ret;
 }
+static int test_extent_accounting(void)
+{
+        struct inode *inode = NULL;
+        struct btrfs_root *root = NULL;
+        int ret = -ENOMEM;
+        inode = btrfs_new_test_inode();
+        if (!inode) {
+                test_msg("Couldn't allocate inode\n");
+                return ret;
+        }
+        root = btrfs_alloc_dummy_root();
+        if (IS_ERR(root)) {
+                test_msg("Couldn't allocate root\n");
+                goto out;
+        }
+        root->fs_info = btrfs_alloc_dummy_fs_info();
+        if (!root->fs_info) {
+                test_msg("Couldn't allocate dummy fs info\n");
+                goto out;
+        }
+        BTRFS_I(inode)->root = root;
+        btrfs_test_inode_set_ops(inode);
+        /* [BTRFS_MAX_EXTENT_SIZE] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, 0, BTRFS_MAX_EXTENT_SIZE - 1,
+                                        NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 1) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 1, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /* [BTRFS_MAX_EXTENT_SIZE][4k] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE,
+                                        BTRFS_MAX_EXTENT_SIZE + 4095, NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 2) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 2, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /* [BTRFS_MAX_EXTENT_SIZE/2][4K HOLE][the rest] */
+        ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
+                               BTRFS_MAX_EXTENT_SIZE >> 1,
+                               (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
+                               EXTENT_DELALLOC | EXTENT_DIRTY |
+                               EXTENT_UPTODATE | EXTENT_DO_ACCOUNTING, 0, 0,
+                               NULL, GFP_NOFS);
+        if (ret) {
+                test_msg("clear_extent_bit returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 2) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 2, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /* [BTRFS_MAX_EXTENT_SIZE][4K] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE >> 1,
+                                        (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
+                                        NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 2) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 2, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /*
+         * [BTRFS_MAX_EXTENT_SIZE+4K][4K HOLE][BTRFS_MAX_EXTENT_SIZE+4K]
+         *
+         * I'm artificially adding 2 to outstanding_extents because in the
+         * buffered IO case we'd add things up as we go, but I don't feel like
+         * doing that here, this isn't the interesting case we want to test.
+         */
+        BTRFS_I(inode)->outstanding_extents += 2;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE + 8192,
+                                        (BTRFS_MAX_EXTENT_SIZE << 1) + 12287,
+                                        NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 4) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 4, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /* [BTRFS_MAX_EXTENT_SIZE+4k][4k][BTRFS_MAX_EXTENT_SIZE+4k] */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE+4096,
+                                        BTRFS_MAX_EXTENT_SIZE+8191, NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 3) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 3, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /* [BTRFS_MAX_EXTENT_SIZE+4k][4K HOLE][BTRFS_MAX_EXTENT_SIZE+4k] */
+        ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
+                               BTRFS_MAX_EXTENT_SIZE+4096,
+                               BTRFS_MAX_EXTENT_SIZE+8191,
+                               EXTENT_DIRTY | EXTENT_DELALLOC |
+                               EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
+                               NULL, GFP_NOFS);
+        if (ret) {
+                test_msg("clear_extent_bit returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 4) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 4, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /*
+         * Refill the hole again just for good measure, because I thought it
+         * might fail and I'd rather satisfy my paranoia at this point.
+         */
+        BTRFS_I(inode)->outstanding_extents++;
+        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE+4096,
+                                        BTRFS_MAX_EXTENT_SIZE+8191, NULL);
+        if (ret) {
+                test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents != 3) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 3, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        /* Empty */
+        ret = clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
+                               EXTENT_DIRTY | EXTENT_DELALLOC |
+                               EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
+                               NULL, GFP_NOFS);
+        if (ret) {
+                test_msg("clear_extent_bit returned %d\n", ret);
+                goto out;
+        }
+        if (BTRFS_I(inode)->outstanding_extents) {
+                ret = -EINVAL;
+                test_msg("Miscount, wanted 0, got %u\n",
+                         BTRFS_I(inode)->outstanding_extents);
+                goto out;
+        }
+        ret = 0;
+out:
+        if (ret)
+                clear_extent_bit(&BTRFS_I(inode)->io_tree, 0, (u64)-1,
+                                 EXTENT_DIRTY | EXTENT_DELALLOC |
+                                 EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
+                                 NULL, GFP_NOFS);
+        iput(inode);
+        btrfs_free_dummy_root(root);
+        return ret;
+}
 int btrfs_test_inodes(void)
 {
        int ret;
@@ -924,5 +1115,9 @@ int btrfs_test_inodes(void)
        if (ret)
                return ret;
        test_msg("Running hole first btrfs_get_extent test\n");
-        return test_hole_first();
+        ret = test_hole_first();
+        if (ret)
+                return ret;
+        test_msg("Running outstanding_extents tests\n");
+        return test_extent_accounting();
 }
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 88e51aded6bd..8be4278e25e8 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1023,17 +1023,13 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
        u64 old_root_bytenr;
        u64 old_root_used;
        struct btrfs_root *tree_root = root->fs_info->tree_root;
-        bool extent_root = (root->objectid == BTRFS_EXTENT_TREE_OBJECTID);
        old_root_used = btrfs_root_used(&root->root_item);
-        btrfs_write_dirty_block_groups(trans, root);
        while (1) {
                old_root_bytenr = btrfs_root_bytenr(&root->root_item);
                if (old_root_bytenr == root->node->start &&
-                    old_root_used == btrfs_root_used(&root->root_item) &&
+                    old_root_used == btrfs_root_used(&root->root_item))
-                    (!extent_root ||
-                     list_empty(&trans->transaction->dirty_bgs)))
                        break;
                btrfs_set_root_node(&root->root_item, root->node);
@@ -1044,14 +1040,6 @@ static int update_cowonly_root(struct btrfs_trans_handle *trans,
                        return ret;
                old_root_used = btrfs_root_used(&root->root_item);
-                if (extent_root) {
-                        ret = btrfs_write_dirty_block_groups(trans, root);
-                        if (ret)
-                                return ret;
-                }
-                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
-                if (ret)
-                        return ret;
        }
        return 0;
@@ -1068,6 +1056,7 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
                                         struct btrfs_root *root)
 {
        struct btrfs_fs_info *fs_info = root->fs_info;
+        struct list_head *dirty_bgs = &trans->transaction->dirty_bgs;
        struct list_head *next;
        struct extent_buffer *eb;
        int ret;
@@ -1095,11 +1084,15 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
        if (ret)
                return ret;
+        ret = btrfs_setup_space_cache(trans, root);
+        if (ret)
+                return ret;
        /* run_qgroups might have added some more refs */
        ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
        if (ret)
                return ret;
+again:
        while (!list_empty(&fs_info->dirty_cowonly_roots)) {
                next = fs_info->dirty_cowonly_roots.next;
                list_del_init(next);
@@ -1112,8 +1105,23 @@ static noinline int commit_cowonly_roots(struct btrfs_trans_handle *trans,
                ret = update_cowonly_root(trans, root);
                if (ret)
                        return ret;
+                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
+                if (ret)
+                        return ret;
        }
+        while (!list_empty(dirty_bgs)) {
+                ret = btrfs_write_dirty_block_groups(trans, root);
+                if (ret)
+                        return ret;
+                ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
+                if (ret)
+                        return ret;
+        }
+        if (!list_empty(&fs_info->dirty_cowonly_roots))
+                goto again;
        list_add_tail(&fs_info->extent_root->dirty_list,
                      &trans->transaction->switch_commits);
        btrfs_after_dev_replace_commit(fs_info);
@@ -1811,6 +1819,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
                wait_for_commit(root, cur_trans);
+                if (unlikely(cur_trans->aborted))
+                        ret = cur_trans->aborted;
                btrfs_put_transaction(cur_trans);
                return ret;
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index ed19a7d622fa..39706c57ad3c 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
        newpage = buf->page;
-        if (WARN_ON(!PageUptodate(newpage)))
+        if (!PageUptodate(newpage))
-                return -EIO;
+                SetPageUptodate(newpage);
        ClearPageMappedToDisk(newpage);
@@ -1353,6 +1353,17 @@ static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
        return err;
 }
+static int fuse_dev_open(struct inode *inode, struct file *file)
+{
+        /*
+         * The fuse device's file's private_data is used to hold
+         * the fuse_conn(ection) when it is mounted, and is used to
+         * keep track of whether the file has been mounted already.
+         */
+        file->private_data = NULL;
+        return 0;
+}
 static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
                              unsigned long nr_segs, loff_t pos)
 {
@@ -1797,6 +1808,9 @@ copy_finish:
 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
                       unsigned int size, struct fuse_copy_state *cs)
 {
+        /* Don't try to move pages (yet) */
+        cs->move_pages = 0;
        switch (code) {
        case FUSE_NOTIFY_POLL:
                return fuse_notify_poll(fc, size, cs);
@@ -2217,6 +2231,7 @@ static int fuse_dev_fasync(int fd, struct file *file, int on)
 const struct file_operations fuse_dev_operations = {
        .owner          = THIS_MODULE,
+        .open           = fuse_dev_open,
        .llseek         = no_llseek,
        .read           = do_sync_read,
        .aio_read       = fuse_dev_read,
diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
index 6e560d56094b..754fdf8c6356 100644
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -131,13 +131,16 @@ skip:
        hfs_bnode_write(node, entry, data_off + key_len, entry_len);
        hfs_bnode_dump(node);
-        if (new_node) {
+        /*
-                /* update parent key if we inserted a key
+         * update parent key if we inserted a key
-                 * at the start of the first node
+         * at the start of the node and it is not the new node
-                 */
+         */
-                if (!rec && new_node != node)
+        if (!rec && new_node != node) {
-                        hfs_brec_update_parent(fd);
+                hfs_bnode_read_key(node, fd->search_key, data_off + size);
+                hfs_brec_update_parent(fd);
+        }
+        if (new_node) {
                hfs_bnode_put(fd->bnode);
                if (!new_node->parent) {
                        hfs_btree_inc_height(tree);
@@ -168,9 +171,6 @@ skip:
                goto again;
        }
-        if (!rec)
-                hfs_brec_update_parent(fd);
        return 0;
 }
@@ -370,6 +370,8 @@ again:
        if (IS_ERR(parent))
                return PTR_ERR(parent);
        __hfs_brec_find(parent, fd, hfs_find_rec_by_key);
+        if (fd->record < 0)
+                return -ENOENT;
        hfs_bnode_dump(parent);
        rec = fd->record;
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index b684e8a132e6..2bacb9988566 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -207,6 +207,7 @@ static ssize_t kernfs_file_direct_read(struct kernfs_open_file *of,
                goto out_free;
        }
+        of->event = atomic_read(&of->kn->attr.open->event);
        ops = kernfs_ops(of->kn);
        if (ops->read)
                len = ops->read(of, buf, len, *ppos);
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index 3c1bfa155571..1028a0629543 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -587,8 +587,6 @@ nfsd4_cb_layout_fail(struct nfs4_layout_stateid *ls)
        rpc_ntop((struct sockaddr *)&clp->cl_addr, addr_str, sizeof(addr_str));
-        nfsd4_cb_layout_fail(ls);
        printk(KERN_WARNING
                "nfsd: client %s failed to respond to layout recall. "
                "  Fencing..\n", addr_str);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index b90952f528b1..5f0d1993e6e3 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -529,8 +529,7 @@ static int ovl_remount(struct super_block *sb, int *flags, char *data)
 {
        struct ovl_fs *ufs = sb->s_fs_info;
-        if (!(*flags & MS_RDONLY) &&
+        if (!(*flags & MS_RDONLY) && !ufs->upper_mnt)
-            (!ufs->upper_mnt || (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY)))
                return -EROFS;
        return 0;
@@ -615,9 +614,19 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
                        break;
                default:
+                        pr_err("overlayfs: unrecognized mount option \"%s\" or missing value\n", p);
                        return -EINVAL;
                }
        }
+        /* Workdir is useless in non-upper mount */
+        if (!config->upperdir && config->workdir) {
+                pr_info("overlayfs: option \"workdir=%s\" is useless in a non-upper mount, ignore\n",
+                        config->workdir);
+                kfree(config->workdir);
+                config->workdir = NULL;
+        }
        return 0;
 }
@@ -837,7 +846,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_stack_depth = 0;
        if (ufs->config.upperdir) {
-                /* FIXME: workdir is not needed for a R/O mount */
                if (!ufs->config.workdir) {
                        pr_err("overlayfs: missing 'workdir'\n");
                        goto out_free_config;
@@ -847,6 +855,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                if (err)
                        goto out_free_config;
+                /* Upper fs should not be r/o */
+                if (upperpath.mnt->mnt_sb->s_flags & MS_RDONLY) {
+                        pr_err("overlayfs: upper fs is r/o, try multi-lower layers mount\n");
+                        err = -EINVAL;
+                        goto out_put_upperpath;
+                }
                err = ovl_mount_dir(ufs->config.workdir, &workpath);
                if (err)
                        goto out_put_upperpath;
@@ -869,8 +884,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
        err = -EINVAL;
        stacklen = ovl_split_lowerdirs(lowertmp);
-        if (stacklen > OVL_MAX_STACK)
+        if (stacklen > OVL_MAX_STACK) {
+                pr_err("overlayfs: too many lower directries, limit is %d\n",
+                       OVL_MAX_STACK);
                goto out_free_lowertmp;
+        } else if (!ufs->config.upperdir && stacklen == 1) {
+                pr_err("overlayfs: at least 2 lowerdir are needed while upperdir nonexistent\n");
+                goto out_free_lowertmp;
+        }
        stack = kcalloc(stacklen, sizeof(struct path), GFP_KERNEL);
        if (!stack)
@@ -932,8 +953,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                ufs->numlower++;
        }
-        /* If the upper fs is r/o or nonexistent, we mark overlayfs r/o too */
+        /* If the upper fs is nonexistent, we mark overlayfs r/o too */
-        if (!ufs->upper_mnt || (ufs->upper_mnt->mnt_sb->s_flags & MS_RDONLY))
+        if (!ufs->upper_mnt)
                sb->s_flags |= MS_RDONLY;
        sb->s_d_op = &ovl_dentry_operations;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 956b75d61809..6dee68d013ff 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1325,6 +1325,9 @@ out:
 static int pagemap_open(struct inode *inode, struct file *file)
 {
+        /* do not disclose physical addresses: attack vector */
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
        pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
                        "to stop being page-shift some time soon. See the "
                        "linux/Documentation/vm/pagemap.txt for details.\n");
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 7c55dd5dd2c9..66203b268984 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -114,6 +114,7 @@ struct vgic_ops {
        void    (*sync_lr_elrsr)(struct kvm_vcpu *, int, struct vgic_lr);
        u64     (*get_elrsr)(const struct kvm_vcpu *vcpu);
        u64     (*get_eisr)(const struct kvm_vcpu *vcpu);
+        void    (*clear_eisr)(struct kvm_vcpu *vcpu);
        u32     (*get_interrupt_status)(const struct kvm_vcpu *vcpu);
        void    (*enable_underflow)(struct kvm_vcpu *vcpu);
        void    (*disable_underflow)(struct kvm_vcpu *vcpu);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 2646aed1d3fe..fd23978d93fe 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -375,6 +375,7 @@ int dm_create(int minor, struct mapped_device **md);
 */
 struct mapped_device *dm_get_md(dev_t dev);
 void dm_get(struct mapped_device *md);
+int dm_hold(struct mapped_device *md);
 void dm_put(struct mapped_device *md);
 /*
diff --git a/include/linux/libata.h b/include/linux/libata.h
index fc03efa64ffe..6b08cc106c21 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -232,6 +232,7 @@ enum {
                                              * led */
        ATA_FLAG_NO_DIPM        = (1 << 23), /* host not happy with DIPM */
        ATA_FLAG_LOWTAG         = (1 << 24), /* host wants lowest available tag */
+        ATA_FLAG_SAS_HOST       = (1 << 25), /* SAS host */
        /* bits 24:31 of ap->flags are reserved for LLD specific flags */
diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
index fb0390a1a498..ee7b1ce7a6f8 100644
--- a/include/linux/mfd/palmas.h
+++ b/include/linux/mfd/palmas.h
@@ -2999,6 +2999,9 @@ enum usb_irq_events {
 #define PALMAS_GPADC_TRIM15                                     0x0E
 #define PALMAS_GPADC_TRIM16                                     0x0F
+/* TPS659038 regen2_ctrl offset iss different from palmas */
+#define TPS659038_REGEN2_CTRL                                   0x12
 /* TPS65917 Interrupt registers */
 /* Registers for function INTERRUPT */
diff --git a/include/linux/module.h b/include/linux/module.h
index 42999fe2dbd0..b03485bcb82a 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -344,6 +344,10 @@ struct module {
        unsigned long *ftrace_callsites;
 #endif
+#ifdef CONFIG_LIVEPATCH
+        bool klp_alive;
+#endif
 #ifdef CONFIG_MODULE_UNLOAD
        /* What modules depend on me? */
        struct list_head source_list;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 429d1790a27e..dcf6ec27739b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -965,9 +965,12 @@ typedef u16 (*select_queue_fallback_t)(struct net_device *dev,
 *      Used to add FDB entries to dump requests. Implementers should add
 *      entries to skb and update idx with the number of entries.
 *
- * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh)
+ * int (*ndo_bridge_setlink)(struct net_device *dev, struct nlmsghdr *nlh,
+ *                           u16 flags)
 * int (*ndo_bridge_getlink)(struct sk_buff *skb, u32 pid, u32 seq,
 *                           struct net_device *dev, u32 filter_mask)
+ * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh,
+ *                           u16 flags);
 *
 * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
 *      Called to change device carrier. Soft-devices (like dummy, team, etc)
diff --git a/include/linux/pinctrl/consumer.h b/include/linux/pinctrl/consumer.h
index 72c0415d6c21..18eccefea06e 100644
--- a/include/linux/pinctrl/consumer.h
+++ b/include/linux/pinctrl/consumer.h
@@ -82,7 +82,7 @@ static inline int pinctrl_gpio_direction_output(unsigned gpio)
 static inline struct pinctrl * __must_check pinctrl_get(struct device *dev)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 static inline void pinctrl_put(struct pinctrl *p)
@@ -93,7 +93,7 @@ static inline struct pinctrl_state * __must_check pinctrl_lookup_state(
                                                        struct pinctrl *p,
                                                        const char *name)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 static inline int pinctrl_select_state(struct pinctrl *p,
@@ -104,7 +104,7 @@ static inline int pinctrl_select_state(struct pinctrl *p,
 static inline struct pinctrl * __must_check devm_pinctrl_get(struct device *dev)
 {
-        return ERR_PTR(-ENOSYS);
+        return NULL;
 }
 static inline void devm_pinctrl_put(struct pinctrl *p)
diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
index d4ad5b5a02bb..045f709cb89b 100644
--- a/include/linux/regulator/driver.h
+++ b/include/linux/regulator/driver.h
@@ -316,7 +316,7 @@ struct regulator_desc {
 * @driver_data: private regulator data
 * @of_node: OpenFirmware node to parse for device tree bindings (may be
 *           NULL).
- * @regmap: regmap to use for core regmap helpers if dev_get_regulator() is
+ * @regmap: regmap to use for core regmap helpers if dev_get_regmap() is
 *          insufficient.
 * @ena_gpio_initialized: GPIO controlling regulator enable was properly
 *                        initialized, meaning that >= 0 is a valid gpio
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6d77432e14ff..a419b65770d6 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1625,11 +1625,11 @@ struct task_struct {
        /*
         * numa_faults_locality tracks if faults recorded during the last
-         * scan window were remote/local. The task scan period is adapted
+         * scan window were remote/local or failed to migrate. The task scan
-         * based on the locality of the faults with different weights
+         * period is adapted based on the locality of the faults with different
-         * depending on whether they were shared or private faults
+         * weights depending on whether they were shared or private faults
         */
-        unsigned long numa_faults_locality[2];
+        unsigned long numa_faults_locality[3];
        unsigned long numa_pages_migrated;
 #endif /* CONFIG_NUMA_BALANCING */
@@ -1719,6 +1719,7 @@ struct task_struct {
 #define TNF_NO_GROUP    0x02
 #define TNF_SHARED      0x04
 #define TNF_FAULT_LOCAL 0x08
+#define TNF_MIGRATE_FAIL 0x10
 #ifdef CONFIG_NUMA_BALANCING
 extern void task_numa_fault(int last_node, int node, int pages, int flags);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 30007afe70b3..f54d6659713a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -948,6 +948,13 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from)
        to->l4_hash = from->l4_hash;
 };
+static inline void skb_sender_cpu_clear(struct sk_buff *skb)
+{
+#ifdef CONFIG_XPS
+        skb->sender_cpu = 0;
+#endif
+}
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
 static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
 {
diff --git a/include/net/dst.h b/include/net/dst.h
index a8ae4e760778..0fb99a26e973 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -481,6 +481,7 @@ void dst_init(void);
 enum {
        XFRM_LOOKUP_ICMP = 1 << 0,
        XFRM_LOOKUP_QUEUE = 1 << 1,
+        XFRM_LOOKUP_KEEP_DST_REF = 1 << 2,
 };
 struct flowi;
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index 534e1f2ac4fc..57639fca223a 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -79,6 +79,16 @@ void nf_log_packet(struct net *net,
                   const struct nf_loginfo *li,
                   const char *fmt, ...);
+__printf(8, 9)
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *li,
+                  const char *fmt, ...);
 struct nf_log_buf;
 struct nf_log_buf *nf_log_buf_open(void);
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index eabd3a038674..c73e7abbbaa5 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -91,6 +91,7 @@ struct vxlanhdr {
 #define VXLAN_N_VID     (1u << 24)
 #define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
+#define VXLAN_VNI_MASK  (VXLAN_VID_MASK << 8)
 #define VXLAN_HLEN (sizeof(struct udphdr) + sizeof(struct vxlanhdr))
 struct vxlan_metadata {
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index db81c65b8f48..d61be7297b2c 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -111,6 +111,7 @@ void	array_free(void *array, int n);
 void    target_core_setup_sub_cits(struct se_subsystem_api *);
 /* attribute helpers from target_core_device.c for backend drivers */
+bool    se_dev_check_wce(struct se_device *);
 int     se_dev_set_max_unmap_lba_count(struct se_device *, u32);
 int     se_dev_set_max_unmap_block_desc_count(struct se_device *, u32);
 int     se_dev_set_unmap_granularity(struct se_device *, u32);
diff --git a/include/trace/events/regmap.h b/include/trace/events/regmap.h
index 23d561512f64..22317d2b52ab 100644
--- a/include/trace/events/regmap.h
+++ b/include/trace/events/regmap.h
@@ -7,27 +7,26 @@
 #include <linux/ktime.h>
 #include <linux/tracepoint.h>
-struct device;
+#include "../../../drivers/base/regmap/internal.h"
-struct regmap;
 /*
 * Log register events
 */
 DECLARE_EVENT_CLASS(regmap_reg,
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                 unsigned int val),
-        TP_ARGS(dev, reg, val),
+        TP_ARGS(map, reg, val),
        TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
-                __field(        unsigned int,   reg             )
+                __field(        unsigned int,   reg                     )
-                __field(        unsigned int,   val             )
+                __field(        unsigned int,   val                     )
        ),
        TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                __entry->reg = reg;
                __entry->val = val;
        ),
@@ -39,45 +38,45 @@ DECLARE_EVENT_CLASS(regmap_reg,
 DEFINE_EVENT(regmap_reg, regmap_reg_write,
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                 unsigned int val),
-        TP_ARGS(dev, reg, val)
+        TP_ARGS(map, reg, val)
 );
 DEFINE_EVENT(regmap_reg, regmap_reg_read,
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                 unsigned int val),
-        TP_ARGS(dev, reg, val)
+        TP_ARGS(map, reg, val)
 );
 DEFINE_EVENT(regmap_reg, regmap_reg_read_cache,
-        TP_PROTO(struct device *dev, unsigned int reg,
+        TP_PROTO(struct regmap *map, unsigned int reg,
                 unsigned int val),
-        TP_ARGS(dev, reg, val)
+        TP_ARGS(map, reg, val)
 );
 DECLARE_EVENT_CLASS(regmap_block,
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
-        TP_ARGS(dev, reg, count),
+        TP_ARGS(map, reg, count),
        TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
-                __field(        unsigned int,   reg             )
+                __field(        unsigned int,   reg                     )
-                __field(        int,            count           )
+                __field(        int,            count                   )
        ),
        TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                __entry->reg = reg;
                __entry->count = count;
        ),
@@ -89,48 +88,48 @@ DECLARE_EVENT_CLASS(regmap_block,
 DEFINE_EVENT(regmap_block, regmap_hw_read_start,
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 DEFINE_EVENT(regmap_block, regmap_hw_read_done,
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 DEFINE_EVENT(regmap_block, regmap_hw_write_start,
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 DEFINE_EVENT(regmap_block, regmap_hw_write_done,
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 TRACE_EVENT(regcache_sync,
-        TP_PROTO(struct device *dev, const char *type,
+        TP_PROTO(struct regmap *map, const char *type,
                 const char *status),
-        TP_ARGS(dev, type, status),
+        TP_ARGS(map, type, status),
        TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
-                __string(       status,         status          )
+                __string(       status,         status                  )
-                __string(       type,           type            )
+                __string(       type,           type                    )
-                __field(        int,            type            )
+                __field(        int,            type                    )
        ),
        TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                __assign_str(status, status);
                __assign_str(type, type);
        ),
@@ -141,17 +140,17 @@ TRACE_EVENT(regcache_sync,
 DECLARE_EVENT_CLASS(regmap_bool,
-        TP_PROTO(struct device *dev, bool flag),
+        TP_PROTO(struct regmap *map, bool flag),
-        TP_ARGS(dev, flag),
+        TP_ARGS(map, flag),
        TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
-                __field(        int,            flag            )
+                __field(        int,            flag                    )
        ),
        TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                __entry->flag = flag;
        ),
@@ -161,32 +160,32 @@ DECLARE_EVENT_CLASS(regmap_bool,
 DEFINE_EVENT(regmap_bool, regmap_cache_only,
-        TP_PROTO(struct device *dev, bool flag),
+        TP_PROTO(struct regmap *map, bool flag),
-        TP_ARGS(dev, flag)
+        TP_ARGS(map, flag)
 );
 DEFINE_EVENT(regmap_bool, regmap_cache_bypass,
-        TP_PROTO(struct device *dev, bool flag),
+        TP_PROTO(struct regmap *map, bool flag),
-        TP_ARGS(dev, flag)
+        TP_ARGS(map, flag)
 );
 DECLARE_EVENT_CLASS(regmap_async,
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
-        TP_ARGS(dev),
+        TP_ARGS(map),
        TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
        ),
        TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
        ),
        TP_printk("%s", __get_str(name))
@@ -194,50 +193,50 @@ DECLARE_EVENT_CLASS(regmap_async,
 DEFINE_EVENT(regmap_block, regmap_async_write_start,
-        TP_PROTO(struct device *dev, unsigned int reg, int count),
+        TP_PROTO(struct regmap *map, unsigned int reg, int count),
-        TP_ARGS(dev, reg, count)
+        TP_ARGS(map, reg, count)
 );
 DEFINE_EVENT(regmap_async, regmap_async_io_complete,
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
-        TP_ARGS(dev)
+        TP_ARGS(map)
 );
 DEFINE_EVENT(regmap_async, regmap_async_complete_start,
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
-        TP_ARGS(dev)
+        TP_ARGS(map)
 );
 DEFINE_EVENT(regmap_async, regmap_async_complete_done,
-        TP_PROTO(struct device *dev),
+        TP_PROTO(struct regmap *map),
-        TP_ARGS(dev)
+        TP_ARGS(map)
 );
 TRACE_EVENT(regcache_drop_region,
-        TP_PROTO(struct device *dev, unsigned int from,
+        TP_PROTO(struct regmap *map, unsigned int from,
                 unsigned int to),
-        TP_ARGS(dev, from, to),
+        TP_ARGS(map, from, to),
        TP_STRUCT__entry(
-                __string(       name,           dev_name(dev)   )
+                __string(       name,           regmap_name(map)        )
-                __field(        unsigned int,   from            )
+                __field(        unsigned int,   from                    )
-                __field(        unsigned int,   to              )
+                __field(        unsigned int,   to                      )
        ),
        TP_fast_assign(
-                __assign_str(name, dev_name(dev));
+                __assign_str(name, regmap_name(map));
                __entry->from = from;
                __entry->to = to;
        ),
diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
index 8d1be9073380..551b6737f5df 100644
--- a/include/uapi/drm/i915_drm.h
+++ b/include/uapi/drm/i915_drm.h
@@ -270,7 +270,7 @@ typedef struct _drm_i915_sarea {
 #define DRM_IOCTL_I915_OVERLAY_PUT_IMAGE        DRM_IOW(DRM_COMMAND_BASE + DRM_I915_OVERLAY_PUT_IMAGE, struct drm_intel_overlay_put_image)
 #define DRM_IOCTL_I915_OVERLAY_ATTRS    DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_OVERLAY_ATTRS, struct drm_intel_overlay_attrs)
 #define DRM_IOCTL_I915_SET_SPRITE_COLORKEY DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_SET_SPRITE_COLORKEY, struct drm_intel_sprite_colorkey)
-#define DRM_IOCTL_I915_GET_SPRITE_COLORKEY DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_SET_SPRITE_COLORKEY, struct drm_intel_sprite_colorkey)
+#define DRM_IOCTL_I915_GET_SPRITE_COLORKEY DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GET_SPRITE_COLORKEY, struct drm_intel_sprite_colorkey)
 #define DRM_IOCTL_I915_GEM_WAIT         DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_WAIT, struct drm_i915_gem_wait)
 #define DRM_IOCTL_I915_GEM_CONTEXT_CREATE       DRM_IOWR (DRM_COMMAND_BASE + DRM_I915_GEM_CONTEXT_CREATE, struct drm_i915_gem_context_create)
 #define DRM_IOCTL_I915_GEM_CONTEXT_DESTROY      DRM_IOW (DRM_COMMAND_BASE + DRM_I915_GEM_CONTEXT_DESTROY, struct drm_i915_gem_context_destroy)
diff --git a/include/uapi/linux/virtio_blk.h b/include/uapi/linux/virtio_blk.h
index 3c53eec4ae22..19c66fcbab8a 100644
--- a/include/uapi/linux/virtio_blk.h
+++ b/include/uapi/linux/virtio_blk.h
@@ -60,7 +60,7 @@ struct virtio_blk_config {
        __u32 size_max;
        /* The maximum number of segments (if VIRTIO_BLK_F_SEG_MAX) */
        __u32 seg_max;
-        /* geometry the device (if VIRTIO_BLK_F_GEOMETRY) */
+        /* geometry of the device (if VIRTIO_BLK_F_GEOMETRY) */
        struct virtio_blk_geometry {
                __u16 cylinders;
                __u8 heads;
@@ -119,7 +119,11 @@ struct virtio_blk_config {
 #define VIRTIO_BLK_T_BARRIER    0x80000000
 #endif /* !VIRTIO_BLK_NO_LEGACY */
-/* This is the first element of the read scatter-gather list. */
+/*
+ * This comes first in the read scatter-gather list.
+ * For legacy virtio, if VIRTIO_F_ANY_LAYOUT is not negotiated,
+ * this is the first element of the read scatter-gather list.
+ */
 struct virtio_blk_outhdr {
        /* VIRTIO_BLK_T* */
        __virtio32 type;
diff --git a/include/uapi/linux/virtio_scsi.h b/include/uapi/linux/virtio_scsi.h
index 42b9370771b0..cc18ef8825c0 100644
--- a/include/uapi/linux/virtio_scsi.h
+++ b/include/uapi/linux/virtio_scsi.h
@@ -29,8 +29,16 @@
 #include <linux/virtio_types.h>
-#define VIRTIO_SCSI_CDB_SIZE   32
+/* Default values of the CDB and sense data size configuration fields */
-#define VIRTIO_SCSI_SENSE_SIZE 96
+#define VIRTIO_SCSI_CDB_DEFAULT_SIZE   32
+#define VIRTIO_SCSI_SENSE_DEFAULT_SIZE 96
+#ifndef VIRTIO_SCSI_CDB_SIZE
+#define VIRTIO_SCSI_CDB_SIZE VIRTIO_SCSI_CDB_DEFAULT_SIZE
+#endif
+#ifndef VIRTIO_SCSI_SENSE_SIZE
+#define VIRTIO_SCSI_SENSE_SIZE VIRTIO_SCSI_SENSE_DEFAULT_SIZE
+#endif
 /* SCSI command request, followed by data-out */
 struct virtio_scsi_cmd_req {
diff --git a/kernel/events/core.c b/kernel/events/core.c
index f04daabfd1cf..2fabc0627165 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3591,7 +3591,7 @@ static void put_event(struct perf_event *event)
        ctx = perf_event_ctx_lock_nested(event, SINGLE_DEPTH_NESTING);
        WARN_ON_ONCE(ctx->parent_ctx);
        perf_remove_from_context(event, true);
-        mutex_unlock(&ctx->mutex);
+        perf_event_ctx_unlock(event, ctx);
        _free_event(event);
 }
@@ -4574,6 +4574,13 @@ static void perf_pending_event(struct irq_work *entry)
 {
        struct perf_event *event = container_of(entry,
                        struct perf_event, pending);
+        int rctx;
+        rctx = perf_swevent_get_recursion_context();
+        /*
+         * If we 'fail' here, that's OK, it means recursion is already disabled
+         * and we won't recurse 'further'.
+         */
        if (event->pending_disable) {
                event->pending_disable = 0;
@@ -4584,6 +4591,9 @@ static void perf_pending_event(struct irq_work *entry)
                event->pending_wakeup = 0;
                perf_event_wakeup(event);
        }
+        if (rctx >= 0)
+                perf_swevent_put_recursion_context(rctx);
 }
 /*
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 01ca08804f51..3f9f1d6b4c2e 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -89,16 +89,28 @@ static bool klp_is_object_loaded(struct klp_object *obj)
 /* sets obj->mod if object is not vmlinux and module is found */
 static void klp_find_object_module(struct klp_object *obj)
 {
+        struct module *mod;
        if (!klp_is_module(obj))
                return;
        mutex_lock(&module_mutex);
        /*
-         * We don't need to take a reference on the module here because we have
+         * We do not want to block removal of patched modules and therefore
-         * the klp_mutex, which is also taken by the module notifier.  This
+         * we do not take a reference here. The patches are removed by
-         * prevents any module from unloading until we release the klp_mutex.
+         * a going module handler instead.
+         */
+        mod = find_module(obj->name);
+        /*
+         * Do not mess work of the module coming and going notifiers.
+         * Note that the patch might still be needed before the going handler
+         * is called. Module functions can be called even in the GOING state
+         * until mod->exit() finishes. This is especially important for
+         * patches that modify semantic of the functions.
         */
-        obj->mod = find_module(obj->name);
+        if (mod && mod->klp_alive)
+                obj->mod = mod;
        mutex_unlock(&module_mutex);
 }
@@ -767,6 +779,7 @@ static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
                return -EINVAL;
        obj->state = KLP_DISABLED;
+        obj->mod = NULL;
        klp_find_object_module(obj);
@@ -961,6 +974,15 @@ static int klp_module_notify(struct notifier_block *nb, unsigned long action,
        mutex_lock(&klp_mutex);
+        /*
+         * Each module has to know that the notifier has been called.
+         * We never know what module will get patched by a new patch.
+         */
+        if (action == MODULE_STATE_COMING)
+                mod->klp_alive = true;
+        else /* MODULE_STATE_GOING */
+                mod->klp_alive = false;
        list_for_each_entry(patch, &klp_patches, list) {
                for (obj = patch->objs; obj->funcs; obj++) {
                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 88d0d4420ad2..ba77ab5f64dd 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -633,7 +633,7 @@ static int count_matching_names(struct lock_class *new_class)
        if (!new_class->name)
                return 0;
-        list_for_each_entry(class, &all_lock_classes, lock_entry) {
+        list_for_each_entry_rcu(class, &all_lock_classes, lock_entry) {
                if (new_class->key - new_class->subclass == class->key)
                        return class->name_version;
                if (class->name && !strcmp(class->name, new_class->name))
@@ -700,10 +700,12 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
        hash_head = classhashentry(key);
        /*
-         * We can walk the hash lockfree, because the hash only
+         * We do an RCU walk of the hash, see lockdep_free_key_range().
-         * grows, and we are careful when adding entries to the end:
         */
-        list_for_each_entry(class, hash_head, hash_entry) {
+        if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
+                return NULL;
+        list_for_each_entry_rcu(class, hash_head, hash_entry) {
                if (class->key == key) {
                        /*
                         * Huh! same key, different name? Did someone trample
@@ -728,7 +730,8 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
        struct lockdep_subclass_key *key;
        struct list_head *hash_head;
        struct lock_class *class;
-        unsigned long flags;
+        DEBUG_LOCKS_WARN_ON(!irqs_disabled());
        class = look_up_lock_class(lock, subclass);
        if (likely(class))
@@ -750,28 +753,26 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
        key = lock->key->subkeys + subclass;
        hash_head = classhashentry(key);
-        raw_local_irq_save(flags);
        if (!graph_lock()) {
-                raw_local_irq_restore(flags);
                return NULL;
        }
        /*
         * We have to do the hash-walk again, to avoid races
         * with another CPU:
         */
-        list_for_each_entry(class, hash_head, hash_entry)
+        list_for_each_entry_rcu(class, hash_head, hash_entry) {
                if (class->key == key)
                        goto out_unlock_set;
+        }
        /*
         * Allocate a new key from the static array, and add it to
         * the hash:
         */
        if (nr_lock_classes >= MAX_LOCKDEP_KEYS) {
                if (!debug_locks_off_graph_unlock()) {
-                        raw_local_irq_restore(flags);
                        return NULL;
                }
-                raw_local_irq_restore(flags);
                print_lockdep_off("BUG: MAX_LOCKDEP_KEYS too low!");
                dump_stack();
@@ -798,7 +799,6 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
        if (verbose(class)) {
                graph_unlock();
-                raw_local_irq_restore(flags);
                printk("\nnew class %p: %s", class->key, class->name);
                if (class->name_version > 1)
@@ -806,15 +806,12 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
                printk("\n");
                dump_stack();
-                raw_local_irq_save(flags);
                if (!graph_lock()) {
-                        raw_local_irq_restore(flags);
                        return NULL;
                }
        }
 out_unlock_set:
        graph_unlock();
-        raw_local_irq_restore(flags);
 out_set_class_cache:
        if (!subclass || force)
@@ -870,11 +867,9 @@ static int add_lock_to_list(struct lock_class *class, struct lock_class *this,
        entry->distance = distance;
        entry->trace = *trace;
        /*
-         * Since we never remove from the dependency list, the list can
+         * Both allocation and removal are done under the graph lock; but
-         * be walked lockless by other CPUs, it's only allocation
+         * iteration is under RCU-sched; see look_up_lock_class() and
-         * that must be protected by the spinlock. But this also means
+         * lockdep_free_key_range().
-         * we must make new entries visible only once writes to the
-         * entry become visible - hence the RCU op:
         */
        list_add_tail_rcu(&entry->entry, head);
@@ -1025,7 +1020,9 @@ static int __bfs(struct lock_list *source_entry,
                else
                        head = &lock->class->locks_before;
-                list_for_each_entry(entry, head, entry) {
+                DEBUG_LOCKS_WARN_ON(!irqs_disabled());
+                list_for_each_entry_rcu(entry, head, entry) {
                        if (!lock_accessed(entry)) {
                                unsigned int cq_depth;
                                mark_lock_accessed(entry, lock);
@@ -2022,7 +2019,7 @@ static inline int lookup_chain_cache(struct task_struct *curr,
         * We can walk it lock-free, because entries only get added
         * to the hash:
         */
-        list_for_each_entry(chain, hash_head, entry) {
+        list_for_each_entry_rcu(chain, hash_head, entry) {
                if (chain->chain_key == chain_key) {
 cache_hit:
                        debug_atomic_inc(chain_lookup_hits);
@@ -2996,8 +2993,18 @@ void lockdep_init_map(struct lockdep_map *lock, const char *name,
        if (unlikely(!debug_locks))
                return;
-        if (subclass)
+        if (subclass) {
+                unsigned long flags;
+                if (DEBUG_LOCKS_WARN_ON(current->lockdep_recursion))
+                        return;
+                raw_local_irq_save(flags);
+                current->lockdep_recursion = 1;
                register_lock_class(lock, subclass, 1);
+                current->lockdep_recursion = 0;
+                raw_local_irq_restore(flags);
+        }
 }
 EXPORT_SYMBOL_GPL(lockdep_init_map);
@@ -3887,9 +3894,17 @@ static inline int within(const void *addr, void *start, unsigned long size)
        return addr >= start && addr < start + size;
 }
+/*
+ * Used in module.c to remove lock classes from memory that is going to be
+ * freed; and possibly re-used by other modules.
+ *
+ * We will have had one sync_sched() before getting here, so we're guaranteed
+ * nobody will look up these exact classes -- they're properly dead but still
+ * allocated.
+ */
 void lockdep_free_key_range(void *start, unsigned long size)
 {
-        struct lock_class *class, *next;
+        struct lock_class *class;
        struct list_head *head;
        unsigned long flags;
        int i;
@@ -3905,7 +3920,7 @@ void lockdep_free_key_range(void *start, unsigned long size)
                head = classhash_table + i;
                if (list_empty(head))
                        continue;
-                list_for_each_entry_safe(class, next, head, hash_entry) {
+                list_for_each_entry_rcu(class, head, hash_entry) {
                        if (within(class->key, start, size))
                                zap_class(class);
                        else if (within(class->name, start, size))
@@ -3916,11 +3931,25 @@ void lockdep_free_key_range(void *start, unsigned long size)
        if (locked)
                graph_unlock();
        raw_local_irq_restore(flags);
+        /*
+         * Wait for any possible iterators from look_up_lock_class() to pass
+         * before continuing to free the memory they refer to.
+         *
+         * sync_sched() is sufficient because the read-side is IRQ disable.
+         */
+        synchronize_sched();
+        /*
+         * XXX at this point we could return the resources to the pool;
+         * instead we leak them. We would need to change to bitmap allocators
+         * instead of the linear allocators we have now.
+         */
 }
 void lockdep_reset_lock(struct lockdep_map *lock)
 {
-        struct lock_class *class, *next;
+        struct lock_class *class;
        struct list_head *head;
        unsigned long flags;
        int i, j;
@@ -3948,7 +3977,7 @@ void lockdep_reset_lock(struct lockdep_map *lock)
                head = classhash_table + i;
                if (list_empty(head))
                        continue;
-                list_for_each_entry_safe(class, next, head, hash_entry) {
+                list_for_each_entry_rcu(class, head, hash_entry) {
                        int match = 0;
                        for (j = 0; j < NR_LOCKDEP_CACHING_CLASSES; j++)
diff --git a/kernel/module.c b/kernel/module.c
index b3d634ed06c9..99fdf94efce8 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1865,7 +1865,7 @@ static void free_module(struct module *mod)
        kfree(mod->args);
        percpu_modfree(mod);
-        /* Free lock-classes: */
+        /* Free lock-classes; relies on the preceding sync_rcu(). */
        lockdep_free_key_range(mod->module_core, mod->core_size);
        /* Finally, free the core (containing the module structure) */
@@ -3349,9 +3349,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
        module_bug_cleanup(mod);
        mutex_unlock(&module_mutex);
-        /* Free lock-classes: */
-        lockdep_free_key_range(mod->module_core, mod->core_size);
        /* we can't deallocate the module until we clear memory protection */
        unset_module_init_ro_nx(mod);
        unset_module_core_ro_nx(mod);
@@ -3375,6 +3372,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
        synchronize_rcu();
        mutex_unlock(&module_mutex);
 free_module:
+        /* Free lock-classes; relies on the preceding sync_rcu() */
+        lockdep_free_key_range(mod->module_core, mod->core_size);
        module_deallocate(mod, info);
 free_copy:
        free_copy(info);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index f0f831e8a345..62671f53202a 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3034,6 +3034,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
        } else {
                if (dl_prio(oldprio))
                        p->dl.dl_boosted = 0;
+                if (rt_prio(oldprio))
+                        p->rt.timeout = 0;
                p->sched_class = &fair_sched_class;
        }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7ce18f3c097a..bcfe32088b37 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1609,9 +1609,11 @@ static void update_task_scan_period(struct task_struct *p,
        /*
         * If there were no record hinting faults then either the task is
         * completely idle or all activity is areas that are not of interest
-         * to automatic numa balancing. Scan slower
+         * to automatic numa balancing. Related to that, if there were failed
+         * migration then it implies we are migrating too quickly or the local
+         * node is overloaded. In either case, scan slower
         */
-        if (local + shared == 0) {
+        if (local + shared == 0 || p->numa_faults_locality[2]) {
                p->numa_scan_period = min(p->numa_scan_period_max,
                        p->numa_scan_period << 1);
@@ -2080,6 +2082,8 @@ void task_numa_fault(int last_cpupid, int mem_node, int pages, int flags)
        if (migrated)
                p->numa_pages_migrated += pages;
+        if (flags & TNF_MIGRATE_FAIL)
+                p->numa_faults_locality[2] += pages;
        p->numa_faults[task_faults_idx(NUMA_MEMBUF, mem_node, priv)] += pages;
        p->numa_faults[task_faults_idx(NUMA_CPUBUF, cpu_node, priv)] += pages;
diff --git a/kernel/time/tick-broadcast-hrtimer.c b/kernel/time/tick-broadcast-hrtimer.c
index eb682d5c697c..6aac4beedbbe 100644
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -49,6 +49,7 @@ static void bc_set_mode(enum clock_event_mode mode,
 */
 static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
 {
+        int bc_moved;
        /*
         * We try to cancel the timer first. If the callback is on
         * flight on some other cpu then we let it handle it. If we
@@ -60,9 +61,15 @@ static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
         * restart the timer because we are in the callback, but we
         * can set the expiry time and let the callback return
         * HRTIMER_RESTART.
+         *
+         * Since we are in the idle loop at this point and because
+         * hrtimer_{start/cancel} functions call into tracing,
+         * calls to these functions must be bound within RCU_NONIDLE.
         */
-        if (hrtimer_try_to_cancel(&bctimer) >= 0) {
+        RCU_NONIDLE(bc_moved = (hrtimer_try_to_cancel(&bctimer) >= 0) ?
-                hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
+                !hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED) :
+                        0);
+        if (bc_moved) {
                /* Bind the "device" to the cpu */
                bc->bound_on = smp_processor_id();
        } else if (bc->bound_on == smp_processor_id()) {
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 7a85967060a5..f0f5c5c3de12 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                        /* Error: request to write beyond destination buffer */
                        if (cpy > oend)
                                goto _output_error;
+                        if ((ref + COPYLENGTH) > oend ||
+                                        (op + COPYLENGTH) > oend)
+                                goto _output_error;
                        LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
                        while (op < cpy)
                                *op++ = *ref++;
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 626e93db28ba..6817b0350c71 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1260,6 +1260,7 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        int target_nid, last_cpupid = -1;
        bool page_locked;
        bool migrated = false;
+        bool was_writable;
        int flags = 0;
        /* A PROT_NONE fault should not end up here */
@@ -1291,17 +1292,8 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
                flags |= TNF_FAULT_LOCAL;
        }
-        /*
+        /* See similar comment in do_numa_page for explanation */
-         * Avoid grouping on DSO/COW pages in specific and RO pages
+        if (!(vma->vm_flags & VM_WRITE))
-         * in general, RO pages shouldn't hurt as much anyway since
-         * they can be in shared cache state.
-         *
-         * FIXME! This checks "pmd_dirty()" as an approximation of
-         * "is this a read-only page", since checking "pmd_write()"
-         * is even more broken. We haven't actually turned this into
-         * a writable page, so pmd_write() will always be false.
-         */
-        if (!pmd_dirty(pmd))
                flags |= TNF_NO_GROUP;
        /*
@@ -1358,12 +1350,17 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        if (migrated) {
                flags |= TNF_MIGRATED;
                page_nid = target_nid;
-        }
+        } else
+                flags |= TNF_MIGRATE_FAIL;
        goto out;
 clear_pmdnuma:
        BUG_ON(!PageLocked(page));
+        was_writable = pmd_write(pmd);
        pmd = pmd_modify(pmd, vma->vm_page_prot);
+        pmd = pmd_mkyoung(pmd);
+        if (was_writable)
+                pmd = pmd_mkwrite(pmd);
        set_pmd_at(mm, haddr, pmdp, pmd);
        update_mmu_cache_pmd(vma, addr, pmdp);
        unlock_page(page);
@@ -1487,6 +1484,7 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
        if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
                pmd_t entry;
+                bool preserve_write = prot_numa && pmd_write(*pmd);
                ret = 1;
                /*
@@ -1502,9 +1500,11 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
                if (!prot_numa || !pmd_protnone(*pmd)) {
                        entry = pmdp_get_and_clear_notify(mm, addr, pmd);
                        entry = pmd_modify(entry, newprot);
+                        if (preserve_write)
+                                entry = pmd_mkwrite(entry);
                        ret = HPAGE_PMD_NR;
                        set_pmd_at(mm, addr, pmd, entry);
-                        BUG_ON(pmd_write(entry));
+                        BUG_ON(!preserve_write && pmd_write(entry));
                }
                spin_unlock(ptl);
        }
diff --git a/mm/memory.c b/mm/memory.c
index 411144f977b1..97839f5c8c30 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3035,6 +3035,7 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        int last_cpupid;
        int target_nid;
        bool migrated = false;
+        bool was_writable = pte_write(pte);
        int flags = 0;
        /* A PROT_NONE fault should not end up here */
@@ -3059,6 +3060,8 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        /* Make it present again */
        pte = pte_modify(pte, vma->vm_page_prot);
        pte = pte_mkyoung(pte);
+        if (was_writable)
+                pte = pte_mkwrite(pte);
        set_pte_at(mm, addr, ptep, pte);
        update_mmu_cache(vma, addr, ptep);
@@ -3069,16 +3072,14 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        }
        /*
-         * Avoid grouping on DSO/COW pages in specific and RO pages
+         * Avoid grouping on RO pages in general. RO pages shouldn't hurt as
-         * in general, RO pages shouldn't hurt as much anyway since
+         * much anyway since they can be in shared cache state. This misses
-         * they can be in shared cache state.
+         * the case where a mapping is writable but the process never writes
-         *
+         * to it but pte_write gets cleared during protection updates and
-         * FIXME! This checks "pmd_dirty()" as an approximation of
+         * pte_dirty has unpredictable behaviour between PTE scan updates,
-         * "is this a read-only page", since checking "pmd_write()"
+         * background writeback, dirty balancing and application behaviour.
-         * is even more broken. We haven't actually turned this into
-         * a writable page, so pmd_write() will always be false.
         */
-        if (!pte_dirty(pte))
+        if (!(vma->vm_flags & VM_WRITE))
                flags |= TNF_NO_GROUP;
        /*
@@ -3102,7 +3103,8 @@ static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
        if (migrated) {
                page_nid = target_nid;
                flags |= TNF_MIGRATED;
-        }
+        } else
+                flags |= TNF_MIGRATE_FAIL;
 out:
        if (page_nid != -1)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 9fab10795bea..65842d688b7c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1092,6 +1092,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
                        return NULL;
                arch_refresh_nodedata(nid, pgdat);
+        } else {
+                /* Reset the nr_zones and classzone_idx to 0 before reuse */
+                pgdat->nr_zones = 0;
+                pgdat->classzone_idx = 0;
        }
        /* we can use NODE_DATA(nid) from here */
@@ -1977,15 +1981,6 @@ void try_offline_node(int nid)
                if (is_vmalloc_addr(zone->wait_table))
                        vfree(zone->wait_table);
        }
-        /*
-         * Since there is no way to guarentee the address of pgdat/zone is not
-         * on stack of any kernel threads or used by other kernel objects
-         * without reference counting or other symchronizing method, do not
-         * reset node_data and free pgdat here. Just reset it to 0 and reuse
-         * the memory when the node is online again.
-         */
-        memset(pgdat, 0, sizeof(*pgdat));
 }
 EXPORT_SYMBOL(try_offline_node);
diff --git a/mm/mmap.c b/mm/mmap.c
index da9990acc08b..9ec50a368634 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -774,10 +774,8 @@ again:			remove_next = 1 + (end > next->vm_end);
                        importer->anon_vma = exporter->anon_vma;
                        error = anon_vma_clone(importer, exporter);
-                        if (error) {
+                        if (error)
-                                importer->anon_vma = NULL;
                                return error;
-                        }
                }
        }
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 44727811bf4c..88584838e704 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -75,6 +75,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                oldpte = *pte;
                if (pte_present(oldpte)) {
                        pte_t ptent;
+                        bool preserve_write = prot_numa && pte_write(oldpte);
                        /*
                         * Avoid trapping faults against the zero or KSM
@@ -94,6 +95,8 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                        ptent = ptep_modify_prot_start(mm, addr, pte);
                        ptent = pte_modify(ptent, newprot);
+                        if (preserve_write)
+                                ptent = pte_mkwrite(ptent);
                        /* Avoid taking write faults for known dirty pages */
                        if (dirty_accountable && pte_dirty(ptent) &&
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 45e187b2d971..644bcb665773 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -857,8 +857,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
         *                   bw * elapsed + write_bandwidth * (period - elapsed)
         * write_bandwidth = ---------------------------------------------------
         *                                          period
+         *
+         * @written may have decreased due to account_page_redirty().
+         * Avoid underflowing @bw calculation.
         */
-        bw = written - bdi->written_stamp;
+        bw = written - min(written, bdi->written_stamp);
        bw *= HZ;
        if (unlikely(elapsed > period)) {
                do_div(bw, elapsed);
@@ -922,7 +925,7 @@ static void global_update_bandwidth(unsigned long thresh,
                                    unsigned long now)
 {
        static DEFINE_SPINLOCK(dirty_lock);
-        static unsigned long update_time;
+        static unsigned long update_time = INITIAL_JIFFIES;
        /*
         * check locklessly first to optimize away locking for the most time
diff --git a/mm/page_isolation.c b/mm/page_isolation.c
index 72f5ac381ab3..755a42c76eb4 100644
--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -103,6 +103,7 @@ void unset_migratetype_isolate(struct page *page, unsigned migratetype)
                        if (!is_migrate_isolate_page(buddy)) {
                                __isolate_free_page(page, order);
+                                kernel_map_pages(page, (1 << order), 1);
                                set_page_refcounted(page);
                                isolated_page = page;
                        }
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
index 75c1f2878519..29f2f8b853ae 100644
--- a/mm/pagewalk.c
+++ b/mm/pagewalk.c
@@ -265,8 +265,15 @@ int walk_page_range(unsigned long start, unsigned long end,
                        vma = vma->vm_next;
                        err = walk_page_test(start, next, walk);
-                        if (err > 0)
+                        if (err > 0) {
+                                /*
+                                 * positive return values are purely for
+                                 * controlling the pagewalk, so should never
+                                 * be passed to the callers.
+                                 */
+                                err = 0;
                                continue;
+                        }
                        if (err < 0)
                                break;
                }
diff --git a/mm/rmap.c b/mm/rmap.c
index 5e3e09081164..c161a14b6a8f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -287,6 +287,13 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
        return 0;
 enomem_failure:
+        /*
+         * dst->anon_vma is dropped here otherwise its degree can be incorrectly
+         * decremented in unlink_anon_vmas().
+         * We can safely do this because callers of anon_vma_clone() don't care
+         * about dst->anon_vma if anon_vma_clone() failed.
+         */
+        dst->anon_vma = NULL;
        unlink_anon_vmas(dst);
        return -ENOMEM;
 }
diff --git a/mm/slub.c b/mm/slub.c
index 6832c4eab104..82c473780c91 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2449,7 +2449,8 @@ redo:
        do {
                tid = this_cpu_read(s->cpu_slab->tid);
                c = raw_cpu_ptr(s->cpu_slab);
-        } while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
+        } while (IS_ENABLED(CONFIG_PREEMPT) &&
+                 unlikely(tid != READ_ONCE(c->tid)));
        /*
         * Irqless object alloc/free algorithm used here depends on sequence
@@ -2718,7 +2719,8 @@ redo:
        do {
                tid = this_cpu_read(s->cpu_slab->tid);
                c = raw_cpu_ptr(s->cpu_slab);
-        } while (IS_ENABLED(CONFIG_PREEMPT) && unlikely(tid != c->tid));
+        } while (IS_ENABLED(CONFIG_PREEMPT) &&
+                 unlikely(tid != READ_ONCE(c->tid)));
        /* Same with comment on barrier() in slab_alloc_node() */
        barrier();
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index d8e376a5f0f1..36a1a739ad68 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -658,14 +658,30 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 static void p9_virtio_remove(struct virtio_device *vdev)
 {
        struct virtio_chan *chan = vdev->priv;
+        unsigned long warning_time;
-        if (chan->inuse)
-                p9_virtio_close(chan->client);
-        vdev->config->del_vqs(vdev);
        mutex_lock(&virtio_9p_lock);
+        /* Remove self from list so we don't get new users. */
        list_del(&chan->chan_list);
+        warning_time = jiffies;
+        /* Wait for existing users to close. */
+        while (chan->inuse) {
+                mutex_unlock(&virtio_9p_lock);
+                msleep(250);
+                if (time_after(jiffies, warning_time + 10 * HZ)) {
+                        dev_emerg(&vdev->dev,
+                                  "p9_virtio_remove: waiting for device in use.\n");
+                        warning_time = jiffies;
+                }
+                mutex_lock(&virtio_9p_lock);
+        }
        mutex_unlock(&virtio_9p_lock);
+        vdev->config->del_vqs(vdev);
        sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
        kobject_uevent(&(vdev->dev.kobj), KOBJ_CHANGE);
        kfree(chan->tag);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b087d278c679..1849d96b3c91 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -563,6 +563,8 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         */
        del_nbp(p);
+        dev_set_mtu(br->dev, br_min_mtu(br));
        spin_lock_bh(&br->lock);
        changed_addr = br_stp_recalculate_bridge_id(br);
        spin_unlock_bh(&br->lock);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 769b185fefbd..a6e2da0bc718 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
        int copylen;
        ret = -EOPNOTSUPP;
-        if (m->msg_flags&MSG_OOB)
+        if (flags & MSG_OOB)
                goto read_error;
        skb = skb_recv_datagram(sk, flags, 0 , &ret);
diff --git a/net/compat.c b/net/compat.c
index 94d3d5e97883..f7bd286a8280 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
            __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
            __get_user(kmsg->msg_flags, &umsg->msg_flags))
                return -EFAULT;
+        if (!uaddr)
+                kmsg->msg_namelen = 0;
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
        kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 25b4b5d23485..ee0608bb3bc0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2166,28 +2166,28 @@ replay:
                        }
                }
                err = rtnl_configure_link(dev, ifm);
-                if (err < 0) {
+                if (err < 0)
-                        if (ops->newlink) {
+                        goto out_unregister;
-                                LIST_HEAD(list_kill);
-                                ops->dellink(dev, &list_kill);
-                                unregister_netdevice_many(&list_kill);
-                        } else {
-                                unregister_netdevice(dev);
-                        }
-                        goto out;
-                }
                if (link_net) {
                        err = dev_change_net_namespace(dev, dest_net, ifname);
                        if (err < 0)
-                                unregister_netdevice(dev);
+                                goto out_unregister;
                }
 out:
                if (link_net)
                        put_net(link_net);
                put_net(dest_net);
                return err;
+out_unregister:
+                if (ops->newlink) {
+                        LIST_HEAD(list_kill);
+                        ops->dellink(dev, &list_kill);
+                        unregister_netdevice_many(&list_kill);
+                } else {
+                        unregister_netdevice(dev);
+                }
+                goto out;
        }
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f80507823531..8e4ac97c8477 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3733,9 +3733,13 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
                     struct sock *sk, int tstype)
 {
        struct sk_buff *skb;
-        bool tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        bool tsonly;
-        if (!sk || !skb_may_tx_timestamp(sk, tsonly))
+        if (!sk)
+                return;
+        tsonly = sk->sk_tsflags & SOF_TIMESTAMPING_OPT_TSONLY;
+        if (!skb_may_tx_timestamp(sk, tsonly))
                return;
        if (tsonly)
@@ -4173,7 +4177,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
        skb->ignore_df = 0;
        skb_dst_drop(skb);
        skb->mark = 0;
-        skb->sender_cpu = 0;
+        skb_sender_cpu_clear(skb);
        skb_init_secmark(skb);
        secpath_reset(skb);
        nf_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index 93c8b20c91e4..78e89eb7eb70 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1655,6 +1655,10 @@ void sock_rfree(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(sock_rfree);
+/*
+ * Buffer destructor for skbs that are not used directly in read or write
+ * path, e.g. for error handler skbs. Automatically called from kfree_skb.
+ */
 void sock_efree(struct sk_buff *skb)
 {
        sock_put(skb->sk);
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 433424804284..8ce351ffceb1 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -25,6 +25,8 @@
 static int zero = 0;
 static int one = 1;
 static int ushort_max = USHRT_MAX;
+static int min_sndbuf = SOCK_MIN_SNDBUF;
+static int min_rcvbuf = SOCK_MIN_RCVBUF;
 static int net_msg_warn;        /* Unused, but still a sysctl */
@@ -237,7 +239,7 @@ static struct ctl_table net_core_table[] = {
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
        },
        {
                .procname       = "rmem_max",
@@ -245,7 +247,7 @@ static struct ctl_table net_core_table[] = {
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
        },
        {
                .procname       = "wmem_default",
@@ -253,7 +255,7 @@ static struct ctl_table net_core_table[] = {
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_sndbuf,
        },
        {
                .procname       = "rmem_default",
@@ -261,7 +263,7 @@ static struct ctl_table net_core_table[] = {
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &one,
+                .extra1         = &min_rcvbuf,
        },
        {
                .procname       = "dev_weight",
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 14d02ea905b6..3e44b9b0b78e 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -268,6 +268,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
                release_sock(sk);
                if (reqsk_queue_empty(&icsk->icsk_accept_queue))
                        timeo = schedule_timeout(timeo);
+                sched_annotate_sleep();
                lock_sock(sk);
                err = 0;
                if (!reqsk_queue_empty(&icsk->icsk_accept_queue))
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 81751f12645f..592aff37366b 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
        mutex_unlock(&inet_diag_table_mutex);
 }
+static size_t inet_sk_attr_size(void)
+{
+        return    nla_total_size(sizeof(struct tcp_info))
+                + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
+                + nla_total_size(1) /* INET_DIAG_TOS */
+                + nla_total_size(1) /* INET_DIAG_TCLASS */
+                + nla_total_size(sizeof(struct inet_diag_meminfo))
+                + nla_total_size(sizeof(struct inet_diag_msg))
+                + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+                + nla_total_size(TCP_CA_NAME_MAX)
+                + nla_total_size(sizeof(struct tcpvegas_info))
+                + 64;
+}
 int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                              struct sk_buff *skb, struct inet_diag_req_v2 *req,
                              struct user_namespace *user_ns,                   
@@ -326,9 +340,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
        if (err)
                goto out;
-        rep = nlmsg_new(sizeof(struct inet_diag_msg) +
+        rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
-                        sizeof(struct inet_diag_meminfo) +
-                        sizeof(struct tcp_info) + 64, GFP_KERNEL);
        if (!rep) {
                err = -ENOMEM;
                goto out;
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 787b3c294ce6..d9bc28ac5d1b 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -67,6 +67,7 @@ static int ip_forward_finish(struct sk_buff *skb)
        if (unlikely(opt->optlen))
                ip_forward_options(skb);
+        skb_sender_cpu_clear(skb);
        return dst_output(skb);
 }
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 99e810f84671..cf5e82f39d3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -272,9 +272,9 @@ static void trace_packet(const struct sk_buff *skb,
                    &chainname, &comment, &rulenum) != 0)
                        break;
-        nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,
+        nf_log_trace(net, AF_INET, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
+                     "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+                     tablename, chainname, comment, rulenum);
 }
 #endif
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index d694088214cd..62856e185a93 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -378,6 +378,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
 */
 void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
 {
+        /* If credits accumulated at a higher w, apply them gently now. */
+        if (tp->snd_cwnd_cnt >= w) {
+                tp->snd_cwnd_cnt = 0;
+                tp->snd_cwnd++;
+        }
        tp->snd_cwnd_cnt += acked;
        if (tp->snd_cwnd_cnt >= w) {
                u32 delta = tp->snd_cwnd_cnt / w;
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index 4b276d1ed980..06d3d665a9fd 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -306,8 +306,10 @@ tcp_friendliness:
                }
        }
-        if (ca->cnt == 0)                       /* cannot be zero */
+        /* The maximum rate of cwnd increase CUBIC allows is 1 packet per
-                ca->cnt = 1;
+         * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
+         */
+        ca->cnt = max(ca->cnt, 2U);
 }
 static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a2a796c5536b..1db253e36045 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2773,15 +2773,11 @@ void tcp_send_fin(struct sock *sk)
        } else {
                /* Socket is locked, keep trying until memory is available. */
                for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
+                        skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
-                                               sk->sk_allocation);
                        if (skb)
                                break;
                        yield();
                }
-                /* Reserve space for headers and prepare control bits. */
-                skb_reserve(skb, MAX_TCP_HEADER);
                /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                tcp_init_nondata_skb(skb, tp->write_seq,
                                     TCPHDR_ACK | TCPHDR_FIN);
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index d5f6bd9a210a..dab73813cb92 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -63,6 +63,7 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                return err;
        IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
+        skb->protocol = htons(ETH_P_IP);
        return x->outer_mode->output2(x, skb);
 }
@@ -71,7 +72,6 @@ EXPORT_SYMBOL(xfrm4_prepare_output);
 int xfrm4_output_finish(struct sk_buff *skb)
 {
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
-        skb->protocol = htons(ETH_P_IP);
 #ifdef CONFIG_NETFILTER
        IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b4d5e1d97c1b..27ca79682efb 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                                goto again;
                        flp6->saddr = saddr;
                }
+                err = rt->dst.error;
                goto out;
        }
 again:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0a04a37305d5..7e80b61b51ff 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -318,6 +318,7 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 static inline int ip6_forward_finish(struct sk_buff *skb)
 {
+        skb_sender_cpu_clear(skb);
        return dst_output(skb);
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 266a264ec212..ddd94eca19b3 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -314,7 +314,7 @@ out:
 *   Create tunnel matching given parameters.
 *
 * Return:
- *   created tunnel or NULL
+ *   created tunnel or error pointer
 **/
 static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
@@ -322,7 +322,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
        struct net_device *dev;
        struct ip6_tnl *t;
        char name[IFNAMSIZ];
-        int err;
+        int err = -ENOMEM;
        if (p->name[0])
                strlcpy(name, p->name, IFNAMSIZ);
@@ -348,7 +348,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 failed_free:
        ip6_dev_free(dev);
 failed:
-        return NULL;
+        return ERR_PTR(err);
 }
 /**
@@ -362,7 +362,7 @@ failed:
 *   tunnel device is created and registered for use.
 *
 * Return:
- *   matching tunnel or NULL
+ *   matching tunnel or error pointer
 **/
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
@@ -380,13 +380,13 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
                if (ipv6_addr_equal(local, &t->parms.laddr) &&
                    ipv6_addr_equal(remote, &t->parms.raddr)) {
                        if (create)
-                                return NULL;
+                                return ERR_PTR(-EEXIST);
                        return t;
                }
        }
        if (!create)
-                return NULL;
+                return ERR_PTR(-ENODEV);
        return ip6_tnl_create(net, p);
 }
@@ -1420,7 +1420,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        }
                        ip6_tnl_parm_from_user(&p1, &p);
                        t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                t = netdev_priv(dev);
                } else {
                        memset(&p, 0, sizeof(p));
@@ -1445,7 +1445,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                ip6_tnl_parm_from_user(&p1, &p);
                t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
                if (cmd == SIOCCHGTUNNEL) {
-                        if (t != NULL) {
+                        if (!IS_ERR(t)) {
                                if (t->dev != dev) {
                                        err = -EEXIST;
                                        break;
@@ -1457,14 +1457,15 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        else
                                err = ip6_tnl_update(t, &p1);
                }
-                if (t) {
+                if (!IS_ERR(t)) {
                        err = 0;
                        ip6_tnl_parm_to_user(&p, &t->parms);
                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
                                err = -EFAULT;
-                } else
+                } else {
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
+                        err = PTR_ERR(t);
+                }
                break;
        case SIOCDELTUNNEL:
                err = -EPERM;
@@ -1478,7 +1479,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                        err = -ENOENT;
                        ip6_tnl_parm_from_user(&p1, &p);
                        t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if (IS_ERR(t))
                                break;
                        err = -EPERM;
                        if (t->dev == ip6n->fb_tnl_dev)
@@ -1672,12 +1673,13 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[])
 {
        struct net *net = dev_net(dev);
-        struct ip6_tnl *nt;
+        struct ip6_tnl *nt, *t;
        nt = netdev_priv(dev);
        ip6_tnl_netlink_parms(data, &nt->parms);
-        if (ip6_tnl_locate(net, &nt->parms, 0))
+        t = ip6_tnl_locate(net, &nt->parms, 0);
+        if (!IS_ERR(t))
                return -EEXIST;
        return ip6_tnl_create2(dev);
@@ -1697,8 +1699,7 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
        ip6_tnl_netlink_parms(data, &p);
        t = ip6_tnl_locate(net, &p, 0);
+        if (!IS_ERR(t)) {
-        if (t) {
                if (t->dev != dev)
                        return -EEXIST;
        } else
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e080fbbbc0e5..bb00c6f2a885 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -298,9 +298,9 @@ static void trace_packet(const struct sk_buff *skb,
                    &chainname, &comment, &rulenum) != 0)
                        break;
-        nf_log_packet(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
+        nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
+                     "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+                     tablename, chainname, comment, rulenum);
 }
 #endif
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ab889bb16b3c..be2c0ba82c85 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                fptr->nexthdr = nexthdr;
                fptr->reserved = 0;
-                if (skb_shinfo(skb)->ip6_frag_id)
+                if (!skb_shinfo(skb)->ip6_frag_id)
-                        fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+                        ipv6_proxy_select_ident(skb);
-                else
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-                        ipv6_select_ident(fptr,
-                                          (struct rt6_info *)skb_dst(skb));
                /* Fragment the skb. ipv6 header and the remaining fields of the
                 * fragment header are updated in ipv6_gso_segment()
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index ca3f29b98ae5..010f8bd2d577 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -114,6 +114,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
                return err;
        skb->ignore_df = 1;
+        skb->protocol = htons(ETH_P_IPV6);
        return x->outer_mode->output2(x, skb);
 }
@@ -122,7 +123,6 @@ EXPORT_SYMBOL(xfrm6_prepare_output);
 int xfrm6_output_finish(struct sk_buff *skb)
 {
        memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-        skb->protocol = htons(ETH_P_IPV6);
 #ifdef CONFIG_NETFILTER
        IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 48bf5a06847b..8d2d01b4800a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -200,6 +200,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 #if IS_ENABLED(CONFIG_IPV6_MIP6)
                case IPPROTO_MH:
+                        offset += ipv6_optlen(exthdr);
                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                struct ip6_mh *mh;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3afe36824703..8d53d65bd2ab 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -58,13 +58,24 @@ struct ieee80211_local;
 #define IEEE80211_UNSET_POWER_LEVEL     INT_MIN
 /*
- * Some APs experience problems when working with U-APSD. Decrease the
+ * Some APs experience problems when working with U-APSD. Decreasing the
- * probability of that happening by using legacy mode for all ACs but VO.
+ * probability of that happening by using legacy mode for all ACs but VO isn't
- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+ * enough.
- * setting, and always treats non-VO ACs as legacy.
+ *
+ * Cisco 4410N originally forced us to enable VO by default only because it
+ * treated non-VO ACs as legacy.
+ *
+ * However some APs (notably Netgear R7000) silently reclassify packets to
+ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
+ * clients would never see some frames (e.g. ARP responses) or would fetch them
+ * accidentally after a long time.
+ *
+ * It makes little sense to enable u-APSD queues by default because it needs
+ * userspace applications to be aware of it to actually take advantage of the
+ * possible additional powersavings. Implicitly depending on driver autotrigger
+ * frame support doesn't make much sense.
 */
-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
-        IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
 #define IEEE80211_DEFAULT_MAX_SP_LEN            \
        IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
@@ -453,6 +464,7 @@ struct ieee80211_if_managed {
        unsigned int flags;
        bool csa_waiting_bcn;
+        bool csa_ignored_same_chan;
        bool beacon_crc_valid;
        u32 beacon_crc;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 10ac6324c1d0..142f66aece18 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1150,6 +1150,17 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                return;
        }
+        if (cfg80211_chandef_identical(&csa_ie.chandef,
+                                       &sdata->vif.bss_conf.chandef)) {
+                if (ifmgd->csa_ignored_same_chan)
+                        return;
+                sdata_info(sdata,
+                           "AP %pM tries to chanswitch to same channel, ignore\n",
+                           ifmgd->associated->bssid);
+                ifmgd->csa_ignored_same_chan = true;
+                return;
+        }
        mutex_lock(&local->mtx);
        mutex_lock(&local->chanctx_mtx);
        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
@@ -1210,6 +1221,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
        sdata->vif.csa_active = true;
        sdata->csa_chandef = csa_ie.chandef;
        sdata->csa_block_tx = csa_ie.mode;
+        ifmgd->csa_ignored_same_chan = false;
        if (sdata->csa_block_tx)
                ieee80211_stop_vif_queues(local, sdata,
@@ -2090,6 +2102,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        sdata->vif.csa_active = false;
        ifmgd->csa_waiting_bcn = false;
+        ifmgd->csa_ignored_same_chan = false;
        if (sdata->csa_block_tx) {
                ieee80211_wake_vif_queues(local, sdata,
                                          IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -3204,7 +3217,8 @@ static const u64 care_about_ies =
        (1ULL << WLAN_EID_CHANNEL_SWITCH) |
        (1ULL << WLAN_EID_PWR_CONSTRAINT) |
        (1ULL << WLAN_EID_HT_CAPABILITY) |
-        (1ULL << WLAN_EID_HT_OPERATION);
+        (1ULL << WLAN_EID_HT_OPERATION) |
+        (1ULL << WLAN_EID_EXT_CHANSWITCH_ANN);
 static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt, size_t len,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1101563357ea..944bdc04e913 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2214,6 +2214,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        hdr = (struct ieee80211_hdr *) skb->data;
        mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+        if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+                return RX_DROP_MONITOR;
        /* frame is in RMC, don't forward */
        if (ieee80211_is_data(hdr->frame_control) &&
            is_multicast_ether_addr(hdr->addr1) &&
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8428f4a95479..747bdcf72e92 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3178,7 +3178,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                wdev_iter = &sdata_iter->wdev;
                if (sdata_iter == sdata ||
-                    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+                    !ieee80211_sdata_running(sdata_iter) ||
                    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
                        continue;
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 0d8448f19dfe..675d12c69e32 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -212,6 +212,30 @@ void nf_log_packet(struct net *net,
 }
 EXPORT_SYMBOL(nf_log_packet);
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *loginfo, const char *fmt, ...)
+{
+        va_list args;
+        char prefix[NF_LOG_PREFIXLEN];
+        const struct nf_logger *logger;
+        rcu_read_lock();
+        logger = rcu_dereference(net->nf.nf_loggers[pf]);
+        if (logger) {
+                va_start(args, fmt);
+                vsnprintf(prefix, sizeof(prefix), fmt, args);
+                va_end(args);
+                logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(nf_log_trace);
 #define S_SIZE (1024 - (sizeof(unsigned int) + 1))
 struct nf_log_buf {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ab777912237..ac1a9528dbf2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
        if (nla[NFTA_CHAIN_POLICY]) {
                if ((chain != NULL &&
-                    !(chain->flags & NFT_BASE_CHAIN)) ||
+                    !(chain->flags & NFT_BASE_CHAIN)))
+                        return -EOPNOTSUPP;
+                if (chain == NULL &&
                    nla[NFTA_CHAIN_HOOK] == NULL)
                        return -EOPNOTSUPP;
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 3b90eb2b2c55..2d298dccb6dd 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -94,10 +94,10 @@ static void nft_trace_packet(const struct nft_pktinfo *pkt,
 {
        struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
-        nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
+        nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
-                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
+                     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
-                      chain->table->name, chain->name, comments[type],
+                     chain->table->name, chain->name, comments[type],
-                      rulenum);
+                     rulenum);
 }
 unsigned int
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index a5599fc51a6f..54330fb5efaf 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
        if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
                return -EINVAL;
+        /* Not all fields are initialized so first zero the tuple */
+        memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
        tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
        tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 213584cf04b3..65f3e2b6be44 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -133,6 +133,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                break;
        case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
                entry->e6.ipv6.proto = proto;
                entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                break;
@@ -344,6 +347,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                break;
        case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
                entry->e6.ipv6.proto = proto;
                entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                break;
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c82df0a48fcd..37c15e674884 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -153,6 +153,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                                iter->err = err;
                                goto out;
                        }
+                        continue;
                }
                if (iter->count < iter->skip)
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index ef8a926752a9..50e1e5aaf4ce 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -513,8 +513,8 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
 {
        const struct ip6t_ip6 *i = par->entryinfo;
-        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
+        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
-            && !(i->flags & IP6T_INV_PROTO))
+            !(i->invflags & IP6T_INV_PROTO))
                return 0;
        pr_info("Can be used only in combination with "
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index a817705ce2d0..dba8d0864f18 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                        int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
-static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
+                             struct rds_iw_device **rds_iwdev,
+                             struct rdma_cm_id **cm_id)
 {
        struct rds_iw_device *iwdev;
        struct rds_iw_cm_id *i_cm_id;
@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                                src_addr->sin_port,
                                dst_addr->sin_addr.s_addr,
                                dst_addr->sin_port,
-                                rs->rs_bound_addr,
+                                src->sin_addr.s_addr,
-                                rs->rs_bound_port,
+                                src->sin_port,
-                                rs->rs_conn_addr,
+                                dst->sin_addr.s_addr,
-                                rs->rs_conn_port);
+                                dst->sin_port);
 #ifdef WORKING_TUPLE_DETECTION
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
-                            src_addr->sin_port == rs->rs_bound_port &&
+                            src_addr->sin_port == src->sin_port &&
-                            dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
+                            dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
-                            dst_addr->sin_port == rs->rs_conn_port) {
+                            dst_addr->sin_port == dst->sin_port) {
 #else
                        /* FIXME - needs to compare the local and remote
                         * ipaddr/port tuple, but the ipaddr is the only
@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
                         * zero'ed.  It doesn't appear to be properly populated
                         * during connection setup...
                         */
-                        if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
+                        if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
 #endif
                                spin_unlock_irq(&iwdev->spinlock);
                                *rds_iwdev = iwdev;
@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
 {
        struct sockaddr_in *src_addr, *dst_addr;
        struct rds_iw_device *rds_iwdev_old;
-        struct rds_sock rs;
        struct rdma_cm_id *pcm_id;
        int rc;
        src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
        dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-        rs.rs_bound_addr = src_addr->sin_addr.s_addr;
+        rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
-        rs.rs_bound_port = src_addr->sin_port;
-        rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-        rs.rs_conn_port = dst_addr->sin_port;
-        rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
        if (rc)
                rds_iw_remove_cm_id(rds_iwdev, cm_id);
@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
        struct rds_iw_device *rds_iwdev;
        struct rds_iw_mr *ibmr = NULL;
        struct rdma_cm_id *cm_id;
+        struct sockaddr_in src = {
+                .sin_addr.s_addr = rs->rs_bound_addr,
+                .sin_port = rs->rs_bound_port,
+        };
+        struct sockaddr_in dst = {
+                .sin_addr.s_addr = rs->rs_conn_addr,
+                .sin_port = rs->rs_conn_port,
+        };
        int ret;
-        ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
+        ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
        if (ret || !cm_id) {
                ret = -ENODEV;
                goto out;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 4575485ad1b4..19a560626dc4 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                if (!skb) {
                        /* nothing remains on the queue */
                        if (copied &&
-                            (msg->msg_flags & MSG_PEEK || timeo == 0))
+                            (flags & MSG_PEEK || timeo == 0))
                                goto out;
                        /* wait for a message to turn up */
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 82c5d7fc1988..5f6288fa3f12 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -25,21 +25,41 @@ static int tcf_bpf(struct sk_buff *skb, const struct tc_action *a,
                   struct tcf_result *res)
 {
        struct tcf_bpf *b = a->priv;
-        int action;
+        int action, filter_res;
-        int filter_res;
        spin_lock(&b->tcf_lock);
        b->tcf_tm.lastuse = jiffies;
        bstats_update(&b->tcf_bstats, skb);
-        action = b->tcf_action;
        filter_res = BPF_PROG_RUN(b->filter, skb);
-        if (filter_res == 0) {
-                /* Return code 0 from the BPF program
+        /* A BPF program may overwrite the default action opcode.
-                 * is being interpreted as a drop here.
+         * Similarly as in cls_bpf, if filter_res == -1 we use the
-                 */
+         * default action specified from tc.
-                action = TC_ACT_SHOT;
+         *
+         * In case a different well-known TC_ACT opcode has been
+         * returned, it will overwrite the default one.
+         *
+         * For everything else that is unkown, TC_ACT_UNSPEC is
+         * returned.
+         */
+        switch (filter_res) {
+        case TC_ACT_PIPE:
+        case TC_ACT_RECLASSIFY:
+        case TC_ACT_OK:
+                action = filter_res;
+                break;
+        case TC_ACT_SHOT:
+                action = filter_res;
                b->tcf_qstats.drops++;
+                break;
+        case TC_ACT_UNSPEC:
+                action = b->tcf_action;
+                break;
+        default:
+                action = TC_ACT_UNSPEC;
+                break;
        }
        spin_unlock(&b->tcf_lock);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 09487afbfd51..95fdf4e40051 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -78,8 +78,11 @@ struct tc_u_hnode {
        struct tc_u_common      *tp_c;
        int                     refcnt;
        unsigned int            divisor;
-        struct tc_u_knode __rcu *ht[1];
        struct rcu_head         rcu;
+        /* The 'ht' field MUST be the last field in structure to allow for
+         * more entries allocated at end of structure.
+         */
+        struct tc_u_knode __rcu *ht[1];
 };
 struct tc_u_common {
diff --git a/net/socket.c b/net/socket.c
index bbedbfcb42c2..245330ca0015 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
        if (len > INT_MAX)
                len = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+                return -EFAULT;
        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;
@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
        if (size > INT_MAX)
                size = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+                return -EFAULT;
        sock = sockfd_lookup_light(fd, &err, &fput_needed);
        if (!sock)
                goto out;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index be2501538011..b6f84f6a2a09 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4400,6 +4400,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
        if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
                return -EINVAL;
+        /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
+         * as userspace might just pass through the capabilities from the IEs
+         * directly, rather than enforcing this restriction and returning an
+         * error in this case.
+         */
+        if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
+                params.ht_capa = NULL;
+                params.vht_capa = NULL;
+        }
        /* When you run into this, adjust the code below for the new flag */
        BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index cee479bc655c..638af0655aaf 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2269,11 +2269,9 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                 * have the xfrm_state's. We need to wait for KM to
                 * negotiate new SA's or bail out with error.*/
                if (net->xfrm.sysctl_larval_drop) {
-                        dst_release(dst);
-                        xfrm_pols_put(pols, drop_pols);
                        XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
+                        err = -EREMOTE;
-                        return ERR_PTR(-EREMOTE);
+                        goto error;
                }
                err = -EAGAIN;
@@ -2324,7 +2322,8 @@ nopol:
 error:
        dst_release(dst);
 dropdst:
-        dst_release(dst_orig);
+        if (!(flags & XFRM_LOOKUP_KEEP_DST_REF))
+                dst_release(dst_orig);
        xfrm_pols_put(pols, drop_pols);
        return ERR_PTR(err);
 }
@@ -2338,7 +2337,8 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
                                    struct sock *sk, int flags)
 {
        struct dst_entry *dst = xfrm_lookup(net, dst_orig, fl, sk,
-                                            flags | XFRM_LOOKUP_QUEUE);
+                                            flags | XFRM_LOOKUP_QUEUE |
+                                            XFRM_LOOKUP_KEEP_DST_REF);
        if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                return make_blackhole(net, dst_orig->ops->family, dst_orig);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 1684bcc78b34..5fde34326dcf 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
                goto out;
        /* No partial writes. */
-        length = EINVAL;
+        length = -EINVAL;
        if (*ppos != 0)
                goto out;
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index fe18071bf93a..8ec5289f8e05 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -687,13 +687,30 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
        return val;
 }
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
+{
+        unsigned int wcaps = get_wcaps(codec, nid);
+        hda_nid_t conn;
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+        if (snd_hda_get_num_conns(codec, nid) != 1)
+                return false;
+        if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
+}
 /* initialize the amp value (only at the first time) */
 static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 {
        unsigned int caps = query_amp_caps(codec, nid, dir);
        int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-        if (get_wcaps(codec, nid) & AC_WCAP_STEREO)
+        if (is_stereo_amps(codec, nid, dir))
                snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
        else
                snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
@@ -703,7 +720,7 @@ static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
 static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
                      unsigned int mask, unsigned int val)
 {
-        if (get_wcaps(codec, nid) & AC_WCAP_STEREO)
+        if (is_stereo_amps(codec, nid, dir))
                return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
                                                mask, val);
        else
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 4ca3d5d02436..a8a1e14272a1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1989,7 +1989,7 @@ static const struct pci_device_id azx_ids[] = {
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
        /* Sunrise Point */
        { PCI_DEVICE(0x8086, 0xa170),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
        /* Sunrise Point-LP */
        { PCI_DEVICE(0x8086, 0x9d70),
          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index ce5a6da83419..05e19f78b4cb 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
                    (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
 }
+/* is this a stereo widget or a stereo-to-mono mix? */
+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
+                           int dir, unsigned int wcaps, int indices)
+{
+        hda_nid_t conn;
+        if (wcaps & AC_WCAP_STEREO)
+                return true;
+        /* check for a stereo-to-mono mix; it must be:
+         * only a single connection, only for input, and only a mixer widget
+         */
+        if (indices != 1 || dir != HDA_INPUT ||
+            get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
+                return false;
+        if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
+                return false;
+        /* the connection source is a stereo? */
+        wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
+        return !!(wcaps & AC_WCAP_STEREO);
+}
 static void print_amp_vals(struct snd_info_buffer *buffer,
                           struct hda_codec *codec, hda_nid_t nid,
-                           int dir, int stereo, int indices)
+                           int dir, unsigned int wcaps, int indices)
 {
        unsigned int val;
+        bool stereo;
        int i;
+        stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
        dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
        for (i = 0; i < indices; i++) {
                snd_iprintf(buffer, " [");
@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                            (codec->single_adc_amp &&
                             wid_type == AC_WID_AUD_IN))
                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
+                                               wid_caps, 1);
-                                               1);
                        else
                                print_amp_vals(buffer, codec, nid, HDA_INPUT,
-                                               wid_caps & AC_WCAP_STEREO,
+                                               wid_caps, conn_len);
-                                               conn_len);
                }
                if (wid_caps & AC_WCAP_OUT_AMP) {
                        snd_iprintf(buffer, "  Amp-Out caps: ");
@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
                        if (wid_type == AC_WID_PIN &&
                            codec->pin_amp_workaround)
                                print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO,
+                                               wid_caps, conn_len);
-                                               conn_len);
                        else
                                print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-                                               wid_caps & AC_WCAP_STEREO, 1);
+                                               wid_caps, 1);
                }
                switch (wid_type) {
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 526398a4a442..74382137b9f5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -396,7 +396,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
 {
        /* We currently only handle front, HP */
        static hda_nid_t pins[] = {
-                0x0f, 0x10, 0x14, 0x15, 0
+                0x0f, 0x10, 0x14, 0x15, 0x17, 0
        };
        hda_nid_t *p;
        for (p = pins; *p; p++)
@@ -5036,6 +5036,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
        SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
        SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
        SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
index b67480f1b1aa..4373ada95648 100644
--- a/sound/soc/codecs/adav80x.c
+++ b/sound/soc/codecs/adav80x.c
@@ -317,7 +317,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
-        unsigned int deemph = ucontrol->value.enumerated.item[0];
+        unsigned int deemph = ucontrol->value.integer.value[0];
        if (deemph > 1)
                return -EINVAL;
@@ -333,7 +333,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = adav80x->deemph;
+        ucontrol->value.integer.value[0] = adav80x->deemph;
        return 0;
 };
diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
index 70861c7b1631..81b54a270bd8 100644
--- a/sound/soc/codecs/ak4641.c
+++ b/sound/soc/codecs/ak4641.c
@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        if (deemph > 1)
                return -EINVAL;
@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = ak4641->deemph;
+        ucontrol->value.integer.value[0] = ak4641->deemph;
        return 0;
 };
diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
index 632e89f793a7..2a58b1dccd2f 100644
--- a/sound/soc/codecs/ak4671.c
+++ b/sound/soc/codecs/ak4671.c
@@ -343,25 +343,25 @@ static const struct snd_soc_dapm_widget ak4671_dapm_widgets[] = {
 };
 static const struct snd_soc_dapm_route ak4671_intercon[] = {
-        {"DAC Left", "NULL", "PMPLL"},
+        {"DAC Left", NULL, "PMPLL"},
-        {"DAC Right", "NULL", "PMPLL"},
+        {"DAC Right", NULL, "PMPLL"},
-        {"ADC Left", "NULL", "PMPLL"},
+        {"ADC Left", NULL, "PMPLL"},
-        {"ADC Right", "NULL", "PMPLL"},
+        {"ADC Right", NULL, "PMPLL"},
        /* Outputs */
-        {"LOUT1", "NULL", "LOUT1 Mixer"},
+        {"LOUT1", NULL, "LOUT1 Mixer"},
-        {"ROUT1", "NULL", "ROUT1 Mixer"},
+        {"ROUT1", NULL, "ROUT1 Mixer"},
-        {"LOUT2", "NULL", "LOUT2 Mix Amp"},
+        {"LOUT2", NULL, "LOUT2 Mix Amp"},
-        {"ROUT2", "NULL", "ROUT2 Mix Amp"},
+        {"ROUT2", NULL, "ROUT2 Mix Amp"},
-        {"LOUT3", "NULL", "LOUT3 Mixer"},
+        {"LOUT3", NULL, "LOUT3 Mixer"},
-        {"ROUT3", "NULL", "ROUT3 Mixer"},
+        {"ROUT3", NULL, "ROUT3 Mixer"},
        {"LOUT1 Mixer", "DACL", "DAC Left"},
        {"ROUT1 Mixer", "DACR", "DAC Right"},
        {"LOUT2 Mixer", "DACHL", "DAC Left"},
        {"ROUT2 Mixer", "DACHR", "DAC Right"},
-        {"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
+        {"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
-        {"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
+        {"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
        {"LOUT3 Mixer", "DACSL", "DAC Left"},
        {"ROUT3 Mixer", "DACSR", "DAC Right"},
@@ -381,18 +381,18 @@ static const struct snd_soc_dapm_route ak4671_intercon[] = {
        {"LIN2", NULL, "Mic Bias"},
        {"RIN2", NULL, "Mic Bias"},
-        {"ADC Left", "NULL", "LIN MUX"},
+        {"ADC Left", NULL, "LIN MUX"},
-        {"ADC Right", "NULL", "RIN MUX"},
+        {"ADC Right", NULL, "RIN MUX"},
        /* Analog Loops */
-        {"LIN1 Mixing Circuit", "NULL", "LIN1"},
+        {"LIN1 Mixing Circuit", NULL, "LIN1"},
-        {"RIN1 Mixing Circuit", "NULL", "RIN1"},
+        {"RIN1 Mixing Circuit", NULL, "RIN1"},
-        {"LIN2 Mixing Circuit", "NULL", "LIN2"},
+        {"LIN2 Mixing Circuit", NULL, "LIN2"},
-        {"RIN2 Mixing Circuit", "NULL", "RIN2"},
+        {"RIN2 Mixing Circuit", NULL, "RIN2"},
-        {"LIN3 Mixing Circuit", "NULL", "LIN3"},
+        {"LIN3 Mixing Circuit", NULL, "LIN3"},
-        {"RIN3 Mixing Circuit", "NULL", "RIN3"},
+        {"RIN3 Mixing Circuit", NULL, "RIN3"},
-        {"LIN4 Mixing Circuit", "NULL", "LIN4"},
+        {"LIN4 Mixing Circuit", NULL, "LIN4"},
-        {"RIN4 Mixing Circuit", "NULL", "RIN4"},
+        {"RIN4 Mixing Circuit", NULL, "RIN4"},
        {"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
        {"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 79a4efcb894c..7d3a6accaf9a 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -286,7 +286,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = cs4271->deemph;
+        ucontrol->value.integer.value[0] = cs4271->deemph;
        return 0;
 }
@@ -296,7 +296,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
-        cs4271->deemph = ucontrol->value.enumerated.item[0];
+        cs4271->deemph = ucontrol->value.integer.value[0];
        return cs4271_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
index ffe96175a8a5..911c26c705fc 100644
--- a/sound/soc/codecs/da732x.c
+++ b/sound/soc/codecs/da732x.c
@@ -876,11 +876,11 @@ static const struct snd_soc_dapm_widget da732x_dapm_widgets[] = {
 static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
        /* Inputs */
-        {"AUX1L PGA", "NULL", "AUX1L"},
+        {"AUX1L PGA", NULL, "AUX1L"},
-        {"AUX1R PGA", "NULL", "AUX1R"},
+        {"AUX1R PGA", NULL, "AUX1R"},
        {"MIC1 PGA", NULL, "MIC1"},
-        {"MIC2 PGA", "NULL", "MIC2"},
+        {"MIC2 PGA", NULL, "MIC2"},
-        {"MIC3 PGA", "NULL", "MIC3"},
+        {"MIC3 PGA", NULL, "MIC3"},
        /* Capture Path */
        {"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index f27325155ace..c5f35a07e8e4 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -120,7 +120,7 @@ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = es8328->deemph;
+        ucontrol->value.integer.value[0] = es8328->deemph;
        return 0;
 }
@@ -129,7 +129,7 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        int ret;
        if (deemph > 1)
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index a722a023c262..477e13d30971 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = priv->deemph;
+        ucontrol->value.integer.value[0] = priv->deemph;
        return 0;
 }
@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
-        priv->deemph = ucontrol->value.enumerated.item[0];
+        priv->deemph = ucontrol->value.integer.value[0];
        return pcm1681_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index f374840a5a7c..9b541e52da8c 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1198,7 +1198,7 @@ static struct dmi_system_id dmi_dell_dino[] = {
                .ident = "Dell Dino",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-                        DMI_MATCH(DMI_BOARD_NAME, "0144P8")
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343")
                }
        },
        { }
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index e182e6569bbd..3593a1496056 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1151,13 +1151,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
                /* Enable VDDC charge pump */
                ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
        } else if (vddio >= 3100 && vdda >= 3100) {
-                /*
+                ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
-                 * if vddio and vddd > 3.1v,
-                 * charge pump should be clean before set ana_pwr
-                 */
-                snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
-                                SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
                /* VDDC use VDDIO rail */
                lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
                lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
index 47b257e41809..82095d6cd070 100644
--- a/sound/soc/codecs/sn95031.c
+++ b/sound/soc/codecs/sn95031.c
@@ -538,8 +538,8 @@ static const struct snd_soc_dapm_route sn95031_audio_map[] = {
        /* speaker map */
        { "IHFOUTL", NULL, "Speaker Rail"},
        { "IHFOUTR", NULL, "Speaker Rail"},
-        { "IHFOUTL", "NULL", "Speaker Left Playback"},
+        { "IHFOUTL", NULL, "Speaker Left Playback"},
-        { "IHFOUTR", "NULL", "Speaker Right Playback"},
+        { "IHFOUTR", NULL, "Speaker Right Playback"},
        { "Speaker Left Playback", NULL, "Speaker Left Filter"},
        { "Speaker Right Playback", NULL, "Speaker Right Filter"},
        { "Speaker Left Filter", NULL, "IHFDAC Left"},
diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
index 249ef5c4c762..32942bed34b1 100644
--- a/sound/soc/codecs/tas5086.c
+++ b/sound/soc/codecs/tas5086.c
@@ -281,7 +281,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = priv->deemph;
+        ucontrol->value.integer.value[0] = priv->deemph;
        return 0;
 }
@@ -292,7 +292,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
-        priv->deemph = ucontrol->value.enumerated.item[0];
+        priv->deemph = ucontrol->value.integer.value[0];
        return tas5086_set_deemph(codec);
 }
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index 8d9de49a5052..21d5402e343f 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        ucontrol->value.enumerated.item[0] = wm2000->anc_active;
+        ucontrol->value.integer.value[0] = wm2000->anc_active;
        return 0;
 }
@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        int anc_active = ucontrol->value.enumerated.item[0];
+        int anc_active = ucontrol->value.integer.value[0];
        int ret;
        if (anc_active > 1)
@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
+        ucontrol->value.integer.value[0] = wm2000->spk_ena;
        return 0;
 }
@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
-        int val = ucontrol->value.enumerated.item[0];
+        int val = ucontrol->value.integer.value[0];
        int ret;
        if (val > 1)
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index 098c143f44d6..c6d10533e2bd 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -125,7 +125,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = wm8731->deemph;
+        ucontrol->value.integer.value[0] = wm8731->deemph;
        return 0;
 }
@@ -135,7 +135,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        int ret = 0;
        if (deemph > 1)
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index dde462c082be..04b04f8e147c 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = wm8903->deemph;
+        ucontrol->value.integer.value[0] = wm8903->deemph;
        return 0;
 }
@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        int ret = 0;
        if (deemph > 1)
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index d3b3f57668cc..215e93c1ddf0 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -525,7 +525,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = wm8904->deemph;
+        ucontrol->value.integer.value[0] = wm8904->deemph;
        return 0;
 }
@@ -534,7 +534,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        if (deemph > 1)
                return -EINVAL;
diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
index 1ab2d462afad..00bec915d652 100644
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = wm8955->deemph;
+        ucontrol->value.integer.value[0] = wm8955->deemph;
        return 0;
 }
@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        if (deemph > 1)
                return -EINVAL;
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index cf8fecf97f2c..3035d9856415 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -184,7 +184,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
-        ucontrol->value.enumerated.item[0] = wm8960->deemph;
+        ucontrol->value.integer.value[0] = wm8960->deemph;
        return 0;
 }
@@ -193,7 +193,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
 {
        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
        struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
-        int deemph = ucontrol->value.enumerated.item[0];
+        int deemph = ucontrol->value.integer.value[0];
        if (deemph > 1)
                return -EINVAL;
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index 9517571e820d..98c9525bd751 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -180,7 +180,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
        struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
        struct wm9712_priv *wm9712 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val = ucontrol->value.enumerated.item[0];
+        unsigned int val = ucontrol->value.integer.value[0];
        struct soc_mixer_control *mc =
                (struct soc_mixer_control *)kcontrol->private_value;
        unsigned int mixer, mask, shift, old;
@@ -193,7 +193,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
        mutex_lock(&wm9712->lock);
        old = wm9712->hp_mixer[mixer];
-        if (ucontrol->value.enumerated.item[0])
+        if (ucontrol->value.integer.value[0])
                wm9712->hp_mixer[mixer] |= mask;
        else
                wm9712->hp_mixer[mixer] &= ~mask;
@@ -231,7 +231,7 @@ static int wm9712_hp_mixer_get(struct snd_kcontrol *kcontrol,
        mixer = mc->shift >> 8;
        shift = mc->shift & 0xff;
-        ucontrol->value.enumerated.item[0] =
+        ucontrol->value.integer.value[0] =
                (wm9712->hp_mixer[mixer] >> shift) & 1;
        return 0;
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index 68222917b396..79552953e1bd 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -255,7 +255,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
        struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
        struct wm9713_priv *wm9713 = snd_soc_codec_get_drvdata(codec);
-        unsigned int val = ucontrol->value.enumerated.item[0];
+        unsigned int val = ucontrol->value.integer.value[0];
        struct soc_mixer_control *mc =
                (struct soc_mixer_control *)kcontrol->private_value;
        unsigned int mixer, mask, shift, old;
@@ -268,7 +268,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
        mutex_lock(&wm9713->lock);
        old = wm9713->hp_mixer[mixer];
-        if (ucontrol->value.enumerated.item[0])
+        if (ucontrol->value.integer.value[0])
                wm9713->hp_mixer[mixer] |= mask;
        else
                wm9713->hp_mixer[mixer] &= ~mask;
@@ -306,7 +306,7 @@ static int wm9713_hp_mixer_get(struct snd_kcontrol *kcontrol,
        mixer = mc->shift >> 8;
        shift = mc->shift & 0xff;
-        ucontrol->value.enumerated.item[0] =
+        ucontrol->value.integer.value[0] =
                (wm9713->hp_mixer[mixer] >> shift) & 1;
        return 0;
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index b9fabbf69db6..6b0c8f717ec2 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -603,7 +603,7 @@ static int fsl_ssi_set_bclk(struct snd_pcm_substream *substream,
        factor = (div2 + 1) * (7 * psr + 1) * 2;
        for (i = 0; i < 255; i++) {
-                tmprate = freq * factor * (i + 2);
+                tmprate = freq * factor * (i + 1);
                if (baudclk_is_used)
                        clkrate = clk_get_rate(ssi_private->baudclk);
@@ -1227,7 +1227,7 @@ static int fsl_ssi_imx_probe(struct platform_device *pdev,
        ssi_private->dma_params_tx.addr = ssi_private->ssi_phys + CCSR_SSI_STX0;
        ssi_private->dma_params_rx.addr = ssi_private->ssi_phys + CCSR_SSI_SRX0;
-        ret = !of_property_read_u32_array(np, "dmas", dmas, 4);
+        ret = of_property_read_u32_array(np, "dmas", dmas, 4);
        if (ssi_private->use_dma && !ret && dmas[2] == IMX_DMATYPE_SSI_DUAL) {
                ssi_private->use_dual_fifo = true;
                /* When using dual fifo mode, we need to keep watermark
diff --git a/sound/soc/intel/sst-haswell-dsp.c b/sound/soc/intel/sst-haswell-dsp.c
index c42ffae5fe9f..402b728c0a06 100644
--- a/sound/soc/intel/sst-haswell-dsp.c
+++ b/sound/soc/intel/sst-haswell-dsp.c
@@ -207,9 +207,6 @@ static int hsw_parse_fw_image(struct sst_fw *sst_fw)
                module = (void *)module + sizeof(*module) + module->mod_size;
        }
-        /* allocate scratch mem regions */
-        sst_block_alloc_scratch(dsp);
        return 0;
 }
diff --git a/sound/soc/intel/sst-haswell-ipc.c b/sound/soc/intel/sst-haswell-ipc.c
index 394af5684c05..863a9ca34b8e 100644
--- a/sound/soc/intel/sst-haswell-ipc.c
+++ b/sound/soc/intel/sst-haswell-ipc.c
@@ -1732,6 +1732,7 @@ static void sst_hsw_drop_all(struct sst_hsw *hsw)
 int sst_hsw_dsp_load(struct sst_hsw *hsw)
 {
        struct sst_dsp *dsp = hsw->dsp;
+        struct sst_fw *sst_fw, *t;
        int ret;
        dev_dbg(hsw->dev, "loading audio DSP....");
@@ -1748,12 +1749,17 @@ int sst_hsw_dsp_load(struct sst_hsw *hsw)
                return ret;
        }
-        ret = sst_fw_reload(hsw->sst_fw);
+        list_for_each_entry_safe_reverse(sst_fw, t, &dsp->fw_list, list) {
-        if (ret < 0) {
+                ret = sst_fw_reload(sst_fw);
-                dev_err(hsw->dev, "error: SST FW reload failed\n");
+                if (ret < 0) {
-                sst_dsp_dma_put_channel(dsp);
+                        dev_err(hsw->dev, "error: SST FW reload failed\n");
-                return -ENOMEM;
+                        sst_dsp_dma_put_channel(dsp);
+                        return -ENOMEM;
+                }
        }
+        ret = sst_block_alloc_scratch(hsw->dsp);
+        if (ret < 0)
+                return -EINVAL;
        sst_dsp_dma_put_channel(dsp);
        return 0;
@@ -1809,12 +1815,17 @@ int sst_hsw_dsp_runtime_suspend(struct sst_hsw *hsw)
 int sst_hsw_dsp_runtime_sleep(struct sst_hsw *hsw)
 {
-        sst_fw_unload(hsw->sst_fw);
+        struct sst_fw *sst_fw, *t;
-        sst_block_free_scratch(hsw->dsp);
+        struct sst_dsp *dsp = hsw->dsp;
+        list_for_each_entry_safe(sst_fw, t, &dsp->fw_list, list) {
+                sst_fw_unload(sst_fw);
+        }
+        sst_block_free_scratch(dsp);
        hsw->boot_complete = false;
-        sst_dsp_sleep(hsw->dsp);
+        sst_dsp_sleep(dsp);
        return 0;
 }
@@ -1943,6 +1954,11 @@ int sst_hsw_dsp_init(struct device *dev, struct sst_pdata *pdata)
                goto fw_err;
        }
+        /* allocate scratch mem regions */
+        ret = sst_block_alloc_scratch(hsw->dsp);
+        if (ret < 0)
+                goto boot_err;
        /* wait for DSP boot completion */
        sst_dsp_boot(hsw->dsp);
        ret = wait_event_timeout(hsw->boot_wait, hsw->boot_complete,
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 30579ca5bacb..e5c990889dcc 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -347,6 +347,8 @@ static ssize_t codec_list_read_file(struct file *file, char __user *user_buf,
        if (!buf)
                return -ENOMEM;
+        mutex_lock(&client_mutex);
        list_for_each_entry(codec, &codec_list, list) {
                len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
                               codec->component.name);
@@ -358,6 +360,8 @@ static ssize_t codec_list_read_file(struct file *file, char __user *user_buf,
                }
        }
+        mutex_unlock(&client_mutex);
        if (ret >= 0)
                ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
@@ -382,6 +386,8 @@ static ssize_t dai_list_read_file(struct file *file, char __user *user_buf,
        if (!buf)
                return -ENOMEM;
+        mutex_lock(&client_mutex);
        list_for_each_entry(component, &component_list, list) {
                list_for_each_entry(dai, &component->dai_list, list) {
                        len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
@@ -395,6 +401,8 @@ static ssize_t dai_list_read_file(struct file *file, char __user *user_buf,
                }
        }
+        mutex_unlock(&client_mutex);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
        kfree(buf);
@@ -418,6 +426,8 @@ static ssize_t platform_list_read_file(struct file *file,
        if (!buf)
                return -ENOMEM;
+        mutex_lock(&client_mutex);
        list_for_each_entry(platform, &platform_list, list) {
                len = snprintf(buf + ret, PAGE_SIZE - ret, "%s\n",
                               platform->component.name);
@@ -429,6 +439,8 @@ static ssize_t platform_list_read_file(struct file *file,
                }
        }
+        mutex_unlock(&client_mutex);
        ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
        kfree(buf);
@@ -836,6 +848,8 @@ static struct snd_soc_component *soc_find_component(
 {
        struct snd_soc_component *component;
+        lockdep_assert_held(&client_mutex);
        list_for_each_entry(component, &component_list, list) {
                if (of_node) {
                        if (component->dev->of_node == of_node)
@@ -854,6 +868,8 @@ static struct snd_soc_dai *snd_soc_find_dai(
        struct snd_soc_component *component;
        struct snd_soc_dai *dai;
+        lockdep_assert_held(&client_mutex);
        /* Find CPU DAI from registered DAIs*/
        list_for_each_entry(component, &component_list, list) {
                if (dlc->of_node && component->dev->of_node != dlc->of_node)
@@ -1508,6 +1524,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
        struct snd_soc_codec *codec;
        int ret, i, order;
+        mutex_lock(&client_mutex);
        mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_INIT);
        /* bind DAIs */
@@ -1662,6 +1679,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
        card->instantiated = 1;
        snd_soc_dapm_sync(&card->dapm);
        mutex_unlock(&card->mutex);
+        mutex_unlock(&client_mutex);
        return 0;
@@ -1680,6 +1698,7 @@ card_probe_error:
 base_error:
        mutex_unlock(&card->mutex);
+        mutex_unlock(&client_mutex);
        return ret;
 }
@@ -2713,13 +2732,6 @@ static void snd_soc_component_del_unlocked(struct snd_soc_component *component)
        list_del(&component->list);
 }
-static void snd_soc_component_del(struct snd_soc_component *component)
-{
-        mutex_lock(&client_mutex);
-        snd_soc_component_del_unlocked(component);
-        mutex_unlock(&client_mutex);
-}
 int snd_soc_register_component(struct device *dev,
                               const struct snd_soc_component_driver *cmpnt_drv,
                               struct snd_soc_dai_driver *dai_drv,
@@ -2767,14 +2779,17 @@ void snd_soc_unregister_component(struct device *dev)
 {
        struct snd_soc_component *cmpnt;
+        mutex_lock(&client_mutex);
        list_for_each_entry(cmpnt, &component_list, list) {
                if (dev == cmpnt->dev && cmpnt->registered_as_component)
                        goto found;
        }
+        mutex_unlock(&client_mutex);
        return;
 found:
-        snd_soc_component_del(cmpnt);
+        snd_soc_component_del_unlocked(cmpnt);
+        mutex_unlock(&client_mutex);
        snd_soc_component_cleanup(cmpnt);
        kfree(cmpnt);
 }
@@ -2882,10 +2897,14 @@ struct snd_soc_platform *snd_soc_lookup_platform(struct device *dev)
 {
        struct snd_soc_platform *platform;
+        mutex_lock(&client_mutex);
        list_for_each_entry(platform, &platform_list, list) {
-                if (dev == platform->dev)
+                if (dev == platform->dev) {
+                        mutex_unlock(&client_mutex);
                        return platform;
+                }
        }
+        mutex_unlock(&client_mutex);
        return NULL;
 }
@@ -3090,15 +3109,15 @@ void snd_soc_unregister_codec(struct device *dev)
 {
        struct snd_soc_codec *codec;
+        mutex_lock(&client_mutex);
        list_for_each_entry(codec, &codec_list, list) {
                if (dev == codec->dev)
                        goto found;
        }
+        mutex_unlock(&client_mutex);
        return;
 found:
-        mutex_lock(&client_mutex);
        list_del(&codec->list);
        snd_soc_component_del_unlocked(&codec->component);
        mutex_unlock(&client_mutex);
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 61bf9128e1f2..9d9db3b296dd 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -30,6 +30,8 @@ static int disasm_line__parse(char *line, char **namep, char **rawp);
 static void ins__delete(struct ins_operands *ops)
 {
+        if (ops == NULL)
+                return;
        zfree(&ops->source.raw);
        zfree(&ops->source.name);
        zfree(&ops->target.raw);
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 4e511221a0c1..0db571340edb 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -22,6 +22,14 @@ TARGETS += vm
 TARGETS_HOTPLUG = cpu-hotplug
 TARGETS_HOTPLUG += memory-hotplug
+# Clear LDFLAGS and MAKEFLAGS if called from main
+# Makefile to avoid test build failures when test
+# Makefile doesn't have explicit build rules.
+ifeq (1,$(MAKELEVEL))
+undefine LDFLAGS
+override MAKEFLAGS =
+endif
 all:
        for TARGET in $(TARGETS); do \
                make -C $$TARGET; \
diff --git a/virt/kvm/arm/vgic-v2.c b/virt/kvm/arm/vgic-v2.c
index a0a7b5d1a070..f9b9c7c51372 100644
--- a/virt/kvm/arm/vgic-v2.c
+++ b/virt/kvm/arm/vgic-v2.c
@@ -72,6 +72,8 @@ static void vgic_v2_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
 {
        if (!(lr_desc.state & LR_STATE_MASK))
                vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr |= (1ULL << lr);
+        else
+                vcpu->arch.vgic_cpu.vgic_v2.vgic_elrsr &= ~(1ULL << lr);
 }
 static u64 vgic_v2_get_elrsr(const struct kvm_vcpu *vcpu)
@@ -84,6 +86,11 @@ static u64 vgic_v2_get_eisr(const struct kvm_vcpu *vcpu)
        return vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr;
 }
+static void vgic_v2_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.vgic_cpu.vgic_v2.vgic_eisr = 0;
+}
 static u32 vgic_v2_get_interrupt_status(const struct kvm_vcpu *vcpu)
 {
        u32 misr = vcpu->arch.vgic_cpu.vgic_v2.vgic_misr;
@@ -148,6 +155,7 @@ static const struct vgic_ops vgic_v2_ops = {
        .sync_lr_elrsr          = vgic_v2_sync_lr_elrsr,
        .get_elrsr              = vgic_v2_get_elrsr,
        .get_eisr               = vgic_v2_get_eisr,
+        .clear_eisr             = vgic_v2_clear_eisr,
        .get_interrupt_status   = vgic_v2_get_interrupt_status,
        .enable_underflow       = vgic_v2_enable_underflow,
        .disable_underflow      = vgic_v2_disable_underflow,
diff --git a/virt/kvm/arm/vgic-v3.c b/virt/kvm/arm/vgic-v3.c
index 3a62d8a9a2c6..dff06021e748 100644
--- a/virt/kvm/arm/vgic-v3.c
+++ b/virt/kvm/arm/vgic-v3.c
@@ -104,6 +104,8 @@ static void vgic_v3_sync_lr_elrsr(struct kvm_vcpu *vcpu, int lr,
 {
        if (!(lr_desc.state & LR_STATE_MASK))
                vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr |= (1U << lr);
+        else
+                vcpu->arch.vgic_cpu.vgic_v3.vgic_elrsr &= ~(1U << lr);
 }
 static u64 vgic_v3_get_elrsr(const struct kvm_vcpu *vcpu)
@@ -116,6 +118,11 @@ static u64 vgic_v3_get_eisr(const struct kvm_vcpu *vcpu)
        return vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr;
 }
+static void vgic_v3_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.vgic_cpu.vgic_v3.vgic_eisr = 0;
+}
 static u32 vgic_v3_get_interrupt_status(const struct kvm_vcpu *vcpu)
 {
        u32 misr = vcpu->arch.vgic_cpu.vgic_v3.vgic_misr;
@@ -192,6 +199,7 @@ static const struct vgic_ops vgic_v3_ops = {
        .sync_lr_elrsr          = vgic_v3_sync_lr_elrsr,
        .get_elrsr              = vgic_v3_get_elrsr,
        .get_eisr               = vgic_v3_get_eisr,
+        .clear_eisr             = vgic_v3_clear_eisr,
        .get_interrupt_status   = vgic_v3_get_interrupt_status,
        .enable_underflow       = vgic_v3_enable_underflow,
        .disable_underflow      = vgic_v3_disable_underflow,
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 0cc6ab6005a0..c9f60f524588 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -883,6 +883,11 @@ static inline u64 vgic_get_eisr(struct kvm_vcpu *vcpu)
        return vgic_ops->get_eisr(vcpu);
 }
+static inline void vgic_clear_eisr(struct kvm_vcpu *vcpu)
+{
+        vgic_ops->clear_eisr(vcpu);
+}
 static inline u32 vgic_get_interrupt_status(struct kvm_vcpu *vcpu)
 {
        return vgic_ops->get_interrupt_status(vcpu);
@@ -922,6 +927,7 @@ static void vgic_retire_lr(int lr_nr, int irq, struct kvm_vcpu *vcpu)
        vgic_set_lr(vcpu, lr_nr, vlr);
        clear_bit(lr_nr, vgic_cpu->lr_used);
        vgic_cpu->vgic_irq_lr_map[irq] = LR_EMPTY;
+        vgic_sync_lr_elrsr(vcpu, lr_nr, vlr);
 }
 /*
@@ -978,6 +984,7 @@ bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
                        BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
                        vlr.state |= LR_STATE_PENDING;
                        vgic_set_lr(vcpu, lr, vlr);
+                        vgic_sync_lr_elrsr(vcpu, lr, vlr);
                        return true;
                }
        }
@@ -999,6 +1006,7 @@ bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
                vlr.state |= LR_EOI_INT;
        vgic_set_lr(vcpu, lr, vlr);
+        vgic_sync_lr_elrsr(vcpu, lr, vlr);
        return true;
 }
@@ -1136,6 +1144,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
        if (status & INT_STATUS_UNDERFLOW)
                vgic_disable_underflow(vcpu);
+        /*
+         * In the next iterations of the vcpu loop, if we sync the vgic state
+         * after flushing it, but before entering the guest (this happens for
+         * pending signals and vmid rollovers), then make sure we don't pick
+         * up any old maintenance interrupts here.
+         */
+        vgic_clear_eisr(vcpu);
        return level_pending;
 }
@@ -1583,8 +1599,10 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
         * emulation. So check this here again. KVM_CREATE_DEVICE does
         * the proper checks already.
         */
-        if (type == KVM_DEV_TYPE_ARM_VGIC_V2 && !vgic->can_emulate_gicv2)
+        if (type == KVM_DEV_TYPE_ARM_VGIC_V2 && !vgic->can_emulate_gicv2) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out;
+        }
        /*
         * Any time a vcpu is run, vcpu_load is called which tries to grab the
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a1093700f3a4..cc6a25d95fbf 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -471,7 +471,7 @@ static struct kvm *kvm_create_vm(unsigned long type)
        BUILD_BUG_ON(KVM_MEM_SLOTS_NUM > SHRT_MAX);
        r = -ENOMEM;
-        kvm->memslots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+        kvm->memslots = kvm_kvzalloc(sizeof(struct kvm_memslots));
        if (!kvm->memslots)
                goto out_err_no_srcu;
@@ -522,7 +522,7 @@ out_err_no_srcu:
 out_err_no_disable:
        for (i = 0; i < KVM_NR_BUSES; i++)
                kfree(kvm->buses[i]);
-        kfree(kvm->memslots);
+        kvfree(kvm->memslots);
        kvm_arch_free_vm(kvm);
        return ERR_PTR(r);
 }
@@ -578,7 +578,7 @@ static void kvm_free_physmem(struct kvm *kvm)
        kvm_for_each_memslot(memslot, slots)
                kvm_free_physmem_slot(kvm, memslot, NULL);
-        kfree(kvm->memslots);
+        kvfree(kvm->memslots);
 }
 static void kvm_destroy_devices(struct kvm *kvm)
@@ -871,10 +871,10 @@ int __kvm_set_memory_region(struct kvm *kvm,
                        goto out_free;
        }
-        slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
+        slots = kvm_kvzalloc(sizeof(struct kvm_memslots));
-                        GFP_KERNEL);
        if (!slots)
                goto out_free;
+        memcpy(slots, kvm->memslots, sizeof(struct kvm_memslots));
        if ((change == KVM_MR_DELETE) || (change == KVM_MR_MOVE)) {
                slot = id_to_memslot(slots, mem->slot);
@@ -917,7 +917,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
        kvm_arch_commit_memory_region(kvm, mem, &old, change);
        kvm_free_physmem_slot(kvm, &old, &new);
-        kfree(old_memslots);
+        kvfree(old_memslots);
        /*
         * IOMMU mapping:  New slots need to be mapped.  Old slots need to be
@@ -936,7 +936,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
        return 0;
 out_slots:
-        kfree(slots);
+        kvfree(slots);
 out_free:
        kvm_free_physmem_slot(kvm, &new, &old);
 out:
@@ -2492,6 +2492,7 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
        case KVM_CAP_SIGNAL_MSI:
 #endif
 #ifdef CONFIG_HAVE_KVM_IRQFD
+        case KVM_CAP_IRQFD:
        case KVM_CAP_IRQFD_RESAMPLE:
 #endif
        case KVM_CAP_CHECK_EXTENSION_VM:
author	Dave Airlie <airlied@redhat.com>	2015-03-31 18:21:46 -0400
committer	Dave Airlie <airlied@redhat.com>	2015-03-31 18:21:46 -0400
commit	9e87e48f8e5de2146842fd0ff436e0256b52c4a9 (patch)
tree	9ada800ddc51e4250aafacc54ef9fb18abf38e37
parent	d7de390bff7ad0f551fc0e409543e98db86a65df (diff)
parent	6e0aa8018f9c676b115b7ca6c20a056fc57c68a9 (diff)